Resolving WinCC Professional V15.1 Remote Download Errors via VPN

When an engineering station that was originally commissioned inside the plant network is relocated to a remote office and reconnected through a VPN tunnel, the TIA Portal download sequence to a WinCC Professional V15.1 redundant server pair frequently fails with a non-obvious alarm referencing the SCS adapter on the redundant station. The PLC portion of the download still works, but the WinCC RT Professional portion halts before any project data is transferred. This article walks through the full diagnostic and remediation path for that scenario, including the official Siemens FAQ entry SIOS entry 108464289 and the loading-settings reference SIOS entry 88780011, the most current TIA Portal V20 documentation for downloading to the server (RT Professional) (procedures are forward-compatible with V15.1), and field-proven routing and name-resolution fixes.

1. Problem Description

The reference system is a small but typical WinCC Professional V15.1 multi-station architecture:

• 2 x WinCC Server (redundant pair) running Windows Server 2016, with WinCC RT Professional V15.1 (license: WinCC RT Professional (RC) with the redundant option).
• 2 x WinCC Client stations on Windows Server 2016.
• 1 x SIMATIC S7-1517 CPU (firmware V2.6 or higher recommended for V15.1 engineering).
• 2 x CP 1543-1 Ethernet communication processors for the plant network.
• 1 x Engineering Station (ES) with TIA Portal V15.1, originally on the plant LAN.

Observed behavior:

• Direct LAN access from ES: download of PLC programs and WinCC graphics to both server 1 (192.168.44.196) and server 2 (192.168.44.197) works with path \\Srv1\winccprojects.
• VPN access from ES (Cisco AnyConnect) over the office Internet link: PLC online view, program download, and HMI tag browsing succeed, but the WinCC RT Professional Download to device > Software (entire project) sequence aborts.
• Symptoms include: TIA Portal prompts "Verify that the SCS adapter on the redundant station are correctly configured", the Simatic Shell dialog does not enumerate the remote server pair, and \\192.168.44.196\winccprojects from the ES returns the same alarm.

The PLC tunnel works because S7ONLINE uses a direct TCP/UDP channel to the CPU or CP that any IP-routed session can reach. The WinCC download path, in contrast, relies on the SIMATIC Communication Services (SCS) and on Windows file-sharing plus WinCC-internal OPC channels that are sensitive to NetBIOS, SMB signing, and route metrics.

2. Root Cause Analysis

Three independent conditions combine to produce the error. Each must be eliminated in order.

2.1 The SCS adapter is not bound to the VPN interface

SCS is the Windows service that brokers WinCC download and runtime traffic between TIA Portal and the WinCC RT stations. It is implemented by S7TraceSrv.exe and a virtual Ethernet adapter named Siemens SIMATIC Communication Services. On the redundant server, the SCS adapter must be installed and its IPv4 address must belong to the same subnet the engineering station uses to reach that server. When the ES is moved off the plant LAN onto a VPN client adapter (for example, the AnyConnect virtual adapter 10.x.x.x), the SCS adapter on the server is still bound to 192.168.44.x and is not reachable on the VPN-assigned subnet. TIA Portal therefore cannot establish the SCS handshake and raises the adapter alarm.

2.2 The engineering station's network identity changed

Inside the plant the ES used a static IPv4 address. Through the VPN the same machine is now a DHCP client of the AnyConnect gateway. Several WinCC-side checks reference the ES machine name and the original IP:

• Simatic Shell enumerates stations by NetBIOS/broadcast on the local subnet. A remote subnet visible only through a routed VPN will not answer broadcast, so the server pair simply does not appear.
• The WinCC download path \\Srv1\winccprojects requires NetBIOS name resolution for Srv1. If the VPN client only learns the server IP (via push routes) but not its NetBIOS name, TIA Portal cannot expand the UNC path.
• Some V15.1 WinCC installations pin the SCS adapter to the original IP of the ES. After a DHCP re-address, the cached binding is stale.

2.3 Firewall and SMB policy block the file-share channel

Even when SCS responds, the actual project files are written through SMB (TCP 445) to the winccprojects share. Most enterprise VPN concentrators and Windows firewall defaults block inbound SMB from the VPN pool. The error text does not change; TIA Portal still blames the SCS adapter because the first failed step in the chain is the SCS handshake.

3. Prerequisites for a Working Remote Download

Confirm every item below before the first VPN download attempt. The list mirrors SIOS entry 108464289 extended for a VPN scenario.

4. Step-by-Step Resolution

4.1 Configure the PG/PC interface for VPN

1. Open Control Panel > Set PG/PC Interface on the ES.
2. Under Access point S7ONLINE, select the virtual AnyConnect adapter (for Cisco it is typically AnyConnect VPN Virtual Miniport Adapter) or, if you tunnel only WinCC traffic through a split-tunnel, select the LAN adapter with parameter assignment TCP/IP (Auto).
3. Click Diagnostics > Test to confirm a successful S7 broadcast to 192.168.44.196 and 192.168.44.197.

