WinCC Flexible 2008: SIMATIC S5/505 Communication on Windows 7

Problem Definition: WinCC flexible 2008 and Legacy SIMATIC PLCs on Windows 7

Field engineers and HMI integrators frequently encounter a compatibility limitation when pairing WinCC flexible 2008 Runtime (RT) with SIMATIC S5 or SIMATIC 500/505 controllers on a Windows 7 host. The original Siemens sales literature states that WinCC flexible 2008 does not support communications to SIMATIC 500/505 and SIMATIC S5 under Windows 7. The ambiguity of this statement is the source of most confusion: it does not mean the Engineering System (ES) cannot be installed on Windows 7, nor that the project cannot be configured with the legacy driver. The limitation applies specifically to the Runtime component executing on Windows 7.

The affected protocols include:

• SIMATIC S5 AS511 – point-to-point serial protocol over RS-232 (COM port), historically used with the PG interface of S5-95U/100U/115U/135U/155U CPUs.
• SIMATIC 505 NITP – Texas Instruments Neutral Interface for Terminal and Protocol, RS-232, requires a CP525-compatible communication module on the 505 side.
• SIMATIC 505 PROFIBUS DP – requires CP5431 FMS/DP or PROFIBUS CP on the controller side.

This article documents the precise root cause, affected versions, diagnostic steps, and field-proven workarounds for the failure mode where WinCC flexible RT cannot establish or maintain links to these legacy controllers on Windows 7.

Root Cause: RT Layer vs. ES Layer

The WinCC flexible 2008 product is split into two independent executables that share a common project database:

• WinCC flexible 2008 ES (Engineering System) – the configuration tool used on the programmer's workstation. The ES includes the device drivers for SIMATIC S5 AS511, SIMATIC 505 NITP (serial), and SIMATIC 505 PROFIBUS DP, and these drivers can be configured in the project regardless of the host operating system (Windows XP SP2/SP3, Windows Vista Business/Ultimate, Windows 7 Professional/Ultimate 32-bit).
• WinCC flexible 2008 RT (Runtime) – the visualization runtime that executes on the HMI device or PC. Only the RT is constrained in the protocols it can actually exchange data with on Windows 7.

The underlying reasons for the RT failure on Windows 7 are platform-level:

1. Kernel-mode driver signing (x64): Windows 7 64-bit enforces Authenticode signing of kernel drivers. Legacy USB-to-serial adapters and PROFIBUS CP drivers (CP5511, CP5512, CP5611, CP5613) shipped before 2009 do not carry cross-certificates valid under the Windows 7 driver signing policy, and are rejected at install time.
2. COM port virtualization regressions: The serial subsystem in Windows 7 changed the way overlapped I/O and IRP cancellation are handled. The AS511 and NITP DLLs use legacy I/O control codes (IOCTL_SERIAL_*) that depend on timing windows tuned for Windows XP/2000. On Windows 7, the receive timeout degrades to the point where the protocol handshake never completes.
3. DEP / ASLR: Data Execution Prevention and Address Space Layout Randomization introduced in Vista/Windows 7 break several legacy Win32 protocol stacks that use self-modifying code or fixed buffer addresses.
4. UAC virtualization of COM ports: When WinCC flexible RT is launched with standard user rights, Windows 7 redirects registry and file writes that some legacy drivers assume are unrestricted.

Affected Versions and Product Lifecycle

Siemens formally positioned the migration path through WinCC (TIA Portal) and the SIMATIC HMI Panel Migration Tool, since WinCC flexible 2008 reached end of active marketing in 2010 and was superseded by TIA Portal V12/V13/V14/V15/V16/V17 releases. TIA Portal does not support legacy S5/505 drivers at all; migration to a newer S7-300/S7-400 or ET 200SP system is required when upgrading the controller.

Diagnostic Procedure

Before applying workarounds, perform the following checks to confirm the failure is RT-related and not a wiring issue.

1. Inspect the RT diagnostic log. Open C:\Program Files\Siemens\WinCC flexible 2008 RT\Logs\TraceProtocol.log (default path) or check Start > WinCC flexible 2008 RT > Diagnostics. Look for error class 0xE0xx0007 – protocol startup failure – and 0xE0xx000B – COM handle not assigned.
2. Verify the configured driver channel. In the ES, confirm the connection is set to SIMATIC S5 AS511 or SIMATIC 505 NITP and that the COM port is mapped to a real or virtual UART (not a Bluetooth-COM bridge).
3. Test the physical layer independently. Use a terminal emulator (e.g., PuTTY at 9600/19200 baud, 8N1) to send a known AS511 or NITP request frame and confirm echo. If no response, the problem is at the cable/PHY level, not the RT.
4. Confirm RT user rights. The Windows 7 RT must run under an account in the local Siemens HMI group or as Administrator. If UAC is enabled, right-click the RT executable and choose Run as administrator to test.
5. Check Device Manager for COM port warnings. Code 10 or Code 28 on a USB-to-serial converter indicates driver-signing failure, which prevents the RT from acquiring the port even if the OS exposes the COM number.

