Troubleshooting WinCC Communication with VIPA 315-2AG23 PLC

Problem Overview

A hydro power plant SCADA installation runs four Siemens SIMATIC S7-315-2 DP CPUs (MLFB 6ES7 315-2AF01-0AB0) connected to a WinCC HMI server over MPI using a CP5611 communication processor on the engineering station. After one CPU was swapped for a VIPA 315-2AG23 (a third-party S7-300 drop-in replacement, sometimes marked with the Siemens-styled MLFB 6ES7 317-2AK14-0AB0 in distributor catalogs), the new controller enters RUN with no diagnostic LED indication, but the WinCC station cannot establish a connection. The PLC does not appear in the S7 channel diagnostic tree and the user program is not being polled.

This article documents the field-proven diagnostic sequence for separating hardware-fault, configuration, and protocol-resource causes when a non-Siemens CPU is dropped into a Siemens SCADA topology.

Affected Components and Versions

Root Cause Analysis

There is no single cause for "RUN LED is on, WinCC cannot connect." The failure tree must be walked top-down. The five most common root causes observed when a VIPA is dropped in for a Siemens 315-2 in a CP5611/MPI WinCC topology are:

1. MPI address collision or default mismatch. The VIPA may default to MPI address 2 or 0, not the address STEP 7 was projecting (typical hydro-plant scheme uses 8). The CP5611 may already be holding that address on the engineering PC side.
2. Slot number mismatch. WinCC expects Rack 0 / Slot 2 for a S7-300 CPU. Some VIPA speed7 cores respond to slot 3 or 2 depending on the support package revision.
3. Baud rate mismatch. CP5611 must match the CPU's MPI bus profile. The VIPA's highest MPI station address and bus baud rate are independent registers; the default 187.5 kbps is correct, but if the project was raised to 1.5 Mbps the VIPA must be set the same way.
4. OP/PG communication resources exhausted. The CPU has a fixed budget of connection resources for PG/OP (S7-300: max 12 OP connections). Each WinCC channel opens one resource; once a VIPA is configured with too many simultaneously active S7 connections (PG, OP, S7-basic, S7-PG, S7-HMI), the 12th connection attempt returns an S7 protocol error.
5. Access point of the CP5611. WinCC's S7 channel must be bound to S7ONLINE -> CP5611(MPI) rather than the soft-net card. If a soft MPI or a different physical port is selected, the channel will not open the bus and no error code is reported in the tag list itself — only in the channel diagnosis.

Step-by-Step Diagnostic Procedure

1. Verify physical layer and bus topology

1. Open Set PG/PC Interface from the Windows Control Panel (on the engineering station).
2. Select CP5611(MPI) -> S7ONLINE as the access point assignment.
3. Click Properties, confirm Transmission rate = 187.5 kbps and Highest MPI address = 31 (default).
4. Click Diagnostics. The MPI network panel must list the live stations. The Siemens 315-2 nodes should appear with their configured addresses; the new VIPA node should also be visible with its actual MPI address (commonly 1 or 2 by default). If the VIPA is not listed, the bus is open or the VIPA's MPI address is outside the scan range.
5. On the VIPA side, lift the cover over the MPI X1 port. The 9-pin D-sub should be wired identically to the Siemens CPU (pin 3 = data B, pin 8 = data A). Do not add a 24 V terminator; the MPI bus uses passive 220 Ω terminators at both physical ends only.

2. Verify the CPU's MPI address

The Siemens CPU used in the project is set to MPI address 8. The VIPA may ship with 1 or 2. Use the VIPA CPU's mode selector (the small rotary switch on the front) to set the address, or use the VIPA SPEED7 tool / the VIPA entry in STEP 7 hardware catalog to push the configuration. Validate with Set PG/PC -> Diagnostics that the VIPA now reports as Address 8.

3. Verify the slot number in the WinCC project

Open the WinCC Explorer, navigate to the S7 channel driver, and open the connection properties for the affected PLC. The expected value is:

Station Address = MPI:8
Rack = 0
Slot = 2

For S7-300 the slot is always 2. For S7-400 the slot varies. The VIPA Speed7 core normally responds at slot 2, but in some VIPA support-package revisions slot 3 is required. If you are unsure, run the WinCC Channel Diagnosis tool (Start -> Programs -> Siemens Automation -> WinCC -> Tools -> Channel Diagnosis) and read the projected connection string.

