Resolving WinCC Communication Failure with PLCSIM in PCS7

When running an all-in-one PCS7 demo project (ES, OS, and PLCSIM on a single engineering station) and the WinCC runtime displays red wrench icons in the picture instead of live process values, the root cause is almost always a mismatch between the configured S7 connection type and what PLCSIM can actually accept as a transport. This article walks through diagnosis and remediation of that exact failure mode, using the Getting Started "Color_GS" project as a reference architecture.

1. Problem Description

After loading the SIMATIC PCS7 Getting Started "Color_GS" project, building the AS program in S7-PLCSIM, performing an OS "Configure" pass, and compiling the OS, the operator screen opens with red wrenches (g) overlaid on the dynamic objects. The picture tree is built, the symbols compile, and no syntax errors are reported, yet no tag updates occur.

Typical symptoms observed in this configuration:

• Red wrenches appear on every faceplate, status display, and group display
• WinCC Explorer does not list any active connection state in Tag Management > SIMATIC S7 PROTOCOL SUITE
• PLCSIM indicates an IP address that matches the NetPro connection entry, but the OS runtime never establishes a session
• Online diagnostics via Start > SIMATIC > WinCC > Tools > Channel Diagnosis report "Connection not established" or "Error 0xFFFE"
• The PCS7 OS does not need to be downloaded because it runs locally on the ES, but the runtime still cannot reach the simulated AS

2. Root Cause Analysis

There are two distinct connection mechanisms that WinCC can use to reach a SIMATIC S7 station. The runtime behavior with PLCSIM is fundamentally different for each, and choosing the wrong one is the single most common cause of red wrenches in a fully virtualized PCS7 project.

2.1 Named Connection vs. S7 Connection

PLCSIM emulates a CPU and its PROFINET/Ethernet interfaces, but it does not implement the full S7ONLINE symbolic resolution layer required for a Named Connection to be resolved at runtime. The result is a silent handshake failure: WinCC tries to open a session, the S7DOS helper returns "partner not found," and the runtime falls back to the red-wrench placeholder display.

2.2 PG/PC Interface Mismatch

Even when the correct S7 Connection is selected at OS compile time, the channel unit on the WinCC side opens the TCP socket using the PG/PC interface that the OS process was started with. If the S7DOS / Set PG/PC Interface is set to a physical NIC that is down, or to a different virtual adapter than PLCSIM is bound to, the channel will fail to reach the loopback / Softbus address. The S7ONLINE helper then reports a transport error (often 0x000A or 0x0001) and the connection is marked broken in Channel Diagnosis.

3. Affected Versions and Components

4. Preconditions for a Working Virtual Demo

Before touching any settings, verify that the following four items are all true. If any one is missing, no amount of WinCC configuration will establish the link.

1. PLCSIM is running with a powered-up CPU: The PLCSIM window must show RUN or RUN-P, and the SF/BF LEDs must be off. If SF is on, fix the AS program first; WinCC cannot help.
2. The AS has a valid IP address: Open PLCSIM and read the IP from the Ethernet interface dialog. Typical demo address is 192.168.0.1 with subnet 255.255.255.0. Note the rack/slot (default 0/2 for an AS 410).
3. The NetPro connection exists and is downloaded to PLCSIM: Open NetPro, double-click the S7 connection between the WinCC station and the AS, confirm the partner IP matches the PLCSIM address, then PLC > Download to Target Station > ... (select the PLCSIM instance).
4. The OS project was compiled after the connection was last changed: OS > Compile OS with the All scope, and select the correct S7 connection name (not "Named Connection") in the dialog.

5. Step-by-Step Resolution

5.1 Set the OS Compile Mode to "S7 Connection"

During the OS compile, the dialog will offer two options for the connection type used in the generated tags:

1. In SIMATIC Manager, right-click the OS (e.g. OS(1)) and choose Compile OS.
2. On the Connections tab, ensure the radio button S7 Connection is selected (not Named Connection).
3. From the dropdown list, choose the S7 connection that points to the simulated AS (the one you defined in NetPro).
4. Click Compile and wait for the success message. Watch for warnings such as "Connection could not be assigned" - these indicate the dropdown is still pointing to a Named Connection.

5.2 Configure the WinCC Channel to Use the Correct PG/PC Interface

This is the step that most often fixes the red-wrench symptom in a fully virtual station.

