Resolving PC 477 WinCC Flexible WinAC Inter-Panel Communication

Symptom Definition and Boundary Conditions

Two SIMATIC Panel PC 477 (P477) stations are deployed on the same plant Ethernet segment. Each station runs WinAC RTX (the software PLC runtime, based on WinLC) executing the STEP 7 user program and WinCC flexible 2008 SP3 Runtime rendering the operator screens. From the Windows command line on either station, an ICMP echo to the partner station succeeds (typical reply in 1 ms with 0 % packet loss on a switched 100 Mbit segment). Despite this Layer-3 reachability, tags configured in WinCC flexible on Station A never update from the values computed by Station B, and vice-versa. No connection-error icon appears on the runtime; the project simply shows the last-cached or default value. The reported field-level observation is unambiguous: ping OK, application data exchange not OK.

This failure mode is one of the most frequently reported issues in legacy WinAC plus WinCC flexible architectures. It can be traced to one of five independent causes, and the fix that ultimately resolved the original installation was a PC Station hardware-configuration re-download via SIMATIC NET - but that fix only addresses two of the five underlying causes. The remaining sections cover the full diagnostic and remediation space so that the same symptom can be cleared regardless of which underlying cause is present on a given site.

Reference Architecture and Component Inventory

The PC 477 is a SIMATIC Panel PC with a 12 in or 15 in TFT touch display, an integrated Ethernet controller (Intel PRO/100 or compatible), and a Windows XP Embedded or Windows Embedded Standard 2009 operating system image. For this architecture, the following software components must be installed on each station in matching versions and languages:

• STEP 7 V5.5 + SPx (project engineering and WinAC configuration)
• WinAC RTX 2010 SPx (or the matching WinLC variant for the controller license model)
• WinCC flexible 2008 SP3 or later, matching the runtime license on the P477
• SIMATIC NET PC Software 2008 SPx or 2010 SPx - provides the IE General CP and OPC server components
• Sm@rtAccess option license for WinCC flexible (only required for the HTTP-tag exchange path)
• OPC Core Components 2.0 (re-distributed with SIMATIC NET and WinCC flexible)

Every component above participates in at least one of the three viable communication paths. Mismatched versions (for example, SIMATIC NET 2008 combined with WinCC flexible 2008 SP5) are an early-stage failure source because internal tag-prefix length limits, connection-resource limits, and the OPC DA proxy stub versioning all changed between service packs. Always verify that all components on a given PC Station share the same service-pack level before commissioning.

Communication Path Selection

There are three distinct protocols that can carry tag data between the two stations, each with different commissioning effort, license cost, and runtime behavior.

For two WinAC plus WinCC flexible stations on the same LAN, Path A is the canonical answer. Path C is documented in the WinCC flexible Communication manual as the only path that supports exchanging tags with 177-series Panels over a WAN or through a firewall server. Path B is appropriate when the WinCC flexible stations also need to expose tags to a third-party SCADA or when the S7 connection count would exceed the WinCC flexible Runtime limit of 16 active connections.

Layer-3 Reachability Does Not Prove Application-Layer Reachability

ICMP connectivity and S7/OPC/HTTP connectivity are independent. A successful ping proves only that the network stack is wired and the route is intact; it proves nothing about whether any application-layer server is listening on the destination port. In a PC Station, the application-layer server is not Windows itself - it is the SIMATIC NET IE General CP (default TCP/102 for ISO-on-TCP / S7 communication), the SIMATIC NET OPC Server (a DCOM service), or the Sm@rtAccess HTTP listener. If none of these is started, or if started but the PC Station's logical hardware configuration does not match the running Windows network adapter, every higher-layer request from the partner station times out without any indication in the WinCC flexible Runtime.

Root Cause Analysis

The five most likely root causes, ordered by field prevalence, are:

1. PC Station hardware configuration mismatch: the configuration in the STEP 7 project does not match the installed network adapter index, or the configuration was never downloaded to the Station Configuration Editor (SCE) runtime database.
2. IE General CP not running: the SCE shows the CP in STOP or not-activated state, often because the underlying Windows network adapter index changed after a Service Pack, a NIC driver update, or a hardware swap.
3. Wrong connection interface in WinCC flexible: the connection is configured against SOFTBUS instead of the IE General CP, or against a soft-tag placeholder. SOFTBUS is the internal WinCC flexible to local-WinAC coupling and cannot reach the partner station over the network.
4. IP address reversion: the static IP address is overridden by a DHCP client or by SIMATIC NET's own behavior, so each station reverts to 0.0.0.0 or an APIPA address (169.254.x.x) between reboots. ICMP may still work because ping is fired before the address reverts, while sustained sockets fail.
5. Missing option license: the Sm@rtAccess option is not licensed on one of the stations, causing the HTTP listener to refuse every incoming request with HTTP 402 Payment Required.

