Resolving S7-300 WiFi Upload Failures via SCALANCE W784

Resolving S7-300 WiFi Upload Failures via SCALANCE W784

This technical reference covers a recurring commissioning and maintenance problem on SIMATIC S7-300 stations that are networked through a SCALANCE W784 industrial WLAN access point. Field engineers report that online monitoring, force, and modify work over the wireless link, but the project upload to PG function never completes, sometimes hanging at the View dialog and other times returning The project in PLC does not contain valid upload information. The root cause is split between two distinct defects: an iWLAN access point that does not propagate ARP/PROFINET DCP discovery frames, and an S7-300 CPU that was originally downloaded with the Upload information option disabled. This guide walks through the recovery procedure, the manual IP entry path, the STEP 7 / TIA Portal re-download parameters, and the SCALANCE W784 Web Based Management checks required to make Upload station to PG work end-to-end.

1. Problem Description and Symptom Matrix

An S7-300 station is wired to a SCALANCE W784-1 / W784-2 / W786-2 iWLAN client module through the CPU's PROFINET interface (typically X2 P1 / P2 on CPU 31x-2 PN/DP or CPU 31x-3 PN/DP). A programming device connects wirelessly to the same SSID. The PG can:

• Open the online view, see the online/offline comparison, and download hardware configuration
• Monitor tags, force outputs, and modify variables
• Ping the CPU IP address with ping -t <ip>

However, the Upload station to PG action (German: Station in PG laden) fails in one of the following modes:

The first three rows of this matrix are the dominant field failures and are the focus of the rest of this article.

2. Required Hardware and Topology

The wireless path replaces the patch cable between PG and S7-300. The S7-300 itself has no built-in WLAN, so a SCALANCE W client module (W744, W746, W747, W784, W786) is mandatory. The most common commissioning configuration looks like the following SVG topology:

Supported hardware combinations (verified against Siemens manuals as of firmware 6.5 for SCALANCE W and CPU firmware V3.3 for S7-300):

3. Root Cause Analysis

Two independent faults are usually present, and a complete fix requires both to be resolved.

3.1 Fault A: Broadcast Domain Truncation

STEP 7 and TIA Portal use PROFINET DCP (Discovery and Configuration Protocol, Ethertype 0x8892) to enumerate accessible nodes. The View dialog also relies on ARP requests. When a SCALANCE W is configured as a Layer-2 bridge between Wi-Fi and the S7-300 PROFINET port, the default iWLAN profile drops multicast frames tagged with non-standard EtherTypes and broadcasts that exceed the wireless link rate. The result is an empty accessible-nodes list, even though unicast TCP/UDP S7 communication (used for online monitoring) works fine because it is unicast.

The diagnostic clue: Pinging the CPU works, but PLC > Display Accessible Nodes returns nothing and TIA Online > Accessible devices shows only the PG's own adapter. The fix is not to enable IGMP snooping. The fix is to manually enter the CPU IP address into the engineering tool's target-system dialog and to verify the SCALANCE W's PROFINET settings.

3.2 Fault B: Upload Information Stripped from CPU

Siemens S7-300 CPUs store compressed program blocks, symbols, and comments in a hidden upload information area. This area is written only when the project is downloaded with the Download to target device dialog opened in TIA Portal and the option Consistent download to target device is selected or in STEP 7 V5.x when the user has not enabled Download > Options > Do not include upload information. If the original commissioning engineer used Download without reinitialization (TIA) or unchecked Include upload information (STEP 7), the CPU holds only runtime blocks; there is no source to read back. The user sees a dialog:

"The project in PLC does not contain valid upload information."

Per Schneider Electric FAQ FA403638, this exact condition occurs on Modicon M340 CPUs when upload information is not written, and the same semantic applies to S7-300: the CPU has no project source to give back. The recovery path is to re-download the project with upload information enabled, then immediately perform an upload to capture a fresh copy.

4. ARP, DCP, and DCE/RPC Discovery Behavior

STEP 7 and TIA Portal use three different discovery mechanisms in this order:

1. ARP probe (RFC 5227) — sent to 255.255.255.255 to locate the gateway-adjacent CPU. Required by the View button.
2. PROFINET DCP IdentifyAll — multicast 01:0E:CF:00:00:00, Ethertype 0x8892, used by Accessible Nodes and TIA's Online > Accessible devices.
3. S7 directed connection — unicast TCP/ISO-on-TCP to port 102. This is the only mechanism that always works once the IP is known.

SCALANCE W models running firmware prior to V6.5 drop ARP probes that exceed 4 per second and DCP multicasts if the iWLAN interface is in iPCF-MC (industrial Point Coordination Function - Managed Channels) mode. Newer firmware (V6.5 onward, see Siemens product support) supports Layer 2 tunneling in PROFINET IO mode, but broadcast remains limited to the configured multicast group range. The result is the same: a working unicast link and a broken View button.

