S7-1500 to WinCC V7.2 Communication: Fixing Disconnected Status

1. Overview of the WinCC V7.2 to S7-1500 Communication Stack

Connecting a SIMATIC S7-1500 controller to a WinCC V7.2 SCADA station requires alignment across three independent configuration layers: the PG/PC interface on the engineering station, the S7ONLINE symbolic access point used by SIMATIC software, and the SIMATIC S7-1200, S7-1500 Channel within the WinCC project. A failure at any of these layers surfaces identically inside the WinCC Explorer as a disconnected status indicator on the connection object, which is why the symptom is so frequently mistaken for a network or CPU fault when the actual cause is a software-binding mismatch.

WinCC V7.2 introduced native support for the S7-1500 family via the dedicated SIMATIC S7-1200, S7-1500 Channel, eliminating the older SIMATIC S7 Protocol Suite requirement and providing direct S7-communication over TCP/IP without the need for an OPC relay or an S7-PLCSIM bridge. The official channel documentation is published in the Siemens support portal under entry 101908495 - WinCC Communication to S7-1500, S7-1200 and ET 200SP.

Because the S7-1500 does not speak the legacy MPI or ISO-on-TCP dialects used by older WinCC channels, only the TCP/IP variant of S7-communication is supported. This means that any production PC running WinCC V7.2 against an S7-1500 must have at least one Intel, Broadcom, or Realtek network adapter that the SIMATIC Net PC Software can bind to via its NDIS-access drivers.

2. Problem Description: Persistent Disconnected Status in WinCC

The fault pattern reported by integrators is consistent and recognizable:

• The CPU is reachable: ping <CPU_IP> returns replies with sub-millisecond latency on a healthy switched segment.
• TIA Portal online functions (Go online, Online & diagnostics) connect to the same CPU without errors, proving that routing and TCP/IP are intact.
• Inside WinCC Explorer, the S7-1500 connection object shows a red icon and the status Disconnected. The status does not transition to Connecting or Connected at any point.
• No diagnostic buffer entries are produced on the CPU itself, because the CPU never receives an S7-communication Connection Request (CR) packet - the request is blocked or routed to the wrong network adapter at the PC.
• In some configurations, switching the PG/PC interface assignment to the correct adapter triggers a Windows dialog: "If you select this interface you will no longer be able to establish an online connection via the router!"

The presence of the router warning dialog is a strong indicator that the PG/PC interface was previously bound to a TCPIP.Auto.<n> symbolic assignment rather than a fixed TCPIP.<n> entry, and that the S7ONLINE access point was pointing to a different NIC than the WinCC channel.

3. Prerequisites: Software and Hardware Requirements

Before changing any settings, confirm the following baseline:

4. Root Cause Analysis: S7ONLINE Access Point and PG/PC Interface

WinCC does not open a raw TCP socket to the CPU. Instead, the SIMATIC S7-1200, S7-1500 Channel makes function calls into the S7ONLINE symbolic access point, which is a logical name (an alias) bound by the OS to a specific physical NIC through the PG/PC Interface applet in the Control Panel. When the binding is wrong, every connection request from WinCC is dispatched to an adapter that is either disconnected, on the wrong subnet, or bound to a virtual NDIS driver that has no route to the PLC.

The default Windows behavior for an unconfigured S7ONLINE is to fall back to TCPIP.Auto.1, a Microsoft-defined auto-assignment that lets the OS choose the first available interface. This is acceptable for laptops that roam between machines, but in a fixed engineering or runtime station it is fragile - the auto-numbering can change after a driver update or a NIC enable/disable cycle.

Siemens documents the principle in the official FAQ 38717202 - Why is communication between the Runtime simulation and the S7-1200/S7-1500 not possible if the PG/PC interface is not set correctly? The document makes two non-negotiable statements:

1. The S7ONLINE access point must be assigned a fixed TCPIP.<n> interface - not TCPIP.Auto.<n>.
2. The interface index <n> must correspond to the network adapter whose IPv4 address is in the same subnet as the S7-1500 CPU.

5. Network Adapter Selection and TCPIP.1 vs TCPIP.Auto.1

The PG/PC Interface applet exposes three classes of entry that look similar in the dropdown but behave very differently:

On a typical engineering workstation with an Intel I219-LM (the index 1 adapter seen as 8275LM in the Siemens driver listing) and a secondary Broadcom NetXtreme (index 2, shown as 8275L), the correct binding for a WinCC-only segment is the index 2 adapter because it is wired to the plant network, while the index 1 adapter is reserved for TIA Portal online access through the office LAN.

The relevant diagnostic question when a connection fails is therefore: Which TCPIP.<n> is currently selected under S7ONLINE, and which one does the WinCC channel's logical IP point to? In the case captured in the field report, the S7ONLINE access point was moved from TCPIP.Auto.1 to TCPIP.2 (the 8275L TCP Auto entry), and the connection immediately came up.

6. Configuring the SIMATIC S7-1200, S7-1500 Channel in WinCC

Once the PG/PC interface is anchored, the WinCC side requires only a handful of parameters:

1. In WinCC Explorer, right-click Tag Management and select Add New Driver → choose SIMATIC S7-1200, S7-1500 Channel. Do not select SIMATIC S7 Protocol Suite - that channel is for S7-300/400 legacy projects and will not negotiate with an S7-1500.
2. Open the new driver, right-click Connections, and choose New Connection.
3. Configure the connection properties:

Tags are then created under the connection by referencing DB blocks, inputs, outputs, or bit memory. WinCC automatically generates the underlying S7 PUT/GET requests; no explicit PUT/GET instructions are required in the TIA Portal user program because the WinCC channel is the remote partner.

