WinCC 7.2 S7-1500 Channel: Resolving Communication Failures

1. Problem Overview

WinCC V7.2 (and later) communicates with the SIMATIC S7-1200 and S7-1500 CPU families through a dedicated channel named SIMATIC S7-1200, S7-1500 Channel. This channel uses the S7 communication protocol over the CPU's integrated PROFINET interface and is documented in the Siemens application note "WinCC Communication to S7-1500, S7-1200 and ET 200SP".

A common field failure is a runtime that starts with the WinCC tag connection remaining in the Disconnected state even when:

• The CPU is reachable by PING from the WinCC station.
• The TIA Portal project is online to the S7-1500.
• The CPU has Full access (no protection) configured in Properties > Protection & Security.
• The DB used for tags has Optimized block access disabled.

The configuration window only displays a OMS+ channel unit instead of a TCP/IP channel unit, and the connection status shows the diagnostic text Channel not initialized / Connection broken. This article isolates each of the documented root causes and walks through the complete resolution path, including the S7-1500 firmware ≥ V2.0 path, the PG/PC interface (Set PG/PC Interface), and the PC Station OPC configuration required for panel PC installations.

2. Root Cause Analysis

Siemens documentation and field experience identify five independent failure paths that can produce a Disconnected runtime status. Any one of them is sufficient to break the S7-1500 channel.

3. Prerequisites

1. Hardware
   • PC station with one free Ethernet port (Intel Gigabit or CP1612A2 recommended). Broadcom Wi-Fi adapters must NOT be used as the S7 access point.
   • S7-1500 CPU (tested with CPU 1517-3 PN/DP, 6ES7517-3AP00-0AB0; order number 6ES7517-3AP02-0AB0 for firmware V2.0).
   • Ethernet cable, managed switch or direct crossover.
2. Software
   • SIMATIC WinCC V7.2 (or V7.3 / V7.4) installed from the original DVD.
   • TIA Portal V14 (or V14 SP1) for the S7-1500 project.
   • SIMATIC NET version matched to the OS — see Section 8.
3. Network
   • WinCC station and CPU on the same IPv4 subnet (e.g. 192.168.0.x / 255.255.255.0).
   • Firewall rule allowing TCP port 102 (ISO-on-TCP / RFC1006) inbound on the WinCC PC.
4. CPU state
   • CPU in RUN (not STOP) so connection establishment is allowed.

4. Solution: Configure the SIMATIC S7-1200/S7-1500 Channel

The channel DLL PDLMcdsv.dll is delivered with WinCC V7.2 Update 2 and later. Configuration is performed once in the WinCC project and is identical for WinCC V7.2, V7.3, V7.4 and V7.5.

1. In WinCC Explorer right-click Tag Management and select Add New Driver > SIMATIC S7-1200, S7-1500 Channel.
2. Open the channel, right-click the OMS+ connection and choose Connection Parameters.
   • IP Address: CPU PROFINET interface IP, e.g. 192.168.0.10.
   • Access Point: S7ONLINE (default). Do NOT change to S7iPTool for this channel.
   • Connection Name: free text, e.g. S71500_Connection_1.
3. Press Apply; WinCC will report the connection as Established only after the PC Station has been activated (see Section 7).

5. Solution: TIA Portal S7-1500 CPU Configuration

Three CPU-side parameters must be checked. The most common field error is leaving Optimized block access enabled on a DB that WinCC is trying to read.

5.1 Disable Optimized Block Access on the DB

1. Open the S7-1500 project in TIA Portal V14 / V15 / V16.
2. In the project tree, right-click the target DB (e.g. DB_HMI_Data) and select Properties > Attributes.
3. Uncheck Optimized block access.
4. Repeat for every DB referenced by WinCC tags.
5. Recompile the project (Project > Compile all > Software (rebuild all blocks)) and download to the CPU.

5.2 Set CPU Protection Level

1. Open Device view > CPU > Properties > Protection & Security.
2. Under Access level select Full access (no protection) for commissioning, or Read/Write access from HMI for production.
3. Enter the HMI password (default empty) and confirm with OK.

5.3 Permit PUT/GET Access

1. In Properties > Protection & Security > Connection mechanisms tick Permit access with PUT/GET communication from remote partner (PLC, HMI, OPC, ...).
2. Download the hardware configuration.

6. Solution: PG/PC Interface (Set PG/PC Interface)

The S7-1200/S7-1500 channel uses the access point S7ONLINE. If S7ONLINE is bound to a wireless adapter or a virtual interface, all connection attempts fail silently with status Disconnected.

