S7-300 Radio Communication to WinCC Flexible PC Over 2 km

Problem Definition: 2 km Wireless Link Between S7-300 and WinCC Flexible

A WinCC Flexible Runtime must be operated on a PC located approximately 2 km from a SIMATIC S7-300 station built around a CPU 314. No cable run is available between the two, so the practical solution is a licensed or unlicensed-band industrial Ethernet radio link. On the PLC side it terminates at a CP 343-1 Lean communication processor — radio being the technique of communicating using electromagnetic radiation between 3 Hz and 300 GHz as defined for general radio communication principles. On the PC side the link terminates at a standard Ethernet NIC, with WinCC Flexible using S7 communication over ISO-on-TCP (RFC 1006) on TCP port 102.

Link Architecture Overview

The end-to-end topology is intentionally simple: a transparent Layer-2 bridge implemented with industrial-grade radio equipment replaces the cable. From the CPU 314's perspective, it is connected to an Ethernet network. From WinCC Flexible's perspective, the HMI station is connected to a SIMATIC S7-300/400 PLC over Ethernet. The radio pair is invisible to both the PLC program and the HMI runtime.

• PLC cabinet: CPU 314, CP 343-1 Lean, radio client, directional antenna.
• Control room PC: WinCC Flexible Runtime, Ethernet NIC, radio client, directional antenna.
• Air interface: 2.4 GHz, 5 GHz, or sub-GHz ISM band, point-to-point bridge mode.

Prerequisites and Frequency Planning

Before any hardware is specified, three items must be confirmed:

1. Local radio regulations. The frequency band, maximum EIRP, duty cycle, and need for link registration are regulated per country. The Siemens representative or the local telecom regulator must be consulted to confirm the allowable band (commonly 2.4 GHz, 5 GHz, or sub-GHz ISM) and EIRP limit.
2. Line-of-sight and Fresnel clearance. A reliable 2 km Ethernet radio link requires near line-of-sight with first-Fresnel-zone clearance of at least 60%. At 2.4 GHz the first Fresnel radius at the mid-point is approximately 11 m; the path must clear buildings, tree lines, and terrain by at least that amount.
3. Power and surge protection. 24 VDC at the PLC cabinet and a mains-fed PoE or AC supply at the PC end for the radio equipment. Lightning/surge protection is mandatory on every outdoor antenna feed.

PLC-Side Hardware Stack

The CPU 314 family does not include an integrated PROFINET or Ethernet port. Ethernet must be added via a CP module. The CP 343-1 Lean is the cost-effective choice and supports the connection types required by WinCC Flexible: S7 communication (ISO-on-TCP, RFC 1006) and PG/OP routing. The CP 343-1 (non-Lean) adds routing and additional IT functions but is not required for a single-PLC HMI link.

PC-Side Hardware Stack

Recommended Siemens Radio Family: SCALANCE W

For industrial-grade wireless Ethernet, the SCALANCE W family (e.g., W774-1, W778-1, W761-1) is the Siemens-recommended platform. Two devices configured in point-to-point bridge mode replace the generic "radiomodem" terminology and provide deterministic industrial behavior, IP65 housing for outdoor mounting, and integrated surge protection. Key features relevant to a 2 km S7 link:

• 2.4 GHz or 5 GHz operation; selected variants support 868 MHz.
• IEEE 802.11 a/b/g/n; up to 150 Mbps (802.11n) throughput.
• IP-based S7 communication — transparent to ISO-on-TCP frames.
• iFeatures for fast roaming if a second AP is added later.
• Web-based management on a dedicated service interface (HTTPS).
• Integrated MAC-based and WPA2/AES security for the air interface.

SCALANCE W devices operate at Layer 2 by default. They forward Ethernet frames, including the ISO-on-TCP frames that carry S7 communication, without modifying IP addresses or transport ports. This is the key reason WinCC Flexible requires no special radio driver.

