Resolving WinCC Unified View of Things Disconnected from PLC

Problem Statement: Intermittent "Disconnected from PLC" in WinCC Unified View of Things

Engineers deploying WinCC Unified View of Things (VoT) on an SIMATIC S7-1500 CPU frequently encounter an intermittent "Disconnected from PLC" status banner inside the browser-based HMI. The error appears most often when the VoT web application is launched from a thin client running a No Touch operating system with a Chromium-based browser, connected to the PLC through an unmanaged switch. Because the application is hosted entirely by the CPU's integrated web server, every disruption manifests in the browser as a loss of process values, frozen screen objects, and the subsequent triggering of HMI alarm bit diagnostics.

The root cause is rarely a single component failure. The most commonly observed contributors are:

• NTP drift between the S7-1500 CPU and the client PC exceeding the TLS/session validity window.
• Tag polling saturation caused by an excessive number of HMI tags assigned to short acquisition cycles.
• Security setting "Only allow secure PG/PC and HMI communication" rejecting the self-signed VoT certificate.
• Known firmware/TIA Portal regressions in VoT web server behavior (notably around TIA Portal V17 Update 2 / Update 3).
• Unmanaged switch buffer exhaustion, broadcast storms, or duplex mismatches on the copper link.

This article walks through the diagnostic ladder an automation engineer should climb before replacing hardware: PLC diagnostic buffer review, time synchronization, tag audit, certificate/secure-communication validation, and known-issue checklist.

Architectural Overview: How View of Things Communicates with the S7-1500

View of Things is a web application generated by TIA Portal and served directly by the S7-1500 CPU through its integrated web server. It is not a stand-alone HMI runtime. The VoT configuration lives in the project tree under the entry "Web applications" and only one VoT application can be created per PLC in the engineering system, as documented in the official Siemens TIA Portal V21 documentation: WinCC Unified View of Things for PLC.

The runtime data path looks like this:

The browser opens an HTTPS session to the CPU's web server (default https://<CPU-IP>/). The CPU evaluates whether the requesting client is permitted, renders the configured screens, and streams tag values back to the browser using the Unified Comfort Panel / Unified PC runtime protocol semantics. If the web server drops the session, the JavaScript runtime inside the browser raises the "Disconnected from PLC" banner.

Step 1 — Capture the S7-1500 Diagnostic Buffer

Before changing any configuration, capture the CPU diagnostic buffer from TIA Portal:

1. Connect TIA Portal online to the S7-1500.
2. Open Online & Diagnostics > Diagnostics Buffer.
3. Filter the time window to the exact minute the browser session was lost.
4. Export the buffer as a CSV using the toolbar "Save as CSV" icon for later comparison.

Look specifically for these event IDs (Siemens Online Help, S7-1500 System Manual):

If the buffer shows event 0x0117 immediately before the disconnect, you are dealing with a time synchronization problem — proceed to Step 2. If 0x0194 or 0x0131 appear, go directly to Step 4 (Certificates & Security).

Step 2 — Validate Time Synchronization Between CPU and Client

The Unified web server uses the CPU's local time to evaluate TLS certificate validity and to stamp browser console messages. A drift of more than ±5 minutes between the CPU clock and the client clock will be treated by the TLS stack as "clock skew" and the handshake is rejected. The S7-1500 in this scenario is already receiving NTP from a server, but the thin client boots a No Touch OS and has no NTP client of its own — its RTC drifts from real time on every power cycle.

Recommended actions:

1. Configure the S7-1500 CPU as an NTP client and confirm the time is being received: Properties > Time of day > Time synchronization; check "Synchronize with NTP server" and enter the server IP. Use a poll interval of 60 s.
2. On the thin client, add a startup script that points the OS to the same NTP server, or pre-bake the time into the boot image. For Windows IoT No Touch, the command is w32tm /config /manualpeerlist:<NTP-IP> /syncfromflags:manual /update && net start w32time.
3. Configure VoT runtime settings to not rely on the browser's local clock for time-stamping alarms. In TIA Portal, open the VoT application and verify the "Time source" field is set to "PLC time" rather than "Client time".
4. Disable daylight savings time on the CPU (or apply a fixed UTC offset) to avoid the twice-yearly 0x0117 jumps.

Step 3 — Audit the HMI Tag Count and Acquisition Cycles

View of Things pushes data into the browser over a single HTTP/2 (or HTTP/1.1) stream. A common cause of intermittent disconnect on lean CPUs (S7-1511, S7-1512) is the web server's connection-handling budget being exhausted by hundreds of tags polled at 100 ms or 250 ms. Symptoms include:

• Disconnect coinciding with peak screen changes on the browser.
• Diagnostic buffer events 0x0175 (session limit reached).
• Wireshark capture of the PLC's port 443 showing TCP RST segments under load.

Audit procedure:

1. Open the VoT application in TIA Portal and switch to the "HMI tags" editor.
2. Sort the Acquisition cycle column ascending. Identify every tag with a cycle ≤ 500 ms.
3. For each fast-cycling tag, ask: Does any visible screen need this value at that rate? If not, change the cycle to 1 s or 2 s.
4. For values only relevant on a specific screen, mark them as "Update only when screen is visible" (legacy Unified concept: Local screen tags).
5. Confirm the total active PowerTag count is below the licensed maximum. The license pool (128 → 512 in this case) applies to configured tags, not just currently displayed ones.

