Connecting Siemens S7-1200 to WinCC V7 via the Native S7-1200/1500 Channel
Field engineers often encounter the same symptom: the engineering station can ping the S7-1200 CPU, the subnet is reachable, and yet WinCC Explorer reports "No connection to the AS" or "Channel DLL error" as soon as the runtime starts. The root cause is almost always a channel selection or PG/PC interface mismatch, not a network fault. This reference walks through the supported, documented path: the SIMATIC S7-1200, S7-1500 Channel introduced in WinCC V7.2, the legacy OPC route for older WinCC versions, and the field-proven diagnostics for each failure mode.
1. Overview of the S7-1200 to WinCC V7 Communication Path
WinCC V7 does not speak the S7-1200/1500 optimized-symbolic protocol directly. It uses the standard S7 communication (S7Comm) on top of ISO-on-TCP (RFC1006) at TCP port 102. Two paths are supported by Siemens:
- Native route (recommended): SIMATIC WinCC V7.2 SP2 or higher installs the SIMATIC S7-1200, S7-1500 Channel, which is purpose-built for these CPUs and exposes access to DB, inputs, outputs, merkers, and timers/counters in a single configuration dialog. See the official Siemens application note "WinCC Communication to S7-1500, S7-1200 and ET 200SP".
- OPC DA route (legacy): For WinCC V7.0 / V7.1, or where the native channel cannot be installed, SIMATIC NET OPC Server acts as the protocol converter. WinCC consumes the data as an OPC DA client. This is the path described in Siemens FAQ entry 39960680.
Both paths assume the same preconditions on the S7-1200 side: an IP address on the PROFINET interface, the Permit access with PUT/GET communication option enabled, and a reachable PC station on the same subnet.
2. Prerequisites
| Item | Requirement | Notes |
|---|---|---|
| WinCC version | V7.2 SP2 or higher for native channel; V7.0/V7.1 requires OPC | The S7-1200, S7-1500 Channel is an installable option of the WinCC V7 setup. |
| S7-1200 firmware | V4.0 or higher recommended | PUT/GET is on by default from V4.2 onward; on older firmware the bit must be set explicitly in the CPU properties under Protection & Security. |
| TIA Portal | V13 SP1 or higher for project engineering | Used to enable the access protection flags, not to configure WinCC itself. |
| Ethernet network | TCP/IPv4, PC and CPU in the same subnet | A managed switch is recommended; PROFINET is not required for plain S7 communication. |
| Firewall | TCP/102 inbound and outbound open between PC station and CPU | Windows Firewall blocks ISO-on-TCP by default on hardened stations. |
| PC station interface | Set to the physical Ethernet adapter bound to the plant network | Wrong selection here is the single most common cause of "Ping works, WinCC does not". |
| User rights | Local administrator for install and runtime service configuration | WinCC Runtime runs as a service and needs rights to open the S7 connection. |
Critical: The S7-1200, S7-1500 Channel does not work with WinCC V7.0 or V7.1. Attempting to add a connection with that channel on an older WinCC produces a missing-DLL fault. Upgrade to V7.2 SP2 minimum, or fall back to the OPC route described in Section 7.
3. Communication Architecture and Protocol Selection
The S7-1200, S7-1500 Channel is a thin S7Comm client implemented inside the WinCC data manager. It opens an ISO-on-TCP connection to the CPU on TCP port 102, performs the S7 communication setup handshake, and then issues read/write requests against the configured address areas.
Three parameters drive the channel and are easily mis-typed:
- IP address of the CPU's PROFINET interface (X1 by default).
- Rack / Slot — S7-1200 is always Rack 0, Slot 1. S7-1500 is also Slot 1 by default, but only if no other module is plugged into the first slot; if a PS or IM sits to the left, the slot shifts.
- Connection name — free text, but must be unique within the channel. WinCC uses it as a prefix in the tag internal name.
4. PLC-Side Configuration in TIA Portal
- Open the S7-1200 project in TIA Portal, select the CPU, and open Device view > Properties > PROFINET interface [X1] > Ethernet addresses.
- Assign a fixed IP address, for example
192.168.0.10, mask255.255.255.0, and disable the router if no routed connection is needed. - Open Properties > Protection & Security > Connection mechanisms and tick Permit access with PUT/GET communication from remote partner. This is the single most frequently missed step on newer firmware. Without it, the S7-1200 rejects every read/write from the WinCC channel and the connection is closed during the S7 setup handshake.