IP Addressing Plan

Use a private subnet dedicated to the PLC-PC link to avoid routing conflicts. The recommended plan for a single HMI station is:

The 192.168.20.x subnet is used for device management (WebConfig, SSH, SNMP). The 192.168.10.x subnet carries the S7 traffic and is bridged transparently by the radio pair. Do not run S7 traffic through the management VLAN; keep the management plane isolated.

CP 343-1 Lean Configuration in STEP 7

The configuration can be performed in STEP 7 V5.5 or TIA Portal. The TIA Portal workflow is shown; STEP 7 V5.5 is functionally identical.

1. Open the S7-300 station in the project and insert the CP 343-1 Lean at slot 4.
2. In the CP properties, open "Ethernet interface" and assign IP 192.168.10.1, subnet 255.255.255.0. Disable router use unless a default gateway is required.
3. Open "Connection mechanisms" and enable both S7 communication and PG/OP communication. Confirm that the S7 port (102) is reachable from the PC subnet.
4. Add an S7 connection with the partner IP 192.168.10.2 (the PC's HMI station), using ISO-on-TCP and port 102. Set the local connection resource to "CPU" so that the CP routes the connection to the CPU 314.
5. Note the locally generated connection ID; this ID is used in STEP 7 programs for BSEND/BRCV or PUT/GET calls if the application requires them.
6. Compile and download the hardware configuration to the CPU and CP. The CP performs a restart; verify that the LINK LED on the CP front panel is solid green and that X1P1/X1P2 (port LEDs) reflect link state.

WinCC Flexible Connection Configuration

1. Open the WinCC Flexible ES project for the HMI station.
2. Open Project > Connections and add a new connection.
3. Select SIMATIC S7 300/400 as the PLC. Set the communication driver to S7 MPI/DP/Ethernet with Ethernet active.
4. Enter the HMI station's access point as the CP 343-1 Lean's IP 192.168.10.1.
5. Set the HMI station number and connection type to S7 connection over Ethernet (ISO-on-TCP), port 102. Rack 0, slot 2 corresponds to the CPU 314.
6. Compile the project and download the runtime to the PC. The WinCC Flexible Runtime starts the connection during startup.

If the PC is on a different physical segment bridged by the SCALANCE W pair, no additional routing is required at the WinCC level; the transparent Layer-2 bridge handles the frame forwarding.

Verifying the Link

Perform these checks in order before commissioning the HMI tag set:

1. Ping test. From the PC, execute ping 192.168.10.1 -t. A reply with sub-100 ms RTT confirms Layer-3 reachability. If ping fails, troubleshoot the radio and physical layer first.
2. S7 online test. In STEP 7 or TIA Portal, select Online > Accessible Nodes against 192.168.10.1. The CPU 314 should appear in the result list with its MPI address and rack/slot.
3. WinCC Flexible connection status. The runtime writes a connection log. The state must show "Connection established" or equivalent. An "Interrupted" or "Disabled" state indicates a mismatch in connection type or port.
4. Tag test. Configure a test tag that reads a known value from the CPU (e.g., MW0). Force a change in STEP 7 via a variable table and verify that the runtime display updates within 1–2 seconds.
5. Link quality. On the SCALANCE W web interface, monitor RSSI, SNR, and retransmit counters over a 10-minute window. For a 2 km line-of-sight link at 2.4 GHz, expect -60 to -75 dBm RSSI with no retransmits under normal conditions.
6. Sustained load test. Run the WinCC Flexible project for 24 hours while logging the connection state. Dropouts will appear as "Connection interrupted" events in the log.

Performance Budget

The radio link is not the bottleneck. A typical WinCC Flexible tag set of 200 tags polled at 1 s consumes roughly 40–80 kbps. A 2 km SCALANCE W link delivers tens of Mbps with proper antennas. The actual constraint is the CP 343-1 Lean, which supports 8 simultaneous S7 connections and a maximum aggregate of approximately 100 connections with firmware V2.x or higher. For a single HMI station, the CP is comfortably sized.

