S7-1212C to WinCC SCADA: PROFINET Communication Setup Guide

David Krause15 min read
SCADA ConfigurationSiemensTutorial / How-to
Licensed PE Working through this on a live machine? A Maine-licensed engineer can take it from here — included with IMD hardware, by the hour for everything else. Book an engineer

Overview

The SIMATIC S7-1212C is a compact CPU in the S7-1200 family that integrates a PROFINET interface, digital and analog I/O, and signal-board expansion in a single footprint. It is frequently deployed as a stand-alone controller in machine-level applications that must publish process data to a higher-level SCADA host. The question of how to bring S7-1212C data into a WinCC system has three distinct, officially documented answers that depend entirely on the WinCC edition in use: WinCC V7.3/V7.4 (legacy), WinCC V13/14/15/16/17 (TIA Portal – Professional or Advanced), and OPC DA/UA through SIMATIC NET. Each path uses the same Ethernet medium and the same PROFINET stack on the PLC, but the engineering software, driver channel, and licensing differ significantly.

This guide walks through hardware selection, TIA Portal project configuration, WinCC channel setup for both the TIA and legacy paths, OPC fallback paths, security hardening, and a commissioning checklist. Engineers familiar with SIMATIC Manager who are touching S7-1200 for the first time should read the entire document because S7-1200 cannot be programmed with SIMATIC Manager; TIA Portal is mandatory.

S7-1212C Hardware & Firmware Prerequisites

The S7-1212C ships in three order variants whose suffix determines the on-board I/O voltages:

MLFB / Order Number Suffix Power Supply Digital Inputs Digital Outputs Analog I/O
6ES7212-1AE40-0XB0 DC/DC/DC 24 V DC 24 V DC 24 V DC transistor 2 AI / 2 AO (voltage)
6ES7212-1BE40-0XB0 DC/DC/Relay 24 V DC 24 V DC Relay (2 A) 2 AI / 2 AO (voltage)
6ES7212-1HE40-0XB0 AC/DC/Relay 85–264 V AC 24 V DC Relay (2 A) 2 AI / 2 AO (voltage)

The integrated PROFINET port (X1) on every S7-1212C supports the protocols required by all three WinCC paths:

  • S7 communication (PUT/GET) — used by WinCC V7.3/V7.4 and by legacy SIMATIC NET OPC.
  • S7-plus / symbolic connection — used by WinCC Professional/Advanced inside TIA Portal from V14 onward.
  • OPC UA server — available from S7-1200 firmware V4.0 with a separately licensed OPC UA activation.
Firmware version is the single most important driver of capability. An S7-1212C delivered with firmware V3.0 (6ES7212-1AE31-0XB0 MLFB family) cannot run OPC UA and requires TIA Portal V13 SP1 for configuration. A V4.4 device needs TIA Portal V16 or V17 and unlocks OPC UA, TLS, and the S7-1200 access-protection enhancements. Match the TIA Portal version to the highest firmware present in the project before commissioning.

Verify the firmware on the device by reading the front-panel article number and looking up the operating instructions on the Siemens Industry Online Support portal. A typical upgrade path is to use the TIA Portal "Online > Accessible nodes" wizard, which exposes the current firmware and offers the matching firmware update file from the HSP (Hardware Support Package).

Selecting the Correct WinCC Path

Three engineering paths are documented for moving tags from S7-1212C into a WinCC runtime. The matrix below is the decision tool to use when specifying a new system.

WinCC Edition Connection Method TIA Portal Required? Hardware Channel Typical Use Case
WinCC V7.3 / V7.4 / V7.5 SIMATIC S7-1200, S7-1500 Channel No (separate project) TCP/IP, S7 communication (PUT/GET) Existing plant with V7.x base; modernization of legacy SCADA
WinCC Professional V13 → V17 HMI connection inside TIA Portal Yes TCP/IP, symbolic HMI tags New TIA-based machines, multi-user SCADA on PC RT
WinCC Advanced V13 → V17 HMI connection inside TIA Portal Yes TCP/IP, symbolic HMI tags Cost-optimized Comfort Panels + single-station PC
WinCC V7.x older than V7.3 OPC DA via SIMATIC NET No (SIMATIC NCM PC) OPC DA over TCP/IP Legacy migration without SCADA re-license
Any modern WinCC OPC UA direct to S7-1200 firmware V4.0+ Yes OPC UA TCP, port 4840 Vendor-neutral clients, multi-vendor SCADA

WinCC Advanced is generally the lowest-cost option that still talks natively to S7-1200 and is sufficient whenever the SCADA is single-station. WinCC Professional adds multi-user redundancy, web clients, and Process Historian. The field report in the originating thread emphasizes this point: "Normally for a S7-1200, WinCC Advanced should be sufficient at a much lower cost."

