Resolving Siemens S7 PG/PC Ethernet Driver Failures on Windows

Problem Definition

A SIMATIC programming device (PG) or PC running STEP 7 V5.x or WinCC flexible 2008 on Windows XP Professional SP3 loses its ability to reach an S7 CPU over the Ethernet interface. The Ethernet adapter itself continues to ping the CPU, but the SET PG/PC Interface diagnostics return an error against the installed S7online access point and the driver shows as "not running correctly". The failure appears after a working session — typically one week of stable operation — without any user-driven change to the PC software stack.

The diagnostic surface area spans three layers that must each be verified independently:

1. The physical/logical NIC (driver, link, IP, subnet).
2. The S7online access point and its underlying NDIS/TDI/TCP stack.
3. The SIMATIC software installation (STEP 7, WinCC flexible, WinCC, PLCSIM, AddOns).

Root Cause Analysis

On Windows XP SP3 the S7online driver is delivered as part of every SIMATIC installation and lives in the Windows service registry and the NDIS layer. Because the same S7online driver instance is shared by every installed SIMATIC product, a later installation (WinCC 2008 in this case) will overwrite the driver of an earlier STEP 7 install. If a partial uninstall, an OS service pack, a Windows security update, or an antivirus rule modifies the registry branch HKLM\SOFTWARE\Siemens\S7ONLINE or the file set under %WINDIR%\system32\s7onts* and %WINDIR%\system32\s7epa*, the access point silently breaks even though the physical NIC remains operational.

The most common root causes, in order of observed frequency on XP SP3:

STEP 7 / Windows XP SP3 Compatibility Matrix

Before reinstalling any driver, verify that the installed STEP 7 version is officially supported on Windows XP SP3. Running an unsupported patch level on XP SP3 produces silent corruption of the S7online driver the moment a Windows update touches the network stack.

Pre-Diagnostic Checklist

1. Confirm the physical link. From cmd execute ping <CPU_IP>. A reply only proves IP routing; it does not prove the S7 driver.
2. Capture the S7 driver version. Open Start → SIMATIC → STEP 7 → Set PG/PC Interface and read the active interface. Note the DLL path (typically ...\S7ONLINE\S7OTBLDX.DLL) and file version.
3. Read the S7 installation log. Inspect %TEMP%\Siemens\S7Install.log and %WINDIR%\setuplog.txt for any S7-related MSI return code (non-zero = corruption marker).
4. Inspect the Windows Event Log. Filter System by source s7otblsx, s7eepa, and Service Control Manager. Event ID 7023 on s7otblsx confirms driver crash.
5. Identify all SIMATIC products installed. Use Control Panel → Add/Remove Programs. A second install on top of an old STEP 7 typically triggers the issue.
6. Document the AV/firewall state. Note product, version, and rule names affecting s7otblsx.exe, step7.exe, and TCP/102.

Driver Reinstallation Procedure

The cleanest field-proven sequence on Windows XP SP3 is a repair-in-place of the latest SIMATIC installation present on the machine. A full uninstall/reinstall is unnecessary if no S7 component has been manually deleted.

1. Disable antivirus and Windows Firewall during the entire procedure. Restart the system to confirm clean boot state.
2. Re-run the SIMATIC setup for the latest installed package (WinCC 2008 / STEP 7 V5.x). Choose Modify, not Repair, so the S7 Online Interface → TCP/IP and ISO Ind. Ethernet sub-features are explicitly re-selected.
3. If the modify path offers Custom, force re-install of:
   • S7ONLINE Access Point
   • S7DOS / S7Epa
   • TCP/IP driver (RFC1006)
   • ISO-on-TCP driver
   • Set PG-PC Interface utility
4. After setup completes, do not reboot immediately. Open cmd as Administrator and force re-registration of the S7 COM/DLL layer:

   regsvr32 /u s7otblsx.dll
   regsvr32 s7otblsx.dll
   regsvr32 /u s7epa.dll
   regsvr32 s7epa.dll
   regsvr32 s7wtrapi.dll
   regsvr32 s7wnasvcp.dll

5. Reboot. On boot, Windows must show Service "s7otblsx" started successfully in Event Viewer.

SET PG/PC Interface Configuration

Open Start → SIMATIC → STEP 7 → Set PG/PC Interface. Select the S7ONLINE access point. The correct assignment on a single-NIC XP SP3 workstation is:

Click Diagnostics. The dialog must show OK against S7ONLINE with the assigned TCP/IP or ISO DLL. A red X or Cannot start S7 driver means the underlying DLL has not been registered or the access point binding is missing.