Cause 1 is the cause that was resolved on the original installation by re-downloading the hardware configuration. The remaining sections show how to verify each cause and apply the matching fix.

Resolution Path 1: Re-Download the PC Station Hardware Configuration

This is the fix that resolved the original installation and addresses Cause 1 and Cause 2 simultaneously. It is the single highest-yield intervention: even if the root cause is elsewhere, performing this step first removes the two most common confounders and unblocks subsequent diagnosis.

Prerequisites

• STEP 7 V5.5 project that contains both PC Stations with their target IP addresses and IE General CP slot assignment.
• Both P477 stations must be online in the STEP 7 project. Accessible Nodes must show both stations by MAC address or IP.
• The Ethernet cable between PG and each station must permit PG function. Set the PG/PC interface to TCP/IP -> Intel (or the matching NIC vendor) in the Windows Control Panel Set PG/PC Interface applet.
• The PC Station target must have the SIMATIC NET service installed and the SCE service started. If the SCE service is not installed, the download will fail with error 16:0:0 (service not found).

Procedure

1. Open the SIMATIC Manager and load the integrated project that contains both PC Station objects. Use Project > Open and navigate to the STEP 7 project file (.s7p).
2. Right-click on Station A in the component view and select Target system > PC Station > Download. Confirm the target IP address in the dialog that appears. If the IP is blank, click Select Target Node and pick from the Accessible Nodes list.
3. Wait for the transfer to complete. STEP 7 writes the new hardware configuration into the SCE runtime database on the target disk. The SCE service restarts and brings the IE General CP online. The download progress bar reports each component as it is transferred; a successful run ends with the message Download (x of x objects) successful.
4. Repeat for Station B.
5. After both downloads, open the Station Configuration Editor (Start > SIMATIC > SIMATIC NET > Configuration > Station Configuration Editor) on each station and verify that the IE General CP shows state RUN and that the configured MAC/IP matches the Windows network adapter.

Verification

Open a Windows command prompt on Station A and run:

A successful S7-TCP listener shows an entry in LISTENING state owned by the SIMATIC NET service (PID varies by service-pack level). If nothing is listening on TCP/102, the IE General CP has not come up and the connection will fail regardless of the WinCC flexible project configuration.

Then verify from Station B with a raw TCP test:

A successful telnet opens a blank screen (the connection is established); press Ctrl+] then "quit" to close. If telnet times out, the partner's IE General CP is not listening.

Resolution Path 2: Configure an S7 Connection in WinCC flexible

For two WinAC stations on the same LAN, the most direct path is a native S7 connection configured in WinCC flexible against the IE General CP. WinAC is presented to WinCC flexible as a standard S7 PLC.

Connection Parameters

Open the WinCC flexible project on Station A. In the project tree, right-click Connections and select Add Connection. Configure the partner as Station B. The connection ID is local; ensure it does not collide with the SOFTBUS connection (default ID 1 for SOFTBUS) used internally between WinCC flexible and the local WinAC.

Tag Mapping

Add tags with the following parameters to expose WinAC B's data blocks on Station A's screens:

Tag name:         TankLevel_B
  Connection:       S7_WinAC_to_WinAC_A
  Address:          DB100.DBD0  (REAL, 4 bytes)
  Acquisition mode: Cyclic continuous
  Acquisition cycle: 1 s
  Scaling:          0.0 to 100.0 (display only, not transferred)

For an array transfer, use the array notation:

Tag name:         Recipe_B
  Connection:       S7_WinAC_to_WinAC_A
  Address:          DB110.DB[0..19]  (20 bytes)
  Acquisition mode: On demand

Verification

Start WinCC flexible Runtime on Station A and open the screen that contains TankLevel_B. The tag should display a value within one acquisition cycle. If it remains blank or shows "###", open the WinCC flexible Connections diagnostic view (Project > Transfer > Runtime diagnostics or via the F8 hot key in Runtime). A red X icon indicates the connection is down; right-click to read the diagnostic buffer.