Network & PROFINET Configuration

The S7-1212C and the WinCC station must share an Ethernet subnet and have routable addresses. Default out-of-the-box addresses differ between sides:

  • S7-1212C PROFINET default: 0.0.0.0 (DHCP / not assigned). Configure a static IP during project engineering.
  • WinCC station default: depends on Windows network profile; typically 169.254.x.x (link-local) when the network is unset.

Recommended fixed addressing for a development cell:

Device IP Address Subnet Mask PROFINET Device Name Router
S7-1212C 192.168.0.10 255.255.255.0 plc1212c 192.168.0.1
Engineering Station (PG) 192.168.0.20 255.255.255.0 n/a 192.168.0.1
WinCC Runtime Station 192.168.0.30 255.255.255.0 n/a 192.168.0.1
PROFINET device names are case-sensitive and must match between the PLC configuration (TIA Portal > Device properties > PROFINET interface > Ethernet addresses) and the online discovery mechanism. If the WinCC station is on a different subnet than the PG, add a router but verify that the WinCC channel or HMI connection supports routed paths – the legacy "SIMATIC S7-1200, S7-1500 Channel" in WinCC V7.x requires the connection to traverse routers using ISO-on-TCP or S7 routing, which requires additional SIMATIC NET configuration.

Disable the Windows firewall on the engineering station for the engineering networks, or open the following ports explicitly: 102/tcp (S7 communication), 4840/tcp (OPC UA), 49152–65535/tcp (PROFINET RPC dynamic range). Production deployments should rely on Windows Defender Firewall with advanced security profiles rather than disabling the firewall entirely.

TIA Portal Project Setup for S7-1212C

TIA Portal is mandatory because the S7-1200 family is not programmable in SIMATIC Manager. Open TIA Portal and create a new project with the matching TIA version. Insert a new SIMATIC S7-1200 device and select the precise MLFB that matches the hardware on the bench.

Step-by-step project creation

  1. Launch TIA Portal V16 (or V17 if the PLC is firmware V4.4+).
  2. Project > New > name the project, set the project path, click Create.
  3. Project tree > Add new device > Controllers > SIMATIC S7-1200 > CPU > CPU 1212C > DC/DC/DC (or matching suffix).
  4. Open Device configuration > PROFINET interface > Ethernet addresses and enter the IP and PROFINET name shown above.
  5. Add the S7 program blocks (OB1 main, FB/FC/DB as required).
  6. Compile the project (Compile > Software rebuild).
  7. Connect the PG to the PLC, select the PLC, click Download to device, choose PG/PC interface, and confirm the PROFINET device name assignment if prompted.

Enabling PUT/GET for S7 communication (required for WinCC V7.x)

From firmware V4.0 onward, the S7-1200 CPU blocks remote PUT/GET access by default. To re-enable it for a WinCC V7.x connection or any third-party client relying on classic S7 communication:

  1. In TIA Portal, open Device configuration of the S7-1212C.
  2. Properties > Protection & Security > Connection mechanisms.
  3. Check Permit access with PUT/GET communication from remote partner.
  4. Compile and download the hardware configuration.
Modern installations should prefer OPC UA over PUT/GET because PUT/GET carries no authentication and exposes the full address space to any client that can route to port 102. If PUT/GET must remain open, restrict it at the firewall to the specific WinCC station IP, and place the PLC on a private automation VLAN.

WinCC Professional / Advanced Connection (TIA Path)

When both the PLC and the SCADA live in the same TIA Portal project, the HMI connection wizard handles the configuration. This is the path recommended for greenfield installations.

Prerequisites

  • TIA Portal V13 SP1 or higher (V16/V17 recommended for current S7-1200 firmware).
  • WinCC Professional or WinCC Advanced license on the engineering station.
  • WinCC Runtime Professional or Advanced license for the runtime PC.

