Fix S7-1500 HMI Lag: WinCC RT Advanced Powertags and CPU Load

This reference documents a field-proven procedure for eliminating 5–10 second update latency in SIMATIC WinCC Runtime Advanced V17 running on multiple IPCs that are exchanging more than 5,500 tags with a SIMATIC S7-1516-3 PN/DP controller. Two independent root causes are addressed: a powertag license that is below the configured tag count, and an S7-1500 CPU communication-load setting that starves the OPC/HMI communication channels of cycle share. Both have to be evaluated together; correcting only one typically does not restore responsiveness.

1. Problem Overview

On a machine whose controller is a 6ES7516-3AN02-0AB0 (S7-1516-3 PN/DP) and whose visualization layer consists of three industrial PCs running WinCC Runtime Advanced V17, operators reported the following:

• Screen changeover on any of the three Runtime stations takes 5 s to 10 s.
• Setpoint entry and parameter acknowledgment lag noticeably behind the keystroke.
• Diagnostic tag updates and trend plots stop refreshing for several seconds.
• Running the same project on a single Runtime instance shows no perceptible lag.

The machine builder escalated the issue because the symptom was not present during the FAT with one IPC and reappeared the moment a second and third Runtime were placed in service. The configuration in TIA Portal V17 reported 5,561 powertags while the license file in use was sized for 4,096 powertags per Runtime.

2. System Configuration Snapshot

3. Root Cause Analysis

Three contributing factors were identified. Any one of them, in isolation, will not normally produce a 5–10 s symptom on a 1,500-class CPU; the combination is what tipped the response time out of the acceptable envelope.

3.1 Powertag License Exceeded

WinCC Runtime Advanced V17 counts every tag (HMI tag, internal tag, and external tag with a PLC address) toward the licensed powertag total per Runtime instance. A project that exchanges 5,561 tags with a single PLC still only consumes 5,561 powertags on the Runtime that hosts it. When that same project is duplicated to two more IPCs, the global tag traffic on the wire triples, while each Runtime still licenses only 4,096 tags. The Runtime software marks itself as "overlicensed" and begins to drop subscriptions on a round-robin basis, which is observed as slow screen changeovers and intermittent stale values.

3.2 CPU Communication Load Too Low

The S7-1500 CPU exposes a Communication load parameter as a percentage of the cycle. The actual OB1 cycle time is computed by the firmware as:

T_actual = T_min / (1 − load/100)

Where T_min is the configured minimum cycle time and load is the communication load percentage. Communication runs for load × T_actual of every cycle, and OB1 runs at T_actual. With a 100 ms minimum cycle and 20 % comm load:

• T_actual = 100 / 0.8 = 125 ms
• Communication share = 0.20 × 125 = 25 ms per cycle
• Three HMI connections share 25 ms of CPU time every 125 ms

That is roughly 8 ms per Runtime per cycle. Once a screen change requests a burst of write operations (setpoint, mode change, recipe record selection), the per-connection share collapses below the time required to serialize the telegram queue, and queueing latency rises into the seconds range.

3.3 Multi-HMI Network Contention

Three HMI connections on the S7-1500 means three independent PG/HMI resource reservations. Each HMI independently polls its tag list on its own acquisition cycle. When all three RTs use the default 1 s update cycle, the average traffic into the CPU becomes 3 × (tag count / 1 s). At 5,561 tags, that is ~16,700 tag reads per second before any operator actions are added. With only 25 ms of CPU comm slice per 125 ms cycle, the controller cannot drain the input queue at the wire rate, and TCP acknowledgements back up, producing the visible "thinking" pause.

4. Diagnostic Procedure

Use the following ordered checks before changing any setting. Each step yields a measurable result that drives the next decision.

1. Confirm the licensed powertag count. In TIA Portal V17 open the HMI device, then Runtime settings > Licensing. The dialog reports the licensed count and the count of configured tags. The 109479986 Siemens FAQ "Performance of WinCC Runtime Advanced" describes the same dialog and the rules for which tag types count toward the limit.
   Reference: Siemens Support entry 109479986
2. Confirm Runtime alarms. On the Runtime IPC, open the WinCC alarm window and filter for system alarms. License violations surface as alarm ID 14000004 ("More tags configured than licensed"). This is the deterministic proof that the limit has been exceeded.
3. Read the CPU communication load. In the project tree, right-click the S7-1500 CPU and choose Properties > Communication. Note the value, then go online and compare with the diagnostic buffer entry written at the most recent restart (event ID 16#4321 for cold restart reports the active comm load).
4. Check HMI connections and load. In the device view, look at the three HMI connections under Devices & Networks. Open the connection properties and verify that the Connection resources are within the CPU's HMI resource budget (S7-1516 supports 128 PG/HMI connections, but only 64 are HMI-typed by default; check with Web server > User management > Resource consumption in the CPU properties).
5. Trace the wire traffic. Capture a 30-second Profinet trace with Wireshark on a mirrored switch port. The frame count between the CPU (MAC of the Profinet interface X1) and the three RTs should be roughly balanced. A heavy skew toward one RT means that connection is doing most of the work and is the most likely victim of queueing.
6. Online & Diagnostics > Communication. With TIA Portal online, open Online & Diagnostics > Communication and read the Communication load live value. A CPU reporting >90 % comm load is the smoking gun; the configured 20 % in the offline project is being ignored because the firmware is auto-extending it.

