Resolving WinCC 7.4 TCP/IP Disconnected Status with SIMATIC

Problem Overview

When WinCC 7.4 running on a Windows engineering station is unable to reach a STEP 7 V5.5 SIMATIC Manager project over TCP/IP, the runtime presents a red handshake icon in the connection list and the status column reads Disconnected. The same station is typically using S7-PLCSIM to simulate the S7-300/S7-400 controller while the HMI project is being validated. The error appears in three common contexts:

• Initial commissioning of a new WinCC / STEP 7 project combination.
• After switching the engineering PC from a real PLC on Ethernet back to a PLCSIM-only bench rig.
• After Windows updates, network adapter swaps, or installation of additional SIMATIC NET components.

In every documented case, the application-layer channel configuration in WinCC is correct. The fault is consistently located one layer below the application: the operating-system level PG/PC Interface is not pointing the correct protocol driver at the S7ONLINE access point.

Symptoms and Error Indicators

Root Cause Analysis

WinCC communicates with the automation system through a Siemens-proprietary channel DLL (S7chn.dll). The channel DLL does not own a network driver directly; it depends entirely on the PG/PC interface that is bound to the symbolic access point S7ONLINE. This indirection is implemented for historical reasons: it allows the same engineering tool to bind to different physical transports (MPI, PROFIBUS, ISO, TCP/IP, PLCSIM) without recompilation.

When S7-PLCSIM is the active controller, the only driver that can deliver S7 telegrams to it is the PLCSIM driver (sometimes listed as PLCSIM.PROTOCOL or PLCSIM.S7Proto). If the PG/PC interface is currently set to a real Ethernet driver such as TCP/IP -> Intel I219-V, the channel DLL will attempt to open a TCP socket to the IP address configured in WinCC and issue an S7 CONNECT request. PLCSIM does not listen on the host NIC for that address; it uses an internal shared-memory soft-PLC channel. The connect attempt times out (typically 30 s) and the channel marks itself disconnected.

Conversely, selecting the PLCSIM driver while attempting to reach a physical S7-CPU will also fail. PLCSIM cannot route outside of the engineering PC process boundary.

Step-by-Step Configuration of the PG/PC Interface

The authoritative Siemens procedure is documented in FAQ 11870489 - "How do you generally parameterize the PG/PC interface...". The condensed procedure for this specific scenario is as follows.

1. Close every Siemens engineering tool that might hold a lock on the access point: SIMATIC Manager, WinCC Explorer, WinCC Runtime, S7-PLCSIM, and any open STEP 7 V5.5 component.
2. Open the Windows Control Panel and launch Set PG/PC Interface (German: PG/PC-Schnittstelle einstellen). On Windows 10 1903+ and Windows 11, the applet resides under Control Panel > All Control Panel Items > Set PG/PC Interface. If the applet is missing, install or repair SIMATIC NET PC Software from the STEP 7 V5.5 SPx media.
3. In the Access Point of the Application dropdown, select S7ONLINE. Do not select a project-specific access point unless your STEP 7 installation has been customized.
4. In the Interface Parameter Assignment Used list, select one of:
   • PLCSIM (PLCSIM.PROTOCOL) - when testing against S7-PLCSIM on the same PC.
   • TCP/IP -> <your network adapter> - when connecting to a real S7-300/S7-400 CPU over Ethernet.
   • ISO -> <your network adapter> - when using ISO-on-TCP (RFC1006) on a real CPU.
5. Click OK and acknowledge any prompts. The selection is written immediately to the registry under HKLM\SOFTWARE\Siemens\SINEC.
6. Restart the Siemens tools so they pick up the new assignment. The PG/PC interface is read once at process start.
7. If the bench rig alternates between PLCSIM and a real PLC, repeat steps 2-6 each time you switch. The selection is per-machine, not per-project.

PLCSIM and the S7ONLINE Access Point in Detail

The S7ONLINE access point is a symbolic handle that every STEP 7 V5.x application (SIMATIC Manager, WinCC, ProTool, STARTER for older drives, and the S7DOS service) uses to resolve the active S7 transport. By binding the PLCSIM driver to S7ONLINE, you are telling the entire toolchain that "the S7 subnet reachable through S7ONLINE is the simulated one running on this PC." No other configuration in SIMATIC Manager, NetPro, or WinCC changes.

When PLCSIM starts, it registers a soft-PLC service on an internal Microsoft RPC endpoint. The PLCSIM driver in the PG/PC interface routes S7ONLINE traffic to that endpoint. The connection therefore never leaves the engineering PC, which has two practical consequences:

• No firewall rule, antivirus exclusion, or Windows Defender profile change can "fix" a missing PLCSIM-to-S7ONLINE binding. The traffic is in-process.
• Changing the IP address that PLCSIM reports (in PLCSIM > PLC > Ethernet Address) has no effect on routing; PLCSIM uses an internal slot/connection identifier, not the IP, to accept connections.

TCP/IP Channel Configuration in WinCC Explorer

Once the PG/PC interface is correctly assigned, confirm the WinCC channel reflects the same intent.