Network Stack and Firewall Verification

The S7 protocol stack always uses a small set of fixed ports. Any firewall, even Windows Firewall on XP SP3, must permit them bidirectionally:

Open Control Panel → Windows Firewall → Exceptions. Add %ProgramFiles%\Siemens\Automation\S7otblsx\s7otblsx.exe and %ProgramFiles%\Siemens\Automation\Simatic_managers7\s7epasrvx.exe. Also add port TCP 102 explicitly. Third-party products (Symantec Endpoint Protection, McAfee VirusScan Enterprise 8.x, Kaspersky Endpoint Security 10, Trend Micro OfficeScan) have been observed to inspect even excluded executables and block port 102 mid-session — temporarily disable host-based IPS to confirm.

Antivirus and Security Software Interference

On Windows XP SP3, antivirus products from the 2010–2014 era interact badly with the S7 DOS driver because they inject TDI filters into the network stack. Symptoms appear as:

• Driver OK after boot, fails after first Accessible Nodes scan.
• Event Viewer shows TDI filter driver rejected connection on port 102.
• CPU replies to ARP and ICMP, but TCP 102 connection is reset.

Resolution:

1. Open the AV console and add explicit exclusions for:
   • C:\Program Files\Siemens\Automation\
   • C:\Program Files\Siemens\SIMATIC\
   • C:\Program Files\Siemens\WinCC\
2. Disable the AV "Network Threat Protection" / "Intrusion Prevention" module for the duration of commissioning.
3. If a corporate-managed McAfee or Trend Micro agent is installed, request a policy push that whitelists the S7otsblsx service.

Verification Procedure

1. Local loopback test. In SET PG/PC Interface → Diagnostics, run Test on the assigned TCP/IP interface. Expect OK on the first line and OK on Read SZL.
2. Accessible Nodes. From SIMATIC Manager → PLC → Accessible Nodes, the CPU must appear with its IP and MAC within 3 seconds.
3. Online connection. Open the project, right-click the CPU → Go Online. The target system indicator should turn green and the diagnostic buffer should appear in < 5 s.
4. Long-term soak. Leave Monitor / Modify open with a 1 s update rate for 30 minutes. No driver reset means the underlying TCP keepalive is healthy.

Troubleshooting Matrix

Advanced Diagnostics

When the standard SET PG/PC diagnostics remain inconclusive, escalate to packet capture. On Windows XP SP3 use Wireshark 1.10.x (the last branch supporting XP). Filter on tcp.port == 102 and verify:

• SYN from PG to CPU IP, TCP 102.
• SYN-ACK from CPU within 50 ms on local subnet.
• TPKT/COTP handshake with TSAP 01.01 → 02.01.
• S7 Communication Setup PDU followed by Read SZL request.

Absence of SYN indicates a local stack issue. SYN with no SYN-ACK indicates the AV/firewall on either end. SYN-ACK followed by immediate RST indicates protocol filter interference (commonly seen with Blue Coat, Palo Alto, or enterprise proxies that decode S7).

Preventive Recommendations

• Pin one SIMATIC version per machine. Do not install STEP 7 V5.4 and V5.5 side by side on XP.
• Schedule the OS patch cycle to avoid Patch Tuesday falling on commissioning days.
• Keep a documented backup of %WINDIR%\system32\s7otblsx.dll, s7epa.dll, and the registry hive HKLM\SOFTWARE\Siemens for fast restore.
• Document the NIC MAC and IP at project handover so future support engineers can compare against the binding list.