Consequently, the engineering workflow is forced to skip discovery and use the S7 directed connection on port 102, by typing the IP address directly.

5. Discovering the S7-300 IP via SCALANCE W784 Web Based Management

When no PG-to-CPU cable is available, the only way to find the CPU's current IP is to read the SCALANCE W Web Based Management (WBM) tables. The WBM lists every MAC address it has learned on each wired and wireless port, together with the IP that the device most recently announced.

1. Confirm the PG is associated to the SCALANCE W SSID. ping 192.168.1.250 (or the configured W784 address) should respond.
2. Open a browser and navigate to https://192.168.1.250. Accept the self-signed certificate warning.
3. Log in with the default credentials admin / admin if unchanged, or with the site-specific credentials.
4. Navigate to Information > ARP Table. The wired port entry for the CPU (port Ge1 or P1 on the W784) shows IP and MAC.
5. Cross-check in Information > LLDP / DCP Neighbors. The S7-300 announces its PROFINET station name and IP via DCP at power-up. Record the name (e.g. plc300-line1) and IP (e.g. 192.168.1.10).
6. Cross-check in WLAN > Client List if the SCALANCE W is also the Wi-Fi client. The associated client shows its own IP and the IP of the wired side.

The MAC address of an S7-300 PN interface starts with 00-0E-8C (Siemens AG, PROFINET allocation) and is printed on the CPU front panel under the X2 socket. Comparing the WBM entry against the printed label prevents a wrong-target upload to a different CPU on the same WLAN.

6. Manual PG/PC Interface Configuration

Once the IP is known, configure the PG/PC interface to point at the wireless adapter and the manual target address.

6.1 TIA Portal (V13 to V18)

1. Open the project, then choose Online > Accessible devices.
2. In the Type of the PG/PC interface drop-down select PN/IE.
3. In the PG/PC interface drop-down select the Wi-Fi adapter, e.g. Intel(R) Wi-Fi 6 AX201 160MHz - WBM-PN/IE. The S7ONLINE access point is normally pre-bound to the wired adapter; if the wireless adapter is not listed, use Set PG/PC interface from the Windows Start menu (Start > Siemens Automation > Set PG/PC Interface) and assign S7ONLINE = <Wi-Fi>.
4. Click Accessible devices. The CPU appears in the list within 1-2 seconds once the unicast S7 connection is established.

6.2 STEP 7 V5.5 / V5.6

1. Open SIMATIC Manager, then Options > Set PG/PC Interface.
2. Select TCP/IP > <Wi-Fi adapter> as the access point. The interface assignment is stored in the registry under HKLM\SOFTWARE\Siemens\SINEC\S7ONLINE.
3. Click PLC > Display Accessible Nodes. The accessible-nodes list is empty on the wireless link — this is expected.
4. Open PLC > Upload Station to PG. A dialog appears with an IP Address field. Do not use the View button. Type the IP recorded from the WBM (e.g. 192.168.1.10) and click OK.
5. STEP 7 negotiates a S7 connection on TCP/102 and lists the blocks found in the CPU.

7. Recovering from "Project Does Not Contain Valid Upload Information"

When the IP entry path completes but the upload dialog returns the upload-information error, the CPU's upload info is missing. There is no way to read it back from the CPU; you must put it back into the CPU first.

7.1 Required Inputs

• The offline STEP 7 or TIA Portal project that originally matches the CPU (or the closest matching version). Block consistency between online and offline is required.
• PG with write access (CPU protection level must be at most Read/write, not Write-protect).
• Physical or wireless network access on the same /24 subnet.

7.2 Re-Download in STEP 7 V5.6

1. Open the project, Options > Set PG/PC Interface → TCP/IP > <Wi-Fi>.
2. Select the S7-300 station in the component view.
3. Right-click the station → Download. In the Select Target Station dialog, click View (will not work over WLAN; instead enter the IP manually as in section 6.2).
4. In the Download dialog, the option Include upload information must remain checked. Do not choose Download without reinitialization; choose the default Download to target device instead.
5. Confirm the dialog with OK. The download takes 30-180 s for typical S7-300 programs (about 4-8 MB compressed upload info for a medium project).
6. Immediately perform PLC > Upload Station to PG with the manual IP. The new project is read back and saved to disk.

7.3 Re-Download in TIA Portal V13 to V18

1. Open the project, ensure the device view of the S7-300 station is active.
2. Right-click the CPU → Download to device > Software (all blocks).
3. In the Extended download to device dialog, uncheck Consistent download is acceptable; check Download upload information if visible. In TIA V16+, the relevant control is in Options > Settings > Online & Diagnostics > Upload — ensure Allow upload to PG/PC is enabled.
4. Select the wireless adapter as the PG/PC interface, type the IP, click Search. The CPU should appear; click Download.
5. When the download completes, run Online > Upload from device (software). The current project, including symbols and comments, is written back to the PG.