1. Open Control Panel > Set PG/PC Interface (32-bit) or Start > Siemens Automation > Set PG/PC Interface.
2. For Access point of the application select S7ONLINE.
3. Assign it to the wired interface: TCP/IP > Intel(R) 82579LM Gigabit Network Connection (or the CP1612A2 driver entry).
4. Confirm with OK. No restart is required.

Verify the binding from a command line:

set S7ONLINE=TCPIP \Device\NPF_{C864CF1A-...}
pings7 192.168.0.10

If the binding is wrong, the WinCC channel diagnosis shows error text "The access point S7ONLINE is not assigned to a network adapter". This is the single most common cause of a permanently Disconnected runtime.

7. Solution: PC Station with OPC Configuration

When the WinCC runtime is hosted on a SIMATIC panel PC (e.g. IPC477D, IPC627C) or a third-party PC station, the S7-1500 channel requires the SIMATIC NET OPC server to be installed and the PC Station to be configured in STEP 7 / TIA Portal. This is the path documented in the Siemens support thread referenced by the original poster.

7.1 Build the PC Station in TIA Portal

1. Add a new device PC station > SIMATIC PC Station.
2. In the device view, add OPC Server and IE General (or a CP1612A2 if present).
3. Drag an S7 connection from the OPC server to the S7-1500 CPU. The connection partner is the CPU PROFINET interface.
4. Compile and download the PC Station to the local PC's PC station configuration directory: C:\Program Files\Siemens\Automation\SIMATIC_NET\config.

7.2 Activate the OPC Server on the Panel PC

1. Open SIMATIC NET Configuration Console (Start > Siemens Automation > SIMATIC NET > Configuration Console).
2. Under OPC Server > Mode select Configured mode (load from STEP 7 project).
3. Click Import Station and select the XDB file generated in Step 7.1.
4. Confirm the S7DOS Helper Service is Started and the OPC Server is Running.

7.3 Bind the WinCC Channel to the OPC Server

1. In WinCC Channel Diagnosis the access point should now show OPC.S7ONLINE.
2. Restart the WinCC Runtime:

   net stop "CCAgent"
   net start "CCAgent"

3. Open the tag list; the connection should transition Disconnected → Establishing → Connected within 5 – 10 seconds.

8. SIMATIC NET Compatibility Matrix

According to the Siemens compatibility tool entry SIMATIC NET Compatibility, only the combinations below are supported for WinCC V7.2. Mixing versions is a frequent source of the missing OMS+ channel behavior.

9. Hardware: CP1612 vs. CP1612A2 vs. IE General

The SIMATIC NET PC Station supports three Ethernet paths to the S7-1500 CPU.

For most WinCC SCADA stations, IE General on the Intel NIC is the lowest-risk option. CP1612A2 is required only when the panel must participate in IRT PROFINET and provide diagnostic buffers. CP1612 (original) is no longer available for new installations and should be replaced by CP1612A2 (6GK1161-2AA02) on a hardware swap.

10. Verification and Diagnostics

1. Layer 3 – Ping
   ping 192.168.0.10 from the WinCC PC must succeed before any channel work is started.
2. Layer 7 – Channel diagnosis
   Open WinCC Explorer > Tools > Channel Diagnosis and confirm the connection shows Connected. Typical turnaround is 2 – 4 seconds after Runtime start.
3. Tag quality
   Add a tag of data type Word at offset 0 of the non-optimized DB and force a value of 16#A5A5 in the CPU. In WinCC tag simulator, the value should be displayed without quality flag 80.
4. Event log
   Filter Windows Application log for source S7DOS. A healthy connection logs the Event ID 256 at startup; Event ID 4097 indicates a failed connection attempt with the partner IP echoed in the message text.
5. Online diagnostics of the CPU
   From TIA Portal, open Online > Online & Diagnostics > Connection information. Each WinCC connection is listed with a Status byte. Status 0x04 = connection established, 0x01 = establishing, 0x0A = partner aborted.

11. Troubleshooting Matrix

12. Commissioning Checklist

• [ ] CPU firmware V2.0 or higher (recommended V2.5 or V2.6 for newest functions).
• [ ] DB optimized access unchecked for all HMI DBs.
• [ ] CPU protection level Full access or HMI access with PUT/GET permitted.
• [ ] PG/PC Interface: S7ONLINE → wired Intel NIC or CP1612A2.
• [ ] SIMATIC NET version matches OS and WinCC per Section 8.
• [ ] PC Station compiled, downloaded, imported in Configuration Console.
• [ ] OPC server in Configured mode and S7DOS service Running.
• [ ] Windows firewall allows TCP 102 inbound.
• [ ] WinCC Runtime: tag status OK, channel diagnosis Connected.