An S7 connection failure typically surfaces with one of the following diagnostic codes:

S7 Functions for Direct WinAC-to-WinAC Exchange (Bypassing WinCC flexible)

If both WinAC instances must share data without going through any HMI, use the standard S7 communication function blocks within the STEP 7 user program on each side. This is the most efficient path for control data because the cycle is bounded by the OB1 scan, not by the HMI update rate.

• PUT (FB15 / SFB15) - write tags to partner without partner-side programming
• GET (FB16 / SFB16) - read tags from partner without partner-side programming
• BSEND / BRCV (FB12 / FB13) - send up to 32 KB per call, coordinated by R_ID
• USEND / URCV (FB8 / FB9) - send up to 4 KB uncoordinated, useful for high-frequency small packets

Example call on Station A to write a 10-byte data block to Station B (Station B's DB100 starting at byte 0):

CALL  "PUT" , DB15
  REQ     := M10.0      // Edge-triggered write
  ID      := W#16#1     // Connection ID from NetPro
  DONE    := M10.1      // Write complete, one-shot
  ERROR   := M10.2      // Error flag
  STATUS  := MW12       // Detailed status (see STATUS table)
  ADDR_1  := P#DB100.DBX0.0 BYTE 10   // Partner address
  SD_1    := P#M 100.0 BYTE 10        // Local source

The connection (ID W#16#1) must be configured in NetPro with the partner's IP address, Rack 0 / Slot 2, and a free connection resource on the partner. The PUT function requires only that the partner's DB100 exists; no partner-side programming is necessary.

PUT/GET STATUS Codes

Resolution Path 3: OPC DA Configuration

OPC DA is the fallback when S7 connections cannot be used (for example, when one side is not a Siemens controller) or when tags must be exposed to multiple HMI stations simultaneously. SIMATIC NET supplies an OPC DA server that exposes WinAC tags as OPC items. WinCC flexible contains an OPC client.

OPC Server Side (Station B)

1. Open the Station Configuration Editor on Station B and verify that the OPC Server component is added to the PC Station and that the IE General CP is in RUN.
2. Open the SIMATIC NET OPC Scout (Start > SIMATIC > SIMATIC NET > OPC Scout). Add a new OPC DA group, browse to the WinAC tags, and verify that read operations return current values.
3. Configure DCOM on Station B so that the OPC client on Station A can authenticate. The default Interactive User identity is acceptable for a peer-to-peer LAN without a domain; switch to Specific user with a shared service account for cross-domain access or when running both stations as Windows services.
4. Add the WinCC flexible Runtime user account on Station A to the local DCOM access list on Station B (dcomcnfg.exe > Component Services > Computers > My Computer > DCOM Config > OPC.SimaticNET > Properties > Security).

OPC Client Side (Station A)

1. In the WinCC flexible project, add the OPC communication driver (only available if the OPC client license is present on Station A).
2. Add a connection of type OPC and enter the OPC Server ProgID: OPC.SimaticNET.1
3. Browse the OPC namespace and add tags. Example item path: S7:[StationB]DB100,REAL0 for a REAL at DB100.DBD0 on Station B.

Verification

On Station A, run the OPC Scout and connect to the partner's OPC server using the partner's hostname. Successful read of any tag proves the DCOM configuration and WinAC tag exposure; failure at this step isolates the issue to DCOM, not to the WinCC flexible configuration.

If OPC Scout reports "Access denied" (HRESULT 0x80070005), the most likely cause is that the WinCC flexible Runtime user account on Station A is not a member of the local OPC server access list on Station B. Add the user (or the Everyone group for initial commissioning) and retry.

Resolution Path 4: SIMATIC HMI HTTP Protocol (Sm@rtAccess)

The SIMATIC HMI HTTP protocol is a constituent part of the WinCC flexible Sm@rtAccess option. It is intended for tag exchange between WinCC flexible Runtime PCs and Panels of the 177 series over LAN, and for tag exchange through a firewall server. It is not intended for mass data; data exchange is request-response over TCP/80 (or TCP/443 if TLS is configured). The HTTP client sends his request to the HTTP server which processes it and returns his response. A device can be configured as an HTTP client and HTTP server simultaneously.

When to Use It

• The plant network is segmented and only HTTP is allowed between segments.
• One of the operator terminals is a Panel of the 177 series that cannot host an S7 client.
• The same data must be exposed to a remote diagnostic station outside the plant LAN.

