Connecting S7-1500 PLCs to WinCC V7.5 SCADA Complete

Overview

Monitoring multiple SIMATIC S7-1500 controllers from a single WinCC V7.5 SCADA workstation is a standard architecture in plant-floor supervision, but several preconditions must be met before tags from each CPU are visible on a common screen. This reference covers the connection of a typical mixed fleet — three CPU 1513-1 PN (6ES7513-1AM02-0AB0) and one CPU 1515-2 PN (6ES7515-2AM02-0AB0) — to a single WinCC Runtime Professional V7.5 server. It documents connection budgets, the S7-Plus channel, the TLS security configuration that became mandatory with firmware V2.9, and the recovery path when the original STEP 7 project is unavailable.

Prerequisites

S7-1500 Connection Budget Per CPU

Each S7-1500 CPU allocates a fixed pool of Open User Communication and S7 connections. The S7 connection count is what the WinCC V7.5 S7-Plus channel consumes. The figure below comes from the SIMATIC S7-1500 system manual and the CPU-specific datasheets.

For a WinCC server connecting with one S7-Plus channel, one S7 connection per CPU is sufficient. A redundant WinCC pair would consume two connections per CPU. The headroom can be used for additional HMI panels, OPC UA servers, PG access, or peer-to-peer PUT/GET between the four PLCs.

WinCC V7.5 S7-Plus Channel

WinCC V7.5 supports the S7-1500 family via two channel units:

• SIMATIC S7-1200, S7-1500 Channel — the modern S7-Plus driver, mandatory for V17+ TIA projects that use TLS certificates.
• SIMATIC S7 Protocol Suite — legacy ISO-on-TCP / TCPIP channel; still usable when both sides are configured for "Permit PUT/GET basic communication" and no TLS is required. This is the fallback path when the STEP 7 project is missing.

Per the WinCC V7.5 Communication Manual, the maximum number of connections per WinCC server is 64 for the S7-Plus channel. Four PLCs sit well within that limit.

TLS Security and Firmware Compatibility

Starting with STEP 7 V17 and CPU firmware V2.9, Siemens requires TLS-protected S7 communication between TIA Portal, HMIs, and WinCC. The mechanism is transparent to the user but the engineering workflow is strict:

1. Generate a CPU certificate in TIA Portal (Project tree → Devices & Networks → CPU → Properties → Security).
2. Export the CPU's self-signed certificate to the WinCC station's certificate store (Local Computer → Personal → Certificates, or the dedicated WinCC store under Siemens\Automation\Certificates).
3. Import the WinCC station's own certificate (generated by the WinCC Channel Assistant) into the CPU's "Trusted certificates and root certification authorities" list.
4. Activate the S7-Plus connection with TLS in the WinCC S7-Plus channel. The handshake is automatic on first connect.

The complete procedure is documented in the Siemens support entry "Secure PG/PC and HMI communication". If firmware on any of the four CPUs is below V2.9, the WinCC S7-Plus channel will refuse to connect with TLS and the operator must either upgrade firmware or fall back to the legacy SIMATIC S7 Protocol Suite channel with "Permit PUT/GET basic communication" enabled on the CPU.

Step-by-Step Configuration

1. Plan IP addresses. Assign static IPv4 to each PLC and to the WinCC station. Typical plant example: PLC1 192.168.10.11, PLC2 192.168.10.12, PLC3 192.168.10.13, PLC4 192.168.10.14, WinCC server 192.168.10.5, all in a /24 subnet.
2. Bring engineering data online. Open the STEP 7 project in TIA Portal V17 or higher, compile each CPU, and ensure the security settings are configured for TLS. Export each CPU certificate to a folder accessible to the WinCC station.
3. Install certificates on the WinCC station. Use the Microsoft Management Console (certlm.msc) to import every CPU certificate under Trusted People and the WinCC runtime certificate under Personal.
4. Create the WinCC project. In WinCC Explorer, right-click Tag Management → Add New Driver → SIMATIC S7-1200, S7-1500 Channel. Repeat four times — one logical connection per CPU.
5. Configure the S7-Plus connection. For each connection set: IP address of the CPU, Rack = 0, Slot = 1, Connection type = S7-Plus, Security = TLS. Point the connection to the correct imported certificate.
6. Import HMI tags. With TIA Portal and WinCC on the same project database, drag the PLC tag tables from each CPU into the WinCC tag management. The OPC tag name is generated as <ConnectionName>::<DB>.<Tag>.
7. Build the picture. On a single WinCC screen, place four process windows or four object groups. Use bar graphs, numeric I/O fields, and status indicators driven by tags from each respective connection. The application cycle is configured in Computer → Properties → Startup.
8. Activate Runtime. Save the project, then click the green traffic-light icon to start WinCC Runtime. Each CPU should appear in Online → Connections with status Connected (green).

