Resolving HMI Connection Swap Between Two PLCSIM in TIA Portal V17

When engineering a WinCC Unified Comfort Panel project that must talk to two S7 controllers, engineers frequently encounter a situation where the HMI tags bind to the first connection and refuse to follow the second connection, even after the connection names are swapped. This is especially common in PLCSIM-driven development environments where the same TIA Portal project targets two virtual CPUs running side by side. The article below documents the root cause, a tested step-by-step resolution, and the synchronization best practices required to keep tag bindings stable when HMI connections are modified.

1. Problem Description

The reported failure mode is reproducible. The engineer creates an HMI project with two HMI connections (HMI_Connection_1 and HMI_Connection_2) targeting two distinct S7 controllers. A tag from PLC_1 is dropped onto an HMI screen to create HMI_Connection_1, and a tag from PLC_2 is dropped onto a second screen to create HMI_Connection_2. At runtime (PLCSIM + Unified RT Simulation), the HMI exchanges data only with PLC_1. All tags bound to HMI_Connection_2 show as quality bad (red exclamation mark in the HMI tag list) and never update.

Initial troubleshooting attempts make the situation worse:

• Swapping connection names (HMI_Connection_1 becomes HMI_Connection_2 and vice versa) causes the HMI tags to follow the rename rather than re-bind to the new controller. Communication with PLC_1 continues; PLC_2 remains silent.
• Deleting the original connection and renaming the surviving one (HMI_Connection_2 -> HMI_Connection_1) breaks every tag on the HMI. The tag list shows all references in red because the original HMI_Connection_1 binding is now orphaned.

The symptoms indicate a tag-to-connection binding that is generated on the first drag-and-drop operation and that is not automatically rewritten when the connection name or target controller changes. WinCC Unified stores the absolute access path in the tag, not just the symbolic connection name, so simple renames do not redirect traffic to the second PLC.

2. Affected Environment and Software Versions

3. Root Cause Analysis

WinCC Unified tags are stored in the HMI device's tag table. Each tag has a connection attribute and an address attribute. The address is resolved against the configured PLC at compile time, and the resulting pointer is baked into the RT image that the HMI loads at startup. When you rename HMI_Connection_1 to HMI_Connection_2, only the symbolic link changes. The PLC reference behind the connection is still the original drop target (PLC_1), and the address pointer was generated against PLC_1's symbol table at the time of the original drop.

Three mechanisms conspire to make the situation sticky:

1. Drag-and-drop creates an implicit link. When a PLC tag is dragged onto an HMI screen, WinCC generates a new tag whose connection points to the drop source and whose address is copied from the PLC symbol. The tag does not auto-rebind when the connection is renamed or its target is swapped.
2. Connection name and connection target are independent properties. Renaming a connection preserves its target. Renaming does not change the underlying PLC, and the tags already created against the connection still resolve to the original PLC.
3. Deleting the connection orphans the tags. Once a connection is deleted, every tag whose connection property referenced it shows quality bad. Recreating a connection with the same name does not reattach existing tags; a synchronization step is required.

The binding is stored in the HMI tag table inside the HMI device, not in the connection object. This is why a manual re-binding step is necessary whenever the connection target is changed.

4. Step-by-Step Resolution

The proven procedure restores correct HMI-to-PLC mapping without manually editing every tag. The procedure assumes both PLCSIM instances are running and the HMI Unified RT simulation is launched from TIA Portal.

4.1 Remove the Broken Connection(s)

1. In the TIA Portal project tree, expand the HMI device and open Connections.
2. Delete the connection that points to the wrong PLC (or both, if you want a clean slate).
3. Compile the HMI project (Right-click HMI device > Compile > Software (rebuild all)) to surface all tags currently bound to the deleted connection. They will appear in red in the HMI tag editor.

4.2 Recreate the Connection from the Correct PLC

1. Open the project tree of the PLC you want the HMI to talk to (PLC_1 or PLC_2).
2. Open the PLC tag table.
3. Drag a single tag from the PLC tag table onto an HMI screen, or use HMI Tag Table > Add new tag > Connection = <the PLC you want to bind>.
4. TIA Portal automatically creates a new connection named HMI_Connection_1 (or the next free index) that points to the drop-source PLC. Verify in HMI > Connections > HMI_Connection_x that the Partner field points to the intended PLC.

4.3 Rename the Connection to Match Existing Tag Bindings

1. Right-click the newly created connection and select Rename.
2. Type the original connection name (for example, HMI_Connection_1) so that the HMI tags that already reference that name will resolve.
3. Compile the HMI again. The tags should now point at the renamed connection, but their quality code will still be bad because the address pointer stored in the tag was generated against the previous drop source.

4.4 Synchronize the HMI Tags Against the New PLC

1. Open the HMI tag table.
2. Click the Synchronize button in the toolbar (the icon with two arrows, also labeled Synchronize PLC tags with HMI tags). See the WinCC Unified Tag Synchronization Help for the toolbar location.
3. In the synchronization dialog, set the Comparison Criteria to Data type (recommended) so that only tags whose data type matches an HMI tag are auto-rebound. Tags with mismatched data types are flagged for manual review rather than silently overwritten.
4. Click Synchronize. TIA Portal updates the address of every HMI tag whose name and data type exist in the new PLC's symbol table.
5. Compile the HMI one more time and start the Unified RT simulation.

