WinCC 7.4 S7-1200 Channel: Restore Server-Client Link

Problem Summary

A WinCC V7.4 redundant server pair (Server A + Server B) plus four WinCC clients on a 192.168.2.0/24 plant LAN must poll a remote SIMATIC S7-1200 CPU at 10.161.144.11 through a SCALANCE S615 LAN/VPN router that terminates VLAN2. The WinCC client stations have static IPv4 addresses inside the 192.168.2.x range. The S7-1200 is reached through the SCALANCE S615 on a separate 10.161.144.0/27 segment.

Adding the SIMATIC S7-1200, S7-1500 Channel to the WinCC Tag Management produces a green connection check mark - confirming that the S7-1200 connection has been opened - and immediately causes the WinCC clients to lose visibility of the partner (redundant) WinCC server. Removing the S7-1200 connection makes the partner server reappear. The connection works; the rest of the runtime breaks.

This symptom is caused by misaligned S7ONLINE binding and Terminal Bus adapter assignment on the WinCC server, not by the S7-1200 channel itself. The remediation below is verified against the official Siemens WinCC-to-S7-1200/S7-1500 channel manual.

System Topology and Subnet Audit

The reported topology is summarized below. The remote S7-1200 is on a /27 subnet (mask 255.255.255.224) connected to the WinCC server side through a SCALANCE S615 with VLAN2.

10.161.144.11/27 lives in the 10.161.144.0 to 10.161.144.31 range. Network address is 10.161.144.0; broadcast is 10.161.144.31; usable hosts are 10.161.144.1 through 10.161.144.30. The S7-1200 address is therefore valid for the subnet. The WinCC server must reach 10.161.144.11 only through the SCALANCE S615 - the plant LAN (192.168.2.x) and the remote segment (10.161.144.x) must be unique and routed, not bridged, inside the SCALANCE S615.

Network Topology Diagram

Root Cause Analysis

Three independent issues can each produce the "green tick but clients lose partner" symptom; in the reported case more than one is typically present. The official Siemens response on the Support portal identifies the second and third points below as the primary causes.

1. S7ONLINE is a symbolic device name, not a binding. In the WinCC channel, Access Point = S7ONLINE is a symbolic name. The real binding is the Set PG/PC Interface assignment in the Windows Control Panel applet. If the applet shows more than one entry per network adapter (e.g. <NIC>.TCPIP.1, <NIC>.TCPIP.Auto.1, and <NIC>.ISO.1), the S7-1200/S7-1500 channel may bind to a different entry than the rest of WinCC. The result is a silent socket-hijack of the redundancy path.
2. Terminal Bus and PLC Bus are not isolated. A redundant WinCC server requires a separate Terminal Bus adapter for the server-client messaging layer. If the Simatic Shell system folder has not been told which adapter is the Terminal Bus, the new S7-1200 channel can claim that adapter and starve the WinCC client connection to the partner server.
3. Duplicate or overlapping IP addressing. The 192.168.2.x plant LAN and the 10.161.144.x remote segment must be distinct, and no two devices in any one broadcast domain may share an IP. Two adapters on the same server must not overlap. Overlap is a common root cause of intermittent partner-server loss that vanishes the moment the S7-1200 channel is removed.

S7ONLINE Binding State Diagram

Affected Components and Versions

Reference for the channel mechanics: WinCC Communication to S7-1500, S7-1200 and ET 200SP - PDF manual (Siemens Support).

Prerequisites

• Local administrator rights on both WinCC servers in the redundant pair.
• WinCC project backup before any change. Stop the WinCC Server service before editing PG/PC bindings.
• SIMATIC Net / SOFTNET installed; Set PG/PC Interface applet present under Start > Siemens Automation.
• Simatic Shell system folder visible in Windows Explorer (added by SIMATIC Net). If absent, repair the SIMATIC Net installation.
• Read access to the TIA Portal project for the S7-1200 to export the symbolic tag list.
• Network access to the SCALANCE S615 web-based management (default https://<management-IP>).
• Two physically separate network adapters (or one adapter with two VLAN sub-interfaces) on each WinCC server - one for the PLC bus, one for the Terminal Bus.

Step-by-Step Remediation

Step 1 - Audit IP addressing before touching WinCC

On the WinCC server, open an elevated command prompt and run:

ipconfig /all
arp -a
route print
ping 10.161.144.11 -n 4
tracert 10.161.144.11

Confirm the following before proceeding:

• The plant-LAN NIC is on 192.168.2.x /24 and is the only server adapter in that subnet.
• The S7-1200 responds to ping - or, if ICMP is filtered on the SCALANCE S615, the next hop on tracert is the S615's VLAN2 interface.
• No other NIC on the server is on 10.161.144.0/27, and no other device on the plant LAN shares an IP with the server.

Step 2 - Bind S7ONLINE to a single deterministic TCPIP entry

1. Start > Siemens Automation > Set PG/PC Interface.
2. In the Interface Parameter Assignment Used dropdown, select the plant-LAN NIC's <NIC Name>.TCPIP.1 entry.
3. Do not select ...TCPIP.Auto.1 or ...ISO.1 when more than one entry exists for the same NIC. The Auto mode lets the S7-1200/S7-1500 channel silently pick a different socket than the rest of WinCC, which is the most common cause of the partner-server drop.
4. Click OK to commit. Repeat on the redundant partner server - the PG/PC Interface setting is per-machine and does not replicate.