1. Close WinCC Runtime (right-click the WinCC Explorer tray icon and choose Stop Runtime).
2. Open Start > SIMATIC > STEP 7 > Set PG/PC Interface (also accessible from the Windows Control Panel under Set PG/PC Interface).
3. In the Interface Parameter Assignment Used dropdown, select S7ONLINE (STEP 7) > TCP/IP > <your virtual NIC>. For a pure PLCSIM demo this is typically:
   • TCP/IP (Auto) > <Realtek / Intel NIC> if PLCSIM is bridged to the host NIC, or
   • TCP/IP > PLCSIM Virtual Ethernet Adapter if PLCSIM V5.5 exposes a dedicated adapter.
4. Click OK to commit.
5. Open WinCC Explorer. In the tree, navigate to Tag Management > SIMATIC S7 PROTOCOL SUITE > TCP/IP.
6. Right-click TCP/IP and select System Parameter > Unit tab. Set the Logical device name to the same interface you chose in step 3 (e.g. TCP/IP.TCPIP.1). Click OK.
7. Open the connection (e.g. AS1) and confirm on the Connection Properties dialog:
   • IP Address = the PLCSIM IP
   • Rack = 0, Slot = 2 (or whatever PLCSIM is configured to)
   • Connection Name = the S7 connection from NetPro

5.3 Match the Connection Inside the WinCC Project

The previous steps make the channel aware of the transport. The runtime still needs to be told which WinCC-internal connection corresponds to the compiled S7 connection. This is done in WinCC Explorer's Tag Management:

1. Open WinCC Explorer.
2. Browse to Tag Management > SIMATIC S7 PROTOCOL SUITE > Industrial Ethernet (or TCP/IP if you did not configure IE explicitly).
3. You will see one or more connections (e.g. OS(1)_Connection_1). Right-click and choose Properties.
4. On the Connection tab, set:
   • Station Address = the PLCSIM IP (for IE) or the IP/TSAP pair (for TCP)
   • Access Point = the logical device from step 5.2
5. Click Test Connection. A successful test reports "Connection established to partner."

5.4 Start PLCSIM Before the WinCC Runtime

Race conditions between PLCSIM startup and WinCC Runtime startup are an underestimated source of intermittent red wrenches. The recommended start order on an all-in-one demo station is:

1. Boot Windows, log on as the engineering user.
2. Open SIMATIC Manager and the project.
3. Start PLCSIM, download the AS program, switch to RUN-P.
4. Wait 5-10 seconds for the simulated PROFINET stack to come up.
5. Start the WinCC Runtime (either via the OS picture window hotkey, or via Windows Start > SIMATIC > WinCC > WinCC Runtime).

If the runtime is started first, it will mark the connection as broken until the next reconnect interval (default 30 s). Force an immediate reconnect with Channel Diagnosis > Connection > Reconnect.

6. Verification

After applying the four corrective steps, the red wrenches should clear within 5-15 seconds. Use the following checks to confirm a clean state:

6.1 Channel Diagnosis

From WinCC Explorer, Tools > Channel Diagnosis. The connection should show status Connected (OK) with the last successful read/write timestamp. If status is Disconnected, expand the entry for the exact error code (see Section 8).

6.2 Tag Simulation

Open a faceplate, right-click any input field, choose Tag properties, and click Update. A live value from PLCSIM should appear within 200 ms.

6.3 Trend Group Display

Insert a WinCC Online Trend Control and bind it to a tag in the simulated AS (e.g. Color_GS/MOT_SPEED). The trend curve should begin drawing immediately. A flat line at zero with a red wrench indicates the connection is up but the tag address is wrong - re-check the AS symbol export.

6.4 Alarm Line Test

Force a process value in PLCSIM (e.g. set an analog input to a high-limit value). Within one WinCC acquisition cycle (default 1 s) the message line at the top of the OS picture should display the configured alarm text. If the message line stays blank, the alarm channel is broken even if the process-value channel works.

7. Error Code Reference

8. Common Pitfalls and Field Notes

8.1 Mixed Connection Types Within One Project

It is possible to have a S7 Connection configured for the process-value channel and a Named Connection left over from an earlier compile for the alarm channel. WinCC will use whichever connection is referenced in the compiled tag DB. If part of the OS updates and part does not, look for connection mismatches across the Tag Management > SIMATIC S7 PROTOCOL SUITE sub-trees (TCP/IP, Industrial Ethernet, Named Connections).

