Problem Overview
Engineers integrating a third-party SIMATIC S7-1200 PLC (specifically 6ES7215-1GA40-0XB0, CPU 1215C) into a SIMATIC PCS 7 V9.0 SP1 plant frequently encounter communication failures when configuring the "SIMATIC S7-1200, S7-1500 Channel" driver inside WinCC V7.4 SP1 Update 4. The typical symptom pattern is: the S7-1200 tags read correctly in the WinCC Explorer on the engineering station, but as soon as the configuration is downloaded to SERVER2, one of two failure modes appears:
- Mode 1: Server redundancy collapses. SERVER1 goes down, SERVER2 takes over with bad trend/alarm data, and the station configuration turns red.
-
Mode 2: No data from the S7-1200 is visible at all on the OS client, even though
pingfrom the OS server to the S7-1200 IP address succeeds.
Reference Plant Configuration
| Component | Part Number / Version | Role |
|---|---|---|
| PCS 7 ES | PCS 7 V9.0 SP1 | Engineering station |
| STEP 7 (Classic) | V5.6 | AS-400 programming |
| WinCC | V7.4 SP1 Update 4 | OS server / client runtime |
| S7-400 CPU | 6ES7416-2XN05-0AB0, FW V5.3 | AS-400, redundancy master (CP 416-2) |
| S7-1200 CPU | 6ES7215-1GA40-0XB0 | Third-party subsystem (read/write only) |
| Network topology | Single subnet (no AS/OS segregation) | Plant bus doubles as terminal bus |
| Server pairing | 1 ES, 1 SERVER2 (with 2 NICs: AS + OS) | Redundant OS server pair, but single S7-416-2 (non-redundant AS) |
Root Cause Analysis
1. PG/PC Interface Switching Triggers Named Connections
When the engineer changes the PG/PC interface assignment in Set PG/PC Interface from the default "PG mode" (or a previously used S7-Online access point) to a PC-internal or Plant-bus NIC access point, the S7 protocol suite used by WinCC switches the connection type used for the S7-1200 channel:
- Industrial Ethernet connection — used when the S7-Online access point points to the CP/IE of the OS server station.
-
Named Connection — used when the access point is set to
S7ONLINE (STEP7) -> PC Internalor to an unrelated NIC.
With a named connection, WinCC attempts to resolve the S7-1200 through the WinCC station configuration editor, looking up a local S7-300/400 station symbol (the OS server's own "virtual" S7 PLC). Because the S7-1200 is not a configured S7 station in the PCS 7 project, the channel cannot bind, and the server's internal PLC-symbol table in Station Configuration Editor shows a red status.
2. Combined Plant/Terminal Bus Multiplies the Conflict
The site runs a single physical subnet for both the AS-OS (plant bus) and OS-OS (terminal bus) traffic. SERVER2 has two NICs:
| NIC | Intended use | Connected to |
|---|---|---|
| NIC 1 (AS) | AS-OS traffic to S7-416-2 | Plant bus switch |
| NIC 2 (OS) | OS-OS redundancy and client traffic | Plant bus switch (same subnet!) |
Because both NICs sit on the same broadcast domain, when the engineer points Set PG/PC Interface at the plant-bus NIC to make the S7-1200 reachable, WinCC's redundancy partner handshake between SERVER1 and SERVER2 (which is normally pinned to NIC 2 / OS subnet) is forced onto the wrong interface, or hijacked by the S7-Online routing. The result: SERVER1 momentarily loses the redundancy master, drops trend logs, alarms, and re-syncs — exactly as reported.
3. S7 Protocol Is Not Secure
S7 communication is a cleartext, unauthenticated protocol. Siemens' official guidance is to never expose the plant or terminal bus to third-party devices directly. The recommended patterns are:
- Treat the S7-1200 as a GSD device on PROFIBUS-DP or PROFINET and proxy it through the S7-400 AS.
- Use PUT/GET blocks (SFB14 / SFB15 on S7-400) to fetch data from the S7-1200 over a controlled S7 connection.
- Use OPC UA on the S7-1500/S7-1200 (FW 4.4+) to expose data to WinCC Unified over a TLS-encrypted channel.
All three patterns keep the third-party PLC off the OS server's direct addressing path.
The S7-1200 / S7-1500 Channel in WinCC V7.x
WinCC V7.2 and higher ships the "SIMATIC S7-1200, S7-1500 Channel" communication DLL. The official Siemens application example is documented in SIMATIC WinCC Communication to S7-1500, S7-1200 and ET 200SP (PDF). Key requirements:
- WinCC V7.2 SP2 or higher on the OS server.