1. In WinCC Explorer, navigate to Tag Management > SIMATIC S7 PROTOCOL SUITE > TCP/IP.
2. Right-click TCP/IP and select System Parameters > Unit. The unit (logical device name) should match the PG/PC interface selection. Default is TCP/IP; if you renamed it during installation, the names must match exactly (case-sensitive in the registry).
3. For each connection in use, open Connection Properties and verify:
   • IP Address: use 127.0.0.1 for PLCSIM, or the CPU's real IP for a physical PLC.
   • Rack / Slot: matches the CPU's physical or simulated position (default PLCSIM is rack 0, slot 2 for S7-300; rack 0, slot 3 for S7-400).
   • Connection Name: must equal the S7 connection name generated by NetPro (e.g., AS1_Connection_1).
4. If the project was built using AS-OS Engineering (the typical path for S7-300/400 + WinCC), regenerate the connection list after fixing the PG/PC interface: Options > AS-OS Engineering > Generate / Update Connection List.

SIMATIC Manager and NetPro Verification

Open the STEP 7 project and double-click NetPro. Verify the following before returning to WinCC:

• The S7 connection target points to the correct CPU and uses TCP/IP as the network type.
• The local end of the connection is bound to a SIMATIC PC Station on the engineering PC, with an "Application" slot pointing to your WinCC project.
• Save and Compile returns zero errors and zero warnings.
• The PC station configuration (in the station's Configuration editor) contains a WinCC Application entry that references the WinCC project directory. Without this, AS-OS Engineering will not transfer any connections to WinCC.
• The CPU's IP address in the STEP 7 Hardware configuration matches the IP used in the WinCC connection list.

Firewall, Network, and Windows Considerations

Although PLCSIM traffic stays in-process, real-PLC traffic over TCP/IP uses ISO-on-TCP (RFC1006) on the well-known port 102. Windows Firewall defaults block this inbound unless an explicit rule is present. Siemens publishes the required port list in the WinCC 7.4 installation manual and in SIMATIC NET PC Software - Communication Manual.

Other Windows-level items that frequently reintroduce the symptom:

• SIMATIC NET driver deactivation: Windows network resets occasionally disable the Siemens virtual NDIS adapters. Open Device Manager and confirm SIMATIC NET Ethernet devices are enabled.
• Antivirus real-time scanning of CCExplorer.exe and S7DOS.exe: exclude the entire Siemens directory tree from real-time scanning. Defender's controlled folder access also blocks the PLCSIM driver registration on first run.
• DCOM and SMB: AS-OS Engineering depends on DCOM between the PC station and the engineering tool. Confirm Component Services > Computers > My Computer > DCOM Config allows the Siemens applications through Windows firewall.

Verification Procedure

1. Start S7-PLCSIM and load the STEP 7 program (PLCSIM > Download). Place PLCSIM in RUN-P.
2. Confirm in PLCSIM that the "Online" LED is solid green and the operator panel shows the simulated CPU in RUN.
3. Open SIMATIC Manager, select the project, and choose PLC > Monitor/Modify. Tag read/write should return values from PLCSIM. This isolates whether the PG/PC interface assignment is working.
4. Open WinCC Explorer and start the runtime (Start > Runtime).
5. Watch the connection list: handshake icon transitions from red (offline) to yellow (connecting) to green (connected).
6. Place an I/O field bound to a tag from the S7 connection in Graphics Designer and toggle a bit. The display must update within one polling cycle.
7. Open Tools > Channel Diagnostics in WinCC Explorer and confirm Establishment Status = CONNECTED with an empty error column for every configured connection.
8. For real-PLC validation, run ping <CPU IP> from a command prompt to separate network-layer faults from application-layer faults.

Troubleshooting Matrix

Differences Between PLCSIM and Real PLC Behavior

Several behaviors differ between PLCSIM and a physical S7-CPU that catch engineers off guard during commissioning:

• IP address is irrelevant on PLCSIM. You can configure any IP in WinCC and PLCSIM will accept the connection as long as the rack/slot match. A physical PLC strictly validates the IP.
• Timing is not real-time on PLCSIM. OB1 cycle time is compressed or expanded depending on host CPU load. Polling intervals shorter than 100 ms can produce inconsistent reads.
• PLCSIM supports one online connection per instance in the older versions shipped with STEP 7 V5.5. If you have both SIMATIC Manager and WinCC Runtime attempting to connect simultaneously, one of them may be refused. PLCSIM V5.4+ supports multiple online connections, but verify with PLCSIM > Help > About.
• Diagnostic buffer entries are not persisted across PLCSIM restart. A "real" PLC keeps the diagnostic buffer for at least the last few power cycles.

Migration Note: Stepping Out of STEP 7 V5.x

The PG/PC interface concept applies only to the STEP 7 V5.5 / WinCC 7.4 (and older) toolchain. In the TIA Portal / WinCC Professional / STEP 7 V16+ environment, the equivalent configuration moves into the project under Devices & Networks > Online access, and the access point is created automatically when the device is added. Migrating a working STEP 7 V5.5 + WinCC 7.4 project to TIA Portal will not migrate the PG/PC interface state, and the same symptom (red handshake, disconnected) will appear if the new TIA project's online access is not configured. Treat the two toolchains as independent for PG/PC purposes even though the underlying protocol is unchanged.

FAQ