Resolving WinCC 7.2 to S7-1200 Communication: HMI Connection Limits and PUT/GET Access

Establishing a stable link between WinCC 7.2 (or later WinCC V7.x) and a SIMATIC S7-1200 controller is a routine task on paper, yet field engineers routinely hit two distinct failure modes: an exhausted HMI connection budget on the CPU, and a silent access-denial caused by the Protection & Security settings in TIA Portal. Both issues produce the same symptom - a configured WinCC station that simply never goes ONLINE - and both are resolved with configuration that is not obvious from the WinCC side alone. This reference consolidates the binding constraints, the exact parameter locations, and the firmware-version-specific behavior required to get the channel green.

1. Root Cause Summary

When a WinCC 7.2 station fails to communicate with an S7-1200 after the channel, address, and PG/PC Interface have all been configured correctly, the failure is almost always traceable to one of the following conditions on the PLC side:

1. Connection resource exhaustion. The S7-1200 CPU maintains a finite pool of PG/OP/HMI connection resources. When the number of active partners (TP panels, WinCC servers, OPC partners) reaches the CPU's hard cap, any new connection request is rejected by the CPU, and WinCC simply shows OFFLINE or a channel diagnostic Channel DLL error. Each WinCC station typically consumes 2 connection resources because WinCC opens both a primary and a redundancy partner slot.
2. PUT/GET access disabled. Beginning with S7-1200 firmware V4.0, Siemens introduced an explicit connection mechanism flag in TIA Portal: Permit access with PUT/GET communication from remote partner (PLC, HMI, OPC…). When this option is unchecked (the secure-by-default state), the CPU will refuse any S7 read/write that is not initiated from a configured HMI/PLC connection. WinCC 7.2, which uses PUT/GET semantics over the S7 protocol suite, is rejected without a usable error message in the channel log.

Both of these conditions are silent on the WinCC side. The WinCC channel does not produce a definitive "permission denied" or "no resources" error; it simply reports that the connection is not established. Diagnosis therefore requires checking the CPU, not the WinCC station.

2. S7-1200 HMI / PG / OPC Connection Resource Limits

The maximum number of HMI / OP / PG / S7 connections is a per-CPU parameter fixed by the firmware. Values for the most common S7-1200 CPUs are summarized below. Always confirm against the specific manual for the exact order number and firmware version you have installed.

3. TIA Portal: Permit PUT/GET and Connection Mechanism

The PUT/GET access flag is the most overlooked single parameter in WinCC-to-S7-1200 integrations. It is located inside the TIA Portal project, not in WinCC.

3.1 Path to the parameter (TIA Portal V13 and later)

1. Open the TIA Portal project containing the S7-1200 station.
2. In the project tree, select the S7-1200 CPU (not the program blocks or the devices folder).
3. Open the Properties dialog (right-click → Properties, or double-click the CPU).
4. Navigate to Protection & Security → Connection mechanisms.
5. Tick the checkbox labeled:
   "Permit access with PUT/GET communication from remote partner (PLC, HMI, OPC…)"
6. Compile and download the hardware configuration to the CPU.

3.2 Free connection (firmware V4 only)

On S7-1200 firmware V4.0 and V4.1, Siemens exposed a second option labeled "Allow free connections" in the same Connection mechanisms panel. Enabling this option relaxes the S7-1200's strict partner authentication and accepts incoming S7 connections from any IP address. This is the simplest workaround for engineering stations that are not added to the connection list, but it is not a substitute for the PUT/GET flag - both are required for WinCC to read and write data.

4. WinCC 7.2 Channel Configuration

The correct channel for S7-1200 on WinCC 7.2 is the SIMATIC S7-1200, S7-1500 Channel. The legacy SIMATIC S7 Protocol Suite can also reach an S7-1200, but it lacks the optimizations added in the dedicated channel and is more sensitive to the PUT/GET access flag. The recommended configuration is as follows.

