Fixing WinCC Flexible 2008 SP5 0x320 Error on Windows 10

Problem Summary

When migrating a WinCC Flexible 2008 SP5 Runtime installation from Windows XP to Windows 10 64-bit (build 1607), HMI screens compile and transfer successfully to the Panel PC but fail to communicate with the connected SIMATIC S7-300 PLCs (CPU 319-3 PN/DP family). The runtime behavior resembles simulator mode: tag values appear blank rather than displaying hash marks (#) when the controller is offline, and no live process data is read. The WinCC Flexible message system reports two recurring alarms:

• General connection error 0x320
• Connection lost to <IP address> / <slot number>

This symptom set is the classic fingerprint of a misbound S7ONLINE access point inside the Windows PG/PC Interface, not a missing SIMATIC NET installation. The runtime cannot resolve the symbolic S7ONLINE access point to a physical TCP/IP interface, so all S7 communication requests are dropped at the application layer before any packet reaches the PLC.

Error Code Analysis

Hex Code 0x320 (Decimal 800)

WinCC Flexible Runtime and WinCC (TIA Portal) both surface S7 communication faults as numeric Win32-style status codes. The 0x320 class indicates a transport-layer failure during the S7 connection setup: the ISO-on-TCP (RFC1006) or TCP socket cannot be opened against the configured partner. Typical underlying reasons and adjacent codes include:

Although 0x320 is commonly associated with PC Station / SIMATIC NET OPC configurations, the same code is raised by the native S7DOS / S7OLE communications DLL inside WinCC Flexible when the S7ONLINE access point cannot be resolved. The runtime never marks the tag as "connection quality = good", so the I/O field stays blank instead of falling back to a hash mark.

"Connection Lost to IP Address / Slot"

The companion alarm text includes the PLC's IP address and the S7-300 CPU slot number (slot 2 for the 319-3 PN/DP, slot 4 for older 31x-2 DP). A wrong slot number is a frequent secondary fault: the HMI project was originally compiled against a different CPU in the same rack, or the rack/slot mapping was changed during the migration. Open WinCC Flexible 2008 SP5 Engineering, select Project → Connections, and confirm the partner points to the same IP, rack 0, and slot number as the physically installed CPU.

Root Cause

The Windows 10 image does not inherit the legacy PG/PC Interface binding from Windows XP. The S7ONLINE access point is either:

1. Unassigned (default = no active interface), or
2. Bound to a wireless adapter that is disabled, or
3. Bound to a virtual Hyper-V / VMware bridge that has no route to the PLC subnet, or
4. Bound to the wrong physical NIC on a Panel PC with dual Ethernet ports.

When the S7ONLINE entry is not resolvable, the S7 communications DLL inside WinCC Flexible Runtime treats every read/write as a transport failure and never marks a tag as having a valid PLC address. The I/O field therefore stays blank. On a correctly configured legacy XP system the I/O field shows hash marks (#) when the connection drops because the PLC variable address is syntactically valid; in the broken Windows 10 configuration the variable address is never evaluated at all.

SIMATIC NET is not the missing component when the Panel PC runs WinCC Flexible Runtime alone. The native S7 protocol stack shipped with WinCC Flexible 2008 SP5 already implements ISO-on-TCP and TCP/IP S7 communication directly against the Windows TCP stack. SIMATIC NET only becomes mandatory when the application requires:

• OPC DA / AE / HDA server exposure to a third-party SCADA,
• S7 redundancy with four-standby partner routing,
• Routing through a PC Station configured in STEP 7 / NCM PC,
• FDL or PROFIBUS DP master on the PC, or
• Alarm-/logging-redundancy S7 connections managed by PC Station.

None of these apply to a single HMI Runtime panel polling a single S7-300 PN/DP CPU. Siemens documents all legitimate configuration permutations in the WinCC Flexible configuration compendium linked from Siemens Support entry 24109937.

Affected Versions and Components

Prerequisites

• Local administrator account on the Panel PC
• WinCC Flexible 2008 SP5 Runtime installed and licensed through the Automation License Manager
• WinCC Flexible project already transferred to the Runtime database
• Ethernet cable connected between the Panel PC's NIC and the PLC's PROFINET port (X3)
• Successful ping <PLC IP> from an elevated command prompt
• PLC IP address, subnet mask, and rack/slot verified in the WinCC Flexible project

Step-by-Step Resolution

1. Verify the Project Transfer

Confirm the compiled runtime file set actually replaced the previous Windows XP image. The transfer directory is typically C:\Program Files\Siemens\Automation\WinCC Flexible 2008\HmiRTm. On Windows 10 64-bit with default UAC redirection, the real path is C:\Program Files (x86)\Siemens\Automation\WinCC Flexible 2008\HmiRTm. The transferred project files end in *.fwx and must be newer than the original XP build date.

2. Open the Windows PG/PC Interface Applet

1. Press Win + R, type control, press Enter.
2. In Control Panel, set View by to Small icons.
3. Locate and double-click Set PG/PC Interface.

