Resolving WinCC Flex 2008 RT Communication Failure with CP343-1 Lean

When a WinCC flexible 2008 Runtime (RT) station on a PC cannot establish a connection to a SIMATIC S7-300 CPU over a CP 343-1 Lean, the symptom is almost always the same: ping works, project compiles, RT starts, but the connection status stays red. The dominant root cause in the field is a slot-number mismatch in the HMI connection table. This article documents the exact configuration that works, the diagnostic steps that surface the failure, and the supporting software stack decisions (Simatic Net, PG/PC interface, system messages) that remove ambiguity during commissioning.

1. Problem Description

Reported scenario:

• Hardware: SIMATIC S7-300 station with a CPU 31x and a CP 343-1 Lean (6GK7343-1CX10-0XE0 family) on PROFINET/Industrial Ethernet.
• Software: WinCC flexible 2008 SP3 Runtime installed on an engineering/runtime PC.
• Network: PC and CP on the same subnet; ICMP echo (ping) from PC to CP IP address succeeds without packet loss.
• Symptom: WinCC flexible RT starts, no alarm is raised, but every HMI tag reports "connection failure" or "no communication". The status indicator in the RT header stays in the error state.

What is NOT the cause in most cases:

• The TCP/IP path. If ping works, layer 3 is healthy.
• The WinCC flexible project itself, provided it compiled and downloaded cleanly.
• The CP 343-1 Lean firmware, which boots independently of the connection state.

2. System Architecture

3. Root Cause Analysis

When the HMI connection in WinCC flexible is configured as a SIMATIC S7 connection over Ethernet, two parameters determine which S7 endpoint the HMI establishes the S7 protocol session with:

The S7 communication model is router-based at the CP level: the WinCC flexible HMI opens a TCP connection to the CP, and the CP routes the S7 frames to the CPU. The CP itself does not terminate the S7 application layer — the CPU does. The slot number therefore must identify the CPU module in the rack, not the CP module. If the HMI is told the CP is the S7 endpoint, the CP returns an S7 negative acknowledgment (typically 0x0A — object access not supported) and the connection never reaches the cyclic-data phase.

4. Required Software Stack

The default installation of WinCC flexible 2008 RT installs the S7ONLINE access point and the necessary NDIS/TCP/IP binding for the configured NIC. Simatic Net is not required for the S7-connection use case from a PC runtime to a CP 343-1 Lean on a flat subnet. This is consistent with the official Siemens FAQ for HMI/PC communication configuration, accessible at the Siemens Industry Online Support FAQ 24109937.

5. PG/PC Interface Configuration

Even with the slot number corrected, the connection still fails if the S7ONLINE access point is not bound to the correct physical NIC. This is the second most common root cause.

1. Open Start → SIMATIC → WinCC flexible 2008 → Set PG/PC Interface (or run the standalone SetPGPCInterface.exe shipped with Simatic Net).
2. In the Access Point dropdown, select S7ONLINE.
3. In the Interface Parameter Assignment Used list, locate the entry for the physical NIC connected to the S7-300 network. Typical descriptors:\code>
   • TCP/IP → <NIC name> (e.g., Intel(R) Ethernet Connection I219-LM)
   • Avoid TCP/IP (Auto) on multi-NIC PCs — it can bind to the wrong interface.
4. Confirm with OK. No PC reboot is required for the S7ONLINE change to take effect, but WinCC flexible RT must be restarted to pick up the new binding.

6. HMI Connection Configuration in WinCC flexible

Open the WinCC flexible project, navigate to Project → Connections, and double-click the S7 connection used by the RT. The relevant fields are:

After saving, regenerate the WinCC flexible RT image. If the project was compiled in WinCC flexible 2008 SP3, transfer the resulting .fwx runtime file to the runtime PC and start the RT loader.

7. When Simatic Net IS Required

There are legitimate cases where Simatic Net must be installed. Validate the use case against this matrix before deciding:

If Simatic Net is required, install a version compatible with WinCC flexible 2008. Simatic Net V8.1 SP1 or V8.2 is the last release that formally supports WinCC flexible 2008. Newer Simatic Net versions (V15.1 and later) are aligned with TIA Portal and do not ship the legacy S7DOS stack that WinCC flexible 2008 RT depends on.

