WinCC Flexible: Connecting More Than 8 PLCs via Router and OPC

Problem Statement: The WinCC Flexible 8-Connection Ceiling

WinCC Flexible 2005, WinCC Flexible 2008, WinCC Flexible 2008 SP2, and WinCC Flexible 2008 SP3 all enforce a hard-coded limit of 8 simultaneous PLC connections per HMI project. The cap applies to the project running on the runtime HMI device (Comfort Panels, Multi Panels, Mobile Panels, and PC Runtime) regardless of whether the underlying panel hardware would otherwise support a larger number of logical partners. Engineers commissioning line-of-sight cell controllers, building automation substations, machine trains, or SCADA concentrator panels routinely run into this ceiling when integrating the ninth, tenth, or twentieth SIMATIC S7-200, S7-300, S7-400, S7-1200, S7-1500, or third-party controller.

The constraint is enforced in the WinCC Flexible Engineering software itself; the configuration tree exposes at most 8 Connections entries under the Communication node, and the runtime kernel does not instantiate any further partner beyond the 8th. Adding a ninth connection in the editor either produces a compile error or silently truncates the project. There is no registry patch, service pack, or hotfix that raises this number for the WinCC Flexible product line (the limit is removed in TIA Portal WinCC, which scales to 128 integrated connections on Comfort Panels and unlimited connections on WinCC Runtime Professional, but that requires a complete migration to the TIA Portal engineering environment).

This article documents three production-proven methods for breaking through the 8-connection wall without abandoning WinCC Flexible: (1) using a SIMATIC S7-1200 (or S7-1500) as an aggregation router that consolidates multiple downstream PLCs into a single WinCC Flexible connection, (2) inserting an OPC DA gateway (TOP Server CE, KEPware, or Matrikon) between the field network and the HMI, and (3) deploying multiple HMI panels with inter-panel peer links. Each method has distinct implications for cyclic data rates, panel licensing, screen design, and fault isolation.

Architectural Constraints and Connection Accounting

Before selecting a workaround, characterize the network precisely. The 8-connection limit counts logical WinCC Flexible connections, not physical interfaces. A single MP 277 10" Touch panel with one PROFINET port and one PROFIBUS DP/MPI port can simultaneously maintain:

• Up to 8 S7 connections (any mix of SIMATIC S7 MPI/DP, SIMATIC S7 300/400, SIMATIC S7 1200, SIMATIC S7 200, SIMATIC S7 NC, SIMATIC S5 AS511, SIMATIC 505, and the SIMATIC HMI HTTP protocols)
• Plus the reserved HMI device-to-device connection for Sm@rtService, Sm@rtAccess, or panel-to-panel variables if used
• Less any connection already used for the area pointer coordination, which occupies one of the 8 slots

Prerequisites

To implement any of the three methods below, gather the following before starting:

1. Engineering software: WinCC Flexible 2008 SP3 (or compatible) installed on Windows 7 SP1 / Windows 10 with admin rights. Verify the installed version under Help > About and confirm build number is > 14.0.1.0 for SP3.
2. HMI panel firmware: Comfort Panels must be on Image V11.0.2.0 or later; MP 277 must be on Image V12.0.0.0 or later. The image version is visible on the panel's Control Panel > System > Information screen and is required for stable S7-1200 routing and PROFINET IO with WinCC Flexible.
3. PLC firmware: For the router method, the S7-1200 must be on firmware 4.2 or later (CPU 1211C, 1212C, 1214C, 1215C, 1217C) with at least 50 KB of free work memory. The S7-1500 must be on firmware 1.8 or later.
4. Network topology map: IP address plan, subnet mask, gateway, VLAN tags, and PROFINET device names. Document which PLCs are downstream-only and which require direct write access from the HMI.
5. OPC foundation (for Method 2): TOP Server CE v5.x or KEPware KEPServerEX v6.x installed on the same PC that hosts WinCC Runtime, with the SIMATIC S7 MPI/DP and S7 TCP/IP drivers licensed. A free 2-hour demo is available from Software Toolbox for evaluation; see also the TOP Server CE with WinCC Flexible integration guide (PDF).
6. STEP 7 / TIA Portal: For the router method, STEP 7 Basic V11 or TIA Portal V13 SP1+ to program the S7-1200's PUT/GET blocks. The SIMATIC S7-1200 Programmable Controller System Manual (entry ID 67584899) covers PUT/GET configuration in section 9.5.

