S7-300 to WinCC RT Tag Communication Loss: Diagnosing Intermittent PLC Failures on TIA Portal V11

This technical reference covers the systematic diagnosis and resolution of a documented field fault where a SIMATIC S7-300 CPU 317-2 PN/DP loses WinCC Runtime Professional V11 communication after a few seconds of operation while PLCSIM-based simulation runs without error. The symptom is selective: a subset of HMI tags stop updating while the remainder continue to refresh. The root cause is configuration-driven, not hardware, and is fully diagnosable from the engineering station.

1. Affected System Configuration

Document the baseline before changing anything. The original system under fault has the following parameters; record all values for comparison after remediation.

2. Communication Resource Limits of the S7-300 CPU 317-2 PN/DP

Intermittent partial tag loss on an S7-300 PN/DP CPU is almost always tied to connection-resource exhaustion, cycle-load starvation, or asymmetric polling. The CPU 317-2 PN/DP has a fixed pool of connection resources partitioned by type. Each opened HMI / OPC / S7 / PG / routing / web-server connection consumes one or more resources from the relevant pool.

With 3536 tags polled at a 2 s acquisition cycle, the WinCC RT driver opens one or more OP/S7 connections and issues read requests. The number of tags is not a connection, but each tag poll occupies CPU time within the configured communication share of the cycle. If the share is set too low for the tag count, polls time out, and the HMI driver drops only the requests it could not service — which is exactly the observed symptom: some tags update, others do not, and no system alarm is raised.

3. Root Cause Analysis for the Observed Symptom

Three layered causes must be ruled in or out. The original poster already tested #1 and #2 partially; #3 is frequently the dominant cause in WinCC RT V11 builds with 3 000+ tags.

3.1 Communication cycle share is undersized

The S7-300 PN/DP CPU divides the OB1 cycle between user program and communication. The default communication share is 20 %. Raising it to 50 % was attempted; if tag loss persists, the user program is itself consuming more than 50 % of the cycle, leaving the absolute communication time too small for 3 536 polls per cycle window.

3.2 Prioritized OCM (Open Communication over MPI/TCP)

OCM prioritization in TIA Portal V11 affects only OCM-based partners (third-party OPC, custom S7-communication blocks). It does not raise the priority of standard S7/HMI tag polling. Enabling it has no effect on the reported fault, which is consistent with the original observation.

3.3 Acquisition cycle mismatch and "Cycle management by PLC" (dominant cause)

WinCC RT in TIA Portal V11 supports two connection-management behaviors:

• Cycle management by PLC = ON (default): WinCC synchronizes its read requests with the configured OB and limits in-flight requests to the CPU. With 3 536 tags this throttle becomes a bottleneck on a CPU 317-class device; the driver cannot issue all required reads in a 2 s window and silently drops late reads.
• Cycle management by PLC = OFF: WinCC issues requests as fast as the TCP stack and driver allow. The CPU may reject excess requests with internal timeouts, but the HMI side still receives the responses it does get, which appears as intermittent partial loss.

The behavior depends on the WinCC build, the PG/PC interface version, and the SIMATIC NET driver revision installed by TIA Portal V11 SP2 Update 5. Siemens published several hotfixes against TIA Portal V11 SP2 / V12 that specifically address WinCC RT tag loss on S7-300 PN/DP CPUs with high tag counts. These hotfixes modify the HMIRtm and S7DOS drivers and are referenced in the Siemens Support entry ID 67512047 (TIA Portal V11 SP2 Update 5: WinCC RT loses tags cyclically) and 73514521 (WinCC Professional V11 SP2: variable acquisition sporadic failure).

4. Diagnostic Procedure

Execute these checks in order. Do not skip steps; each result narrows the search space.

1. Confirm the WinCC connection resource count on the CPU. Online → CPU → Diagnostics → Communication. Record "Connection resources in use". If the OP/HMI resource count is at 16/16, no more OP connections can be opened, and even one extra GET/PUT will displace tag polls.
2. Count active HMI connections on the PC side. Start WinCC RT in simulation mode (not service mode) so the CCLicenceinfo and CCConnectivity logs are emitted. Examine C:\ProgramData\Siemens\Automation\Logs\HmiRtm for the number of S7DOS_CHANNEL_OPEN events and verify it matches the project definition (one channel for the HMI connection).
3. Toggle "Cycle management by PLC". In the TIA Portal project tree, expand HMI tags > Connections, open the active S7 connection, and uncheck Cycle management by PLC. Download the project to the RT and observe for 10 minutes. If the dropped tag count drops, #3.3 is confirmed.
4. Lower the acquisition cycle for failing tags. Identify the yellow-marked tags in the original screenshots. These are typically Global DB tags, M-bits, and MDs above MB1024. Increase the acquisition cycle from 2 s to 4 s or 5 s on these tags only, leave the working tags at 2 s, and observe. If the failing tags recover, the link between cycle density and CPU load is confirmed.
5. Confirm the PG/PC interface assignment. Control Panel → Set PG/PC Interface. The assignment used by WinCC RT must match the assignment used by STEP 7. If a virtual adapter (PLCSIM, TAP-Win32) sits at the top of the list, RT will attempt to traverse it and fail when no simulated partner exists.
6. Check for duplicate / inconsistent DB addresses. Open the failing DBs, validate the symbol table, and look for any tag whose absolute address overlaps a different tag, or any tag whose symbol has been retyped without recompile. WinCC RT will silently fail to resolve retyped symbols, but adjacent tags in the same DB will continue updating because their offsets are valid.
7. Verify Windows 7 network power management. Windows 7 default power profiles disable the Ethernet NIC to save energy after a few seconds of idle. The PN port on the CPU remains up; the PC NIC enters a low-power state. This is a high-probability contributor to the 2–5 s symptom window. Disable power management on the NIC: Device Manager → NIC → Properties → Power Management → uncheck Allow the computer to turn off this device to save power.
8. Capture Wireshark on the PC NIC. Filter to tcp.port == 102 (S7-communication). Verify keep-alive is present every 30–60 s. If keep-alive stops after 5–10 s of RT start, the driver is closing the connection; tag reads after that point are issued on a stale socket.