8. Diagnostic Procedure

When the connection still fails after correcting the slot, run the diagnostic sequence below. It is ordered from cheapest to most informative.

1. Enable system messages in the WinCC flexible RT. In the project tree, open Project → Runtime → Settings → System Messages and enable the connection-status and tag-status event classes. Restart the RT and read the live message log. Typical messages include:
   • "Connection to PLC broken" — generic, check parameters.
   • "S7 error: 0x0A object access not supported" — wrong slot or wrong CPU.
   • "S7 error: 0x03 object does not exist" — wrong DB number or area boundary.
   • "S7 error: 0x05 address out of range" — tag address beyond CPU memory map.
2. Test with STEP 7 online diagnostics. If STEP 7 is available on the PC, open Accessible Nodes over the same NIC. The S7-300 station should appear with the CPU's MPI/PN address. If Accessible Nodes finds the CPU but RT does not connect, the issue is in the WinCC flexible configuration, not the network.
3. Wireshark capture on the PC NIC. Filter for siemens-s7 (port 102 ISO-TSAP traffic). You should see the RT opening a TPKT/COTP connection to the CP IP on TCP port 102, followed by an S7 Communication Setup PDU. If the RT is silent (no SYN), the S7ONLINE access point is misbound. If the RT opens the connection but receives a COTP DR (disconnect reject) with cause 0x0001, the slot is wrong.
4. Check the CP 343-1 Lean diagnostic LEDs on the physical module. The SF LED should be off. RUN LED steady green means the CP is operational. LINK LED on the integrated port shows physical link state.
5. Disable Windows Firewall for the test only. WinCC flexible 2008's S7DOS service uses TCP/102 and UDP broadcasts — if a third-party firewall is blocking either, the connection silently fails.

9. Verification Steps

1. Start the WinCC flexible RT on the PC. The status indicator in the RT header should turn from red to green within 10–30 seconds, depending on tag count and CP cycle time.
2. Open a tag inspection tool (WinCC flexible tag simulator or the RT's Tag Simulation overlay). Force a known bit in the S7-300 program and verify the corresponding HMI tag updates. This is the definitive test of bidirectional S7 communication.
3. Check the Connections status in the RT diagnostics window. All configured connections should report Connected with the partner IP and slot echoed back.
4. Trigger a CPU stop/run transition. The HMI should display a "PLC stopped" system message and resume polling within seconds of the CPU returning to RUN.
5. Save the project and back up the .fwx runtime file. Document the final slot/Rack/IP triplet in the project README so that future maintenance does not reintroduce the slot confusion.

10. Common Pitfalls and Edge Cases

11. Migration Note: WinCC flexible → TIA Portal

WinCC flexible 2008 is in the extended maintenance phase. New installations should consider migrating to TIA Portal (WinCC Comfort/Advanced) on the engineering side and a SIMATIC Panel or WinCC Runtime Advanced on the runtime side. The CP 343-1 Lean stays in place — only the HMI/PC side is modernized. During migration, the connection parameters (CPU slot, IP address) carry over unchanged, so the slot-vs-CP lesson remains valid.

If the migration target is TIA Portal V17 or later with a WinCC Runtime Professional on the PC, the access point mechanism is replaced by a configured HMI connection in the TIA project tree, and the legacy S7DOS service is replaced by the TIA runtime's built-in S7 stack. Simatic Net is still not required for the simple single-CPU case.

12. Summary

The fix is two lines in the WinCC flexible connection table: change the slot to the CPU slot, and keep the IP address pointing at the CP 343-1 Lean. Confirm the S7ONLINE access point is bound to the correct NIC, enable system messages, and verify with a tag-level read/write test. Simatic Net is not needed for this configuration. If the system messages still report an S7 error after these changes, capture a Wireshark trace on port 102 — the cause code in the COTP DR packet identifies the exact rejected parameter.