Resolving InTouch Data Fetch Failures from Siemens S7 PLCs

Problem Overview

AVEVA (formerly Wonderware) InTouch HMI/SCADA stations intermittently stop fetching process data from Siemens SIMATIC S7 controllers (S7-300, S7-400, S7-1200, S7-1500, and S7-200). The HMI runtime appears healthy, alarms still fire on local logic, but tag values freeze on screen and historical logs record constant values. In multi-node deployments with several InTouch stations polling the same PLC pool, the failure often correlates with a recently added HMI client, a polling-rate change, or a cabling swap.

The root cause is almost always one of three issues:

1. S7 CPU connection-resource exhaustion – the PLC has reached its maximum number of simultaneous S7 or PG/OP connections.
2. Ethernet physical-layer problems – marginal cabling (CAT-5 runs installed where CAT-6/CAT-7 is required by the environment) causing late collisions, retransmits, and TCP timeouts on the S7 protocol (ISO-on-TCP / RFC 1006 / S7 Comm).
3. Driver/architecture mismatch – the wrong DAServer (SIDirect, DASIDirect, OPC, SyPPI), a missing redundancy partner, or an InTouch hierarchical topology that collapses when one peer drops.

This reference walks through diagnosis, mitigation, and long-term remediation using STEP 7 (S7 Manager), Windows networking tools, and the AVEVA InTouch configuration interface.

Symptom Profile and Failure Modes

InTouch polling failures against S7 controllers present in a small number of recognizable patterns. Identifying the pattern narrows root-cause analysis considerably.

Root Cause: S7 Connection Resource Limits

Every SIMATIC S7 CPU maintains an internal connection table that is dimensioned in firmware. The connection table is split into configured (programmed in STEP 7 / TIA Portal) and unconfigured (dynamically allocated) resources. The SIMATIC S7-300 and S7-400 manuals define the following maximum connection counts:

The numbers above must be confirmed against the specific CPU's manual because Siemens revises connection counts per firmware release. Confirm by opening the device manual from Siemens Industry Online Support, selecting your order number (e.g., 6ES7315-2AH14-0AB0), and reading the "Communication" section.

When the configured + unconfigured connection table fills, the CPU responds to new ISO-on-TCP connect requests with a TCP RST or simply drops the SYN. The InTouch client then sees "Quality: Bad" or "Comm Error", and from that moment every tag that was mapped through that connection stays frozen until InTouch releases the socket.

Diagnostic Procedure Using STEP 7

The PLC exposes live connection counts in STEP 7's online CPU properties. This is the single most informative diagnostic when InTouch drops.

1. Open SIMATIC Manager and load the project that matches the offline hardware (or browse online via "Accessible Nodes" / "Online → Accessible Nodes").
2. Select the CPU in the project tree.
3. Press Ctrl+D (or right-click → "PLC → Monitor/Modify"). The "CPU Properties – Online" dialog opens.
4. Click the "Communication" tab. Three counters are displayed:
   • Configured connections – total slots declared in the project's NetPro/HW Config.
   • Currently used connections – live count of active sockets, including PG, OP/HMI, and S7 peer links.
   • Available connections – remaining capacity.
5. Note the "Used" value with the InTouch fleet online, then poll again with a single HMI to confirm baseline. If "Used" matches "Configured", the PLC is saturated.
6. For S7-1200/1500 in TIA Portal, the equivalent path is Project tree → Devices & Networks → select CPU → Online & Diagnostics → Connection diagnostics, or use the Web server's "Communication status" page.

Repeat the measurement at different times of day. If the count spikes only during batch or recipe downloads, it confirms that PG sessions (commissioning laptops) are stealing slots from runtime HMIs.

Ethernet Physical-Layer: Cable Quality and Signal Integrity

Where the PLC connection budget is healthy but InTouch still freezes, the cause is frequently the cable plant. S7 Comm runs over ISO-on-TCP (RFC 1006), which tolerates modest packet loss but is highly sensitive to late collisions, jitter, and duplex mismatches. When operators report that freezes stopped after a CAT-5 to CAT-7 swap, the cause is almost always:

• CAT-5 vs CAT-5e vs CAT-6 spec mismatch – 100 Mb/s S7 communication normally runs over CAT-5, but a noisy VFD room or proximity to 480 V power will inject noise that a CAT-5 (not 5e) jacket cannot reject.
• Shield not bonded – foil/drain wire unterminated turns the shielded run into a common-mode antenna.
• Run length – 100BASE-TX is specified to 100 m; field terminations sometimes push 110 m with marginal SNR.
• Duplex mismatch – switch port hard-set to full-duplex while the PLC auto-negotiates half-duplex results in late collisions that pass through TCP as timeouts.