7. Step-by-Step Commissioning Procedure

The full commissioning sequence below resolves the disconnected symptom and establishes a stable link:

1. Verify CPU settings in TIA Portal. Open the device configuration of the S7-1500, navigate to Properties > Protection & Security > Connection mechanisms, and enable Permit access with PUT/GET communication from remote partner. Compile and download to the CPU.
2. Confirm network reachability. From the WinCC PC, open a command prompt and execute ping <CPU_IP> -t. Verify sub-millisecond latency and zero packet loss. If the ping fails, the problem is at the Layer-2/3 level, not the WinCC channel.
3. Confirm TIA Portal online works. Use Online > Go online in TIA Portal to validate that the PC can already do S7-communication to the CPU via the currently active PG/PC interface. Note the adapter index used.
4. Install or repair SIMATIC Net PC Software. Insert the WinCC V7.2 setup DVD stack and run the SIMATIC Net PC Software installer. Match the version to the OS: V7.1.6 for Windows XP, V8.2 SP2 for Windows 7. The package installs the S7DOS and NDIS access drivers required by the channel.
5. Open the PG/PC Interface applet. From Control Panel, launch Set PG/PC Interface. Under Access Point > S7ONLINE, change the assignment from TCPIP.Auto.1 to a fixed TCPIP.<n> entry pointing to the NIC whose IPv4 address is in the same subnet as the CPU.
6. Acknowledge the router warning. If Windows shows "If you select this interface you will no longer be able to establish an online connection via the router!", click OK. This dialog appears when the previous binding was a router-anchored auto entry. Confirm that the TIA Portal online connection still works after the change.
7. Reboot the PC. SIMATIC Net NDIS drivers do not always re-bind cleanly without a full restart. Skipping this step leaves a phantom binding in the registry.
8. Configure the WinCC channel. Add the SIMATIC S7-1200, S7-1500 Channel as described in Section 6. Enter the CPU IP address and verify that the access point defaults to S7ONLINE.
9. Activate WinCC Runtime. Open the runtime project and observe the connection icon transition from red (Disconnected) to yellow (Connecting) to green (Connected) within 3-5 seconds.

8. Verification and Diagnostics

After the channel reports Connected, perform the following verification steps before declaring the link production-ready:

• Tag read test: Create a temporary internal tag mapped to a known DB1.DBX0.0 value in the CPU. Toggle the bit from TIA Portal and confirm the tag updates in WinCC within one configured cycle.
• CPU diagnostic buffer: Inspect Online & diagnostics > Diagnostic buffer on the CPU. Each WinCC connection establishment logs an Communication connection established event with the partner IP and AR identifier.
• Channel diagnostics: In WinCC Explorer, the connection object exposes a Connection status field and a Quality field per tag. Quality must read Good (192) for healthy values.
• Wireshark trace (optional): Capture TCP traffic on the WinCC NIC while the channel starts. Confirm that S7-communication Connection Request (CR) packets are sent from the PC's IP to the CPU's IP on port 102 (ISO-TSAP). Absence of these packets confirms a binding problem; presence followed by Connection Refused confirms an authorization or firmware issue.

9. Common Error Messages and Pitfalls

Several dialog boxes and error codes surface during installation and commissioning. The following list catalogs the most frequently encountered ones with their interpretation:

10. Simatic Net PC Software: Version Matrix

SIMATIC Net PC Software is the host-side stack that implements the S7-communication transport for WinCC. The version must match the operating system exactly because the NDIS-access driver is OS-version specific:

The setup DVDs are physically shipped together with the WinCC media kit. Siemens does not publish a public download link for the full DVD image - a local distributor or the SIOS portal under the customer's account is the only legal source. Hotfixes are distributed separately through the Siemens Industry Online Support update service.

11. Hardware Considerations: CPU Ports vs Communication Processors

An S7-1500 CPU exposes one or two PROFINET ports directly on the front of the module (labelled X1 and, on larger CPUs such as the CPU 1517 or CPU 1518, X2). WinCC can communicate over either integrated port without any additional hardware - the PROFINET interface is also a standard TCP/IP interface and the S7-communication rides on top.

Where an external communication processor adds value:

• Network segmentation: A CP 1543-1 can be placed on the plant network while the CPU PROFINET port remains on the machine network, isolating WinCC traffic from I/O traffic.
• Security gateway: The CP 1543-1 implements a stateful firewall and supports IPsec; this is the recommended path when the SCADA station sits in an untrusted zone.
• Routing: If the SCADA PC and the CPU are on different subnets separated by a Layer-3 switch, configuring the CP as a router avoids touching the office firewall.

The reference to a CP 1512 in the source query is a transcription artifact - the catalog module in this position is the CP 1542-5 (PROFIBUS) or CP 1543-1 (TCP/IP). For pure TCP/IP S7-communication to WinCC, the CP 1543-1 (6GK7543-1AX00-0XE0) is the correct module number to order.

12. Frequently Asked Questions