- If you use access protection with a password, document the level; the WinCC connection will still work as long as PUT/GET is permitted.
- Compile and download the hardware configuration. Verify with the online diagnostic that the IP address is actually applied (the CPU's display shows the address; on a CPU 1214C and above you can also use Online > Accessible devices).
- Create at least one global DB with structured tags. The WinCC channel can read only non-optimized DBs as direct addresses; for symbolic access on optimized blocks you need TIA V16+ and the S7-1500 channel put/get is not enough — in practice keep a small non-optimized DB for the WinCC interface or expose the tags as absolute addresses. For S7-1200 the SIMATIC S7-1200, S7-1500 Channel reads DBs with Standard access only; set the DB property Optimized block access to No.
Engineering tip: The S7-1200 has 16 S7 communication resources total. Each HMI, each WinCC channel, and each PUT/GET partner uses one. Plan the resource budget before adding additional HMIs or OPC servers.
5. PG/PC Interface Configuration on the Engineering Station
The PG/PC interface is the Windows-side binding of the S7 protocol stack to a physical NIC. A misconfigured PG/PC interface is the leading cause of the "ping works, WinCC does not" symptom.
- Open Control Panel > Set PG/PC Interface (32-bit) or, on 64-bit Windows, the matching applet under Siemens Automation > PG/PC Interface.
- Select the access point S7ONLINE and point it to the Ethernet adapter connected to the plant network, for example Intel I219-LM.TCPIP.1. Do not select a virtual adapter, a VPN tunnel, or a disabled NIC.
- Test with Start > SIMATIC > S7-1200 Station > Online > Accessible nodes. The CPU should appear with its IP and MAC.
- If you have multiple subnets (e.g., plant network plus office LAN), pin S7ONLINE to the plant NIC explicitly. The TIA Portal installer writes the binding to the registry under
HKLM\SOFTWARE\Siemens\SINEC— do not edit it by hand.
6. WinCC V7 Configuration with the S7-1200, S7-1500 Channel
- Open WinCC Explorer and right-click Tag Management > Add New Driver > SIMATIC S7-1200, S7-1500 Channel. Confirm the selection; the channel is added as a tree node.
- Right-click the new channel > New Connection. Enter a connection name (e.g.,
PLC_LINE_1), the IP address of the CPU, and confirm Rack 0, Slot 1. - Open the connection properties and verify the access point. WinCC reuses S7ONLINE for the channel; if your project uses a custom access point (common when SIMATIC NET OPC is in the same PC), point the channel at the same access point the OPC server uses to keep a single S7 route.
- Add tags. Right-click the connection > New Tag. Configure the address using the standard S7 syntax, for example:
- Bit:
DB1.DBX0.0 - Byte:
DB1.DBB1 - Word:
DB1.DBW2 - Real:
DB1.DBD4 - Input:
IW0 - Output:
QW0 - Merker:
MW10
- Bit:
- Set the acquisition mode. For process values, Cyclic continuous at 500 ms to 2 s is a sensible default. For alarms, On change reduces network load.
- Save the project, then activate WinCC Runtime. Watch the connection status icon: green = established, yellow = establishing, red = fault.
7. Legacy OPC DA Path for WinCC V7.0 / V7.1
If you cannot upgrade WinCC, or if your PC station runs SIMATIC NET for other reasons, use OPC DA. The flow is documented in Siemens entry 39960680.
- Install SIMATIC NET on the WinCC PC station (the OPC server component ships with SIMATIC NET V8.2 or higher on current hardware; older projects used V7.1 or V8.1).
- Open Station Configuration Editor and add the OPC server and a CP (either an actual CP card, e.g., 6GK1 161-2AA01, or a softnet CP, e.g., S7-1613) bound to the plant NIC.
- In SIMATIC NET, configure an S7 connection to the S7-1200 with Rack 0, Slot 1, and the CPU's IP. The connection is local to the PC station and consumes one S7 resource on the CPU.
- Bind items to the S7 connection and assign the symbolic names WinCC will use.