Method 1: Direct Multi-Driver Configuration (Up to 8 PLCs)

If the application can be bounded at 8 controllers, configure each PLC as a discrete WinCC Flexible connection. This is the lowest-latency, most deterministic option and preserves direct symbolic tag access from the panel.

Step-by-Step Configuration

1. Open the WinCC Flexible project and select the HMI device in the project tree.
2. Expand Communication > Connections. The right pane displays the connection editor with one row per logical connection.
3. Double-click the cell in the Name column of the row beneath the existing Connection_1 to add a new entry. Each row accepts a unique alphanumeric identifier (Connection_1 through Connection_8).
4. Set the Communication driver column to one of: SIMATIC S7 300/400, SIMATIC S7 1200, SIMATIC S7 200, SIMATIC S7 MPI/DP, or SIMATIC S5 AS511 for legacy controllers.
5. Configure the partner parameters per driver. For SIMATIC S7 300/400 over TCP/IP, populate IP address, Rack, Slot, and Connection type (S7 Communication or ISO-on-TCP). For MPI/PROFIBUS, populate Station address, Network, and Highest station address.
6. Enable the Area pointer in the connection properties only if the application requires coordinated tag exchange (e.g., date/time, project ID, user version, or data record coordination). Each active area pointer occupies a slot toward the 8-connection cap.
7. For Ethernet plus PROFIBUS mixed configurations, open Device Settings > Network and configure the Ethernet port's IP address, subnet mask, and default gateway before saving the new connection. Save and recompile.
8. Transfer the project to the panel via Ethernet, PROFIBUS, MPI, USB, or RS-232 (whichever channel the panel's Transfer Settings allow). Confirm the panel's Control Panel > Transfer permits the channel you intend to use.

Verification

On the panel, open Control Panel > System > Connections and confirm all 8 connection rows show a green status LED. Switch to the WinCC Flexible online diagnostics: Project > Transfer > Online > Diagnostics should display all configured partners as Reachable. The Tag simulation tool (Tools > Tag Simulation) lets you force value changes from the engineering station against the live panel.

Method 2: PLC as Aggregation Router (More Than 8 PLCs)

When the application requires more than 8 controllers, the most efficient method is to designate one PLC as an aggregator that consolidates data from downstream PLCs and exposes a single WinCC Flexible connection. The S7-1200 and S7-1500 are the canonical routers because they support both PUT/GET server access (to expose consolidated data to the panel) and PUT/GET client access (to fetch from downstream S7-300/S7-400/S7-1200 PLCs over PROFINET or PROFIBUS). WinCC Flexible sees only the router as Connection_1; the downstream PLCs are invisible to the HMI's connection accounting.

Why a Router Works

The S7-1200 CPU contains a TCP/IP server on its PROFINET interface that can simultaneously service up to 16 S7 communication partners. A WinCC Flexible panel counts as one of those partners. Inside the S7-1200, the user program runs PUT instructions (SFB/FB) that read input data from each downstream PLC into a consolidated data block; the panel then reads that data block through standard GET semantics. From the panel's perspective, the entire downstream fleet appears as a single block of tags.

Data Flow Pattern

WinCC Flexible (HMI) -----PROFINET-----> S7-1200 Router (FB GET_PUT) -----PROFINET/PROFIBUS-----> Downstream PLC 1..N

The S7-1200 acts as a polling concentrator. It uses PUT (write) and GET (read) S7 communication instructions to copy tag blocks from each downstream PLC into local DBs. The panel's WinCC Flexible tags are then configured to point at addresses within those local DBs.