Workarounds for Windows 7 RT Deployment

Option 1 – Deploy the RT on a Windows XP or Windows Embedded Standard 2009 host

The most reliable fix is to keep WinCC flexible 2008 RT on its originally supported OS: Windows XP SP3 32-bit or Windows Embedded Standard 2009. Both platforms continue to host legacy S5 AS511, 505 NITP, and 505 PROFIBUS DP drivers without modification. For greenfield installations, SIMATIC IPC227G, IPC427C, or IPC477C panels with preinstalled Windows Embedded Standard 2009 are drop-in solutions.

Option 2 – Windows 7 XP Mode (Windows Virtual PC)

Windows 7 Professional, Enterprise, and Ultimate ship with Windows XP Mode (XPM), a virtual Windows XP SP3 environment. Run WinCC flexible 2008 RT inside the XPM guest and assign the host's physical COM port (or USB-to-serial adapter) to the VM. Configure the RT project to use COM1 mapped to the bridged device. Performance is adequate for sub-1 s refresh rates typical of S5/505 visualization.

Option 3 – OPC tunneling through an XP bridge

Install WinCC flexible 2008 RT on a Windows XP or Windows Embedded PC that acts as an OPC DA 2.05a server for the legacy S5/505 channels. On the Windows 7 engineering station or panel, install any OPC DA 2.05a client (e.g., WinCC, WinCC Professional, or a third-party HMI) and bridge tags via the OPC interface. This pattern preserves the original WinCC flexible project while moving the visualization host to a modern OS.

Option 4 – PROFIBUS/Ethernet gateway for 505 DP

Use a third-party PROFIBUS DP slave-to-Modbus/TCP gateway (e.g., Helmholz RPi PROFIBUS, Anybus X-gateway PROFIBUS, or INAT TCP/ECM-PB). Connect the gateway to the 505 CP5431 PROFIBUS interface, expose the cyclic I/O as Modbus/TCP holding registers, and drive WinCC flexible RT on Windows 7 using the MODBUS TCP/IP driver that is fully supported on Windows 7.

Option 5 – Serial server (terminal server) for AS511/NITP

For S5 AS511 or 505 NITP deployments, use a COM port redirector such as Moxa NPort 5110, Lantronix UDS1100, or Perle IOLAN STS1. These devices attach the RS-232 link to an Ethernet network and present a virtual COM port on the Windows 7 RT host via a vendor-specific redirector driver signed for Windows 7. The redirector bypasses the Windows 7 kernel serial regression because the I/O is handled in TCP user space.

Configuration Notes for the Recommended Workaround

The most field-proven combination for Windows 7 hosts is Option 5 + Option 3 (serial server plus OPC bridge) when the WinCC flexible project must remain intact and the HMI PC must run Windows 7 for other reasons (e.g., third-party MES software).

1. Mount the serial server on the same subnet as the WinCC flexible RT panel; assign it a fixed IP.
2. On the Windows 7 RT host, install the vendor redirector driver and map the IP:Port pair to COM10 (avoid COM1–COM4 to prevent conflict with the physical ports).
3. In the WinCC flexible project, edit the connection SIMATIC S5 AS511 or SIMATIC 505 NITP and set the COM port to COM10.
4. Adjust baud rate to 19200 bit/s for AS511 and 9600 bit/s for NITP, 8 data bits, no parity, 1 stop bit, no flow control. These are the only legal combinations for the legacy protocol stacks.
5. Recompile and transfer the project to the RT panel.
6. Verify tag updates in the RT diagnostic view; a healthy link shows < 100 ms cycle time for < 50 tags.

Verification Checklist

Migration Path Off WinCC flexible

Because WinCC flexible 2008 is no longer in active support and TIA Portal does not include native S5/505 drivers, the long-term recommendation for facilities still running these controllers is to deploy a protocol converter (S5 AS511 → S7-300 PN/PN coupler, or 505 NITP → Modbus TCP → S7-1500) and migrate the visualization to WinCC (TIA Portal) V17/V18 or WinCC Professional V8.x. This eliminates the legacy OS dependency entirely.

Troubleshooting Matrix

References and Official Documentation

• WinCC flexible Communication Part 1 – User Manual (PDF) – Siemens Support entry 18797552, contains the canonical list of supported communication drivers for WinCC flexible 2008 SP2 and later.
• WinCC flexible 2008 SP5 Readme – Siemens Support entry 18796222, documents OS-specific restrictions on legacy S5/505 channels.
• Entry ID 8970169: WinCC flexible system manual – Operating system compatibility matrix.
• Entry ID 109751546: Migration from WinCC flexible to TIA Portal – recommended migration path for projects containing legacy drivers.