S7-1200 to WinCC Flexible: Ethernet Configuration on MP377 Panels

Overview

Adding a SIMATIC S7-1200 CPU into an existing SIMOTION D and WinCC Flexible MP377 project is a common expansion scenario in mixed-generation Siemens lines. The challenge is that WinCC Flexible 2008 SP2/SP3/SP4/SP5 was released before the S7-1200 family existed, and the standard "S7-1200" driver that appears in newer TIA Portal HMI tags is not available in the legacy WinCC Flexible engineering environment. The S7-1200 is, however, fully reachable on Ethernet from a WinCC Flexible runtime when the panel is configured with the S7-300/400 driver and the controller is set to rack 0, slot 1, with cyclic operation enabled.

This reference covers the engineering steps required to bring a CPU 1211C / 1212C / 1214C / 1215C / 1217C onto the same Ethernet subnet as a SIMOTION D and a Multi Panel 377 (MP377 12"/15"/19" Touch or Key), exposes the controller tags to the HMI, and verifies the connection. It also documents the migration path to TIA Portal V13+ and the secure-communication model used by WinCC Unified when an S7-1200 (firmware V4.4 or higher) is later upgraded.

System Architecture and Prerequisites

Three controllers reside on the same subnet in the target topology:

• SIMOTION D (e.g., D4x5-2) — the original motion controller, programmed in SIMOTION SCOUT / SIMATIC Manager, communicating with the MP377 over Ethernet (Industrial Ethernet / PROFINET).
• SIMATIC S7-1200 (CPU 12xx, firmware V4.x) — the new PLC to be added to the line, programmed in TIA Portal.
• Multi Panel 377 (MP377) — the operator interface running a WinCC Flexible 2008 SP2 (or later) runtime, configured in WinCC Flexible 2008 SP2 or higher.

Engineering tools required:

• SIMATIC STEP 7 V5.4 / V5.5 (or SIMOTION SCOUT) — for the existing SIMOTION D project.
• SIMATIC TIA Portal (any edition that matches the S7-1200 firmware you intend to use, e.g., V13, V14, V15, V15.1, V16, V17, V18, V19, V20, V21) — for the new S7-1200 program.
• SIMATIC WinCC Flexible 2008 SP2, SP3, SP4, or SP5 — for the MP377 project. SP2 is the minimum revision that resolves the initial S7-1200 communication limitations.

Runtime / firmware prerequisites:

• S7-1200 CPU firmware V3.0 or higher is recommended for stability with the S7-300/400 driver. V4.x is the typical baseline in 2020+ deployments.
• MP377 image with WinCC Flexible 2008 SP2 or later runtime; verify with Start > System > Information on the panel.
• Ethernet switch (managed or unmanaged) supporting 10/100 Mbit/s full duplex.

Network Topology and IP Addressing

All three devices must be on the same IP subnet and must share the same subnet mask. A typical deployment uses a dedicated machine subnet:

Assign static addresses. Disable DHCP on the engineering PG when commissioning the S7-1200 CPU's PROFINET port so the device is always reachable at 192.168.0.20.

Why the S7-300/400 Driver Is the Correct Choice

WinCC Flexible 2008 SP2 does not provide a dedicated "S7-1200" driver because the S7-1200 was introduced after the WinCC Flexible feature freeze. The S7-1200 CPU speaks the same ISO-on-TCP / S7-communication subset used by S7-300/400 stations, and the panel's "SIMATIC S7 300/400" driver can be redirected to a CPU 12xx with no firmware change, provided the slot parameter is set correctly. In WinCC Flexible 2008 SP2 onward, the driver explicitly supports the S7-1200 family when the parameters below are honored.

S7-1200 Data Block Configuration for HMI Access

The S7-1200 introduces a distinction that does not exist on S7-300/400: data blocks may be created with symbolic-only access, optimized access, or classic absolute access. WinCC Flexible reads and writes the controller by absolute address, so the DBs and tags must be exposed as non-optimized (also called "standard" or "absolute-addressable") blocks.

In TIA Portal, open the DB properties and uncheck Optimized block access. When the option is left enabled (default for new DBs since V13), the runtime will not return the tag values to the panel because the absolute offsets are not stable and the OPC/S7 channel cannot resolve them.