If the applet is missing, install it from the WinCC Flexible 2008 SP5 DVD's \SETUP\SUPPORT\PGPC directory or copy SETPGAI.exe and the S7EHTMLR DLLs from a working reference machine. The applet writes its configuration into the registry at HKLM\SOFTWARE\Siemens\Automatic\PGPCInterface.

3. Assign the S7ONLINE Access Point

1. In the Access Point of the Application dropdown, select S7ONLINE.
2. In the Interface Parameterization Used list, expand the TCP/IP group.
3. Select the entry that names the physical NIC you intend to use. On a dual-port Panel PC the correct entry is Networkcard.TCPIP.1 for the on-board Intel NIC. The second NIC would be Networkcard.TCPIP.2.
4. Click OK to commit the binding.

4. Confirm the Binding Persists Across Reboot

Open regedit and verify the assignment persists:

[HKLM\SOFTWARE\Siemens\Automatic\PGPCInterface\S7ONLINE]
"SetPGInterface"="Networkcard.TCPIP.1"

If the value reverts to (unset) after a reboot, another installer (often SIMATIC Manager's NCM PC wizard) is overwriting the binding. Install SIMATIC Manager and WinCC Flexible on different Panel PCs or run NCM PC explicitly and re-bind afterwards.

5. Restart the WinCC Flexible Runtime Service

1. Open services.msc.
2. Stop and restart the Siemens WinCC Flexible Runtime service (service name WinCCflexibleRT).
3. Restarting re-reads the S7ONLINE binding; an open runtime often ignores changes made through the applet until the next process start.

6. Optional: When SIMATIC NET Must Coexist

If the same Panel PC hosts a third-party OPC client or a STEP 7 PC Station configured in NCM PC, the S7ONLINE access point is consumed by SIMATIC NET's s7oiehsx virtual adapter. In that case you must install SIMATIC NET 2008 SP2 or later, configure the PC Station as an HMI station, and ensure the WinCC Flexible project uses the PC Station's local S7 connection (type SIMATIC S7 Protocol Suite) rather than the legacy S7ONLINE routing. See the Siemens WinCC Flexible configuration compendium for the matrix of permitted combinations.

Verification Procedure

1. Launch WinCC Flexible Runtime.
2. Open the WinCC Flexible Messages view (the diagnostics screen that lists connection alarms).
3. Confirm the 0x320 and connection lost messages disappear within 30 seconds of start-up.
4. Touch any I/O field wired to a process tag: the value should update within the configured acquisition cycle (default 1 s).
5. Physically disconnect the Ethernet cable. Within the configured timeout (default 5 s) the I/O field should display hash marks (#) — this is the expected fallback for a healthy S7 connection.
6. Reconnect the cable. The runtime should re-establish the S7 connection automatically and resume reading tags without a restart.

If the I/O fields remain blank after Step 5, the runtime is still in simulator mode. Check that the transferred project file actually contains the connection configuration: open the *.fwx project with WinCC Flexible 2008 SP5 Engineering and verify the Connections node lists the PLC's IP under Partners.

Diagnostic Tools

WinCC Flexible Diagnose Button

The diagnose button in the runtime environment enumerates every device reachable via the S7ONLINE access point on the local LAN. On a healthy network the panel should list all 20+ PLCs of the subnet. If the list is empty despite successful ping, the access point is bound to a non-broadcast-capable virtual adapter. The diagnose function uses UDP broadcast to port 17171; corporate switches that drop directed broadcasts will also produce an empty list — verify the switch port configuration before assuming a binding fault.

Wireshark Capture

Install Wireshark on the Panel PC and capture on the bound interface while starting the runtime. Filter for tcp.port == 102 (ISO-on-TCP / RFC1006). The expected handshake is a SYN from the PC to the PLC's IP on port 102, followed by a SYN-ACK. If no SYN appears at all, the access point binding is the failure point. If SYN appears but no SYN-ACK follows, the PLC is unreachable (firewall, wrong IP, wrong VLAN, duplicate IP). If SYN-ACK appears but the runtime still reports 0x320, capture the next TPKT payload and verify the TSAP request matches the configured partner TSAP (typically 01.01 on the PLC side).

PLC-Side PN Port Diagnostics

From STEP 7 V5.6: PLC → Module Information → Communication. The active TCP connections list shows the PC's IP, the port number, and the byte count. A connection that never establishes here confirms the request never reaches the CPU. The 319-3 PN/DP CPU display also scrolls a status code — code E0 indicates an established S7 connection, while E1 through E4 indicate progressive connection setup states.

ARP Table Verification

Run arp -a from the Panel PC and confirm the PLC IP resolves to the expected MAC address. A duplicate IP that resolves to the wrong MAC produces a successful ping but every S7 packet is delivered to the wrong device, producing 0x320 with no consistent error pattern.

