S7-400: Configuring Four PLCs in WinCC Flexible via Ethernet

Architecture Overview

When four SIMATIC S7-400 CPUs must be visualized from a single engineering notebook or operator terminal, the HMI software must hold four simultaneous S7 connections and expose each PLC's data areas as discrete tag namespaces. The two Siemens-native runtime paths are WinCC flexible PC Runtime (legacy) and TIA Portal WinCC RT Professional / WinCC Unified PC RT (current). Both operate as a TCP/IP client that opens ISO-on-TCP (RFC 1006) sessions against CP 443-1 modules mounted in the S7-400 racks.

The most important architectural decision is whether the four PLCs share a single Ethernet subnet or sit on separate subnets. WinCC flexible PC Runtime uses the Windows TCP/IP stack and depends on the S7ONLINE access point for transport; it cannot bridge subnets without an IP router or Layer-3 switch, so the four PLCs must be reachable through a default route. If the production line is segmented, configure static routes or use the S7 routing capability of the CP 443-1.

Prerequisites

Before configuring the runtime, verify the following items.

For current-generation projects, replace WinCC flexible with TIA Portal WinCC V17 / V18 / V19 and use the S7-400 as a "HMI-device capable" partner. WinCC flexible was discontinued by Siemens in 2017 (last public release 2008 SP5 HF17) and remains functional but receives no further patches.

Connection Capacity of WinCC Flexible PC Runtime

WinCC flexible PC Runtime stores its connection limits in the registry under HKLM\SOFTWARE\Siemens\Automation\WinCC flexible\RT\Connections. The maximum number of simultaneously active controller connections is controlled by the MaxConnections value.

For four S7-400 PLCs, the default limit (8) is more than sufficient. The limit matters when the same runtime also connects to a third-party device (e.g. a Modbus TCP meter) or to additional HMI stations. If the registry value is exceeded, WinCC flexible logs event 1000202 "Connection not established, maximum number of connections reached" in the Windows event log.

S7-400 Ethernet Hardware Configuration

Each S7-400 must be equipped with at least one CP 443-1. Insert the CP in the rack (slot 1–4 depending on the power supply configuration), assign an IP address, and enable the S7 protocol with the "S7 communication" checkbox. The CP 443-1 maintains a connection table; WinCC flexible Runtime initiates S7 connections as a PG/PC-type connection, and the CP allows up to 64 S7 connections on the EX30/EX50 modules. Four HMI connections therefore consume 4 of 64 resources, leaving headroom for STEP 7 online, other HMIs, and S7 routing.

STEP 7 V5.5 Hardware Configuration (per PLC)

1. Open the S7 project in STEP 7 V5.5.
2. In HW Config, drag the CP 443-1 (e.g. 6GK7 443-1EX30-0XE0) into the rack.
3. Double-click the CP and assign:
   • IP address: e.g. 192.168.10.41 (PLC 1), 192.168.10.42 (PLC 2), 192.168.10.43 (PLC 3), 192.168.10.44 (PLC 4)
   • Subnet mask: 255.255.255.0
   • Router address: (blank for single subnet)
4. Under Properties → Interface → S7 Communication, ensure the option is active.
5. Download the hardware configuration to the PLC.
6. Test the CP from the engineering station: ping 192.168.10.41. A reply confirms the L2 stack is alive.

Network Topology and Performance

On a single 100 Mbit switch, ISO-on-TCP (RFC 1006) overhead is roughly 20 % of payload. Each S7 poll cycle is typically 2–4 packets (request + ack + ack-data + ack). With four PLCs at 1 s acquisition, bandwidth use is below 0.5 % of the 100 Mbit capacity. Latency budget per PLC: < 10 ms.

If the four PLCs are on separate VLANs/subnets, configure the CP 443-1's S7 routing capability: enable "S7 routing" in the CP properties, then in STEP 7 NetPro → S7 Connection → Properties → Gateway add the IP router. Verify with tracert 192.168.10.41 from the runtime PC.

Configuring WinCC Flexible Connections

In the WinCC flexible project, open Project → Connections and add four S7-400 connections.