Required DB settings

Tag addressing example

Create a DB named DB_HMI_Interface (DB number 100) with the following structure. All tags are absolute-addressable because optimized access is disabled:

DATA_BLOCK "DB_HMI_Interface"
{ S7_Optimized_Access := 'FALSE' }
VERSION : 0.1
NON_RETAIN
  STRUCT
    MachineState       : WORD;      // 0 = Idle, 1 = Run, 2 = Fault
    SetpointSpeed      : REAL;      // rpm
    ActualSpeed        : REAL;      // rpm
    Temperature        : REAL;      // degC
    RecipeNumber       : INT;       // 1..99
    StartCommand       : BOOL;      // HMI -> PLC
    StopCommand        : BOOL;      // HMI -> PLC
    ResetFaults        : BOOL;      // HMI -> PLC
  END_STRUCT;
END_DATA_BLOCK

The corresponding WinCC Flexible tag addressing is then:

Every absolute address must be re-typed or imported by CSV in WinCC Flexible. There is no automatic tag synchronization between TIA Portal and WinCC Flexible 2008 SPx — this is the source of the "duplicate effort" engineers describe when maintaining such mixed-tool installations.

Step-by-Step Configuration in WinCC Flexible

1. Open the existing WinCC Flexible project (the same one that holds the SIMOTION D connection).
2. Open Project > Communication > Connections and click New.
3. Set the communication driver to SIMATIC S7 300/400.
4. Enter the S7-1200 IP address in Station address (192.168.0.20).
5. Expand Properties > Station and set Rack = 0, Slot = 1.
6. Under Properties > Connection, enable Cyclic operation.
7. Click OK to create the connection. The new connection now appears next to the existing SIMOTION D connection.
8. Open the tag editor and add the HMI tags shown in the table above. Use the address syntax DB 100 DBW 0, DB 100 DBD 2, DB 100 DBX 16.0, etc.
9. Bind the tags to the desired I/O fields, buttons, and alarms on the MP377 screens.
10. Compile the project (Project > Compiler > All) and transfer to the MP377.

Step-by-Step Configuration in STEP 7 / SCOUT (for SIMOTION D coexistence)

The existing STEP 7 (or SCOUT) project must know about the MP377 so that NetPro can validate the S7 connection route. For a single-MP377 / SIMOTION-D / S7-1200 line, the S7-1200 is treated as a standalone partner that the panel polls directly; STEP 7 does not need to be modified, but the project should be opened to verify the topology:

1. Open the existing STEP 7 / SCOUT project.
2. Open Options > Set PG/PC Interface and confirm the TCP/IP adapter is selected.
3. In Accessible Nodes, the S7-1200 at 192.168.0.20 should appear with its MAC address.
4. No additional S7 connection needs to be inserted in NetPro, because the MP377 establishes its own S7 connection to the S7-1200 directly — the SIMOTION D does not route S7-1200 traffic.
5. Recompile and download the STEP 7 project only if the SIMOTION D configuration was modified.

Step-by-Step Configuration in TIA Portal (S7-1200 Side)

1. Create the S7-1200 device in TIA Portal. The CPU model and firmware version must match the physical device (e.g., 6ES7214-1AG40-0XB0, firmware V4.4).
2. Configure the PROFINET interface with IP 192.168.0.20, subnet 255.255.255.0.
3. Disable the Optimized block access attribute on every DB the HMI must access (see table above).
4. Inside the DB, define a PLC data type or use the structured variant as shown in the previous code block.
5. Enable Permit access with PUT/GET communication on the CPU under Properties > Protection > Connection mechanisms. The WinCC Flexible S7-300/400 driver uses PUT/GET when the HMI is configured with this driver, so the option must be active.
6. Compile and download the S7-1200 program.

Verification and Diagnostics

After the panel image has been transferred, use the following checks in order:

1. Panel-side connection status. On the MP377, the connection icon in the system bar should turn from red to green. Start > System > Connections shows the live status of every configured partner.
2. Tag live value test. Bind a numeric I/O field to DB 100 DBW 0. Changing the value from the PLC (online with TIA Portal's watch table) must be reflected on the panel within the configured update cycle (default 1 s for the S7-300/400 driver).
3. Project online diagnostics. In WinCC Flexible, use Project > Transfer > Status and then the runtime diagnostics view. A green connection with byte counts incrementing on both sides confirms healthy traffic.
4. S7-1200 online diagnostics. In TIA Portal, open Online > Online & Diagnostics > Diagnostics buffer on the S7-1200. Look for connection establishment events from the MP377 IP. If a security event "Access via PUT/GET denied" appears, the option in step 5 of the TIA Portal procedure is not yet active.
5. Wireshark / tcpdump capture. Capture port 102 on the switch. The S7 communication includes setup frames; if the panel sends a CR (Connection Request) and the controller responds with CC (Connection Confirm), the S7 transport is healthy. If the controller answers with DR (Connection Refuse) and a transport error, the slot or rack is wrong, or the PLC program is not running.