Step-by-step configuration

  1. Project tree > Add new device > HMI > select WinCC Runtime Professional or WinCC Runtime Advanced. Choose the matching PC interface.
  2. Open the HMI device > Connections. Right-click and select Add new connection.
  3. Select the S7-1212C as the partner (endpoints are auto-filled if both devices are in the same project and subnet).
  4. Confirm the integration mode. "Standard project with HMI tags" is the default; it lets the HMI pull symbolic tags from the PLC data block.
  5. Open HMI tags > Show all tags. Create a new tag, choose Connection = PLC1212C_HMI_1, set Data type (Bool, Int, Real, etc.), set the PLC tag as the source (e.g., "DB_Machine".Speed).
  6. Compile the HMI device (Compile > Software rebuild).
  7. Start WinCC Runtime and verify with the online diagnostics (Tools > Connections > Status).

Verification

Open WinCC Runtime. The green connection indicator on the HMI tag must show "Connected". To force a value, set a breakpoint in the PLC and watch the tag update live. From the WinCC side, Tools > Status of connections displays the partner IP, port 102, and cycle time. Cycle times between 100 ms and 1 s are typical for symbolic HMI connections.

WinCC V7.3 / V7.4 / V7.5 (Legacy) Connection

The legacy WinCC V7.x platform manages its own project separate from the PLC's TIA Portal project. The "SIMATIC S7-1200, S7-1500 Channel" (also referenced as "Channel Unit") is the driver that talks S7 communication (PUT/GET) to the S7-1212C.

Prerequisites

  • WinCC V7.3, V7.4, or V7.5 installed on the engineering station.
  • S7-1200 firmware V4.0–V4.6 with PUT/GET enabled (see previous section).
  • TCP/IP connectivity, PLC reachable on port 102.

Step-by-step configuration

  1. Open WinCC Explorer on the engineering station.
  2. Right-click Tag Management > Add new driver > select SIMATIC S7-1200, S7-1500 Channel. Confirm.
  3. Open the new driver, right-click S7-1200,S7-1500 > New connection.
  4. Connection properties:
    • Name: e.g., PLC1212C_Shopfloor.
    • Station: IP address 192.168.0.10.
    • Access Point: S7ONLINE (default) or the user-defined access point assigned to the right TCP/IP interface.
    • Connection type: TCP/IP.
  5. Create a new tag: address syntax uses absolute addressing because V7.x cannot read S7-1200 symbolic names directly. Example for an integer in DB10 word 0: DB10,DBW0. Example for a real: DB10,DBD4. Example for a bit in DB10 byte 0: DB10,DBX0.0.
  6. Set the data type to match (Word, DWord, Bool, Real, etc.).
  7. Repeat for every tag required in the SCADA graphics.
  8. Save the project and activate runtime.

Common mistakes

  • Using the older SIMATIC S7 Protocol Suite driver — this does not support S7-1200/S7-1500. The legacy "MPI/IE/DP" approach will not enumerate the device.
  • Address syntax using percent or decimal offsets that exceed the DB length.
  • Forgetting the DB must be set as non-optimized (Standard access) when configuring in TIA Portal. Optimized blocks strip the byte offsets required by WinCC V7.x.
In TIA Portal, open the relevant DB, right-click > Properties > Attributes > uncheck Optimized block access. Recompile and download the DB before the WinCC V7.x project can read the offsets.

OPC DA Alternative (WinCC V7.x older than V7.3)

WinCC V7.0, V7.1, and V7.2 do not include a native S7-1200/S7-1500 channel. The standard workaround is to install SIMATIC NET on the WinCC station, expose the S7-1212C through the SIMATIC NET PC station, and let WinCC read tags through the OPC DA server.

Step-by-step

  1. Install SIMATIC NET PC software on the WinCC engineering/runtime station.
  2. Open SIMATIC NCM PC Manager > create a new PC station with OPC server.
  3. Add an S7 connection to the S7-1212C (IP 192.168.0.10).
  4. Configure the S7 connection as the OPC server's source.
  5. In WinCC Explorer, add the OPC driver, browse the SIMATIC NET OPC DA server, and create tags from the address space.
  6. Save, activate runtime, verify with the OPC Scout utility bundled with SIMATIC NET.