Configuration

1. License the Sm@rtAccess option on both stations. Without the option, the HTTP listener refuses every incoming request with HTTP 402.
2. On Station B (HTTP server), open the WinCC flexible project and select Project > Transfer > Sm@rtAccess Settings. Enable the HTTP server, set the listening port (default 80), and define which tags are exposed in the Tag list.
3. On Station A (HTTP client), add a connection of type SIMATIC HMI HTTP. Enter Station B's IP, port 80, and the tag list path. The connection appears in the connections list with the HTTP icon.
4. Compile and download both projects. The HTTP server starts automatically with the WinCC flexible Runtime.

Behavior and Limits

• Request-response only; the server does not push unsolicited updates.
• Round-trip latency is dominated by the polling interval. Use a 1 s cycle for slow-changing values (level, temperature) and 250 ms only for alarms or critical interlocks.
• Throughput is approximately 50-200 tags per second per client, depending on tag size and network RTT. Plan accordingly for screens with many tags.
• The SIMATIC HMI HTTP protocol is not suitable for exchanging mass data. For continuous streams above a few KB/s, switch to S7 or OPC.

Verification

On Station A, open a browser and request http://192.168.0.21/Taglist.xml. A successful HTTP 200 response with the configured tag names confirms the server is up and the tag list is published. HTTP 402 means the Sm@rtAccess option is not licensed.

SIMATIC NET and Station Configuration Editor

Every path above depends on the SIMATIC NET runtime being installed, configured, and running. The Station Configuration Editor (SCE) is the runtime database where the PC Station's logical hardware is bound to physical Windows resources. According to the SIMATIC NET: PC software Industrial Communication with PG/PC Volume 2 - Interfaces manual, each PC Station must contain at least one IE General CP, configured with:

• The Windows network adapter index (matched to the physical NIC used for plant traffic)
• A unique station index within the S7 project (for example, Station A = index 1, Station B = index 2)
• The IP address and subnet mask of the plant network interface

If any of these three values is missing or wrong, the IE General CP either refuses to start or starts with state STOP, both of which manifest as silent communication failure with no error in WinCC flexible Runtime itself.

For PC station configuration within TIA Portal projects that integrate S7-300, S7-400, and S7-1500 controllers, the connection types and selection rules are documented in the TIA Portal help under Communication connections to PC stations (S7-300, S7-400, S7-1500). Although that page targets TIA Portal V20, the connection types (S7 connection, S7 connection with OPC, ISO-on-TCP) and their constraints are unchanged from the STEP 7 V5.5 and WinCC flexible era covered here. Use it as a reference for the conceptual model of how a PC Station connects to the S7 world, then apply the equivalent configuration in NetPro for the legacy project.

SCE State Matrix

IP Address Persistence: Resolving the Manual vs Automatic Conflict

The original installation also reported that a manually configured IP address would revert to Obtain an IP address automatically (DHCP) after a reboot or after certain Windows updates. This is a separate symptom from the S7 connection failure but it can mask or amplify the failure: an S7 client attempting to connect to 169.254.x.x (APIPA) cannot reach the partner.

Diagnostic

Open a command prompt and run:

Compare the IP address to the value configured in the Station Configuration Editor. If they differ, the SCE is publishing the wrong address, or Windows is overriding it after the SCE has already bound the listener. Repeat the command immediately after a reboot to confirm whether the IP persists across the boot cycle.

Root Causes

1. The Windows network adapter has Obtain an IP address automatically enabled. The SIMATIC NET SCE attempts to write the static IP at startup but is overridden by the Windows DHCP client on a later event.
2. A Windows update reinstalled the network adapter driver and the adapter index changed. The SCE still binds to the old index, while Windows routes the configured IP to a different virtual interface.
3. The SCE's Index for the IE General CP was set to a NIC that no longer exists (for example, after a motherboard replacement).
4. IPv6 is enabled and Windows prefers the link-local IPv6 address (fe80::...) over the configured IPv4. Some S7 clients follow the AAAA record and fail.

Fix

1. On both stations, open the network adapter properties and disable Internet Protocol Version 4 (TCP/IPv4) -> Obtain an IP address automatically. Set the IP and subnet mask manually and clear the Alternate Configuration tab.
2. In the Station Configuration Editor on each station, verify that the IE General CP references the correct Windows network adapter index. If in doubt, delete the CP and re-add it, then re-download the PC Station from STEP 7.
3. Disable the DHCP client service on the plant NIC if it cannot be removed from the adapter properties. Set the service startup type to Disabled so it cannot reset the address.
4. Disable IPv6 on the plant NIC if it is not in use. Registry key: HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\DisabledComponents = 0xFF followed by a reboot.