- In WinCC Explorer, add the OPC channel, then New Connection > OPC DA. Browse the local OPC server (Siemens.SimaticNet.OPCDA.1 or similar) and select the items. Configure update rate (typically 250 ms to 1 s).
- Activate WinCC. Use the OPC Scout (shipped with SIMATIC NET) to verify item quality first — if OPC Scout shows Bad quality, the S7 side is the problem; if Scout is Good and WinCC is Bad, the OPC channel binding is wrong.
8. Address and Area Mapping Reference
| WinCC Address | PLC Area | Data Type | Notes |
|---|---|---|---|
IB0, IW0, ID0
|
Process input image | BYTE, WORD, DWORD | Limited to the size of the input image configured in TIA Portal (default 1024 bytes). |
QB0, QW0, QD0
|
Process output image | BYTE, WORD, DWORD | Writes from WinCC enter the output image and are applied on the next OB1 cycle. |
MB0, MW0, MD0
|
Merker (M) | BYTE, WORD, DWORD | Use sparingly; S7-1200 retentive behavior depends on PLC tag configuration. |
DB1.DBX0.0 |
Data block | BOOL | DB must be non-optimized for direct absolute access. |
DB1.DBB0, DB1.DBW0, DB1.DBD0
|
Data block | BYTE, WORD, DWORD | Word/DWord addresses must be even; misaligned reads return Bad quality. |
DB1.DBD0 as FLOAT |
Data block | REAL | Set WinCC tag type to Floating-point number 32-bit IEEE 754. |
DB1.DBS0, DB1.DBW0 as STRING |
Data block | STRING | S7 strings are length-prefixed; the channel exposes them only with WinCC V7.3 and S7-1500 channel patch, otherwise use a byte array and decode in the HMI script. |
9. Verification Procedure
- On the PC station, open a command prompt and run
ping 192.168.0.10. A reply confirms Layer 3 reachability only. - Run
telnet 192.168.0.10 102(enable the Telnet client first on Windows). A blank screen and a connection establish message confirm that ISO-on-TCP port 102 is reachable. A "connect failed" indicates a firewall or routed path issue. - In TIA Portal, go Online > Accessible devices and select the plant NIC. The CPU should appear with the configured IP.
- Open WinCC Explorer, activate Runtime, and watch the connection state. A green state is required before any tag update is meaningful.
- Use Tools > WinCC Channel Diagnosis (applet CCChannelDiagnosis.exe) to inspect live S7 PDU traffic. Set the access point to S7ONLINE and connect; you will see the S7 setup handshake, the read/write requests, and any error codes returned by the CPU.
- For the OPC path, open the OPC Scout and add an item. Quality Good means S7 communication is healthy; Quality Bad means either the S7 connection or the PUT/GET permission is missing.
10. Troubleshooting Matrix
| Symptom in WinCC | Likely Root Cause | Diagnostic Check | Remediation |
|---|---|---|---|
| Ping works, Runtime shows connection fault immediately | PG/PC interface bound to wrong NIC or PUT/GET disabled on CPU | Set PG/PC Interface applet; check CPU Connection mechanisms in TIA | Point S7ONLINE to the plant NIC; tick Permit access with PUT/GET; recompile and download |
| Channel DLL not found error | Native channel not installed, or WinCC version below V7.2 | Help > About in WinCC Explorer | Run WinCC setup, add SIMATIC S7-1200, S7-1500 Channel; or upgrade to V7.2 SP2+ |
| Connection establishes, then drops every 30 s | OPC server watchdog timeout or Windows Firewall killing the session | Event Viewer > Windows Firewall log; OPC Scout session status | Allow TCP/102 inbound/outbound on the plant profile; in SIMATIC NET raise the watchdog |
Tags stay quality Bad with address DB1.DBW3
|
Misaligned word access (odd byte offset) | Inspect the DB layout in TIA | Use even byte offsets for WORD/DWORD/REAL |
| WinCC reads DB inputs correctly but writes return error 0x0003 | DB is optimized (symbolic-only) or write-protected | DB properties > Optimized block access | Disable optimized access for the WinCC interface DB, or add the DB to Know-how protection exception |
| Channel works in Configuration but not in Runtime | WinCC Runtime service has no rights to the S7 stack or wrong logon | Services > CCAgent, WinCC Runtime; Event Viewer Application log | Run the service under a user with administrator rights; restore SIMATIC NET Configuration Console defaults |
| Sporadic alarm flooding from a tag | Cyclic acquisition on a bit that toggles faster than the cycle time | Tag logging in WinCC Tag Logging | Switch to On change for alarm bits; debounce in PLC code |
| Slow HMI response on a large tag list | Too many tags in a single acquisition cycle | Channel Diagnosis statistics | Split tags across multiple connections; raise the cycle time; use area pointers |
11. Security, Performance, and Lifecycle Notes
- Security: PUT/GET is unauthenticated. If the S7-1200 is on a network reachable from the office or the internet, enable a connection password in the S7-1200 protection settings, or place the CPU behind a firewall that blocks TCP/102 from outside the plant subnet. For higher assurance, switch to OPC UA on TIA V15.1+ with the S7-1500 OPC UA server, although this requires upgrading the SCADA to a UA-capable client.