Troubleshooting Matrix

When SIMATIC NET Becomes Mandatory

SIMATIC NET is required when the Panel PC must simultaneously serve as:

• PC Station in STEP 7 / NCM PC: the PC participates in the S7 routing topology and acts as a gateway between subnets. WinCC Flexible then connects via the PC Station's local S7 connection rather than the S7ONLINE access point.
• OPC DA server: third-party SCADA or MES clients consume tags through an OPC proxy. SIMATIC NET provides the OPC server; WinCC Flexible 2008 SP5 does not expose an OPC DA interface on its own.
• S7 Redundant Connection: two S7-400H CPUs require SIMATIC NET's redundancy layer; WinCC Flexible's native S7 stack does not implement H-pair failover.
• PROFIBUS DP master on the PC: a CP 5611 / CP 5621 card needs the SIMATIC NET DP driver to publish I/O to WinCC Flexible via OPC.
• Routing across subnets: when the HMI panel must reach a PLC that is not on its directly connected LAN, the panel needs an S7 route. SIMATIC NET's s7oiehsx virtual adapter owns the routing table; WinCC Flexible alone cannot publish S7 routes.

For a Panel PC running WinCC Flexible RT only against a single S7-300 PN/DP, none of these conditions apply, so SIMATIC NET can legitimately be omitted from the bill of materials. The vendor quote that omitted SIMATIC NET was correct.

CPU 319-3 PN/DP Specifics

The 319-3 PN/DP (6ES7318-3EL01-0AB0 and 6ES7318-3FL01-0AB0) is the top-end S7-300 CPU with three interfaces: MPI/DP (X1), DP (X2), and PROFINET (X3). The PROFINET port occupies slot 2 of the S7-300 backplane in the WinCC Flexible connection editor. Common migration mistakes:

• Leaving the slot at the historical default of slot 3 (which was correct for 31x-2 DP CPUs using the DP port in slot 4). This produces connection error 0x323 (connection rejected), but if the slot value is also wrapped into an invalid TSAP pair the runtime may instead surface 0x320.
• Addressing the second PROFINET port of a 319-3 PN/DP when only one is active in the hardware configuration (STEP 7 HW Config marks the unused port as "deactivated").
• Forgetting to assign a router for cross-subnet HMI traffic; 319-3 PN/DP defaults to no default gateway, so cross-network read attempts fail silently after the initial ARP.
• Using a 100 Mbit switch port on a 1 Gbit PROFINET port. Auto-negotiation falls back to 100 Mbit but duplex mismatches produce intermittent 0x320 after a few minutes of run time.

Windows 10 1607 Compatibility Checklist

For STEP 7 V5.6 and WinCC Flexible 2008 SP5 to install and run reliably on Windows 10 64-bit build 1607:

• Disable Secure Boot or sign the legacy Siemens drivers (Simatic Manager setup ships an INF that requires test-signing mode on some hardware).
• Install only the language packs the project strings depend on; missing MUI strings cause WinCC Flexible startup errors.
• Disable Fast Startup. Fast Startup leaves the system in a hibernation hybrid state and can break the S7ONLINE binding on the next boot.
• Set the power plan to High performance so the S7 connection does not get torn down when the panel screen saver activates.
• Disable Hyper-V completely unless explicitly required; its virtual switch inserts a vEthernet adapter that hijacks the S7ONLINE Auto-mode binding.
• Disable Windows Firewall on the panel port or add an inbound allow rule for TCP port 102 (ISO-on-TCP). The default Windows 10 firewall profile is Public and blocks unsolicited inbound traffic — not normally an issue for outbound HMI traffic, but some STEP 7 diagnostic functions (PG functions) require inbound replies.
• Disable NIC Teaming on the panel port. Windows 10 1607 supports native NIC teaming through the Hyper-V virtual switch; teamed NICs do not expose the PnP instance that SETPGAI.exe expects.
• Verify the .NET Framework 3.5 feature is installed; WinCC Flexible 2008 SP5 uses .NET 2.0/3.5 components that are not enabled by default on Windows 10 1607.

Field-Proven Configuration Sequence

The fastest repeatable recovery procedure for a freshly imaged Windows 10 panel that must run WinCC Flexible RT against an S7-300 PN/DP:

1. Image Windows 10 LTSB 2016 (1607) with all critical and important updates applied.
2. Install STEP 7 V5.6 SP2 if PG functions are needed; otherwise skip.
3. Install WinCC Flexible 2008 SP5 Advanced; during install, enable "Runtime" component.
4. Enable .NET Framework 3.5 from Windows Features.
5. Disable Hyper-V, NIC teaming, Fast Startup, and Windows Firewall on the panel NIC.
6. Set power plan to High performance; disable NIC power management.
7. Transfer the compiled *.fwx project via Ethernet or USB stick to C:\Program Files (x86)\Siemens\Automation\WinCC Flexible 2008\HmiRTm.
8. Open Control Panel → Small icons → Set PG/PC Interface. Assign S7ONLINE → Networkcard.TCPIP.1.
9. Restart the WinCCflexibleRT service.
10. Launch Runtime, verify tag updates, verify hash marks on cable disconnect.

The whole sequence typically takes 90 minutes on a freshly imaged Panel PC and eliminates the recurring 0x320 / blank-tag pattern without any SIMATIC NET installation.

FAQ