Step-by-Step Configuration

1. In TIA Portal, create the S7-1200 project. Add all downstream PLCs as non-connected partners in the Devices & Networks editor and assign them to the same PROFINET subnet as the router CPU.
2. Allocate a data block DB_Router_HMI on the S7-1200 sized to accommodate the largest data set from any downstream PLC. Typical block size: 4 KB to 16 KB depending on tag count.
3. Program the S7-1200 with one GET block per downstream PLC. Each GET call (FB14 in the STEP 7 Standard Library, or instance of GET from the TIA Portal instructions) copies a defined data range from a downstream PLC into a defined region of DB_Router_HMI. Configure each call with the downstream PLC's IP address, rack/slot, and the source DB number/byte offset.
4. Enable PUT/GET server access on the S7-1200: Device properties > General > Protection > Permit access with PUT/GET communication from remote partner must be checked. Without this flag the HMI cannot read.
5. Compile and download the S7-1200 project.
6. In WinCC Flexible, add a single connection with the SIMATIC S7 1200 driver pointed at the S7-1200 router's IP address.
7. Define tags in WinCC Flexible that point at offsets inside DB_Router_HMI. For example, downstream PLC 1's DB10.DBW0 becomes WinCC Flexible tag PLC1_Word0 addressed at DB_Router_HMI.DBW0.
8. Set acquisition cycles conservatively (1 s to 2 s for non-critical process values; 500 ms for fast diagnostics; 100 ms minimum) to avoid overloading the router's CPU utilization.

Cyclic PUT/GET Sample (SCL on S7-1200)

// FB_Poller - cycles through downstream PLCs every 250 ms
IF "scan_tick" THEN
  "scan_tick" := FALSE;
  CASE "poll_index" OF
    0: // PLC1 fetch
      %DB50 ( "dst_buffer" := 0, "dst_len" := 64 );
      "PUT_BLOCK".REQ := TRUE;
      "PUT_BLOCK".ID := 1;
      "PUT_BLOCK".ADDR_1 := P#DB10.DBX0.0 WORD 32;
      "PUT_BLOCK".SDB := 50;
      "PUT_BLOCK".LEN := 64;
    1: // PLC2 fetch
      ...
  END_CASE;
  "poll_index" := ("poll_index" + 1) MOD "poll_count";
END_IF;

Limitations of the Router Method

• Latency floor: Each downstream PLC must wait its turn in the router's poll cycle. With 16 downstream PLCs at 250 ms per poll, the worst-case read latency is 4 s.
• No direct write: HMI writes to a downstream PLC are mediated by the router's PUT instruction; the panel cannot perform direct symbolic writes to PLC 5's tags.
• Single point of failure: If the S7-1200 router is offline, all downstream visibility from the HMI is lost. Consider a hot-standby S7-1200 pair for critical applications.
• Data freshness: A 16-PLC fleet at 1 s/PLC poll produces 16 s end-to-end latency. Use alarm-triggered GET calls for fast event propagation.

Method 3: OPC DA Gateway (Unlimited PLCs, PC Runtime)

For HMI stations running on a Windows PC (WinCC Flexible Runtime), the cleanest solution is to insert an OPC DA 2.0/3.0 server between the field network and the HMI. WinCC Flexible acts as an OPC client and the OPC server (TOP Server CE, KEPware, Matrikon) handles all native device communication. The connection-cap restriction of WinCC Flexible is bypassed because only one OPC connection is needed; the OPC server can address hundreds of devices.

Why OPC Works

WinCC Flexible has a built-in OPC channel driver. When configured, the panel/runtime acts as a DA 2.0 client that subscribes to tag updates from a remote or local DA server. The DA server (TOP Server CE for example) speaks the native protocols of every downstream PLC: SIMATIC S7 MPI/DP, S7 TCP/IP, Modbus TCP, EtherNet/IP, PROFIBUS, and dozens of others. The DA server holds the connection accounting; WinCC Flexible sees a single tag namespace.