Validate with these tools:

1. Wireshark on a SPAN/mirror port of the S7 switch. Filter for tcp.port == 102 and look for retransmissions, duplicate ACKs, and zero-window events. A healthy S7 link shows <0.1% retransmits; >1% is degraded.
2. Managed switch counters – check "CRC errors", "Late collisions", "Runts", and "Giants" per port. Any non-zero counts after a fresh boot indicate physical-layer issues.
3. Cable certifier – Fluke DSX or equivalent. Verify the run meets the rated category (CAT-6A for industrial runs near drives).

Architecture Options: Direct vs Hierarchical Polling

Where the PLC cannot accommodate another client (small S7-300 CPU, S7-1200 with only 3 PG + 8 HMI slots), redistribute load so the PLC sees fewer connections and the HMIs still get their data:

For the InTouch fleet problem reported in the field, splitting HMIs into two groups – half polling the PLC directly, half polling a peer InTouch node that already holds a healthy connection – eliminates the saturation window without new hardware.

Driver Selection: SIDirect DAServer, OPC, and SyPPI

InTouch connects to S7 controllers through one of three integration paths. Mismatched drivers are a frequent cause of partial freezes.

Recommended deployment when saturation is suspected:

1. Run a single SIDirect DAServer instance per PLC or per cluster of small PLCs.
2. Configure the SIDirect topic to use single S7 connection with multiplexing of tags (this is the default but verify in DAServer Manager → SIDirect → Topic Configuration → Connection Mode).
3. Connect every InTouch node to that one SIDirect topic via SuiteLink.
4. Confirm the S7 connection count drops from N (one per HMI) to 1 (one per SIDirect) in STEP 7's Communications tab.

Restoring Communication: Step-by-Step Procedure

Apply this procedure when InTouch polling has already failed and you need to recover the running plant.

1. Confirm scope. Identify whether one InTouch node or all nodes are affected. Check smc.log (SIDirect) and InTouch's Logger output for "S7 connection refused", "Quality Bad", or "Read timed out" entries.
2. Check PLC availability. From a maintenance laptop, ping the PLC's IP. If ping fails, escalate to network/cabling before proceeding.
3. Read PLC connection count. Use the STEP 7 procedure above. If "Used" = "Configured", jump to step 6.
4. Release zombie connections. In STEP 7, select PLC → Clear/Reset → Reset Connection List (older S7-300/400). For S7-1200/1500 use TIA Portal's "Reset to factory defaults" only as a last resort; prefer "Disconnect all" from the online diagnostics.
5. Verify InTouch recovery. Within 60 s of the reset, tags should refresh. If not, restart archestrA.SIDirect.DAServer service and the affected InTouch node.
6. Redistribute polling if the PLC has a structural limit (S7-300 with 16 connections serving 8 HMIs + 4 engineering stations). Move engineering stations to a separate "engineering" VLAN with PG routing only when required.
7. Replace cabling if Wireshark shows retransmits or if managed switch counters show CRC/late-collision events. Re-pull with CAT-6A STP bonded at both ends.
8. Document the new baseline connection count for shift handover so operators can spot future regressions.

Verification Checks and Long-Term Monitoring

Once polling has been restored, establish ongoing checks so the next regression is caught at the same minute it occurs:

Troubleshooting Matrix

Field-Proven Caveats

• Engineering PC during commissioning is the single biggest contributor to runtime freezes. Make "Disconnect all" a daily close-out step on every engineering laptop that touches the PLC.
• OPC DA over DCOM has its own connection-quota problems unrelated to S7 (Windows firewall, DCOM authentication). OPC UA is preferable for any new deployment.
• S7-1500 firmware updates sometimes revise the per-CPU HMI connection count upward – always re-read the manual after a firmware upgrade.
• Switched port security that limits MAC addresses per port can break ISO-on-TCP silently if the PLC's MAC ages out.