Resolving WinCC RT Professional V16 S7-1200 Connection Failures

Problem Overview

A WinCC Runtime Professional V16 station running on a dedicated PC or virtual machine periodically drops connections to a subset of its 20 S7-1200 PLC targets after RT Start or after launching the WinCC Simulation. The exact number of dropped connections is non-deterministic — anywhere from a few to the majority of the 20 PLCs may show Connection Failed in the runtime diagnostics immediately after launch. The connections are restored cleanly the moment the operator runs Accessible Nodes in the TIA Portal Engineering client on the same PC, or as soon as the engineering client touches the S7-1200 PROFINET interface via an online operation.

This symptom pattern is characteristic of a missing or unlicensed SIMATIC NET PC Software stack beneath WinCC RT Professional. Without the licensed SIMATIC NET transport, the WinCC S7 channel cannot hold persistent S7 connections to multiple controllers; the S7 protocol is being negotiated on demand and torn down between runtime cycles. The engineering client's Accessible Nodes operation works around the failure because the TIA Portal installation ships its own transient S7 driver for online operations — but it is not a substitute for the licensed runtime transport that WinCC RT Professional requires.

Affected Versions, Components, and Topology

Root Cause Analysis

There are five root-cause classes that produce the described "drops on start, recovers after Accessible Nodes" symptom. They should be ruled out in the order below because the first is overwhelmingly the most common in field incidents.

1. SIMATIC NET PC Software Not Installed or Not Licensed on the RT PC

WinCC Runtime Professional does not include a licensed S7 transport. It depends on SIMATIC NET for the OPC UA / S7 channel DLLs (NSL, S7ONLINE, CP-1616/PC-IE drivers). On the Engineering Station the TIA Portal installer drops a transient version of those DLLs to support online operations, which is exactly why Accessible Nodes temporarily restores connections. On a dedicated RT PC without TIA Portal installed, there is no such fallback, so the S7 channel of WinCC either fails to bind or binds in a degraded mode that only supports a small number of connections.

Identifying evidence:

• Service S7DOS Help Service (or S7 DOS) is missing from services.msc.
• Folder C:\Program Files\Siemens\Automation\SimaticNet does not exist on the RT PC.
• Configuration Console ("SIMATIC NET Configuration Console" start menu entry) is absent.

2. Missing or Wrong Softnet S7-1200/1500 License

Each active S7 connection from a PC station to an S7-1200 or S7-1500 requires one SOFTNET-S7 runtime license (per connection, not per PLC). The WinCC RT Professional install ships with the WinCC license; it does not ship SOFTNET-S7 runtime keys. The relevant catalog numbers are:

For a 20-PLC system you need at least 20 SOFTNET-S7 connections of an appropriate tier. If only the bundled "8 connections" allowance is active, the 9th and subsequent connections will silently fail to bind — which matches the "some PLCs work, others don't" pattern.

3. S7-1200 Connection Resource Exhaustion (3-Connection Per-CPU Limit)

Each S7-1200 CPU provides only 3 passive S7 connection resources for HMI/PG communication (the number is fixed in firmware and cannot be raised by hardware). Any other HMI panel, the engineering client, and each WinCC connection counts against this limit. If a station has 1 PG + 1 HMI Panel + 2 WinCC connections, the S7-1200 will refuse the next connection request with S7 error W#16#0003 "Object already exists / no resources" on the CPU diagnostic buffer.

This is the second most common cause of "some PLCs connect, others don't". Identify it by reading the S7-1200 diagnostic buffer via TIA Portal Online & Diagnostics > Diagnostics Buffer.

4. Firewall, Antivirus, or DCOM Hardening on Windows Server 2016

SIMATIC NET uses ISO-on-TCP (port 102) and the S7DOS Helper Service (port ranges dynamically allocated by DCOM/OPC). The user reports firewall is disabled, but server-class antivirus suites (Symantec Endpoint Protection, McAfee ENS, Trend Micro Apex One, Windows Defender with Server hardening) frequently re-enable filtering for svchost.exe hosts that own the S7DOS service. SIMATIC NET V16 added a hardened installer that registers the required Windows firewall rules, but only if Windows Firewall service is running.

5. PC Station / Index Mismatch Between TIA Project and RT PC

If the PC Station in the TIA Portal project is configured against a different Configuration Console index than the one physically installed on the RT PC (e.g. project is built for "PC Station 1 / Index 2" while the RT PC's Configuration Console shows "Index 1"), the S7 connections will not bind at startup but will appear valid after the engineering client reconnects.

Step-by-Step Resolution Procedure

Perform the steps below on the dedicated WinCC RT PC. Do not skip the verification step between phases.

Phase A — Confirm the Stack

1. Open services.msc as Administrator. Confirm the presence of:
   • S7DOS Help Service (Siemens S7 DOS Helper Service)
   • SIMATIC NET Configuration Service
   • SIMATIC NET OPC Server (only if OPC DA/UA bridging is used)
   If absent → SIMATIC NET PC software is not installed.
2. Open C:\Program Files\Siemens\Automation\SimaticNet\bin. The following DLLs must be present:
   • NSL__s.dll (Network Sub-Layer)
   • S7ONLI~1.DLL (S7 Online DLL)
   • SNMPSrv.dll
3. Open Start > Siemens Automation > SIMATIC NET > Configuration Console. Confirm at least one network adapter is bound to S7ONLINE access point.

Phase B — Install or Repair SIMATIC NET V16

1. Insert the SIMATIC NET V16 DVD (it ships in the same package as WinCC RT Professional V16). If you downloaded the installer, launch SIMATIC_NET_PC_Software_V16_Setup.exe.
2. Choose Install > Complete. The complete install registers the Windows Firewall rules and the S7DOS service.
3. Reboot the PC. The S7DOS service must be Started and Automatic before WinCC RT starts.
4. Launch Automation License Manager > Start > Siemens Automation. The license key USB or the license server should display the SOFTNET-S7 keys. If none are visible, transfer the keys from the supplied license USB stick.