- The S7-1200 must permit PUT/GET access from a remote partner. In TIA Portal under Properties > Protection & Security > Connection mechanisms, the checkbox "Permit access with PUT/GET from remote partner (PLC, HMI, OPC, …)" must be enabled. Without it, every read returns
W#16#8082(resource unavailable) orW#16#80A2(DB does not exist on partner). - The S7-1200 IP, rack, and slot must match the WinCC channel configuration. For CPU 1215C, the default rack is
0and slot is1. - On the OS server, the Station Configuration Editor must show a healthy IE/CP index entry with the green "connection" symbol.
Why Direct S7-1200 Channel Configuration Breaks Redundancy
The PCS 7 OS server redundancy is built on the Master-Slave / Standby pattern. Each server runs its own WinCC project, and at runtime they exchange process image tags, archive segments, and alarm logs over the OS subnet. The S7 connections from the OS server to the AS are bound to the OS server's own Station Configuration Editor entry.
When you add an S7-1200 connection directly to WinCC Explorer on the OS server, the channel DLL SIMATIC S7-1200, S7-1500 Channel registers an internal PLC symbol inside the Station Configuration Editor. This forces the redundancy handshake to renegotiate the connection table. Symptoms on a combined subnet:
- One OS server briefly holds two simultaneous S7-Online paths (one to S7-416-2, one to S7-1200).
- The redundancy partner sees the secondary path as a topology change and triggers a re-sync.
- Trend and alarm buffers taken from the partner at re-sync time are treated as inconsistent, and a partial re-sync is performed — alarms and trends acquired during the swap window are lost.
The field-recommended remedy is to never open a WinCC channel directly to a non-PCS 7 PLC. Always proxy the data through the AS-400.
Solution: PUT/GET via the S7-416-2 (Field-Proven)
The cleanest, lowest-risk pattern for a PCS 7 V9.0 SP1 / WinCC V7.4 SP1 OS server is to add a single S7 connection from the S7-400 AS to the S7-1200, use PUT (SFB15) and GET (SFB14) in the AS program to mirror the S7-1200's relevant DBs into a local DB on the S7-400, and let WinCC read those mirrored tags via the standard PCS 7 AS-OS connection it already uses.
Prerequisites
- CPU 1215C FW 4.2 or higher is recommended (CPU 6ES7215-1GA40-0XB0 ships with FW 4.2; verify with Online & Diagnostics > General).
- TIA Portal V15.1 or higher on a separate engineering laptop (you do not need TIA on the PCS 7 ES).
- The S7-1200 program must expose a clean DB with all values to be read by PCS 7 (e.g.
DB200 "HMI_Interface"). - PUT/GET must be enabled on the S7-1200: TIA Portal → Device Configuration → Properties → General → Protection & Security → Permit access with PUT/GET from remote partner = checked.
- An unused, free IP address on the plant-bus subnet for the S7-1200. Confirm reachability with
pingfrom SERVER2 (AS NIC).
Step-by-Step Implementation
Step 1 — TIA Portal: Configure the S7-1200 side
- Open the S7-1200 project in TIA Portal.
- Create or identify a DB that holds the data PCS 7 must read (e.g.
DB200 "HMI_Interface"with the "HMI Access" attribute on every tag intended to be read). - Navigate to Device Configuration → Properties → Protection & Security and enable Permit access with PUT/GET from remote partner.
- Set the S7-1200 IP, subnet mask, and router (if any) to match the plant bus.
- Compile and download the hardware configuration. Verify in Online & Diagnostics that the CPU is in
RUNwith no diagnostic buffer entries.
Step 2 — STEP 7 V5.6: Configure the S7 Connection on the AS-400
- In the PCS 7 ES, open the S7-400 station in SIMATIC Manager with HW Config.
- Open NetPro and right-click on the CP 443-1 of the S7-400 → Insert New Connection.
- Connection type: S7 connection. Partner: Unspecified.
- Partner IP address: the S7-1200 IP. Partner rack/slot:
0 / 1. - Local ID: assign a free connection ID (e.g.
20). This ID is what SFB14/SFB15 will reference at runtime. - Download the NetPro configuration to the S7-416-2.
