Resolving Simatic Net Multi-NIC Hardware Error on Dual Network

Problem Overview

Symptom set reported on engineering stations running SIMATIC NET PC Software Edition 2005 v6.3 SP3 (build 3228) on Windows XP SP2 with two Ethernet adapters installed:

• Wired NIC: 192.168.100.162 / 255.255.255.0, gateway 192.168.100.254
• Wireless NIC: 192.168.105.202 / 255.255.255.0, gateway 192.168.105.254
• ping from one subnet to a host in the other subnet returns "Hardware error" instead of "Destination host unreachable" or a normal timeout.
• Station Configuration Editor logs "CP with index 2 is not operational" and "The components could not create a default SDB."
• Configuration Console shows both NDIS adapters with green status; the fault is not visible there.

The same workstation pings across both subnets without fault when SIMATIC NET is uninstalled, isolating the issue to the SIMATIC NET stack rather than the hardware or the Windows TCP/IP driver.

Root Cause Analysis

Three independent SIMATIC NET behaviours combine to produce the failure on a dual-NIC PG/PC:

1. Single-NDIS coupling. SIMATIC NET IE-PG coupling for v6.x binds to a single NDIS miniport through the OPC-Server/CP-IE Schnittstelle. The second card has no SDB (System Data Blocks) projection and is therefore flagged "not operational" in the Station Configuration Editor.
2. SDB generation failure. The "components could not create a default SDB" error is raised by S7wnSub (the S7 communication service) when it cannot resolve a routable interface for the configured CP IE General slot. Without an SDB, S7 communication over the second card cannot initialise.
3. TCP/IP(Auto) auto-binding. With two adapters in different subnets, the PG/PC interface selection TCP/IP(Auto) -> ... walks the binding order and may attach a route through the wrong interface. The ping command then submits the ICMP echo to a source address whose outgoing adapter is administratively bound to a different SIMATIC NET CP, producing WSAENETDOWN.

Why the wired card fails when the wireless card is active

Windows XP routes based on the longest prefix match first, then on metric. With both 192.168.100.0/24 and 192.168.105.0/24 on the host, traffic to a 192.168.105.x destination should leave on the wireless NIC. The SIMATIC NET S7 service, however, registers a raw socket on the bound NDIS index. If the SIMATIC NET CP IE General is mapped to the wired index (index 1) and the IE-PG Access setting is "Assign IP addresses unique to the project", the service actively rejects traffic originating on the wireless index. The ICMP stack inherits the rejection and returns Hardware error rather than a normal TTL expiry.

Why Configuration Console is silent

Configuration Console interrogates the NDIS layer (ndisuio user-mode IOCTL) and reports link state, MAC, and IP. SIMATIC NET's SDB/CP faults sit one layer above NDIS, in the S7 communication engine (S7wnSvr.exe, s7oiehsx.exe). Configuration Console cannot see them, which is why the cards appear healthy while S7 communication is broken.

Affected Versions and Compatibility

Diagnostic Procedure Before You Touch Anything

1. Capture ping output from both subnets with the wireless card enabled and disabled.
2. Open Configuration Console, export the active module list, and note the Index assigned to each NDIS adapter.
3. Open Station Configuration Editor, export the Station file (*.sdf or *.cfg), and record the CP IE General index, ring position, and SDB reference.
4. Run cmd > route print and save the interface table; verify metric and binding order.
5. From Start > SIMATIC > SIMATIC NET > Commissioning PC Station (or Start > Station Configuration Editor > Diagnostics), capture the local event log filtered to source S7 and OPC.
6. Verify the PG/PC interface assignment in Set PG/PC Interface (Control Panel). Screenshot the active Access Point and the assigned parameter set.

Step-by-Step Resolution

Step 1 – Disable the second NDIS path for S7 traffic

If you need two physical networks on the engineering station (for example, a plant network and an office network), use a routing-capable gateway device or a VLAN-aware switch instead of binding two NICs into the SIMATIC NET station. On the SIMATIC NET side, keep only one adapter indexed as CP IE General.