5. PLC Tag Synchronization Best Practices

Synchronization is the cleanest way to re-bind a large set of HMI tags, but it must be used carefully to avoid silent rename storms that break screen dynamization, scripts, and faceplate bindings.

Engineers who are worried about breaking faceplate or script bindings should follow this conservative workflow:

1. Export the HMI tag table to Excel (HMI Tag Table > Export) as a backup.
2. Run the synchronization with Replace WinCC tag name disabled and Delete WinCC tags without a PLC counterpart disabled.
3. Review the diff list. Tags flagged for mismatch must be re-bound manually (right-click > Adapt tag).
4. Re-import the Excel export if a manual repair is needed.

Synchronization is not destructive when the comparison criteria are constrained to data type and absolute address. It is destructive when Name is selected and the HMI tag names diverge from the PLC tag names, because every screen, script, and faceplate that uses the HMI tag by name will silently lose its reference.

6. PLCSIM vs PLCSIM Advanced Considerations

The behavior described in the source is reproducible with both products, but the practical workflow differs.

6.1 S7-PLCSIM

• Limited to 2 virtual CPUs per TIA Portal instance.
• Local loopback only; no external network routing.
• WinCC Unified RT discovers both PLCSIM instances automatically through the local PLCSIM TCP/IP interface.

6.2 S7-PLCSIM Advanced

• Up to 16 virtual CPUs.
• Supports distributed simulation across multiple PCs.
• Provides a virtual Ethernet adapter, allowing HMI Unified RT to be started on a separate machine and connect over real TCP/IP. This is the recommended setup when both PLCs need to run on a single host for the HMI to use a single PG/PC interface.
• Set the PG/PC interface in TIA Portal under Options > Set PG/PC Interface to PLCSIM Advanced Virtual Ethernet for each connection.

For 2-PLC simulation on a single engineering workstation, S7-PLCSIM is sufficient. For more complex topologies, S7-PLCSIM Advanced is required. Both products are documented in the SIMATIC S7-PLCSIM V17 Function Manual and the SIMATIC S7-PLCSIM Advanced V17 Function Manual.

7. Multi-PLC Configuration in TIA Portal

When a single HMI device must talk to two S7 controllers, configure each connection with a distinct Partner and a distinct Access Point. Misconfigured access points are the most common reason for cross-traffic between two PLCSIM instances.

8. Verification and Testing

After the connection rebuild and synchronization, verify communication against both virtual PLCs using the following sequence.

8.1 Compile Diagnostics

1. Right-click the HMI device > Compile > Software (rebuild all).
2. Open the Info / Output window and confirm that no warnings reference unresolved tags or missing connections.

8.2 RT Simulation Watch

1. Start the WinCC Unified RT simulation.
2. Open the HMI screen that dynamizes tags from both PLCs.
3. Toggle a bit in PLC_1 (e.g., DB1.DBX0.0) and confirm that the HMI tag bound to HMI_Connection_1 updates within one polling cycle.
4. Toggle the same bit in PLC_2 and confirm that the HMI tag bound to HMI_Connection_2 updates independently.

8.3 Connection Status Panel

WinCC Unified exposes the runtime connection status through internal system tags:

• @ConnectionState_<ConnectionName> – returns 0 (disconnected), 1 (connecting), 2 (connected).
• @ConnectionError_<ConnectionName> – last connection error code.

Create a diagnostics screen that displays both system tags for each configured connection. If either connection reports state 0, the polling cycle will not update the tags bound to that connection, and the connection must be re-checked (TSAP, access point, target PLC online state).

8.4 Trace and Packet Capture (Advanced)

For deeper diagnosis, capture the S7 protocol traffic on the PLCSIM loopback interface using Wireshark. The S7 protocol runs over TCP port 102. A connection that is up but does not deliver data will show a successful TPKT/COTP handshake followed by zero read/write requests. This indicates that the HMI tags are bound to the connection at compile time, but the connection itself is not being polled by the HMI – a symptom of a tag-list refresh failure, usually cured by a full rebuild.

9. Common Pitfalls and Edge Cases

10. Pre-Production Hardening Checklist

Before promoting the project from the PLCSIM development environment to a real Unified Comfort Panel, audit the following items. They are the same items that prevent the original failure mode from reappearing when the panel is loaded onto a physical PLC.

1. Each HMI connection has a unique, descriptive name (for example, CON_PLC_FILLER, CON_PLC_LABELER).
2. All HMI tags reference the correct connection in the Connection column. Sort the tag table by Connection and visually confirm that the expected controller matches each tag.
3. The HMI tag list shows no red quality marks after a full rebuild.
4. The diagnostics screen reports Connected for every configured connection.
5. Both target PLCs are in RUN and reachable from the HMI's PROFINET network.
6. The synchronization options are set to the conservative defaults (Data type as the only criterion, rename and delete options disabled).
7. A backup of the HMI tag table (Excel export) is checked into the project's version-control system before any major tag refactor.

FAQ