4.2 Repair the SCS adapter on the redundant server pair

The SCS adapter is installed by the TIA Portal Setup under SIMATIC Communication Services. If its IP no longer matches the LAN, reassign it on each server:

1. Open ncpa.cpl.
2. Open properties of Siemens SIMATIC Communication Services.
3. Set IPv4 to a static address in 192.168.44.0/24 that does not collide with the physical NIC.
4. Reboot the server. SCS binds to the IP at boot.

If the adapter is missing, run \\SupportDisk\Setup\SCS\setup.exe from the TIA Portal V15.1 installation media on the server, then reboot.

4.3 Adjust the loading path in TIA Portal

For RT Professional, the download path is configured per project tree node, not in PG/PC. Per the TIA Portal documentation for downloading the project to the server (RT Professional):

1. In the project tree, right-click WinCC Server > WinCC RT Professional.
2. Choose Download to device > Software (entire project).
3. In the Extended download dialog, click Configure under Path of the project directory on the target computer.
4. Replace \\Srv1\winccprojects with the IP-based UNC path \\192.168.44.196\winccprojects (and repeat for server 2 with \\192.168.44.197\winccprojects).
5. Enable Use IP address from the routing device if you are crossing a routed VPN that exposes the servers only by IP.

For a redundant server pair, TIA Portal V15.1 stores the path in the project under Common data > WinCC projects and applies it to both servers. If only the primary server is reachable from the VPN, the path will be marked red and the SCS adapter alarm will trigger as a secondary symptom. Always re-test both paths after any IP change.

4.4 Restore name resolution across the VPN

Simatic Shell relies on UDP 137/138 broadcasts limited to the local subnet. Across a routed VPN you need unicast name resolution. Apply the following on the ES and both servers:

1. Open ncpa.cpl > LAN adapter advanced properties > WINS.
2. Add the static IP of the other two stations (or of a WINS server if the plant has one). On a two-server plus one-ES plant without WINS, add the IP of each remote machine manually.
3. Open ncpa.cpl > LAN adapter advanced properties > TCP/IPv4 > Advanced > WINS > Enable NetBIOS over TCP/IP.
4. Reboot each machine.

After this change, Start > SIMATIC > Simatic Shell on the ES will enumerate the server pair within a few seconds, and \\Srv1\winccprojects will resolve through the WINS/NetBIOS unicast channel.

4.5 Open SMB and SCS ports through the VPN firewall

On the Windows firewall of each server, allow the following inbound rules scoped to the VPN remote network (typically the AnyConnect pool, e.g. 10.10.0.0/16):

• TCP 445 (SMB) - File and Printer Sharing (SMB-In).
• UDP 137, 138 (NetBIOS name service, datagram).
• TCP 139 (NetBIOS session) if you keep legacy NetBIOS enabled.
• TCP 102 (S7ONLINE) and the SCS dynamic port range (default 49152-65535, sometimes narrowed to 50000-50100 in Siemens setup).

On the Cisco AnyConnect side, configure a split-tunnel that includes the plant subnet and a client firewall rule that does not block SMB outbound. SMB is a common block target for corporate VPNs; if you cannot change the policy, consider an RD Gateway or an HTML-access remote maintenance approach (Siemens Sm@rtServer option on the WinCC client) instead of a direct file share.

4.6 Address the DHCP change on the ES

If the ES obtained its IP via DHCP from the AnyConnect gateway, two side effects are common:

• The SIMATIC WinCC Explorer on the engineering station tries to bind to its old IP and may not start cleanly. Restart WinCC Explorer or the entire TIA Portal.
• Some V15.1 builds cache the SCS adapter's idea of the ES IP in %ProgramData%\Siemens\Automation\WinCC\RT Professional\<project>\station.ini. After moving the ES, delete this file (it is regenerated on first download) or use the Station configurator to reinitialize.

If your office policy allows it, assign a static IP in the AnyConnect pool range to the ES so the SCS binding is stable. If not, document the lease time and warn the operator that any address change forces a full WinCC re-download.

5. Verifying the Fix

Run the following checks in sequence. Each must pass before the next is attempted.

1. ICMP: From the ES, ping 192.168.44.196 and ping 192.168.44.197 both succeed.
2. Name resolution: nslookup Srv1 192.168.44.196 (or nbtstat -a Srv1) returns the server IP.
3. SMB share: net view \\Srv1 lists winccprojects. Open it in Explorer and verify write permission by creating a temp file.
4. Simatic Shell: Both server icons appear within 30 seconds.
5. SCS handshake: In TIA Portal, open Online > Accessible nodes. Both WinCC RT stations appear with the SCS adapter type, not as unknown.
6. Dry-run download: In the project tree, right-click the WinCC Server node and select Download to device > Software (only changes). Confirm that TIA Portal reports the version on the server, the redundant partner's status, and starts the transfer.
7. Runtime integrity: After the download, the WinCC RT process CCECSvrRT.exe restarts automatically. Verify that both clients reconnect and the redundant partner takes over the project.