TSAP (Transport Service Access Point) on the S7-400 defaults to 01.01; the WinCC flexible Runtime side defaults to 01.01 as well. If the CP has been configured with a non-default TSAP, match it exactly — mismatched TSAPs are the most common cause of "Connection not established" alarms at startup.

For each connection:

1. Set Communication Driver = "SIMATIC S7 300/400".
2. Set PLC Address = IP address above.
3. Set Expansion Slot = rack/slot of the CPU (e.g. 0/3 for slot 3 in rack 0).
4. Set Connection Type = ISO-on-TCP (Port 102).
5. Leave Activate connection when starting Runtime = "Yes" so WinCC flexible cycles the connection in case of failure.

Change Connection Function

WinCC flexible exposes a system function ChangeConnection that lets the operator switch the runtime's active connection from the HMI. This is useful when the four PLCs perform identical operations on parallel lines and the operator wants to monitor only one line at a time.

Pattern A — All four connections always active (recommended)

Leave the four connections configured as always active. WinCC flexible Runtime maintains ISO-on-TCP sessions with all four PLCs simultaneously and updates tags from each. Tags are namespaced by connection name (e.g. PLC_LINE1\DB10.DBX0.0). Refresh cycles are configured per connection; default is 1 s. With four active connections, expect a CPU load of roughly 3–5 % on a Core i5 / 8 GB notebook.

Pattern B — Switch using ChangeConnection

Use a screen with four buttons, each calling the system function in the click event:

// WinCC flexible ST script (button click)
ChangeConnection("PLC_LINE1");

The function switches the runtime's current connection for the selected screen object. Note that all configured tags remain — only the displayed faceplate is re-bound. To truly free a connection for another device, use the Connect / Disconnect system functions.

Tag and Variable Configuration

Tags must be created under the connection they belong to. WinCC flexible does not aggregate tags from multiple connections into a single namespace.

Naming convention: prefix every tag with the line identifier (LINE1_, LINE2_ …) to avoid collisions when porting screens.

Verification and Commissioning

1. Compile the project: Project → Compiler → Check Consistency. No warnings should reference missing connections.
2. Start Runtime in simulation: Project → Start Runtime. Open the Diagnosis window (View → Diagnosis) and verify four green connection icons.
3. Read a known tag: Insert an I/O field bound to PLC_LINE1\DB10.DBW0 and toggle the value in the PLC (VAT). Confirm the field updates within one acquisition cycle.
4. Force a connection drop: Disconnect the Ethernet cable from PLC 3. WinCC flexible logs Event 14001 / 14002 ("Connection interrupted"). Reconnect and verify automatic re-establishment within 30 s.
5. Check CP connection resources: In STEP 7, CP 443-1 → Diagnostics → Connections. Confirm four "PG/PC" entries from the runtime IP.
6. Stress test: Set all acquisition cycles to 100 ms. Runtime CPU should remain below 15 % on a modern dual-core. If higher, raise the lowest-priority cycle to 500 ms.

Troubleshooting Matrix

Alternative HMI / SCADA Platforms

For an existing four-PLC S7-400 line, sticking with Siemens WinCC (either flexible PC Runtime for retrofits or TIA Portal WinCC for new projects) avoids driver licensing and engineering overhead. Third-party panels from ABB or IDEC only become attractive when one of the four PLCs must be replaced with a non-Siemens controller.

Migration Path: From WinCC Flexible to TIA Portal

For new projects or plants upgrading from Windows 7 / 8 to Windows 10 / 11, migrate the WinCC flexible project to TIA Portal WinCC. The migration is straightforward because the S7 driver is binary-compatible at the wire level.

1. Install TIA Portal V18 or V19 with the WinCC Professional option.
2. Open the existing STEP 7 V5.5 project; TIA Portal's migrator ("Project → Migrate to TIA Portal") converts it to a TIA project.
3. Add a new HMI device: HMI → PC-System → WinCC RT Professional.
4. In the HMI's Connections editor, add the same four S7-400 partners. TIA Portal pre-fills IP addresses from the migrated PLC configuration.
5. Transfer tags from the WinCC flexible tag database using the OPC import wizard or the WinCC flexible converter ("WinCC flexible → WinCC" migration tool).
6. Compile and start RT Professional; verify the four connections in the runtime Diagnosis view.

FAQ