Resolving WinCC Runtime Advanced WiFi Transfer Communication

Problem Description

Engineers commissioning Siemens WinCC Runtime Advanced panels or PC-based runtime stations frequently encounter a transfer failure when the engineering station is connected to the same physical Ethernet switch as the target device, but the engineering PC's link to that switch is provided by a WiFi adapter rather than a wired NIC. The symptom is consistent: the TIA Portal V17 "Load to device" or "Transfer" operation against the WinCC Runtime target times out, while:

• A wired NIC on the same subnet can reach the WinCC PC by ICMP ping.
• The WinCC PC continues to display process screens, confirm operator button presses, and exchange data with the connected S7-PLC (visible in the project diagnostics).
• Manual IP assignment on the WiFi adapter (static address in the same subnet as the wired network) restores transfer.
• PG/PC interface configuration has been changed to point at the WiFi adapter, but the transfer still fails.

The failure is not caused by a WinCC runtime bug and is not a wireless signal-strength issue. It is a layered configuration problem spanning the Windows TCP/IP stack, the Siemens S7ONLINE access point, the WinCC Runtime Loader, and (on IPC installations) the SoftController plug-in. Each of these layers is addressed below, in the order Siemens recommends you check them.

Root Cause Analysis

From field experience, four root causes explain more than 95% of the WiFi transfer failures reported for WinCC Runtime Advanced on TIA Portal V17:

Each cause has a dedicated fix section below. Verify them in order — RC-01 is by far the most common when the user is on WiFi.

Network Adapter Configuration: Eliminate Subnet Overlap

The Windows TCP/IP stack chooses the lowest-metric interface for outbound traffic. When both the wired and the WiFi NICs are in 192.168.0.0/24, Windows may route S7ONLINE traffic out of one adapter and ping traffic out of the other, producing an inconsistent picture. S7DOS cannot negotiate a TCP/102 session over a flap.

Step-by-step: re-home the engineering station on WiFi

1. Open ncpa.cpl, identify the wired Ethernet adapter.
2. Right-click → Disable the wired adapter. Do not unplug it — disabling preserves its TCP/IP settings for fallback.
3. Open the WiFi adapter → Properties → Internet Protocol Version 4.
4. Configure a static address in the same subnet as the WinCC Runtime target, for example:

   IP address:      192.168.0.50
   Subnet mask:     255.255.255.0
   Default gateway: 192.168.0.1 (only if the WinCC PC is on a routed segment)
   Preferred DNS:   192.168.0.1

5. Click Advanced → uncheck Automatic metric → set Interface metric = 10 for the WiFi adapter. This guarantees it wins the routing election.
6. From an elevated CMD, run:

   route print
   ipconfig /flushdns
   arp -d *

7. Ping the WinCC PC by IP, then by name. Both must succeed before you proceed.

Configuring the PG/PC Interface (S7ONLINE)

WinCC Runtime Advanced transfer does not bind directly to a NIC. It binds to the S7ONLINE access point, which the PG/PC Interface applet routes to a specific physical adapter. If S7ONLINE is still pointing at the wired NIC, every transfer attempt exits the wrong interface.

Set PG/PC Interface procedure (TIA Portal V17)

1. Close TIA Portal.
2. Open the Windows Control Panel → Set PG/PC Interface (the 32-bit applet, not the modern Settings page — it is still shipped with STEP 7 / TIA).

   C:\Program Files (x86)\Siemens\Automation\S7WIN\SetPgPcInterface.exe

3. In the Access Point dropdown, select S7ONLINE.
4. In the Interface Parameterization list, select the entry that names your WiFi adapter (it will show the wireless NIC description, e.g. Intel Wi-Fi 6 AX201). If multiple entries exist for the same NIC (TCP/IP vs ISO-on-TCP), pick TCP/IP → <WiFi NIC> for TIA Portal V17 projects.
5. Click OK. The applet writes the binding to the registry under HKLM\SOFTWARE\Siemens\S7ONLINE.
6. Re-open TIA Portal. The "Accessible nodes" view should now list the WinCC Runtime PC reachable on the WiFi subnet.

WinCC Runtime Loader and Transfer Mode

Unlike a Comfort Panel, a PC-based WinCC Runtime does not expose a permanent transfer channel. The WinCC Runtime Loader must be running in Transfer mode to accept a download. If the loader is in Production mode, the HMI is running and actively holds port 102 on the engineering side; the transfer dialog will time out and you may falsely conclude that the network is at fault.

Switch Runtime Loader to Transfer mode

1. On the WinCC Runtime PC, right-click the WinCC Loader icon in the system tray (the small RT icon near the clock).
2. Select Start → Transfer. The icon turns yellow.
3. Optionally, in TIA Portal → Runtime settings → General, set the project to Start after transfer so the loader returns to Production automatically once the download completes.

Confirm Loader service status

sc query "Siemens SIMATIC WinCC Runtime Advanced Loader"
sc qc "Siemens SIMATIC WinCC Runtime Advanced Loader"

The service should be RUNNING and set to AUTO_START. If the service is disabled, transfer is impossible regardless of the network path.

SoftController Conflict on IPC Systems

Many IPC installations (SIMATIC IPC227G, IPC427D, IPC BX-39A, etc.) ship with a preinstalled SoftController (WinLC) component as part of the TIA bundle. The SoftController registers an S7 connection of its own on the same machine, and the S7DOS Helper arbitrates the first incoming transfer request to the SoftController instead of the WinCC Runtime. The result is a transfer that "succeeds" against the SoftController (or hangs) but never reaches WinCC.

Detect the conflict

• Open Task Manager → Details, look for S7WinLC.exe or SoftController.exe. If present and your WinCC project does not use a SoftController, the conflict exists.
• Look for a PLC entry in the project tree labelled PC Station → SoftController. If the project does not contain one, the installed runtime instance is orphan.