Step 3 — STEP 7 V5.6: Program PUT/GET in the S7-400
Add a new CFC chart (e.g. HMI_Proxy) and instantiate the standard SFB14 (GET) and SFB15 (PUT) blocks. Example call in STL on a cyclic OB (e.g. OB35, 1 s cycle):
CALL "GET" , DB100 // SFB14 background instance
REQ := TRUE
ID := 20 // Local connection ID from NetPro
NDR := "hmi_proxy.ndr"
ERROR := "hmi_proxy.err"
STATUS := "hmi_proxy.sts"
ADDR_1 := P#DB200.DBX0.0 BYTE 100 // Remote S7-1200 DB200, 100 bytes
RD_1 := P#DB210.DBX0.0 BYTE 100 // Local mirror DB210
Mirror the data into a local DB that the PCS 7 OS already reads through its standard AS-OS channel:
CALL "PUT" , DB101 // SFB15 background instance
REQ := "hmi_proxy.write_req"
ID := 20
DONE := "hmi_proxy.done"
ERROR := "hmi_proxy.put_err"
STATUS := "hmi_proxy.put_sts"
ADDR_1 := P#DB200.DBX0.0 BYTE 100
SD_1 := P#DB210.DBX100.0 BYTE 100
Step 4 — WinCC: Expose the Mirrored Tags
- In the WinCC Explorer of the ES, open Tag Management → AS connection (the standard PCS 7 AS-OS connection — do not create a new S7-1200 channel).
- Add new tags that reference the local mirror DB210 offsets, e.g.
DB210.DBD0,DB210.DBD4, etc. - Run the OS project editor, compile the OS, and download to SERVER2 (and SERVER1).
- Verify on the OS client that the S7-1200 values appear in the faceplates and trend curves.
Step 5 — Restore the PG/PC Interface
Revert Set PG/PC Interface on SERVER2 back to the original OS-bus NIC for S7-Online. Because the S7-1200 is no longer being addressed from the OS server, the redundant handshake between SERVER1 and SERVER2 returns to normal.
Verification Checklist
| Check | Method | Pass Criteria |
|---|---|---|
| S7-1200 reachable from AS-400 |
ping <S7-1200 IP> from ES |
Reply < 1 ms, 0% loss |
| PUT/GET status word | Watch STATUS of SFB14/SFB15 in CFC online |
W#16#0000 = no error |
| Mirror DB consistent | Open DB210 in VAT, compare to DB200 on S7-1200 | Values match within 1 s |
| OS server redundancy | WinCC Explorer → Redundancy tab on both servers | State = Master on one, Standby on the other; no Synchronization in progress warnings |
| Station Configuration | Open Station Configuration Editor on both OS servers | All IE/CP indices show green "connection" symbol, no red status |
| Trend & alarm re-sync | Force a server switch (stop Master) | Standby takes over within 5 s, no archive gaps > 10 s |
| CPU 1215C connection count | TIA Portal → Online & Diagnostics → Connection resources | ≤ 8 active connections (PUT/GET uses 1) |
Status / Error Code Matrix for SFB14 / SFB15
| STATUS (hex) | Meaning on SFB14 (GET) | Meaning on SFB15 (PUT) | Typical Cause |
|---|---|---|---|
0000 |
No error, new data received (NDR set) | No error, write complete (DONE set) | Healthy state |
0082 |
Active job in progress | Active job in progress | RE |
00C0 |
Data could not be read | — | DB does not exist on partner |
00C1 |
Read length error | — | AD |
8082 |
Local resource exhausted | Local resource exhausted | Too many parallel calls / wrong connection ID |
80A2 |
— | Partner DB not present | DB200 missing on S7-1200 |
80A3 |
— | Partner write protection active | DB200 is read-only or not HMI-accessible |
80C3 |
— | Partner resource exhausted | S7-1200 busy; reduce poll rate |
8183 |
Partner connection broken | Partner connection broken | Wrong IP / rack / slot in NetPro |
8184 |
Partner CPU in STOP | Partner CPU in STOP | S7-1200 in STOP; switch to RUN |
Alternative Architectures
Option A — GSD Device on PROFINET
Import the S7-1200 GSDML into HW Config (or TIA Portal for new builds) and connect it as a PROFINET device under the S7-400's PROFINET IO controller. The S7-400 reads/writes I/O slots directly. Pros: deterministic, no extra CPU overhead. Cons: limited to cyclic I/O data, no acyclic parameter access.
Option B — OPC UA on S7-1500/S7-1200 (FW 4.4+)
Newer S7-1200 CPUs (FW 4.4 and higher, e.g. 6ES7215-1AG40-0XB0 successors) expose an OPC UA server. Combined with WinCC Unified (RT Unified), the OS client can subscribe to the S7-1200 over TLS-encrypted OPC UA. Per the Siemens TIA documentation on certificates in WinCC Unified, legacy S7 channels are not supported for encrypted communication — OPC UA is the only TLS-capable path.