4.1 Adding the channel

1. In WinCC Explorer, right-click Tag Management → Add New Driver.
2. Select SIMATIC S7-1200, S7-1500 Channel.
3. Confirm with Open. A new logical driver S7-1200, S7-1500 Channel appears in the tag management tree.

4.2 Adding a connection

1. Right-click the new driver → New Connection.
2. In Connection Properties set the parameters:

5. PG/PC Interface and SIMATIC NET Setup

The WinCC station routes its S7-1200 traffic through the PG/PC Interface setting of the local Windows machine. A misaligned interface is the second most common cause of an apparently-correctly-configured channel that never establishes.

5.1 PG/PC Interface (Windows control panel applet)

1. Open Start → Control Panel → Set PG/PC Interface (the applet shipped with SIMATIC NET).
2. For the access point S7ONLINE, set the interface parameter assignment to the local Ethernet NIC used to reach the S7-1200 network - typically TCP/IP > <NIC name>.TCPIP.1.
3. Confirm any warning about a mixed configuration and click OK.

5.2 SIMATIC NET requirements

SIMATIC NET must be installed with at least the PC Station component. Typical supported versions on WinCC 7.2 include:

• SIMATIC NET V8.2 (commonly paired with WinCC 7.2 SP7)
• SIMATIC NET V8.1 / V7.1 (older combinations, still functional with firmware V2.x CPUs)

For firmware V4.x CPUs it is recommended to use SIMATIC NET V13 SP1 or later for full compatibility with the S7-1200/1500 channel.

6. Step-by-Step Connection Procedure

1. Verify the CPU resource budget. From TIA Portal → Online → Accessible Devices, look at the CPU's Connection resources diagnostics. If the HMI/OP pool is at its cap, identify and either disconnect or remove a partner.
2. Enable PUT/GET access. In TIA Portal → CPU Properties → Protection & Security → Connection mechanisms, enable Permit access with PUT/GET communication from remote partner (PLC, HMI, OPC…). Recompile and download to the CPU.
3. Set the CPU IP address. From TIA Portal → Device Configuration → PROFINET interface → Ethernet addresses, confirm the IPv4 address, subnet mask, and (if used) router address match the physical network.
4. Install SIMATIC NET on the WinCC engineering station if not already present. Restart the Windows services S7DOS and CP_PC_Intern_1 after installation.
5. Set the PG/PC Interface for the access point S7ONLINE to the local Ethernet NIC's TCP/IP variant.
6. Add the S7-1200/1500 channel in WinCC Explorer and create one connection per CPU, with the CPU IP, rack 0, and slot 1.
7. Create one or more tags in the channel connection. For best results, use Symbolic addressing by selecting Read symbol from AS; otherwise address by DB<number>,DBWx<offset> (data block bit/byte/word), Ix (input), or Qx (output).
8. Place tags on a process picture with a configured update cycle (250 ms is a reasonable starting value).
9. Activate WinCC Runtime and observe the channel status. The connection should transition to Connected within a few hundred milliseconds; failure to do so indicates a CPU-side issue, not a WinCC-side issue.

7. Firmware-Specific Behavior

The behavior of the connection mechanisms on the S7-1200 has evolved across firmware generations. Knowing which firmware is in the field is the difference between a one-minute fix and an unsolvable mystery.

A practical consequence: a working V2.2 CPU and a non-working V4.0 CPU of the same model on the same network is not a WinCC configuration issue - it is the security hardening introduced in V4.0.

8. Diagnostics and Verification

Use the following sequence to verify the channel after the configuration is complete. Stop at the first green check - if the channel still does not connect, the fault is in the next layer down.