Network Topology

The reference topology places the four S7-1500 CPUs and the WinCC server on a single OT VLAN behind a managed switch. PROFINET traffic to distributed I/O is kept on each CPU's own PROFINET port; SCADA traffic uses the integrated PN port of each CPU. For multi-segment plants, route the SCADA VLAN through a Layer-3 switch or a firewall that allows the WinCC server to reach each CPU's IP.

Alternatives to WinCC V7.5

WinCC V7.5 is sized for plant-wide, multi-server SCADA. For a four-PLC visualization, the following Siemens runtimes deliver the same connectivity at a lower cost and a smaller footprint:

For a four-CPU supervisory screen, a Comfort Panel (e.g., TP1500 Comfort 6AV2 124-1QJ01-0AX0) mounted in a control room often replaces a full WinCC V7.5 server, and removes the cost of the WinCC RT license and Windows Server. If a PC is mandatory, WinCC Unified PC Runtime is the current strategic platform and supports the same S7-Plus channel with TLS.

Troubleshooting Matrix

Recovery Path When the STEP 7 Project Is Unavailable

The original post raised a real-world constraint: the SCADA backup exists, but the original STEP 7 project, the HMI tag table, and the CPU password are not on hand. The recommended recovery procedure is:

1. Upload the four CPUs to a fresh TIA project. Use Online → Upload device as new station in TIA Portal. This requires online access and the CPU's write-protection password only if the project is set to Read/write protection; an unencrypted project uploads without a password.
2. Export tag definitions. In the uploaded project, expand PLC tags → Show all tags and export the symbol table as XLSX or CSV. Use this export as the source of truth for WinCC tag addresses.
3. Generate certificates fresh. Once the TIA project exists, the CPU certificate can be re-generated and the TLS trust chain re-established without needing a copy of the original project file.
4. Build the WinCC project from the upload. Manually create the four S7-Plus connections and bind tags to the exported symbol table. This is more work than a clean engineering import but it is a workable field path.

Verification Procedure

After commissioning, perform these checks to confirm the architecture is healthy:

1. In WinCC Explorer open Tools → Connections Status. All four S7-Plus connections should report Established with a TLS cipher listed (e.g., TLS_AES_256_GCM_SHA384).
2. Trigger a known change in each PLC (e.g., set a marker M0.0 from the CPU's web server or PG). The matching WinCC tag should update within the configured acquisition cycle (default 1 s, 500 ms typical for fast loops).
3. Pull the network cable from one CPU. The WinCC connection status should flip to Disconnected within the keep-alive timeout (default 30 s). Reconnect and confirm automatic re-establishment.
4. Run WinCC --status from a command prompt on the server. The connection count should report 4 of 64 S7-Plus connections in use.

Field-Proven Caveats

• Don't run WinCC V7.5 and WinCC Unified on the same station. Different certificate stores and different channel DLLs collide. Pick one runtime per server.
• Watch Windows time. TLS certificates use the system clock for validity. A 5-minute skew on the SCADA server breaks the handshake with a misleading "certificate expired" error.
• Keep STEP 7 version parity. A project engineered in TIA V18 cannot be opened in V17. Match the TIA version on every engineering seat to avoid version-rollback loops.
• Use a dedicated OT NIC. Sharing the management NIC between WinCC and the office network invites broadcast storms that delay tag updates.