5. Solution 1 — Upgrade the Powertag License

The first mandatory fix is the license. Three RT instances at 4,096 tags each is a total budget of 12,288 tags, while the project defines 5,561. Every Runtime therefore needs at least a 8,192-tag license, with a 4,096-tag license on the second and third units. Siemens provides the following discrete powertag sizes for WinCC Runtime Advanced V17:

Always size the license to the next tier above the configured tag count, never to the exact number, because tag counts grow as the project is commissioned. A 5,561-tag project on three RTs requires three × 8,192-tag licenses. The license is delivered as a .lic file or activated via the Automation License Manager (ALM); the License key is stored on the IPC's local drive or on a USB stick bound to the IPC's CP1616 / CP1626 MAC address.

Verification after license upgrade:

• Restart the WinCC Runtime service. The licensing dialog must report the new count and zero overrun.
• Confirm that alarm 14000004 no longer appears in the WinCC alarm log after a 10-minute soak test.
• Check the ALM log file C:\ProgramData\Siemens\Automation\ALM\ALMTrace.log for any "license not found" entries.

6. Solution 2 — Tune the S7-1500 CPU Communication Load

License correction alone does not improve speed; the user in the original case explicitly noted this. The real performance lever on the controller side is the communication load. Raising it from 20 % to 35 % was sufficient on this S7-1516-3 PN/DP project.

6.1 Setting Path in TIA Portal V17

1. Project tree → PLC → Device configuration.
2. Open the CPU Properties dialog.
3. Navigate to Communication in the left pane.
4. Field "Cycle load due to communication (in %)" → set to 35 (or higher; see table below).
5. Compile (Hardware) → Download to CPU → confirm RUN-to-RUN transition.

6.2 Impact of the Communication Load Value

6.3 Determining the Optimal Value

Do not set the communication load higher than necessary. Each percentage point is borrowed from OB1, and any process that requires a hard real-time response can be jeopardized. The recommended approach:

1. Determine the worst-case execution time of OB1 with all user programs compiled and downloaded. Use Online & Diagnostics > Cycle time; the value labeled OB1 max is the figure to protect.
2. Compute the headroom: headroom = T_min - OB1_max. If OB1_max > T_min, the cycle is already violated; raise T_min first.
3. Set the comm load to the highest percentage such that OB1_max + (comm_time/cycle) < T_actual with a 20 % safety margin.

For the 5,561-tag, three-RT case, a 35 % comm load gave the operator-acceptable response time of < 500 ms on a screen change, while still holding the OB1 cycle to < 80 ms. Above 50 % the OB1 jitter started to disturb a fast motion axis; below 30 % the HMI lag returned.

7. Solution 3 — Multi-HMI Network Optimization

The license and the comm load together resolve the symptom, but on a busy machine the operator experience can be further improved by topology choices that are not obvious from the project tree.

7.1 Avoid Duplicate Polling

If the three Runtime instances display essentially the same screens (typical for a redundant operator-station setup), the project as configured is generating three independent read requests for every tag at every acquisition cycle. Consolidate the HMI tags behind a single shared area pointer configuration so each Runtime reads once and the other two subscribe. WinCC Runtime Advanced does not support a direct HMI-to-HMI tag publish, but a thin S7-1500 data block with the consolidated dataset can be polled with a 1 s cycle and force-update notifications on the change-of-value event.

7.2 HMI Tag Update Cycle

Open the HMI tag editor, multi-select all tags, and verify that the Acquisition cycle matches the actual required update rate. The default 1 s cycle is appropriate for trend display; 250 ms is the lower practical limit on Profinet for tag bursts above 2,000 tags per Runtime. Tag groups that drive the alarm display should use Cyclical continuous only on a small subset (typically < 200 tags).

7.3 Connection Type

For an S7-1516 with three RTs, ensure the connection is configured as S7 HMI Connection with the Active flag set on the Runtime. Use PUT/GET only where the Runtime genuinely needs to write back; an unsolicited read is cheaper on the wire than a PUT/GET. The corresponding CPU property is at Properties > Connection mechanisms > Permit access with PUT/GET — if disabled, the HMI must use Absolute addressing only.

7.4 Network Topology Sketch

8. Verification and Acceptance Test

Use the following checklist on every restart of the system. Each item produces a concrete pass/fail and must be signed off before the system is returned to production.

9. Best Practices for S7-1500 / WinCC Runtime Advanced Systems

• License the next tier up. Always oversize powertag licenses by one tier; a tag that compiles today may double when the OEM adds a recipe faceplate next month.
• Default the communication load to 50 % for HMI-heavy machines (more than 2,000 tags or more than 2 Runtime instances) unless a hard real-time motion axis forces a lower value. The default of 20 % found in this project is a legacy setting from the S7-300/S7-400 era that no longer matches the S7-1500 cycle philosophy.
• Use Cyclical-continuous sparingly. Each continuous tag is one PDU per cycle. For a 3 RT / 5,500 tag project, restrict continuous tags to < 5 % of the total.
• Keep HMI tag names in the project, not on the Runtime. If tags are added at runtime (e.g., via scripts that read a DB index), the license will be exceeded silently. TIA's static tag count is the only safe reference.
• Document the comm-load value in the project header. Put the active percentage, the date, and the engineer in the project's documentation notes. A future service call will not have to redo the entire diagnostic procedure.
• Re-verify the diagnostics after any firmware update. A firmware change on the S7-1500 can reset the communication load to its default, especially when going from V2.x to V3.x. Always re-check after a firmware upgrade.

10. Frequently Asked Questions