4. Read the S7 channel error code

The hex string reported by the user in the source thread — ProjectedConnectionAddress MPI,8 0,,0,3,02 — must be parsed as bus = MPI, station = 8, rack = 0, slot = 2 (the trailing 0,3,02 decode to connection type=0 (S7), resource=3, slot=02). The fact that the project string is present means WinCC does know about the connection; the failure is at the physical link. Pull the full last-error hex code from:

and from the WinCC Channel Diagnosis scroll-down panel. Common error codes in this scenario are listed in the table below.

5. Increase the CPU's communication resources

In STEP 7, open the VIPA's hardware configuration (after installing the VIPA HSP — Hardware Support Package — supplied by VIPA). On the CPU properties dialog, select the Communication tab. The default is:

PG communication: 1 (or 2)
OP communication: 1 (or 2)
S7 basic communication: 0

Raise OP communication to 4 if WinCC has more than one S7 connection opened against this CPU, and raise PG communication to 2 if the engineering station also uses NetPro / STEP 7 online. Total S7 connection resources on the 315-2 class is 12, so do not over-allocate.

6. Force the bus to a known-good baud rate

The default WinCC CP5611 MPI profile uses 187.5 kbps. If the project was raised to 1.5 Mbps at some point in the past, the VIPA's Bus parameters register must match. From STEP 7: PLC -> Properties -> MPI Interface -> Properties -> MPI Bus, set Transmission Rate to the same value as the CP5611. Both ends must match exactly; there is no auto-negotiation on MPI.

Compatibility Matrix: Siemens vs. VIPA 315-2AG23

Verification Procedure

1. After applying the fixes, re-run Set PG/PC Interface -> Diagnostics; the VIPA must appear with the correct MPI address.
2. Open the WinCC project, deactivate and re-activate the runtime; the S7 connection status icon should change from disconnected to connected within 30 s.
3. In the WinCC Channel Diagnosis, the Connection Status column must read OK and Last Error must be empty (or 0x0000).
4. Force a tag update from the VIPA (e.g., a counter or a hand-acked input); verify in the Tag Management -> Simulation view that the value changes.
5. Trigger a simulated S7 connection loss by unplugging the MPI connector; verify that WinCC reports a quality code of bad on the affected tags within one polling cycle (typical WinCC cycle is 1 s for fast tags, 5 s for standard).
6. Reconnect the MPI cable; the connection must auto-recover without restarting the WinCC runtime.

Advanced Diagnostics and Edge Cases

SoftMPI vs. CP5611

On Windows 7 / 10 64-bit installations, the soft MPI driver (the virtual adapter that ships with SIMATIC NET) can be auto-selected by Windows when the CP5611 is installed. If the WinCC S7 channel is bound to SoftMPI instead of CP5611(MPI), every connection attempt will time out because the soft adapter is not a physical bus participant. Lock the access point with Set PG/PC Interface -> CP5611(MPI) -> S7ONLINE as the only enabled selection.

VIPA firmware revision sensitivity

The VIPA 315-2AG23 firmware revision (visible in the diagnostic buffer as the Module identification) determines which MPI bus parameters it accepts. Revision 3.x and later are fully WinCC V7 compatible. Revision 1.x / 2.x may interpret the WinCC S7 connection request as a PG request, not an OP request, and refuse the connection. Use the VIPA SPEED7 Tool to update the firmware to the latest 3.x revision before further troubleshooting.

Connection resource accounting

The total S7-300 connection budget is the sum of PG + OP + S7 basic + S7 routed. WinCC's S7 channel opens one OP connection per configured S7 connection. If the project has two S7 connections to the same VIPA (for redundancy, for example), two OP resources are reserved. The S7 connection diagnostic in the channel diagnosis lists the actual Resource ID of each open connection; if a Resource ID collides with a STEP 7 online session, WinCC will get 0x000A.

PROFIBUS DP interaction

If the VIPA is also used as a DP master and any DP slave drops off the bus, the CPU's OP communication resources can be temporarily blocked. Check the VIPA's diagnostic buffer (open with STEP 7 -> PLC -> Module Information -> Diagnostic Buffer) for DP errors before attributing the WinCC loss to WinCC itself.

Field-Commissioning Checklist

Standards and Reference Documents

• Siemens S7-300 CPU 315-2 DP manual: S7-300 CPU 315-2 DP (6ES7315-2AF01-0AB0) manual
• Siemens CP5611 manual: CP 5611 communication processor manual
• SIMATIC WinCC V7.4 channel diagnostics manual: WinCC V7.4 Communication manual
• PROFIBUS / MPI wiring and bus parameters: PROFIBUS Nutzerorganisation (PI) specification
• SIMATIC S7-300 communication resource allocation: S7-300 Communication functions manual

FAQ