Phase C — Align the PC Station Configuration

1. In the TIA Portal project, open the Devices & Networks editor and select the PC Station.
2. In Properties > Communication > S7 Connections, confirm each S7-1200 has a dedicated S7 connection object. Set the connection resource on the S7-1200 to 3 (default) and the local end to S7ONLINE.
3. Compile the PC Station (Right-click > Compile > Software (rebuild all)).
4. Download the PC Station to the RT PC via Online > PC Station > Download to Target System. Use the same index that appears in the Configuration Console on the RT PC (typically Index 1 for a single PC station).

Phase D — Rebalance the S7-1200 Connection Resources

1. For every S7-1200 CPU in the project, open Properties > Communication > Connection Resources.
2. Confirm that the total number of active connections (engineering + HMI + WinCC) does not exceed 3.
3. Where multiple HMI clients must talk to a single S7-1200, raise the number using the following parameter in the CPU's Protection & Security > Connection Mechanisms for firmware V4.4 and later:

   // S7-1200 V4.4+ data block parameters (read-only diagnostic)
   "MaxPassiveConnections" := 3;  // S7-1200 hardware limit
   "ActiveConnections"      := 0;
   

   If you truly need more, switch to S7-1500, which provides 16–64 passive connections depending on CPU.

Phase E — Harden Windows Server 2016

1. Confirm the Windows Firewall service is Running (even if the firewall is "off"). Some AV suites will not register exceptions if the service is disabled.
2. Add explicit inbound rules to the SIMATIC NET executables:

   Program:  C:\Program Files\Siemens\Automation\SimaticNet\bin\s7dos.exe
   Protocol: TCP  Local Port: 102  Direction: Inbound  Action: Allow
   Program:  C:\Program Files\Siemens\Automation\SimaticNet\bin\s7oiehsx.exe
   Protocol: TCP  Local Ports: 49152-65535 (dynamic DCOM range)
   

3. Add the SIMATIC NET install directory and the WinCC RT directory to the AV exclusion list. Do not exclude the entire C:\ root.
4. Disable Randomized ADAM (RPC port allocation) via netsh int ipv4 set dynamicport tcp start=49152 num=16384 so that OPC bridging uses a known port range.

Phase F — Update WinCC RT Professional

Install every released update for WinCC RT Professional V16. As of the latest available update set, the cumulative package addresses a known S7 channel bug where the channel fails to re-bind dropped connections after RT Start when more than 8 connections are configured and only Softnet Lean licensing is in use. The update is published in the Siemens Industry Online Support portal under entry ID 109769627 as "Updates for WinCC Runtime Professional V16".

Verification Procedure

After applying the resolution steps, verify the fix with the following checks. All three must pass before declaring the issue closed.

Verification 1 — Channel Diagnosis Tool

1. On the RT PC, launch Start > Siemens Automation > Channel Diagnosis.
2. Select S7 Channel > Connect and enter the IP address of each S7-1200 in turn.
3. Each connection should report Status: Connected within 1 second on the first attempt, with no retry loops. If any connection requires > 3 attempts or reports Resource error, the S7-1200 is exhausted (Phase D).
4. Save the log to C:\ProgramData\Siemens\CoRtHmiRT\ChannelDiagnosis.log and attach it to the change record.

Verification 2 — Runtime Connection Monitor

1. Start WinCC Runtime Professional.
2. Open WinCC Explorer > Connections > Right-click > Connection Status. All 20 entries must show a green status indicator.
3. Leave Runtime running for a minimum of 24 hours. Re-check the status. No connection should drop below Established state for more than one polling cycle.

Verification 3 — Stress Test

1. Stop and restart WinCC Runtime 10 times in succession (script: net stop "CCAgentSvc" & net start "CCAgentSvc").
2. After each restart, confirm that all 20 connections come up without operator intervention (no Accessible Nodes workaround).

Channel Diagnosis Log Reference

Connection Sizing Cheat Sheet

Use the matrix below as a quick reference when sizing licenses and PC capacity. The per-CPU column is the hard ceiling imposed by the S7-1200 hardware; the per-PC column is the licensing ceiling imposed by SOFTNET-S7.

Common Field-Proven Pitfalls

• Installing SIMATIC NET on the Engineering PC but not the RT PC. The two stacks are independent. SIMATIC NET must be installed and licensed on every runtime target.
• Using WinCC RT Advanced by mistake. RT Advanced is limited to 8 connections; the user is on RT Professional but a project that was originally built as Advanced and migrated will retain the 8-connection ceiling in the project file.
• Softnet-S7 Lean license deployed at scale. Lean limits the number of tags per polling cycle; on a 20-PLC project it throttles the channel and produces intermittent read timeouts that look like connection drops.
• Antivirus scanning the SIMATIC NET directory. Real-time AV scanning of s7dos.exe introduces 200–500 ms latency per S7 PDU, which trips the connection watch-dog.
• Engineering client also configured with the same PC Station index. Two Configuration Console entries pointing at the same index race for the S7 transport and either can claim it at startup.

Reference Documentation

• Siemens TIA Portal Help Portal — "Creating a connection (RT Advanced)": TIA Portal V20 — Creating a connection (RT Advanced)
• Siemens Industry Online Support entry ID 109769627 — Updates for WinCC Runtime Professional V16.
• SIMATIC NET PC Software V16 Readme (search entry ID 109769826 on the Siemens support portal).

FAQ