Recommended baseline for a 1511-class CPU with one VoT instance:

Step 4 — Verify the CPU Certificate and "Secure Communication" Setting

When the CPU property "Only allow secure PG/PC and HMI communication" is enabled, every HMI client — including the VoT browser session — must present a trusted certificate. The S7-1500 ships with a self-signed certificate that browsers reject outright.

1. In TIA Portal: PLC properties > Protection & Security > Certificate manager. Inspect the active web server certificate. If it is still the default self-signed cert, export it.
2. Import the exported certificate into the thin client's Trusted Root Certification Authorities store. On No Touch Windows, run certlm.msc and place the cert under Trusted Root Certification Authorities > Certificates.
3. Reboot the thin client. The Chromium browser will now trust the CPU's identity.
4. Alternatively — preferred for production — install a certificate signed by your plant CA and load it onto the CPU through the certificate manager.

Quick verification of trust without modifying the client: from the thin client command line, run curl -vk https://<CPU-IP>/. If the handshake completes, trust is established. If it returns SSL certificate problem: unable to get local issuer certificate, the cert is not trusted.

Step 5 — Check for Known TIA Portal / Firmware Issues

Siemens released a support note covering the regression where View of Things becomes inaccessible in the web browser after TIA Portal V17 Update 2 / Update 3. Engineers who recently upgraded their engineering software and started observing disconnects should review this first.

• Confirm the exact TIA Portal version: Help > About shows e.g. V17 Update 5 or V18 Update 3.
• Confirm the CPU firmware version: Online & Diagnostics > Diagnostics > CPU shows e.g. Firmware V2.9.7.
• Verify both engineering and runtime are at the latest update. Mixed TIA versions in a project can corrupt the generated VoT application bundle.

After a TIA Portal update, perform a full project recompile (right-click the PLC > Compile > Software (rebuild all blocks)) and re-download the generated VoT web application. Stale compiled artefacts in the CPU's web server directory are a frequent source of intermittent parse errors that look like network drops.

Step 6 — Validate the Physical Network

An unmanaged switch is fine for a single VoT client, but a few rules of thumb eliminate most of the physical-layer ghosts:

1. Replace or re-crimp the patch cord between the S7-1500 and the switch. Bad crimps on Cat5e/Cat6 are the single most common cause of intermittent link flaps.
2. Force the CPU and the thin client NIC to a fixed 100 Mbit / Full Duplex if the switch is unmanaged (in TIA Portal: Properties > PROFINET interface > Port 1 > Transmission mode > Manual).
3. Mirror the switch port connected to the CPU on a managed replacement (even temporarily) and run a 10-minute Wireshark capture. Look for TCP RST, TCP Dup-ACK, or ARP storms.
4. Confirm no other node on the unmanaged switch is generating a broadcast storm. Unmanaged switches do not filter broadcasts.
5. Reserve a DHCP lease or assign a static IP to the thin client; a DHCP renewal mid-session can cause the browser to re-establish its socket and briefly show "Disconnected from PLC".

Step 7 — Capture a Browser-Side Trace

Chromium's Developer Tools (F12) expose the WebSocket and XHR traffic the VoT runtime uses. On the thin client:

1. Open the VoT URL in Chromium.
2. Press F12, switch to the Network tab, and enable Preserve log.
3. Filter by WS (WebSocket) and XHR.
4. Wait for a disconnect event.
5. Inspect the closed WebSocket frame. The status code identifies the failure:

   Code	Meaning	Likely Cause
   1006	Abnormal closure	TCP RST — switch flap, CPU port reset, certificate rejected
   1011	Internal server error	VoT web app exception — recompile project, clear CPU web directory
   1012	Service restart	CPU web server restarted — TIA download, firmware update, RAM clear
   1001	Going away	Client navigated away or browser tab closed

Code 1006 points to network or TLS; 1011 points to project integrity.

Verification Checklist

After applying changes, perform these verifications:

• Diagnostic buffer is clean for a continuous 24 h window — no 0x0117, 0x0131, 0x0174, 0x0175, 0x0194 events.
• Time drift between CPU and client stays under ±10 s. Monitor with w32tm /monitor /computers:<CPU-IP>.
• No WebSocket abnormal closures in the browser console for 24 h.
• CPU load — check Online & Diagnostics > Performance. Web server thread CPU time should stay below 40 %.
• Switch port counters — CRC errors, runts, giants all at zero.

Troubleshooting Matrix

Preventive Hardening for Production VoT Deployments

• Deploy a managed switch with port-based storm control and BPDU filtering enabled for the PLC segment.
• Replace the default self-signed certificate with a CA-signed certificate before the line is signed off.
• Use a redundant NTP source (e.g. two stratum-2 servers) and configure the CPU and all HMI clients to use both.
• Reserve all PLC/HMI IP addresses in DHCP and disable unused switch ports.
• Run the thin client from a write-protected image (No Touch) and use a watchdog that reboots the device if the VoT session stays disconnected for more than 60 s.
• Document the minimum required TIA Portal and CPU firmware versions for the VoT application; pin both in the project properties to prevent silent drift.

FAQ