Step 3 - Assign the Terminal Bus to a dedicated adapter

1. In Windows Explorer, navigate to Simatic Shell (a system folder installed by SIMATIC Net).
2. Right-click the folder and select Terminal Bus Settings.
3. Select the network adapter reserved for WinCC client-server traffic. This must be a different adapter from the one bound to S7ONLINE in Step 2, and ideally a different subnet from 10.161.144.0/27.
4. Apply the change. Restart the WinCC Server service: in the WinCC Explorer, use File > Exit WinCC Explorer, stop the CCEServer / WinCC service, then restart.

Step 4 - Configure the S7-1200/S7-1500 Channel in WinCC

1. In WinCC Explorer, open Tag Management, right-click and select Add New Driver > SIMATIC S7-1200, S7-1500 Channel.
2. Open the new connection and set its Connection Properties:

3. From the TIA Portal project for the S7-1200, export the PLC tag table (PLC > Export to Text/Excel). In the WinCC connection, right-click and choose Read Symbol from AS to import the symbolic names.
4. Build the tags. The channel uses the S7-1200's optimized data blocks. In the TIA Portal, ensure the DBs are marked Accessible from HMI (right-click the DB > Properties > Attributes > HMI accessible) and that the CPU has Permit access with PUT/GET communication from remote partners enabled under Protection & Security.
5. Save the WinCC project. Activate the runtime and verify the connection status before evaluating partner-server visibility.

Step 5 - SCALANCE S615 VLAN and firewall check

The S615 is a Layer-3 stateful firewall with VPN capability. For the S7-1200 channel to traverse VLAN2:

• VLAN2 must route (not bridge) between the 192.168.2.x plant-LAN side and the 10.161.144.x remote side - or, if a VPN tunnel is in use, the S7 traffic must be encapsulated by the tunnel policy.
• The S7-1200 IP (10.161.144.11) must be reachable from the plant-LAN side of the S615 - check Layer 3 > Static Routes on the S615.
• Firewall rules must allow TCP port 102 (ISO-on-TCP / S7) from the WinCC server's plant-LAN IP to 10.161.144.11.
• The S615 idle session timeout must exceed the WinCC keep-alive interval. Default S615 TCP idle timeout is 1800 s; if the channel keep-alive is shorter, the connection resets every half hour.

If the green tick appears in WinCC but the partner-server link still drops, capture a Wireshark trace on the plant-LAN NIC of Server A filtered to ip.addr == 10.161.144.11. The green tick only proves the channel opened the socket; the S615 may be silently dropping the payload.

Verification

1. In WinCC Explorer, confirm the S7-1200 connection shows the green check and the Connection Status reads OK with at least one successful poll.
2. On each WinCC client, open WinCC Explorer > Server Data and confirm both Server A and Server B are listed as active (not failed).
3. From the client, force a redundancy failover: stop the WinCC Server service on the current master. The client must reconnect to the partner within the configured redundancy time (default 10 s) and tag values must continue updating without restart.
4. Use the WinCC Channel Diagnosis tool and confirm no 0xFFFE or 0xFFFF quality codes on the S7-1200 tags after a 30-minute soak test.
5. Reboot the server. After reboot, the binding must still resolve to TCPIP.1 - the Auto mode tends to re-select the wrong interface after a NIC enumeration change.
6. Run a side-by-side S7-1200 Test Connection from WinCC Channel Diagnosis on both Server A and Server B. Round-trip time should be under 100 ms on a healthy LAN; the S615 path through VLAN2 may add 10-50 ms.

Troubleshooting Matrix

Field-Proven Caveats

• Per-server configuration. Each WinCC server in the redundant pair has its own PG/PC Interface applet. A fix on Server A does not propagate to Server B. Repeat Steps 2 and 3 on every server in the redundancy group.
• Removing the channel hides the symptom, it does not fix it. Removing the S7-1200 channel appears to restore the partner server because the offending binding or the wrong S7ONLINE adapter is released. The fix must be applied at the PG/PC / Terminal Bus layer.
• ICMP is not a valid reachability test through the S615. If ICMP is blocked on the SCALANCE S615 (a common hardening setting), ping will fail even when the S7-1200 is fully reachable. Use Test Connection from the S7-1200/S7-1500 channel diagnostic instead of ping for end-to-end checks.
• The green check is opened at channel load. A TCP/102 socket can be opened to a firewall that will silently drop later payloads. Always validate with a forced failover and a 30-minute soak.
• S7-1200 firmware limits apply. S7-1200 CPUs only support a fixed number of simultaneous class-1 communication jobs (six by default). Each WinCC connection - and each WinCC server in a redundant pair - consumes one job. The CPU must have enough job resources for both Server A and Server B to talk to it concurrently.
• Symbolic addressing requires accessible DBs. Even with PUT/GET enabled, a DB that is optimized and not flagged as Accessible from HMI in TIA Portal will return quality code 0xFFFE for every tag.

When to Escalate

If after applying Steps 1 through 5 the partner server still disappears exactly when the S7-1200 channel is enabled, capture an SDT (Siemens Support Diagnostics Tool) dump from the affected server and open a Service Request at Siemens Industry Online Support - Service Requests. Attach the WinCC project backup, the SDT archive, the SCALANCE S615 configuration export (System > Backup & Restore), and a Wireshark capture from the plant-LAN NIC filtered to the S7-1200 IP.

FAQ