Option C — Third-Party OPC Tunnel
Products such as Softing dataFEED, Kepware, or ICONICS can bridge S7-1200 native S7 to OPC DA/UA for WinCC. These are useful in greenfield sites but add licensing and support overhead and are not aligned with PCS 7 cybersecurity guidance.
Common Pitfalls and Field Notes
-
PUT/GET disabled on the S7-1200: the single most common reason GET returns
W#16#8184despite a pingable CPU. Always verify the "Permit access with PUT/GET" checkbox. -
Wrong connection ID: the ID passed to SFB14/15 must match the NetPro "Local ID" exactly. Mismatches produce
W#16#8082. - CPU 1215C connection budget: 8 active connections (incl. HMI, PG, PUT/GET, Modbus, OPC UA). With WinCC V7.4, a TIA-HMI connection, and a PUT/GET, you are at 3 — still well within budget, but do not stack multiple HMI panels.
- DB optimization: if DB200 is configured as Optimized (TIA default), PUT/GET can still read it, but only as a contiguous byte block. Symbolic access is not exposed over PUT/GET.
- Plant-bus MAC flaps: in combined-subnet plants, watch for IGMP/snooping on the switches. Some managed switches treat the S7-1200's S7 keep-alive as multicast and prune it, breaking PUT/GET silently.
- Time synchronization: the S7-1200's RTC drifts significantly under load. If the mirrored data includes timestamps, sync the S7-1200 via NTP (CPU 1215C supports NTP client with FW 4.2+).
Cybersecurity Considerations
S7 communication is unauthenticated and unencrypted. The plant bus on a PCS 7 site should be treated as a trusted, segregated network. Best-practice recommendations from the IEC 62443 / Siemens Defense-in-Depth whitepapers:
- Place the S7-1200 in a DMZ or field-bus segment, not directly on the plant bus.
- Use a SCALANCE S615/S623 security module or a stateful firewall to filter S7 traffic between the S7-1200 subnet and the AS/OS subnet.
- Disable unused services on the S7-1200 (Web server, DCP, SNMP) under Protection & Security.
- Restrict PUT/GET to specific connection partners via the S7-1200 Local access protection list (FW 4.4+).
- Log all S7 connection establishments to a central SIEM (e.g. via the SCALANCE Syslog).
Frequently Asked Questions
Why does the S7-1200 channel in WinCC V7.4 break my OS server redundancy?
The S7-1200 / S7-1500 channel registers an internal PLC symbol in the OS server's Station Configuration Editor. On a combined plant-bus / terminal-bus network, the redundancy handshake is rerouted through this new symbol, causing the standby server to drop its partner state and trigger a partial re-sync. Always proxy S7-1200 data through the AS-400 using PUT/GET instead of opening a direct WinCC channel to the S7-1200.
Do I need TIA Portal installed on the PCS 7 engineering station to read an S7-1200?
No. You only need TIA Portal to program the S7-1200. The PCS 7 ES stays on STEP 7 V5.6 / SIMATIC Manager. Configure the S7-1200 on a separate laptop, enable PUT/GET access, and consume the data from the S7-416-2 via SFB14/SFB15 in a CFC chart.
What STATUS code do I get if PUT/GET is disabled on the S7-1200?
With "Permit access with PUT/GET from remote partner" unchecked, the S7-1200 rejects the connection at the protocol level. SFB14 typically returns W#16#8184 (partner unreachable / access denied) and SFB15 returns W#16#80A3 (partner write protection active). Open TIA Portal, enable the checkbox under Protection & Security, and recompile-download the S7-1200.
Can I use WinCC Unified to read the S7-1200 directly without PUT/GET?
Yes. WinCC Unified (RT Unified) ships a native S7-1500 / S7-1200 channel that talks directly to the S7-1200. For TLS-encrypted communication, you must use OPC UA — the legacy S7 channel is cleartext. The CPU 1215C (6ES7215-1GA40-0XB0) supports the OPC UA server role from FW 4.4 onward.
How many PUT/GET connections can a CPU 1215C handle?
The CPU 1215C supports up to 8 active S7 communication connections, shared across HMI, PG, PUT/GET, Modbus TCP, and OPC UA. A single PUT/GET connection between the S7-416-2 and the S7-1200 uses one slot. With a WinCC Unified client, a TIA-PG, and the PCS 7 PUT/GET, plan for 3-4 connections and avoid stacking additional HMI panels on the same CPU.