8.2 WinCC Explorer vs. NetPro Priority

Changes made in WinCC Explorer's Tag Management > Connection Properties take effect immediately at runtime. Changes made in NetPro only take effect after a NetPro download and an OS recompile. When troubleshooting, always edit the WinCC side first - it is the lower-risk path because it does not break the NetPro/AS configuration.

8.3 Softbus vs. Real TCP

PLCSIM V5.x can operate in two modes: bound to the host's real TCP/IP stack (default) or via the internal Softbus (legacy, only useful when no NIC is installed). Softbus is not addressable from a separate process. For an all-in-one demo, always use the real TCP/IP mode and bind the connection to a loopback or host-visible address.

8.4 Demo Project Reference

Siemens publishes a set of use-case oriented WinCC demo projects (including a "Communication" package) that come with preconfigured S7 connections, working NetPro layouts, and known-good channel parameters. The current V7.4 SP1 set is available at the Siemens Support portal:

Demo project for SIMATIC WinCC V7.4 SP1 - ID 109482515

Use these projects as a baseline: open the project, verify the connection in WinCC Explorer, then compare against your own project's Tag Management > SIMATIC S7 PROTOCOL SUITE settings. Any difference is a candidate root cause.

8.5 Windows Firewall and Antivirus

Third-party endpoint protection products will silently block TCP/102 (ISO-TSAP) or TCP/UDP 5001-5007 (used by the S7DOS helper) if not whitelisted. On a freshly imaged demo station, temporarily disable the third-party product to confirm whether it is the cause. The native Windows Defender Firewall is generally benign toward CCAlgCS.exe, CCExplorer.exe, and S7DOS64.exe in the default PCS7 install.

8.6 Demo Project Color_GS Specific

The "Color_GS" Getting Started project is built around an AS 410 with three CFCs (COLOR_MIX, TANK_FILL, TANK_DRAIN) and one SFC. The OS is a single-user station with four overview pictures. The preconfigured S7 connection name is S7-Verbindung_1. If your project shows a different name (e.g. after a SIMATIC version migration), the OS compile dialog will not pre-select it; you must choose it manually from the dropdown.

9. Diagnostic Flowchart

Use this decision tree when red wrenches appear. Each node links back to the section in this article that contains the fix.

1. Is PLCSIM in RUN-P with no SF/BF?
   • No → Fix the AS program; download again. Section 4 item 1.
   • Yes → Continue.
2. Does the IP in PLCSIM match the IP in the NetPro S7 connection?
   • No → Re-configure NetPro, download to PLCSIM. Section 4 item 3.
   • Yes → Continue.
3. Was the OS compiled with "S7 Connection" selected (not "Named Connection")?
   • No → Re-compile OS with the correct selection. Section 5.1.
   • Yes → Continue.
4. Does the Set PG/PC Interface point at the same virtual NIC as PLCSIM?
   • No → Re-set the PG/PC interface. Section 5.2.
   • Yes → Continue.
5. Does the WinCC Tag Management connection's Station Address and Access Point match the runtime transport?
   • No → Edit connection properties in WinCC Explorer. Section 5.3.
   • Yes → Continue.
6. Does Test Connection in WinCC Explorer report success?
   • No → Cross-check Channel Diagnosis error code against Section 7.
   • Yes → Done. The red wrenches should clear within 15 seconds.

10. Related Configuration: Alarm Channel and Archive Channel

The above procedure restores the process-value channel. Two additional channels must be configured in parallel for the full OS to function:

11. Verification Checklist

Use this list as a final sign-off before declaring the demo project fit for training or sales use:

• [ ] PLCSIM is in RUN-P, SF/BF off, CPU diagnostic buffer is clean
• [ ] NetPro S7 connection partner IP matches the PLCSIM IP byte-for-byte
• [ ] NetPro has been downloaded to PLCSIM after the last IP/TSAP change
• [ ] OS was compiled with "S7 Connection" selected, and the S7 connection name is the one defined in NetPro
• [ ] Set PG/PC Interface = the virtual NIC that PLCSIM is bound to
• [ ] WinCC Tag Management connection properties: Station Address, Rack, Slot, Access Point all match
• [ ] Channel Diagnosis reports "Connected (OK)" for the process-value, alarm, and archive channels
• [ ] Faceplate inputs accept operator commands and write back to PLCSIM (read/write round trip)
• [ ] An alarm triggered in PLCSIM appears in the OS message line within 2 s
• [ ] A trend inserted into the OS begins drawing on a forced process value change
• [ ] A power-cycle of the WinCC Runtime establishes the connection without manual intervention (auto-reconnect works)

12. FAQ