Connecting Multiple WinCC Runtime Clients to a Siemens S7-1500

WinCC Runtime Advanced and WinCC Runtime Professional both support concurrent HMI connections to a single SIMATIC S7-1500 CPU. A common engineering task is to install the same WinCC Runtime project on two physical PCs (or a PC and a Panel) and have both clients communicate with one PLC. This reference covers the connection topology, the per-CPU HMI connection budgets, the TIA Portal configuration required to duplicate an HMI station, and the S7-1500-side diagnostics that expose how many clients are currently online.

1. Topology Overview

Two physical HMI stations can connect to a single S7-1500 over the SIMATIC S7-1200, S7-1500 Channel (channel name SIMATIC S7-1200, S7-1500 Channel). The channel uses the S7-1500 PG/OP protocol on top of ISO-on-TCP (RFC1006) or TCP, and each client establishes an independent PG/HMI connection resource on the CPU. From the PLC's perspective, each HMI consumes one of the available HMI connections defined in the CPU's connection resources (formerly called "OP connections").

Both PCs are independent clients with unique IP addresses. The PLC must have enough HMI connection resources to handle both clients in parallel plus any PG, OPC UA, S7, or Open User Communication sessions currently active.

2. S7-1500 HMI Connection Budget by CPU

Each S7-1500 CPU has a fixed maximum number of HMI (OP) connections. Exceeding this number causes new connection attempts to be rejected and the HMI displays "Connection failed: Maximum number of connections reached." The following table summarizes the most common CPU types; always verify against the current manual for the exact catalog number in use.

For two WinCC Runtime clients you need at least 2 dedicated HMI connections. Reserve additional resources for engineering (PG), OPC UA servers, and any S7 routing used during commissioning.

3. Configuring Two HMI Stations in One TIA Portal Project

The recommended approach is to add both HMI devices to the same TIA Portal project, even when the runtime files will be deployed to two different PCs. The project becomes the single source of truth; only the PG/PC interface and the HMI device's IP address differ at download time.

3.1 Prerequisites

• TIA Portal V16 or later (V20 recommended for the latest S7-1500 CPUs).
• S7-1500 CPU with GSD/GSDML installed and a configured PROFINET subnet.
• Two PC systems with WinCC Runtime Advanced or Professional installed.
• Each PC assigned a unique static IP address on the same subnet as the CPU.

3.2 Step-by-Step Procedure

1. Open the TIA Portal project containing the S7-1500 station.
2. In the project tree, choose Add new device > HMI > WinCC Runtime Advanced (or Professional). Add the first HMI station; configure the connection to the S7-1500 and the IP address of PC #1 in the HMI device configuration under Properties > General > PROFINET interface.
3. Complete the HMI screens, tag connections, alarms, and area pointer configuration for the first HMI.
4. Right-click the HMI station in the project tree and choose Duplicate (or use copy → paste). TIA Portal duplicates the entire HMI configuration, including the connection to the PLC.
5. Open the second HMI's device configuration and change its PROFINET IP to PC #2's address. The PLC connection path remains identical because the target CPU is the same device.
6. In the second HMI's connection properties, verify that the partner (PLC) IP matches the S7-1500 CPU's PROFINET address. Set the access point to S7ONLINE for TCP/IP routing, or to the explicit PROFINET interface if used.
7. For runtime transfer, configure each HMI station's PG/PC interface to point at the corresponding physical Ethernet adapter of its target PC.
8. Compile each HMI station separately, then download to its dedicated PC. Use Project > Download to device with the appropriate target visible.

Reference: Creating a connection (RT Advanced) — WinCC, TIA Portal V20 documentation.

3.3 What the Runtime Will and Will Not Differentiate

Both HMIs run the same project image, so they share tag names, screen IDs, alarm IDs, and the connection partner. From the PLC's point of view, the two HMI connections appear as two independent sessions identified by the client IP and the S7 connection resource ID. If you need per-client behavior (for example, station-specific user logins, station-specific user rights, or per-panel recipe views), use PLC-side logic to discriminate, as described in Section 5.

4. PLC-Side Visibility of Active HMI Connections

The S7-1500 does not expose a single tag that returns "how many HMIs are connected right now," but it does expose everything required to derive that number deterministically. There are three practical mechanisms, listed in order of recommendation.

4.1 Method A — Connection Resource Diagnostics Blocks

The instruction RD_SINFO reads the start information of OB 100, OB 101, or the current OB, but it does not enumerate HMI connections. For HMI connection status, use the system blocks and constants exposed in the S7-1500 system data:

• Diagnostics in the online view of the device: Online & diagnostics > Connections shows every active PG/HMI/S7/OPC UA connection, its local ID, type, and partner address. Use this during commissioning only; it is not a runtime tag.
• Connection diagnostics via STATUS in the user program: the system function TCON, TDISCON, and the HMI connection status can be polled with STATUS of the configured HMI connection. Each HMI connection can be queried with its connection ID.

4.2 Method B — Area Pointer "Coordination"

The Coordination area pointer is the most reliable, deterministic mechanism. It is a dual-bit handshake in the PLC memory that each HMI client toggles once per second. The PLC counts the number of toggling bits per cycle to determine which HMIs are alive.

1. In the TIA Portal HMI connection editor, open the connection to the S7-1500 and select Area pointer.
2. Enable the Coordination area pointer and assign a unique DB and byte offset for each HMI station. For HMI #1 use DB 100 DBX 0.0; for HMI #2 use DB 100 DBX 1.0 (or any other two bits in the same or different DBs).
3. Download the configuration to both WinCC Runtime PCs. At runtime, each WinCC client toggles its assigned bit at a 1 Hz cadence.
4. In the S7-1500 program, monitor the two bits and increment/decrement a counter.