Step-by-Step Configuration (TOP Server CE Example)

1. Install TOP Server CE on the same Windows PC that runs WinCC Flexible Runtime. Apply the SIMATIC S7 MPI/DP and SIMATIC S7 TCP/IP driver licenses.
2. Launch the TOP Server configuration tool. Add a new channel of type SIMATIC S7 TCP/IP for Ethernet-attached PLCs and a separate channel of type SIMATIC S7 MPI/DP for legacy PLCs on PROFIBUS.
3. For each channel, add one device per PLC. Configure IP address, rack, slot, and connection type.
4. Add tags under each device matching the tag names exported from the PLC projects. Use the TOP Server tag import utility to bulk-import STEP 7 symbol tables.
5. Activate the TOP Server. Confirm under Runtime > Status that all devices show Communication Active.
6. In WinCC Flexible, right-click Communication > Connections and add a new connection. Select driver OPC (not SIMATIC S7).
7. Set the OPC server name to the local or remote machine hosting TOP Server (e.g., OPC.SimaticNET or the registered ProgID of TOP Server CE).
8. In the tag editor, choose Connection > OPC and browse the OPC server's namespace. Add the tags that the screens require.
9. Compile and transfer the project to the PC runtime. The runtime's OPC client will subscribe to the configured items.

Step-by-Step Configuration (KEPware KEPServerEX)

1. Install KEPServerEX and apply the Siemens TCP/IP Ethernet driver license.
2. Create a new channel of type Siemens TCP/IP Ethernet. Under device drivers, add one device per S7-300/400/1200 PLC, specifying the IP address and the rack/slot of the CPU.
3. Add tags manually or use the Import Tags tool against a STEP 7 symbol export. KEPServerEX v6 uses OPC UA in addition to DA; ensure Enable OPC DA is on in the project's Server Properties > OPC DA.
4. In WinCC Flexible, add an OPC connection pointing at the KEPServerEX ProgID KEPware.KEPServerEX.V6. Add tags from the OPC browser.

Verification

Use the OPC Quick Client (bundled with TOP Server and KEPServerEX) to verify the server is publishing all configured items with good quality. In WinCC Flexible Runtime, open Diagnostics > Connections and confirm the OPC connection shows Connected and the item count matches the design. Force a value change on a downstream PLC and verify the HMI tag updates within the configured acquisition cycle.

Limitations of the OPC Method

• PC runtime only: This method requires WinCC Flexible Runtime on Windows. Comfort Panels, MP 277, and Mobile Panels do not include an OPC client channel and cannot use the OPC workaround directly.
• Single point of failure: If the OPC server or PC crashes, all visibility is lost. Deploy redundant OPC servers and use the Redundancy license option.
• Licensing cost: TOP Server CE and KEPServerEX are commercial products priced per device channel. For >50 PLCs, a site license is the most economical option.

Method 4: Distributed HMI Panels with Peer Variables

For very large installations where no single panel can host 8 connections, deploy multiple smaller HMI panels and use the Global Script / area pointer feature to peer variables between them. Each panel still respects the 8-connection cap, but the operator can navigate a unified faceplate by using Change Connection in a WinCC Flexible script to switch which connection a tag group is bound to.

' Visual Basic Script within a WinCC Flexible event
Sub ChangeToPLC9()
  Dim conn As Object
  Set conn = SmartTags("current_connection")
  conn.Value = 9 ' index of the preconfigured alternative connection
  HmiRuntime.Screens("Overview").ScreenItems("TagGroup1").Connection = 9
End Sub

Mixed Ethernet + PROFIBUS Configuration: Resolving the Orange Driver

A common failure mode is the appearance of an orange driver highlight in the connection table when an Ethernet connection is added to a project that already has a PROFIBUS DP or MPI connection. The orange state indicates that the panel's Ethernet interface configuration is missing or incomplete, and the panel will not service the Ethernet connection at runtime until the issue is fixed.