This path is the most expensive of the three because it requires a SIMATIC NET license plus an OPC channel license. It is generally not recommended for new installations because WinCC V7.3 or a TIA-based HMI is usually a more cost-effective upgrade.

OPC UA Direct from S7-1200

S7-1200 firmware V4.0 and higher can host an OPC UA server. The server-side license is activated per CPU. TIA Portal exposes the OPC UA server interface configuration under Device configuration > OPC UA.

Server configuration on S7-1212C

  1. Enable OPC UA in the CPU properties.
  2. Add the S7-1200 OPC UA activation license (6ES7672-2WN00-0AA0, family-specific) or use the trial mode for engineering.
  3. Configure server endpoint, port (4840 default), and security policy (None, Basic128Rsa15, Basic256, Basic256Sha256).
  4. Expose DB tags as OPC UA nodes by checking "Accessible from OPC UA" on the data block attributes.
  5. Compile and download.

WinCC client configuration

  1. In the WinCC project, add the OPC UA driver (WinCC V7.4 SP1+ or TIA-based HMI).
  2. Point the driver at opc.tcp://192.168.0.10:4840.
  3. Browse the server namespace, drag tags into the tag management.

OPC UA is the recommended modern path because it supports encryption (TLS), authentication (certificates or username/password), and vendor-neutrality. It also lets non-Siemens SCADA packages read S7-1200 data without any additional Siemens software on the client side.

PLC Access Protection & Security Hardening

Hardening the S7-1212C is essential once it is connected to a network that includes the WinCC host. The following table summarizes the security-relevant CPU properties:

Setting Location in TIA Portal Recommended Value Rationale
Access level (Protection) Protection & Security > Access level Full access (no password) during commissioning, write-protected during production Prevents unauthorized download of modified programs
Permit access with PUT/GET Protection & Security > Connection mechanisms Disable if only OPC UA is used; enable if WinCC V7.x is the SCADA Minimizes attack surface on port 102
Know-how protection Block properties Enabled for FB/FC/OB that contain IP Protects algorithms from being read by competitors
OPC UA security policy OPC UA > Server > Security policies Basic256Sha256 + SignAndEncrypt for production Defeats passive sniffing on the network
PLC program password Protection & Security > Password for CPU 16+ characters Lowers brute-force risk

Tag Mapping & Variable Addressing

For the legacy WinCC V7.x path the addressing syntax is non-symbolic and requires careful bookkeeping. The table below covers the most common data types referenced from a S7-1212C data block named DB_Machine.

PLC Variable (TIA) DB Number Offset WinCC Address (V7.x) WinCC Data Type
DB_Machine.MotorOn 10 Byte 0, Bit 0 DB10,DBX0.0 Binary tag
DB_Machine.SpeedSetpoint 10 Word 2 DB10,DBW2 Unsigned 16-bit
DB_Machine.CurrentRPM 10 DWord 4 DB10,DBD4 Unsigned 32-bit
DB_Machine.Temperature 10 Real 8 DB10,DBD8 Floating-point 32-bit IEEE 754
DB_Machine.ErrorCode 10 Int 12 DB10,DBW12 Signed 16-bit
DB_Machine.SerialNo 10 String[16] starting at 14 DB10,DBB14 (length-prefixed byte stream) Text tag, 16 characters
Any byte inserted into the DB shifts all downstream offsets. When modifying the PLC program, always re-export the address list from TIA Portal (Tools > Address list) and update the WinCC tags accordingly. Mismatched offsets are the most common cause of "stuck" values in the SCADA graphics.

Commissioning Verification Checklist

Run this checklist before declaring the SCADA-PLC connection operational:

  1. Ping the S7-1212C from the WinCC station. Confirm reply time < 5 ms on a copper network.
  2. In TIA Portal, Online > Accessible nodes shows the PLC with its configured IP and PROFINET name.
  3. Force a Boolean in the PLC using the monitor/modify table. Observe the corresponding WinCC tag update in Graphics Designer.
  4. In the WinCC project, Tools > Status of connections (or Tag Management > Diagnostics) shows green status.
  5. Cycle time stays below the configured update rate; if WinCC is set to 1 s update and the channel reports 3 s cycles, check for network collisions or incorrect VLAN tagging.
  6. Disconnect the Ethernet cable from the S7-1212C. WinCC must report a connection failure within two scan cycles (status goes red).
  7. Reconnect; status recovers automatically.
  8. Review the WinCC diagnostic files (Diagnostics folder in the project directory) for "Quality = Bad" warnings.