Configuration Console
  > Modules
    > Index 1  -> Wired NIC        (assign to CP IE General, slot 0)
    > Index 2  -> Wireless NIC     (do NOT assign to any SIMATIC NET component)

Step 2 – Set IE-PG Access to "Do not assign IP addresses automatically"

1. Open Set PG/PC Interface.
2. Select the active access point, for example S7ONLINE (STEP 7) -> TCP/IP(Auto) -> <your wired NIC>.
3. Click Properties.
4. Switch to the IE-PG Access tab.
5. Select the radio button "Do not assign IP addresses automatically".
6. Click OK and exit.

The default "Assign IP addresses unique to the project" radio button makes SIMATIC NET assume it owns the IP layer and reject frames that do not match the projected SDB. On a station that also has a wireless card, this rejection is the direct cause of the Hardware error.

Step 3 – Pin the active access point to one adapter

1. In Set PG/PC Interface, point S7ONLINE at TCP/IP -> <wired NIC only>.
2. Avoid TCP/IP(Auto) on a multi-NIC host. The Auto wrapper binds against the first enumerated adapter, which on a wireless-first BIOS is the wrong card.
3. Save the assignment.

Step 4 – Rebuild the SDB from a fresh project

1. Open STEP 7 / NCM S7.
2. Create a new PC station project with one CP IE General on slot 0 and one IE General on the operator station index.
3. Compile and download the SDB to the local PC station.
4. Restart Station Configuration Editor.

The error "components could not create a default SDB" is almost always traceable to a project-side corruption when two CPs are configured in slots that do not correspond to physical modules. Removing the orphan slot and recompiling is the standard fix.

Step 5 – Re-test

1. Open a command prompt: ping -S 192.168.100.162 192.168.105.1 (forces the source address to the wired card).
2. Repeat with ping -S 192.168.105.202 192.168.100.1.
3. Confirm that both directions return Reply from rather than Hardware error or Destination host unreachable.
4. Open Station Configuration Editor > Diagnostics. CP with index 2 is not operational should now be absent or should appear only for the unassigned wireless index, which is acceptable.

Station Configuration Editor Error Reference

Multi-NIC Configuration Best Practices

• One SIMATIC NET, one NIC. Do not map two physical Ethernet adapters into a single PC station. SIMATIC NET PC Software v6.3 to v7.1 expects a single ring of CP modules per station; the second card is not a routable peer.
• Disable the second card for S7. If the engineering station also needs office internet, leave the wireless adapter in Windows but exclude it from the S7ONLINE access point. Set its metric higher so default Windows routing prefers the wired card only when both subnets are reachable.
• Use a static IP on the SIMATIC NET card. DHCP renewals on the SIMATIC NET-bound NIC can interrupt SDB sessions and produce transient CP not operational events. Use a fixed 192.168.x.y address and reserve it on the DHCP server.
• Never enable IE-PG address assignment on a multi-NIC host. "Assign IP addresses unique to the project" was designed for single-NIC stations and is the dominant source of the Hardware error symptom.
• Match subnet mask with gateway scope. The reported configuration has each NIC's gateway pointing at a router in its own subnet (192.168.100.254 and 192.168.105.254). This is correct, but the host only needs a default gateway for the subnet that is the primary S7 path. Remove the gateway from the office-facing NIC if S7 traffic is not expected to leave the plant subnet.
• Sequence adapters in Device Manager. On Windows XP the binding order is set in Network Connections > Advanced > Advanced Settings > Connections. Put the SIMATIC NET-bound adapter first in the bind order; this controls which card TCP/IP(Auto) chooses.
• Keep STEP 7, NCM S7, and SIMATIC NET versions aligned. A v5.4 STEP 7 with a v6.3 SP3 SIMATIC NET is supported, but a STEP 7 v5.5 with v6.3 is not. Mismatch produces SDB format errors that surface as CP not operational.

OPC Communication Verification

After the S7 stack is healthy, validate the OPC layer. The OPC Scout (bundled with SIMATIC NET v6.x) is the fastest way to confirm that the fix reached the application layer.

1. Launch OPC Scout from Start > SIMATIC > SIMATIC NET > OPC Scout.
2. Add a new OPC-DA group named VERIFY.
3. Add an item, for example S7:[S7 connection_1]DB1,W0.
4. Subscribe at 250 ms update rate.
5. Confirm that read/write round-trip stays under 50 ms on a healthy local S7 connection.