1. L1 - Physical and L2. Confirm the WinCC station's NIC has link, and that the S7-1200's PROFINET port has link. Replace or reseat cables as required.
2. L3 - Ping. From a Command Prompt on the WinCC station, run ping <CPU IP>. Loss > 0% indicates a subnet or firewall problem; WinCC will not recover from this.
3. Access checks. In TIA Portal → Online → Accessible Devices, enter the CPU IP. If TIA cannot see the CPU from the same NIC, the WinCC channel will also fail. Fix this first.
4. Connection resources. From TIA Portal online, open the CPU's Diagnostics → Connection resources. If the HMI/OP pool is full, identify the active partner and free a slot.
5. PUT/GET verification. Re-open CPU Properties → Protection & Security → Connection mechanisms and confirm the flag is ticked. If the project is read-only, this is a meaningful stop condition - the WinCC operator has no authority to enable PUT/GET; this must be done by the project engineer.
6. Channel status. In WinCC Runtime, open the Channel Diagnosis tool (Start → SIMATIC → WinCC → Channel Diagnosis). The S7-1200/1500 connection should report OK within ~1 s of activation.
7. Tag value check. Right-click a tag → Update. A numeric tag with a defined value confirms end-to-end read. A write tag can be exercised with Write.

9. Troubleshooting Matrix

10. Best Practices and Field Tips

• Document the connection budget. Maintain a table on the cabinet drawing showing every HMI partner connected to each S7-1200 CPU, the firmware version, and the number of consumed connection resources. The most common field incident is a new SCADA addition that silently exhausts the pool.
• Treat PUT/GET as a controlled parameter. Once enabled, document it in the project's security log. A subsequent TIA Portal project update or a firmware update can reset it to the secure default and silently break the SCADA link.
• Prefer the dedicated S7-1200/1500 channel over the generic S7 Protocol Suite on WinCC 7.2. The dedicated channel is aware of firmware-V4.x semantics and surfaces a clearer diagnostic in Channel Diagnosis.
• Reserve 2 HMI slots for SCADA. If the CPU has 6 HMI/OP slots, the working combination is 4 TPs + 1 WinCC server, or 6 TPs (no SCADA), or 3 TPs + 1 WinCC, or 0 TPs + 3 WinCC servers, and so on. One WinCC server consumes 2 slots, not 1.
• Plan for firmware upgrades. When a customer asks to move an S7-1200 from V2.2 to V4.x, schedule a verification step: the SCADA channel must be re-validated even if WinCC, the network, and the project are unchanged.
• Avoid dual-homing the SCADA. Do not bind a single WinCC station to two different CPUs that share a single NIC. Use one PC station per network segment, or install a second NIC and set a dedicated Access Point for each channel.
• Validate from the engineering PC first. If TIA Portal cannot bring the CPU online from the SCADA machine with the same PG/PC Interface setting, the WinCC channel will also fail. Resolve connectivity from TIA first.

11. Safety and Cybersecurity Note

Enabling Permit access with PUT/GET communication from remote partner is equivalent to opening an unauthenticated S7 endpoint on the S7-1200's PROFINET port. This is acceptable when the S7-1200 is on a segregated OT network and the access is needed for SCADA integration, but it is not appropriate when the same PLC is on a network that also carries business traffic or untrusted endpoints. The recommended hardening posture is:

1. Segregate the S7-1200's PROFINET port onto a dedicated VLAN or a separate physical NIC.
2. Disable unused services on the CPU: Web server, SNMP, OPC UA server (if not used).
3. Use the CPU's Access level settings to require a password for write operations.
4. Deploy a stateful inspection firewall between the SCADA VLAN and any other network.

12. Quick Verification Checklist

• [ ] TIA Portal shows the CPU online from the same machine running WinCC
• [ ] Permit access with PUT/GET communication from remote partner (PLC, HMI, OPC…) is enabled and downloaded to the CPU
• [ ] CPU's HMI/OP connection resources are not exhausted (at least 2 free)
• [ ] PG/PC Interface access point S7ONLINE points to the correct Ethernet NIC's TCP/IP variant
• [ ] SIMATIC NET is installed and the SIMATIC NET Configuration Console shows the PC station as OK
• [ ] WinCC 7.2 channel SIMATIC S7-1200, S7-1500 Channel is in use, with IP, rack 0, slot 1 set
• [ ] WinCC channel diagnosis shows the connection as OK
• [ ] A test tag in the channel reads a known value from the CPU