WinCC flexible Connection Configuration: SOFTBUS vs IE General

A subtle but common mis-configuration is selecting the wrong connection interface for a partner station. WinCC flexible distinguishes between two connection endpoints at configuration time:

In the Connections dialog, ensure that each partner station is configured against IE General and that the partner IP is bound to the IE General's local network. SOFTBUS must be reserved for the local WinAC and must never be selected as the transport for an external partner.

Network Topology Considerations

Although both stations can ping, application-layer failure often hides behind a managed switch that has not learned the MAC of the destination, a firewall that drops TCP/102, or a VLAN that splits the two stations into different broadcast domains. Verify the following:

• The two P477 stations are in the same VLAN or the inter-VLAN route permits TCP/102 and TCP/135 (DCOM) bidirectionally.
• The managed switch does not have IGMP snooping or port security enabled in a way that drops the SIMATIC NET traffic.
• No firewall (Windows Firewall on the P477 itself, or a plant firewall) blocks TCP/102 for the SIMATIC NET service. Add an inbound rule for %SystemRoot%\system32\sbserv.exe or for the SIMATIC NET service executable.
• If using OPC DA, TCP/135 and the dynamic DCOM port range (default 49152-65535 on Windows XP SP2 and later) must also be open.

Diagnostic Flowchart

Verification and Acceptance Test

Once a fix is applied, run the following end-to-end test before declaring the system operational:

1. On Station A, ping Station B. Expect reply in < 1 ms with 0 % loss on a 100 Mbit switched segment.
2. On Station A, open a command prompt and run telnet 192.168.0.21 102. Expect a blank screen (the connection opened); press Ctrl+] then "quit" to close.
3. Start WinCC flexible Runtime on Station A. Open a screen that contains a tag from Station B. Verify that the value updates at the configured acquisition cycle.
4. In WinCC flexible, open the connection diagnostic view and confirm the connection state shows a green icon (or 0x7000 in the status field).
5. Force a value change on Station B (set a tag in the STEP 7 watch table). Confirm the change appears on Station A within two acquisition cycles.
6. Reboot both stations. Re-run steps 1-5. If any value disappears or the connection drops after a reboot, the IP-persistence issue is not yet resolved and the IP-fix section must be re-applied.

Connection Diagnostic Tags

WinCC flexible exposes internal tags of the form @Connections.ConnectionName.State that can be displayed on a diagnostic screen. Use them to surface the live connection state on every operator screen that displays partner data, so that future failures are immediately visible. Recommended diagnostic layout:

@Connections.S7_WinAC_to_WinAC_A.State    // 0 = down, 1 = up
@Connections.S7_WinAC_to_WinAC_A.Quality    // Last read quality code
@Connections.S7_WinAC_to_WinAC_A.LastError  // Timestamp of last error

Performance Tuning and Limits

For high-frequency tag exchange (more than 100 tags per second), prefer S7 PUT/GET inside the STEP 7 user program over WinCC flexible connections, because the user program can place tags directly in the OB1 image without the HMI round-trip.

Backup and Rollback Procedure

Before any PC Station configuration change, capture the working state:

1. Export the STEP 7 project to a versioned archive (.s7p + .s7f + NetPro backup).
2. Open the Station Configuration Editor and select File > Export. Save the .ncm file with a date stamp.
3. Export the WinCC flexible project as a compilable archive (.hmi).
4. Document the active IP addresses, adapter indices, and the S7 connection IDs of every active connection.

If a subsequent change breaks communication, restore by importing the saved SCE configuration, re-downloading the PC Station, and re-transferring the WinCC flexible Runtime.

Edge Cases and Field Notes

• Windows time skew: DCOM authentication fails silently if the two stations differ by more than 5 minutes. Synchronize to a domain controller or to a manual NTP source.
• Antivirus quarantine: some endpoint-protection products quarantine sbserv.exe or s7oiehsx.exe after a signature update. Add the SIMATIC NET installation directory to the exclusion list.
• Energy-saving modes: Windows XP Embedded can power down the NIC after a period of inactivity. Disable this in Device Manager > NIC > Power Management.
• Service Pack mismatches: SIMATIC NET 2008 SP1 with WinCC flexible 2008 SP5 is known to leak OPC DA subscriptions after ~24 hours. Either match both to the same SP level or upgrade both to 2010 SPx.
• Dual-NIC PCs: if a P477 has a second NIC (for example, a wireless card), disable it or unbind all SIMATIC NET components from it. The IE General CP must bind to the wired plant NIC.

Troubleshooting Matrix

Frequently Asked Questions