8. Uploading the S7-300 Project from STEP 7 V5.6

Use the procedure that matches the engineering tool you have. Do not mix TIA and STEP 7 V5.x against the same CPU in a single upload cycle — the project formats are not interchangeable and a partial upload will fail block checksums.

1. Close all other S7 connections on the PG. Sockets on TCP/102 are limited to 16 by default and the S7-300 reserves 4 for itself.
2. Open SIMATIC Manager and create a new empty project (File > New > Project).
3. Choose PLC > Upload Station to PG.
4. In the dialog, select Target station: "Manually configured target station", enter the IP, and click OK.
5. STEP 7 reads the system data, identifies the rack/slot configuration, and lists the OB/FB/FC/DB blocks. Click OK to accept.
6. Save the new project with File > Save As and a meaningful name (include the plant and date, e.g. Line1_CPU317_2024-05-21.zip).
7. Verify the upload by re-opening the project and performing PLC > Compare Online/Offline. No differences should be reported if the CPU is at rest and no process values changed during the read.

9. Uploading the S7-300 Project from TIA Portal

1. Open TIA Portal and create an empty project.
2. Add a new S7-300 station (Add new device > SIMATIC S7-300 > the matching CPU). The CPU article number must match exactly — e.g. 6ES7 317-2EK14-0AB0 — otherwise TIA refuses to compare.
3. Open the device view, right-click the CPU → Online & Diagnostics > Online access.
4. Set the PG/PC interface to the wireless adapter. Set the connection to TCP/IP.
5. Click Go online. TIA opens a direct S7 connection. In the online diagnostics view, confirm the diagnostic buffer is free of communication errors.
6. Right-click the CPU → Upload from device (software). TIA reads the project tree, blocks, symbols, and comments. Save the project.

10. SCALANCE W784 Configuration Best Practices

Beyond the workarounds above, the SCALANCE W should be configured to maximize the chance of broadcast-based discovery working. Apply the following settings in WBM under Layer 2 > PROFINET and WLAN > Radio:

11. Verification and Online Diagnostics

After a successful upload, perform these verification steps to confirm that what came back from the CPU matches the expected configuration.

1. Block compare: In STEP 7 PLC > Compare Online/Offline. Result must be "Blocks are identical".
2. Diagnostic buffer: Open PLC > Diagnostics/Settings > Diagnostic Buffer. The last entry should be Online connection established with timestamp matching the upload. No SF (system fault) entries should appear during the read.
3. Cycle time: In TIA Online & Diagnostics > Cycle time / Memory, confirm OB1 cycle time is within expected limits (typical 5-50 ms for S7-300). A spike to > 150 ms during the read indicates radio link degradation, not CPU load.
4. Symbol table: Open the symbol table. If it is empty or full of generic names, the upload info was not present. Re-do the re-download from section 7.
5. WLAN link quality: In WBM, navigate to Information > WLAN > Client list. RSSI should be -65 dBm or better for reliable uploads. -75 dBm or worse will frequently fail on blocks larger than 64 KB.
6. Save and archive: Save the project, then File > Archive into a .zip. Store alongside the original commissioning project.

12. Troubleshooting Matrix

Use the following decision matrix when the upload still fails after the procedures above.

13. Cross-Platform Notes and Field-Proven Caveats

• Windows Firewall: On Windows 10/11, the S7 communication driver opens TCP/102 and UDP/34964. The Windows firewall must allow SIMATIC S7DOS Help Helper and S7TraceSrv. Disable the firewall briefly for the first upload to rule it out.
• Antivirus: Trend Micro, Kaspersky, and Symantec Endpoint Protection intercept broadcast packets. Add the engineering subnet to the exclusion list.
• VPN client: Cisco AnyConnect and FortiClient disable split tunneling by default. Disable the VPN or add an exclusion for 192.168.1.0/24.
• Third-party Wi-Fi cards: Intel Wi-Fi 6 cards work natively. Broadcom and Realtek drivers occasionally set the Wi-Fi adapter to promiscuous mode on connect, which delays the S7 connection by 2-3 s. Update the driver or use a USB Wi-Fi adapter from the Siemens PG compatibility list.
• Multi-SSID environments: If the PG sees two SSIDs with the same name, the wireless driver may roam between APs. Pin the BSSID of the SCALANCE W in the Wi-Fi profile.
• S7-300 / S7-400 router networks: When the S7-300 sits behind an IE/PB Link or SCALANCE S615, the upload must be initiated from the PG side with the router IP, not the CPU IP. The CPU IP is in a different subnet and the S7 connection terminates on the CPU, but routing is handled by the SCALANCE S.

14. Frequently Asked Questions