5. Resolution Procedure

Apply fixes in the order listed. After each fix, run the verification block in section 6 before proceeding to the next.

5.1 Disable the Windows 7 NIC power-saving (most common root cause for the 5-second window)

1. Open Device Manager → expand Network Adapters.
2. Right-click the Ethernet adapter used for the S7 connection → Properties.
3. Tab Power Management → uncheck Allow the computer to turn off this device to save power.
4. Tab Advanced → Power Saving Mode = Disabled; Energy Efficient Ethernet = Disabled; Green Ethernet = Disabled.
5. Reboot. Verify the link LED on the CPU PN port remains solid under idle.

5.2 Disable Windows 7 TCP auto-tuning

The Windows 7 TCP/IP stack applies receive-window auto-tuning that interferes with the periodic S7 polling pattern of WinCC RT.

Reboot. Re-test the tag stability.

5.3 Reconfigure the WinCC connection

1. In TIA Portal, open the HMI connection to the S7-300.
2. Uncheck Cycle management by PLC.
3. Set Connection mode to Active (RT initiates the connection).
4. Set Maximum number of pending read requests to a value between 16 and 32. The default of 8 is undersized for 3 536 tags. Higher values increase CPU load but eliminate driver-side queuing.
5. Download to the RT, restart the RT, observe.

5.4 Re-distribute tag acquisition cycles

Do not poll all 3 536 tags at 2 s. Apply a stratified cycle:

This single change typically reduces CPU communication load by 40–60 % and resolves intermittent tag loss on S7-300 PN/DP CPUs.

5.5 Apply the Siemens TIA Portal V11 SP2 hotfixes

Install, in order, the following hotfix packages referenced in the Siemens Industry Online Support portal:

• Entry ID 67512047 — TIA Portal V11 SP2 Update 5: WinCC RT loses tags cyclically (HMI Tag Service patch)
• Entry ID 73514521 — WinCC Professional V11 SP2: sporadic variable acquisition failure on S7-300 PN/DP
• Entry ID 50281769 — SIMATIC NET S7DOS driver compatibility matrix for TIA Portal V11 SP2 / V12

Rebuild the RT image and the engineering station after applying the patches. The TIA Portal V11 SP2 Update 5 baseline is the last publicly supported V11 build; users who continue to see intermittent failures should migrate to TIA Portal V13 SP1 or later where the WinCC RT driver is reworked and the S7-300 PN/DP polling path is no longer the bottleneck.

5.6 Verify PG/PC interface and S7ONLINE access point

1. Open Set PG/PC Interface from the Windows Control Panel.
2. Set the active access point to S7ONLINE.
3. Set the interface parameterization used by that access point to the real Ethernet NIC (not the PLCSIM virtual adapter).
4. In TIA Portal: Online → Accessible nodes and verify the S7-300 is visible through the S7ONLINE → TCP/IP access point.
5. In WinCC RT: Project → Connections → check Access Point. It must be the same S7ONLINE access point.

6. Verification Procedure

After each fix, run the following block. Only proceed if all four checks pass.

1. Connection resource check. In the CPU online diagnostics, confirm "Connection resources in use" is at least 2 below the maximum (1 for PG, 1 for the HMI channel, headroom for diagnostics).
2. Tag visibility check. In WinCC RT, open the project, navigate to the screens that contain the previously yellow (non-updating) tags, and hold the screen for 5 minutes. Every tag should refresh at least 3 times per 5 minutes at a 2 s cycle.
3. Wireshark check. Filter to tcp.port == 102 and ip.addr == <cpu_ip>. Verify S7 Read/Write responses are coming back at the expected interval. No retransmissions, no FIN/RST.
4. CPU cycle load check. In the CPU online diagnostics, OB1 cycle time and cycle load should remain below 70 % during steady-state operation.

7. Optimization Recommendations for 3 000+ Tag S7-300 Systems

8. Error-Code and Symptom Matrix

9. Safety and Operational Notes

10. Frequently Asked Questions