Migration to TIA Portal V13+

From TIA Portal V13 onward, WinCC (the TIA Portal HMI engineering environment) supports a migration wizard that can convert a WinCC Flexible 2008 SP2/SP3/SP4/SP5 project into a TIA Portal HMI project. The migration benefits this scenario in two ways:

• The S7-1200 tags become available as native TIA Portal HMI tags, eliminating the absolute-address manual table.
• Optimized DBs can be used on the S7-1200 side, because TIA Portal HMI is aware of the S7-1200's optimized memory model and reads through the S7-1200 driver (not the S7-300/400 driver).

Steps for migration:

1. In TIA Portal, open the S7-1200 project.
2. Right-click the project tree and select Migration > Migrate WinCC Flexible project.
3. Browse to the existing .hmi or .exp file.
4. Map the migrated tags to the S7-1200 connection. TIA Portal V13+ automatically uses the new S7-1200 driver, so the rack/slot/cyclic-operation parameters become internal.
5. Recompile the migrated project. WinCC Flexible-only objects (such as legacy sm@rtClient views) may need manual adjustment.

Transition to WinCC Unified and Secure Communication

When the MP377 is eventually replaced by a Unified Comfort Panel (UCP) running WinCC Unified Runtime, the S7-1200 connection model changes again. By default, Unified Runtime expects secure S7 communication: the panel and the controller exchange certificates, and plain PUT/GET is replaced by a TLS-protected channel. The official TIA Portal V21 documentation describes the management of certificates and the optional legacy-mode fall-back:

• If the Secure communication option is enabled on the HMI connection, the S7-1200 (firmware V4.4 or higher) presents a self-signed certificate that the Unified Runtime must trust. The TIA Portal engineering station is used to export the certificate from the controller, import it into the Unified project, and assign it to the connection.
• If the option is disabled, the Unified Runtime falls back to the legacy S7-300/400 driver behavior, and the procedures documented in the present article apply unchanged.

Reference: Certificates in WinCC Unified Runtime — Communication with S7-1500 and S7-1200 (TIA Portal V21 documentation).

Performance and Update Cycle Tuning

The default S7-300/400 update cycle in WinCC Flexible is 1 s. For the S7-1200, the controller poll latency depends on:

• PLC program scan time. If OB1 takes longer than 50 ms, the panel will see stale values during heavy CPU load. Move complex math to cyclic OBs (OB30+).
• Number of tags polled. Each tag adds a request-response round trip. Group consecutive DBW/DBX into a single DBW to amortize the cost.
• Network load. PROFINET real-time frames are higher priority than the S7 communication; configure QoS on managed switches if jitter becomes an issue.

To set a custom update cycle in WinCC Flexible, open the connection properties, switch to Update, and override the cycle time per tag. Use 100 ms for fast alarms and 1 s for trend displays.

Troubleshooting Matrix

Field-Proven Tips and Caveats

• CPU slot never changes. Unlike S7-300, the S7-1200 has a fixed slot 1 regardless of the number of signal modules on the right side of the CPU. Do not derive the slot from the hardware configuration catalog.
• Watch the DB number range. WinCC Flexible allows DB numbers 0 to 65535. S7-1200 reserves the low numbers for system use; the safe range is DB 100 to DB 60000 for application data.
• Symbolic vs absolute references in the PLC. Even when the DB is not optimized, the absolute address remains the only access method for the WinCC Flex panel. Symbolic accesses inside the PLC program continue to work independently of the HMI access path.
• Two tools, two programs. The S7-1200 lives in the TIA Portal project; the MP377 lives in the WinCC Flexible project. Plan for tag-table maintenance as a recurring engineering task until the project is migrated to TIA Portal.
• Keep the engineering PG out of the S7-1200 subnet during runtime. Some PROFINET discovery storms from TIA Portal can briefly delay the S7 communication cycle, which appears on the MP377 as a momentary value freeze.
• Save a backup of the WinCC Flexible project before any migration. The migration wizard is one-way; the source project is not modified, but a separate backup of the S7-1200 program protects the controller side.

Related Siemens Documentation

• Siemens Industry Online Support — manual and entry search portal (search for "WinCC Flexible 2008 SP2 S7-1200" for the original Siemens entry that resolved the S7-1200 access from WinCC Flexible panels).
• Certificates in WinCC Unified Runtime — Communication with S7-1500 and S7-1200 (TIA Portal V21).
• SIMATIC S7-1200 Programmable Controller — System Manual (entry ID 109751049 on the Siemens support portal).
• SIMATIC HMI WinCC Flexible 2008 — Communication Manual (entry ID 18797599 on the Siemens support portal).
• SIMOTION D4x5-2 — Commissioning and Hardware Installation Manual (entry ID 109749734 on the Siemens support portal).

Frequently Asked Questions