6. Simatic Shell Discovery Across Subnets

Simatic Shell (SS7Shell.exe) uses two discovery mechanisms:

• Local broadcast on UDP 137/138 limited to the directly attached subnet.
• SCS directory maintained by the SIMATIC Communication Services on the engineering station. The directory is populated from prior online sessions.

Over a routed VPN only the second mechanism will find the servers. To populate the SCS directory manually:

1. Open Start > SIMATIC > Station configurator.
2. Click Stations > Add station and enter the IP of server 1 and server 2 with their WinCC project name.
3. Apply. Simatic Shell now displays both stations regardless of broadcast reachability.

The Station Configurator and the SCS adapter IP are documented in detail in SIOS entry 108464289, which also describes the TIA Portal Loading settings that SIOS entry 88780011 details. Treat both entries as the canonical reference for any V15.1 remote download case.

7. Alternative Connection Strategies

When the VPN cannot be opened for SMB (the most common cause of repeated failure), three production-grade alternatives exist. Each is fully supported by TIA Portal V15.1 and WinCC RT Professional.

7.1 Sm@rtServer on the WinCC client

Each WinCC client in this architecture can host a Sm@rtServer. The ES opens the WinCC client via HTTPS in a browser, performs the visual check, and pushes the modified HMI page through the Sm@rtServer channel. This avoids SMB entirely and works over corporate HTTPS-only VPNs.

7.2 Remote Desktop Gateway plus local TIA Portal

Provide the ES a Remote Desktop session into a dedicated engineering workstation inside the plant. The remote machine is on the plant LAN, so all checks above revert to the original local-LAN values. SMB, SCS, and NetBIOS behave normally. The only network requirement is RDP (TCP 3389) plus UDP 3389 for the gateway.

7.3 S7-1500 Webserver and TIA Portal Project-Server

Publish the project to a TIA Portal Project Server inside the plant. From the VPN, the ES connects to the Project Server over HTTPS, checks out the project, edits locally, and checks it back in. The actual WinCC download is then triggered from a plant-resident ES that has the correct network identity. This pattern scales to multiple remote engineers.

8. Troubleshooting Matrix

9. Long-Term Hardening

Once the immediate alarm is resolved, treat the remote-maintenance path as a permanent subsystem and lock down its parameters.

• Static addressing on the engineering station. Configure the AnyConnect client to release the same address to the ES host MAC, or assign a static IP inside the AnyConnect pool. The SCS adapter assumes a stable ES IP.
• Dedicated VPN user. Use a named VPN account for the ES only, with split-tunnel limited to 192.168.44.0/24 and the gateway IP. Avoid general remote-access users that bring in different routes.
• Scheduled NTP. All WinCC RT stations, the engineering station, and the domain controller (or workgroup master) must share a common time source. Skew of more than 5 minutes is a known cause of secondary download failures that present as SCS adapter errors.
• Backup the SCS configuration. After a successful configuration, export the SCS adapter settings and the Station Configurator entries to a project-archive. Recovery from a server rebuild then takes minutes instead of hours.
• Document the path string. Save the exact UNC path (server name or IP, share, project folder) in the project documentation. Operators who later type \\Srv1\winccprojects from a VPN may forget to add the IP form.

10. Field Notes and Caveats

• V15.1 is the engineering floor for this system. TIA Portal V16, V17 and V18 can open V15.1 projects read-only or with an upgrade prompt, but the WinCC RT must match the engineering version. Mismatched V15.1 ES with V16 RT is the single most common cause of the SCS adapter alarm in the field.
• The Cisco AnyConnect MTU default of 1406 is acceptable for SCS. If you lower it below 1380 to support double-encapsulation, large WinCC project transfers will fragment and stall. Match the VPN MTU to the LAN MTU minus VPN overhead (typically 50-80 bytes for IPsec/SSL).
• Symmetric routing is required. If the AnyConnect tunnel pushes a default route that overrides the LAN default gateway, the SCS adapter on the server may receive packets from a different source IP than TIA Portal expects, and the SCS handshake will silently fail. Verify with tracert 192.168.44.196 from the ES.
• Do not edit station.ini by hand unless the SIOS article explicitly instructs you to do so. The file is rewritten at every RT start; manual edits are lost and can corrupt the redundant configuration.

11. Summary of the Working Configuration

With all checks above applied, the engineering station connects from the office over Cisco AnyConnect, the SCS adapter on each server is bound to the plant subnet, the WinCC download path is expressed as \\192.168.44.196\winccprojects and \\192.168.44.197\winccprojects, NetBIOS and SMB are open to the VPN pool, and TIA Portal can download modified WinCC graphics to both servers without raising the SCS adapter alarm. The PLC portion of the download is unaffected because S7ONLINE uses its own independent TCP channel that does not depend on the SCS adapter, the WinCC share, or NetBIOS.

For further reading, refer to the canonical Siemens support entries SIOS 108464289 and SIOS 88780011, and to the TIA Portal documentation page Downloading the project to the server (RT Professional). Verify all parameters against the documentation that ships with the exact TIA Portal V15.1 Update installed on the engineering station.

FAQ