Troubleshooting Matrix

Symptom Likely Root Cause Diagnostic Step Fix
WinCC cannot find the PLC in the channel wizard Different subnet or firewall blocking port 102 telnet 192.168.0.10 102 from the WinCC station Reconfigure subnet, add firewall rule for TCP 102
Connection succeeds but all tags show Quality=Bad PUT/GET disabled in CPU firmware V4.0+ TIA Portal > Device > Protection > Connection mechanisms Enable "Permit access with PUT/GET" and redownload
Tags read but values are scrambled Endian mismatch or DB optimized-block access enabled Compare WinCC address against the DB offset; inspect DB properties in TIA Portal Uncheck "Optimized block access" on the DB, recompile, redownload
OPC UA client cannot connect to S7-1212C OPC UA license missing or server disabled CPU Web server / diagnostics buffer; OPC UA Scout test Install OPC UA activation license; enable server in TIA Portal
HMI tag stays at zero in WinCC Professional Symbolic name changed after initial link HMI tags > Show all tags > "Compare with PLC" Re-link the HMI tag to the PLC symbol, recompile
WinCC V7.x crashes when activating runtime Project compiled against V7.3 SP3 update, runtime on lower SP Check WinCC Explorer > About for exact build number Install matching SP/Update on runtime PC
High cycle time on WinCC connection TCP offload disabled on the network card, or large tag count polled at 250 ms WinCC channel diagnostics > statistics Increase acquisition cycle, enable TCP offload, reduce tag count per scan
TIA Portal "Download to device" fails with "PROFINET device name does not match" PLC was commissioned with a different PG previously Online > Accessible nodes > Assign PROFINET name Right-click > Assign PROFINET device name, select the configured name

Documentation & Licensing References

Engineers performing this work should keep the following documents available:

  • SIMATIC S7-1200 Programmable Controller System Manual (Siemens entry ID 109759061).
  • SIMATIC S7-1200 Function Manual – OPC UA Server (Siemens entry ID 109769506).
  • WinCC V7.5 Communication Manual – S7-1200/S7-1500 Channel (Siemens entry ID 109751562).
  • TIA Portal Help – "Establishing an HMI connection" for the matching TIA version.
  • SIMATIC NET PC Software Commissioning Manual for OPC DA fallback paths.

Can an S7-1212C connect directly to WinCC SCADA without OPC?

Yes. WinCC V7.3 or later supports the SIMATIC S7-1200/S7-1500 channel natively over PROFINET. WinCC Professional/Advanced inside TIA Portal V13 SP1 or higher connects symbolically without any additional middleware. OPC is only required for WinCC versions older than V7.3.

Do I need TIA Portal to configure the SCADA link?

For WinCC V7.3/V7.4 the SCADA project is configured in WinCC Explorer, but TIA Portal is still required to program the S7-1212C and to enable PUT/GET access in the CPU protection settings. For WinCC Professional or Advanced inside TIA Portal, a single TIA project contains both the PLC and the HMI/SCADA configuration.

Which WinCC edition is the lowest cost for a single PC talking to S7-1212C?

WinCC Advanced (or WinCC Runtime Advanced on a PC) is sufficient for single-station HMI/SCADA against an S7-1200 and is significantly cheaper than WinCC Professional. Use Professional only if you need multi-user, web, or Process Historian features.

Why does WinCC V7.3 see the PLC but read garbage from the data block?

The data block is likely configured for optimized symbolic access in TIA Portal, which hides byte offsets from WinCC V7.x. Open the DB properties, uncheck "Optimized block access," recompile, redownload, and the WinCC tags will read correct values at the documented offsets.

Is OPC UA recommended over PUT/GET for new projects?

Yes. OPC UA on S7-1200 firmware V4.0+ supports encryption, authentication, and vendor-neutral clients, while PUT/GET sends unencrypted S7 frames on TCP port 102. For greenfield WinCC installations using WinCC V7.4 SP1 or TIA-based HMI, prefer OPC UA unless a legacy constraint forces PUT/GET.

Back to blog