Example SCL code in the PLC to count active HMI stations:

// SCL in OB1 or cyclic OB
// Inputs: bHMI1Coord AT %I0.0 : BOOL;  // Coordination bit for HMI #1
//         bHMI2Coord AT %I0.1 : BOOL;  // Coordination bit for HMI #2
// Outputs: iHmiCount : INT;            // Number of active HMIs
//          bHMI1Online : BOOL;          // Edge-detected status HMI #1
//          bHMI2Online : BOOL;          // Edge-detected status HMI #2

// Edge detection: an HMI is considered online if a toggle is seen
// within the last 3 seconds.
IF bHMI1Coord AND NOT bHMI1CoordPrev THEN
   bHMI1Online := TRUE;
   tHMI1LastToggle := TIME();
END_IF;
bHMI1CoordPrev := bHMI1Coord;

IF bHMI2Coord AND NOT bHMI2CoordPrev THEN
   bHMI2Online := TRUE;
   tHMI2LastToggle := TIME();
END_IF;
bHMI2CoordPrev := bHMI2Coord;

// Timeout: 3 seconds without a toggle ⇒ HMI considered offline
IF (TIME() - tHMI1LastToggle) > T#3s THEN bHMI1Online := FALSE; END_IF;
IF (TIME() - tHMI2LastToggle) > T#3s THEN bHMI2Online := FALSE; END_IF;

iHmiCount := BOOL_TO_INT(bHMI1Online) + BOOL_TO_INT(bHMI2Online);

Alternative: simply use the current bit value and a watch window in TIA Portal to verify. The Coordination bit is high for 1 s and low for 1 s, so it appears as a 0.5 Hz square wave at the PLC when the HMI is online and as a constant zero when offline.

4.3 Method C — Per-Connection Life-Bit via a Custom Area Pointer or a Periodic Tag

If you cannot use the Coordination area pointer (for example, when the HMI is a third-party OPC UA client, not WinCC), implement your own heartbeat:

1. On the HMI, schedule a VBScript or C-script that toggles a dedicated PLC bit every 500 ms:

' VBScript on the HMI (WinCC RT Advanced, scheduler @ 500 ms)
Dim tagName, bitValue
tagName = "HMI_Heartbeat_HMI1"
bitValue = SmartTags(tagName) ' current value
SmartTags(tagName) = NOT CBool(bitValue) ' toggle

2. On the PLC, run the same edge-detect + 3-second timeout logic shown in Method B.

This is the approach recommended by the field report when the HMI has a built-in connection health check: HMI runs a function that polls a "healthy" bit in the PLC, and if no feedback arrives within 3–5 s, the HMI raises a connection-lost alarm. The same pattern can be inverted to expose HMI health to the PLC.

5. Differentiating Between HMI Stations in the PLC

With both HMIs sharing the same connection path, the PLC must use a unique resource per station if it needs to distinguish them. Practical mechanisms:

For most small installations, the Coordination area pointer plus a "station ID" tag written once at HMI startup is the cleanest solution.

6. Connection Health Monitoring and System Alarms

WinCC Runtime raises a built-in system alarm whenever the connection to the PLC is interrupted. The default alarm text is "Connection to PLC failed" with alarm number 140002 in WinCC V7 and 190200 in TIA Portal HMI alarms. You do not need a script to detect a connection loss; you can subscribe to the system alarm and forward its state to the PLC using a tag.

To forward the alarm state to the PLC, enable the System events in the HMI alarms editor and add a tag-based acknowledgement in the PLC. A simple ladder equivalent:

// STL pseudo-code on the PLC
A     "HMI1_ConnFault"   // HMI #1 system alarm tag (BOOL)
S     "HMI1_AlarmAck"    // latched acknowledgement
// timeout: clear after 5s with self-reset

Reference: WinCC Connection to S7-1500, S7-1200 and ET 200SP — Siemens Industry Online Support, ID 101908495.

7. Common Configuration Errors and Fixes

8. WinCC V7 vs. WinCC Runtime Advanced — Differences in Multi-Client Setup

For the two-PC scenario described in the field report, both products support it. WinCC Runtime Advanced is the simpler choice because the HMI can be duplicated inside the same TIA Portal project without writing additional server/client logic.

9. Verification Procedure

1. Download the project to both PCs.
2. On the PLC, open Online & diagnostics > Connections and confirm two HMI connections are listed with different partner IPs.
3. In the PLC, watch the two Coordination bits in the configured DB; each should toggle at 0.5 Hz.
4. Shut down WinCC Runtime on PC #1; the corresponding bit on the PLC should fall to 0 within 3 seconds and the HMI count should decrement to 1.
5. Restart PC #1; the bit resumes toggling and the count returns to 2.
6. Trigger a fault (pull the network cable from PC #2); confirm a system alarm appears on PC #2 and the HMI #2 status changes to offline on the PLC.

10. Field-Proven Recommendations

• Always configure two distinct Coordination area pointers, one per HMI, instead of a single shared one. The Coordination bit is intended to be per-client.
• Reserve a 3–5 second timeout in the PLC to filter out short network blips; shorter timeouts generate false offline alarms.
• Document the HMI connection ID of each station in the TIA Portal project comment; the ID appears in the online connection list and is useful for support cases.
• When migrating from WinCC V7 to TIA Portal, re-create the connections with the SIMATIC S7-1200, S7-1500 Channel. The older S7 Channel for S7-300/400 cannot be used with the S7-1500.
• For CPU firmware ≥ V2.9, the SIMATIC S7-1200/S7-1500 Channel supports symbol-based access with the "Create structure" button for PLC UDTs — see the PDF WinCC Communication to S7-1500, S7-1200 and ET 200SP (PDF, ID 101908495) for the supported field names and data types.