If OPC writes are slow despite a green S7 connection, the binding has reverted to a low-priority NIC. Re-check Step 2 (IE-PG Access setting) and Step 3 (access point pin). The same fault pattern surfaces in third-party OPC clients, including OPC UA .NET clients that resolve the SIMATIC NET server by Application URI – a stale or self-signed certificate forces the client to fall back to discovery, which can look like slow writes if the network binding is wrong.

OPC UA certificate checks

For SIMATIC NET v8 and later (OPC UA server), verify the following after fixing the NIC binding:

• The Application URI in the certificate matches the SIMATIC NET station's Station name exactly.
• The certificate is placed in %ProgramData%\Siemens\Automation\OPC UA\PKI\Trusted on every client.
• The trust chain is intact; a broken chain (intermediate CA missing) causes clients to reject the server and silently retry discovery.

Verification Checklist

Troubleshooting Matrix

Reference: Windows Sockets Error Codes Seen on SIMATIC NET Stations

Hardware error in ping is almost always 10050. If the customer reports any other text, the issue is not a binding problem but a routing or firewall one.

Edge Cases and Field Notes

• USB-to-Ethernet adapters. Some USB NICs enumerate as NDIS adapters but are not in the SIMATIC NET hardware compatibility list. They appear in Configuration Console, but CP IE General cannot bind to them. Symptom: SDB downloads succeed, but CP not operational appears on next restart.
• VPN clients. A Cisco AnyConnect or OpenVPN TAP adapter behaves like a third NIC. If it is enabled while SIMATIC NET is running, the binding order shifts and the IE-PG Access flag resets. Add VPN adapters only after the SIMATIC NET stack is fully loaded, or use split-tunnel rules to exclude the plant subnet.
• IPv6 on Windows XP. SP2 enables IPv6 by default after a hotfix. If the wired NIC has an IPv6 link-local address and the wireless does not, TCP/IP(Auto) prefers the wired card for IPv4 and breaks S7-on-wireless assumptions. Disable IPv6 on the SIMATIC NET-bound adapter to stabilise routing.
• VMware / VirtualBox bridges. Bridged virtual NICs enumerate as additional NDIS adapters and steal the Auto-binding. Exclude them from Network Connections > Bridge or disable before commissioning.
• Antivirus firewalling. Some endpoint protection suites block ICMP from non-default adapters. Confirm with netsh firewall set icmpsetting 8 enable (Windows XP) and rule out a side effect before deeper diagnosis.
• Service start order. S7wnSvr depends on RPCSS, EventSystem, and COM+ Event System. If a service start race produces the CP not operational error on first boot, a manual restart of the SIMATIC NET S7 service resolves it without project changes.

Alternate Controller and Platform Notes

The Hardware error symptom is not unique to SIMATIC NET PC Software. The same NDIS binding root cause is documented for:

• S7-1200 / S7-1500 TIA Portal stations – the TIA Portal PC station has the same single-CP rule. Adding a second Ethernet adapter in the device configuration produces a similar not operational warning.
• WinCC Runtime stations – WinCC uses the same OPC-SimaticNET layer; mis-binding breaks WinCC channel diagnostics with the same S7 event log signature.
• WinAC RTX – Soft-PLC runtime relies on the same S7wnSvr; a multi-NIC host will fail to load the RTX slot if the access point is not pinned.
• Third-party OPC DA bridges – Kepware, Matrikon, and Softing use the SIMATIC NET S7 driver. Binding fixes on the SIMATIC NET side propagate automatically.

On S7-300 / S7-400 the equivalent fix is in STEP 7's PC Interface assignment, not TIA Portal. The IE-PG Access tab exists only in the SIMATIC NET access point; the S7-CPU side does not have an equivalent flag.

Safety and Operational Considerations

When commissioning a new PC station, validate S7 communication on a bench test rig with one NIC and one S7-300/S7-400 CPU before adding the office/wireless adapter. The NDIS bind order is the single most common reason that stations fail first commissioning and pass follow-up.

FAQ