- Performance: Each S7-1200 connection is sequential within a single WinCC channel instance. For projects with several hundred tags, create multiple channel instances and balance the tags across them. The S7-1200 can service roughly 50 to 80 ms of S7Comm per connection on a 1214C; budget accordingly.
- Firmware compatibility: S7-1200 firmware V4.6 and V5.x changed some default behaviors. PUT/GET remains on by default in V5.x but the path is now under Properties > Security > Connection mechanisms. The S7-1200, S7-1500 Channel supports all current firmware revisions; the OPC route is sensitive to SIMATIC NET version — pair SIMATIC NET V8.2 with the S7-1200 firmware V4.x for the broadest compatibility.
- Lifecycle: WinCC V7.x is in extended support. The S7-1200, S7-1500 Channel is the forward path; for new projects, prefer TIA Portal with WinCC Professional (unified) where the S7-1200, S7-1500 Channel is integrated and offers symbolic access.
- Redundancy: S7-1200 does not support H-system redundancy. For redundant HMI/SCADA, run two WinCC servers in a WinCC/Server-Redundant pair and use two physical connections (one per CPU instance), or fall back to a CPU 1517/H or 1518/H for true plant-side redundancy.
12. Field Commissioning Checklist
- Static IP assigned on the S7-1200 PROFINET X1, mask documented.
- PUT/GET communication enabled in TIA Portal and downloaded.
- DBs intended for WinCC configured with Optimized block access = No.
- PG/PC interface (S7ONLINE) bound to the plant NIC; verified with TIA Accessible devices.
- TCP/102 open in Windows Firewall on the plant profile, both directions.
- WinCC V7.2 SP2 or higher installed; SIMATIC S7-1200, S7-1500 Channel added during setup.
- Connection created with Rack 0, Slot 1, correct IP.
- Sample tags configured and tested in WinCC Graphics Designer.
- WinCC Runtime activated, connection status green for at least 5 minutes.
- Disconnection, power-cycle of the CPU, and network interruption tested; alarm/event raised on each.
13. Frequently Asked Questions
Which WinCC version supports the SIMATIC S7-1200, S7-1500 Channel?
WinCC V7.2 SP2 and higher. The channel is a setup option in the WinCC V7 installer and must be explicitly selected. Earlier versions (V7.0, V7.1) require the OPC route through SIMATIC NET.
Why does ping succeed but WinCC still reports "no connection to the PLC"?
Ping only proves Layer 3 reachability. WinCC needs the S7 communication handshake on TCP port 102. Check the PG/PC interface binding (must point to the plant NIC), confirm PUT/GET is enabled in TIA Portal, and verify Windows Firewall allows TCP/102 inbound and outbound.
What rack and slot does the S7-1200 use in WinCC channel configuration?
The S7-1200 CPU is always Rack 0, Slot 1. This is independent of the physical position of the CPU in the DIN rail.
Can WinCC read optimized (symbolic-only) data blocks in the S7-1200?
No. The SIMATIC S7-1200, S7-1500 Channel accesses only non-optimized DBs by absolute address. Create a small standard DB for the WinCC interface, or use TIA V16+ with WinCC Professional (unified) for symbolic access.
How many S7 connections can a single S7-1200 serve for WinCC?
The S7-1200 provides 16 S7 communication resources total. Each WinCC channel instance, each HMI panel, and each PUT/GET partner consumes one resource. Plan the budget across the plant and leave at least two free for engineering.