For a 200-tag HMI:

• Payload per tag: ~4 bytes (DBW or MW)
• Protocol overhead per request: ~50 bytes (S7 header + TCP/IP)
• Per-second throughput: 200 × 54 ≈ 11 kbps payload, 50–80 kbps with full overhead
• SCALANCE W capacity: 50+ Mbps effective — 600× headroom

Troubleshooting Matrix

Regulatory and Safety Considerations

A 2 km industrial link at 2.4 GHz with 8 dBi Yagi antennas can produce EIRP in the 20–30 dBm range. Many jurisdictions limit unlicensed 2.4 GHz EIRP to 20 dBm (100 mW) for point-to-multipoint, with point-to-point often allowed up to 30 dBm or more. Confirm with the local regulator before deployment. The general principles of radio communication as a method of transmitting information via electromagnetic radiation apply regardless of band, but the legal limits are jurisdiction-specific.

Lightning protection is mandatory for any outdoor antenna. Use a DC-grounded gas-discharge surge protector at the building entry point and bond the antenna mast to a low-impedance earth (≤ 10 Ω). Without proper bonding, a nearby lightning strike will induce surge currents on the shield that destroy the radio's Ethernet port and propagate into the PC and PLC.

Bill of Materials Summary

1. CPU 314 (6ES7314-1AG14-0AB0 or equivalent current part)
2. CP 343-1 Lean (6GK7343-1CX10-0XE0)
3. SCALANCE W778-1 or W774-1 (2×), N-connector or M12 variants as required
4. Outdoor directional antennas (2×), matched band and gain to EIRP budget
5. Coaxial jumpers (2×), LMR-400, N-male connectors, < 5 m each
6. Lightning surge arrestors (2×), gas-discharge, DC-grounded
7. IP65 junction boxes for radio mounting (2×)
8. Industrial PC with Windows IoT or approved Windows version and 1 Gbps Ethernet
9. WinCC Flexible Runtime license (RT 128 / RT 256 / RT 512 / RT 1024 / RT 2048 / RT 4096)
10. STEP 7 V5.5 or TIA Portal for CP configuration
11. Earthing kit and bonding conductors for antenna masts

Field-Commissioning Checklist

• Radio firmware on both SCALANCE W units is the latest released version for the product family.
• CP 343-1 Lean firmware ≥ V2.x; check release notes for known issues with newer STEP 7 versions.
• WinCC Flexible ES and Runtime versions match; mixing ES 2008 SP3 with RT 2008 SP1 is acceptable, but mixed major versions are not.
• Antenna alignment tool or compass used during aiming; aim with 1° precision at 2 km.
• Link test packet capture shows < 1% packet loss over 10 minutes at full offered load.
• WinCC Flexible connection log shows 0 dropouts over 24 hours of operation.
• Spare radio and spare CP configured and bench-tested for swap-in replacement.

Alternatives and Edge Cases

If 2.4 GHz or 5 GHz is congested, a sub-GHz solution such as the SCALANCE W761-1 family operating in the 868 MHz or 900 MHz ISM band offers better propagation through vegetation and buildings, at the cost of lower bandwidth (typically 10–20 Mbps effective). For 2 km with clear line-of-sight, 2.4 GHz is the cost-effective default.

If the path is not line-of-sight (e.g., the PC and PLC are separated by a building), consider a repeater topology: SCALANCE W AP at an intermediate point with PV power if no mains is available. Repeater latency is on the order of 1–5 ms per hop, which is acceptable for WinCC Flexible.

If the customer requires deterministic latency (e.g., for safety functions), do not use a best-effort radio link. Use wired Ethernet with media converters over fibre, or use a safety-rated radio such as the SCALANCE W family with iPCF mode and PROFINET over WLAN. WinCC Flexible HMI traffic is not safety-rated and tolerates standard Wi-Fi jitter without issue.

FAQ