Resolution Steps

1. Select the HMI device in the project tree and open Device Settings.
2. Navigate to Device Settings > Network Interface and select the Ethernet entry.
3. Configure IP address, Subnet mask, and Default gateway to match the production network. If the Ethernet port is on a separate physical NIC (e.g., on MP 377 with two Ethernet ports), confirm the correct port is selected.
4. Open Device Settings > Transfer and enable the Ethernet channel in addition to the PROFIBUS transfer channel. The Transfer channel list is independent of runtime connections; both must be set.
5. Open Device Settings > Network > Protocols and confirm that the PROFINET IO and TCP/IP protocols are enabled if you intend to use them for runtime communication.
6. Save, recompile, and transfer. After the transfer, restart the panel. The driver should turn green in the connection table.

Reference

Siemens documents this scenario in the WinCC Flexible 2008 Communication manual under "Communication > Configuring connections > Ethernet connections." The official entry is Siemens Support entry ID 18797552. If the orange highlight persists after a clean transfer, verify that the panel image version is at least V11.0.2.0; older images have a bug that mis-reports the Ethernet state until a power cycle.

Diagnostic Matrix for Connection Limit Symptoms

Migration Path: TIA Portal WinCC

If the application will outgrow the 8-connection cap repeatedly, plan a migration to TIA Portal WinCC. Comfort Panels on TIA Portal support 128 integrated connections on the largest sizes; PC-based WinCC Runtime Professional supports unlimited connections when licensed accordingly. The Siemens Support entry ID 109476811 documents the conversion procedure for moving a WinCC Flexible project to TIA Portal WinCC. The conversion preserves tag names, screen layouts, and scripts in most cases; minor rework is required for custom ActiveX controls and VB scripts that reference deprecated WinCC Flexible runtime objects.

Performance Sizing: Throughput and Latency Math

When selecting between the router and OPC methods, compute the worst-case update latency and bus load before commissioning.

Router Method Throughput

Each GET/PUT call on the S7-1200 transfers one data block per call. With N downstream PLCs and a target worst-case latency of L seconds, the per-PLC poll interval must be ≤ L / N. The S7-1200 GET/PUT block uses 32-byte minimum frame size and scales linearly; a 64-byte block at 100 ms cycle yields 6.4 KB/s per PLC. For 20 PLCs at 100 ms cycle, the S7-1200 PROFINET interface sustains ~128 KB/s aggregate — well within the 100 Mbit/s PROFINET capacity but consuming ~10% of the CPU's scan budget.

OPC Method Throughput

TOP Server CE's default update rate is 100 ms with deadband filter; KEPServerEX default is 50 ms. The OPC DA 2.0 protocol uses DCOM and has a per-item overhead of ~250 bytes; with 4,000 items, aggregate bus traffic is ~10 MB/s. PC hardware must be sized accordingly: dual-core CPU, 4 GB RAM minimum, Gigabit Ethernet NIC.

Validation Checklist Before Going Live

1. All 8 (or fewer) WinCC Flexible connections are present in the project tree and have a green status in the connection table after transfer.
2. Each tag is bound to the correct connection; no cross-connection address pollution.
3. If using a router, the S7-1200 PUT/GET access flag is enabled and the PLC's protection level is at Full access (no protection) or Read access as appropriate.
4. If using OPC, the OPC server's Server State is Running and the OPC client subscription in WinCC Flexible is Active.
5. The HMI panel's image version is documented in the project backup folder for traceability.
6. Acquisition cycles for non-critical tags are ≥ 1 s; only alarm and interlock tags use 100 ms or 500 ms.
7. A redundant communication path is documented and tested for any safety-relevant tag (e.g., E-Stop status, guard interlock).
8. All PLC partners are reachable from a manual ping test before HMI commissioning begins.

FAQ