Resolution

1. If the project does not use a SoftController, uninstall the SoftController runtime from the IPC:

   Control Panel → Programs → Siemens SIMATIC SoftController → Uninstall

2. Reboot the IPC.
3. Re-run the transfer. S7DOS will now bind exclusively to the WinCC Runtime channel.

If the project does require a SoftController (rare on a WiFi-transferred HMI), you must load the SoftController configuration first via the same WiFi link, then load the WinCC Runtime in a second pass. TIA Portal V17 supports sequential loads of components within a PC Station; the order is configured in PC Station → Device configuration → Slot assignment.

Secure Communication Certificate Path

TIA Portal V17 SP1 and later enable secure communication by default for S7-1500 CPUs and for the WinCC Runtime itself. When the PLC is configured with Connection mechanisms → Permit access with secure communication only, the engineering PC must hold the PLC's certificate in its trusted store, or the TCP/102 handshake is refused before any HMI data is exchanged. The same applies in reverse for the WinCC Runtime if it is the secure endpoint.

Certificate location and verification

C:\ProgramData\Siemens\Automation\device-certificates\

Each trusted PLC/Runtime certificate appears as a .cer file. If the target device's certificate is missing here, TIA Portal transfer will fail with Error 0x80072F8F (SEC_E_INVALID_CERTIFICATE) or, in newer builds, with a WinCC-specific 0xE0A70001 / 0xE0A70005 secure-channel error.

Repair steps

1. In TIA Portal → Online → Accessible nodes, right-click the target WinCC PC and choose Establish secure connection. TIA copies the device certificate into the local store.
2. If the PLC side enforces secure communication, in the PLC's Properties → Protection → Connection mechanisms, confirm that Permit access with PUT/GET or Permit access with secure communication is checked, and the engineering PC's certificate is enrolled. See the official Siemens secure-communication reference at Secure communication (RT Advanced, RT Professional).
3. For self-signed certificates on the target device, make sure the engineering PC clock is within the certificate's validity window. A WiFi-attached PC with broken NTP sync will reject the certificate as not-yet-valid or expired.

TIA Portal V17 Project Settings

Several V17-specific settings influence WiFi transfer behaviour. Confirm them before any rebuild:

Offline Transfer Procedure (Plan B)

When the WiFi link cannot be made to behave — typically because of corporate AP isolation, captive portals, or 802.11X EAP-TLS misconfiguration — Siemens supports an offline transfer path. The compiled HMI runtime is exported to a USB stick or network share, then imported on the WinCC PC. This decouples the HMI from any live S7ONLINE session.

Export from TIA Portal (V17)

1. Right-click the HMI device in the project tree → Load preview → Load to file system.
2. Choose a target folder; TIA writes a complete .zip with all binaries and the RT-Project folder.

Import on the WinCC PC

1. Copy the folder to the WinCC PC.
2. Open WinCC Runtime Advanced → RT Loader.
3. Select Settings → Project path → point to the copied RT-Project folder.
4. Click Start. The runtime launches from the offline source.

This procedure is documented as Siemens Support entry 109740696 (TIA Portal → WinCC RT → Offline transfer). The full walkthrough is in the Siemens Industry Online Support article 109740696.

Verification Checklist

Run these checks in order. Each one must pass before moving to the next. If any check fails, stop and apply the fix from the matching section above.

1. Layer 1 — L1 link: WiFi shows Connected, no internet or Connected, internet. Signal ≥ -65 dBm. SSID matches the engineering VLAN.
2. Layer 2 — Addressing: ipconfig /all shows one NIC in the WinCC subnet with metric 10. No duplicate 0.0.0.0 routes.
3. Layer 3 — Reachability: ping <wincc-pc> succeeds, tracert shows the first hop is the engineering PC's own WiFi gateway.
4. Layer 4 — TCP/102: Test-NetConnection -ComputerName <wincc-pc> -Port 102 returns TcpTestSucceeded : True. (PowerShell.)
5. Layer 5 — S7ONLINE: Set PG/PC Interface shows S7ONLINE → TCP/IP → WiFi adapter.
6. Layer 6 — Runtime Loader: Loader service is RUNNING, icon in tray is yellow (Transfer mode).
7. Layer 7 — SoftController: No S7WinLC.exe in Task Manager (unless project uses it).
8. Layer 8 — Secure comms: Target's certificate is in %PROGRAMDATA%\Siemens\Automation\device-certificates. PC clock within validity.
9. Layer 9 — TIA accessible nodes: Target appears in Online → Accessible nodes with correct device name and IP.
10. Layer 10 — Transfer: Load to device completes without error. Runtime switches to Production mode (icon green) if "Start after transfer" is enabled.

Troubleshooting Matrix

Performance and Security Notes for WiFi-Based Engineering

• Bandwidth: A full HMI compile plus first-transfer of a multi-MB WinCC project (images, scripts, logs) can take several minutes over 802.11n. Use 802.11ac/ax (5 GHz) where possible.
• Jitter: 802.11 power-save mode (U-APSD) breaks the S7DOS heartbeat. Disable WiFi power management on the engineering PC: Device Manager → WiFi adapter → Properties → Power Management → uncheck "Allow the computer to turn off this device to save power".
• Security: Industrial WiFi should use WPA2-Enterprise (802.1X) at minimum, with separate SSIDs/VLANs for engineering, control, and office traffic. Never share the engineering SSID with visitor or BYOD devices.
• DNS: Use the controller/DNS server's IP as the WiFi adapter's primary DNS. A captive-portal WiFi (hotel, guest) will redirect the browser but silently break S7DOS name resolution.