WinCC Flexible: Resolving "Could Not Establish Connection" on S7-300 MPI
When a WinCC Flexible project cannot reach a SIMATIC S7-300 CPU over MPI, the most common root cause is a category error: the engineer is trying to push an HMI runtime project into the PLC. WinCC Flexible does not load into a CPU. The runtime executes on the PC (or on a panel), and the CPU is the data server it talks to. The dialog "Could not establish connection. Please check your settings, interfaces, cables etc.!" is reported by WinCC Flexible itself and is a network/address failure on the S7 protocol, not a transfer failure of the WinCC project.
This reference walks through the complete fix path on a CPU 315-2DP with a CP5611 MPI card, including the correct tool split between SIMATIC Manager (PLC) and WinCC Flexible (HMI), the MPI bus parameters, the connection and tag configuration, the runtime launch on the PC, and a field-tested verification sequence.
1. Problem Description
Symptom observed on the engineering PC:
- Project: motor forward/reverse/stop with two direction lamps, programmed in S7 STL against a CPU 315-2DP (MLFB 6ES7 315-2AF03-0AB0) with onboard DI/DO.
- HMI: WinCC Flexible 2008 SP3 project, intended to run on the same PC (PC RT, not a touch panel).
- Interface: SIEMENS CP5611 MPI PCI card in the PC, PROFIBUS/MPI cable to the CPU's MPI port.
- Error: WinCC Flexible Runtime fails to start with
Could not establish connection. Please check your settings, interfaces, cables etc.! - PLC program: confirmed working via Variable Table in SIMATIC Manager; outputs Q1.0, Q1.1, Q2.0, Q2.1 toggle correctly when inputs are forced.
Pre-checklist: the S7 program is in the CPU, the CPU is in RUN with no SF/BF, the MPI cable is the standard 6ES7 901-0BF00-0AA0 (or equivalent RS-485 PROFIBUS cable with PG bus connector) and termination is powered. If any of these are red, fix them first; the WinCC dialog is the same regardless.
2. Root Cause Analysis
The error string is generic and the dialog does not tell you which layer failed. The actual fault tree has five nodes, in order of likelihood for a PC-RT install:
| Rank | Layer | Failure | How it manifests |
|---|---|---|---|
| 1 | Tooling | Engineer attempts to "transfer WinCC to PLC". WinCC has no concept of "download to PLC"; it has "download to Panel" and "start Runtime on PC". | Confusion, aborted transfer, eventually the connection error when RT is finally started. |
| 2 | Address | PC MPI address is 0 (default PG); the WinCC connection expects the HMI node to be a non-zero address (e.g. 1) and the CPU is typically 2. | MPI token never reaches the configured partner; bus scanner shows the CPU but RT shows no connection. |
| 3 | Driver | CP5611 driver is missing or the slot is wrong; Set PG/PC interface points to a non-existent access point. | "Interface not installed" or immediate connection refused. |
| 4 | Configuration | WinCC connection configured for PROFIBUS, MPI address, rack/slot, or TSAP mismatched against the real CPU. | RT starts but tags show "connection error" on every read. |
| 5 | Bus | Baud rate, profile, or highest station address inconsistent across nodes; termination missing on a long segment. | Intermittent connect, BF on CPU, RT dialog re-appears. |
Confirming which layer is in fault: open SIMATIC Manager > Options > Set PG/PC Interface, choose S7ONLINE -> CP5611(MPI), then Accessible Nodes. The CPU 315-2DP must appear with its MPI address. If it does, layers 3 and 5 are clean and the problem is layers 1, 2, or 4.
3. Required Hardware and Software
| Item | Specification | Notes |
|---|---|---|
| CPU | 6ES7 315-2AF03-0AB0 (CPU 315-2DP, FW ≥ 2.0) | Onboard MPI port, PROFIBUS DP master/slave on second interface. |
| PG/HMI PC | Windows XP SP3 / Windows 7 32-bit, x86 | WinCC Flexible 2008 SP3 is not x64-compatible. |
| PC interface | SIEMENS CP5611 (6GK1 561-1AA01) PCI card | Requires SIMATIC NET 2008 / PC-Adapter driver. CP5621 (PCIe) is a modern substitute. |
| Cable | 6ES7 901-0BF00-0AA0 PROFIBUS cable with PG bus connector, or 6XV1 830-0EH10 | Twisted, shielded, 120 Ω termination on both ends; max 1.5 Mbps with CP5611. |
| Software | SIMATIC Manager V5.5 + SP2, WinCC Flexible 2008 SP3 (or later in the 2008 line) | For integrated projects, use STEP 7 V5.x with the WinCC Flexible integration option. |
4. MPI Bus Parameters and Addressing Rules
All nodes on an MPI segment must share bus parameters. With only a CPU and one PC node, use the defaults; documenting them prevents future drift.
| Parameter | CPU 315-2DP default | CP5611 / PC node | Comment |
|---|---|---|---|
| Baud rate | 187.5 kbps | 187.5 kbps | Do not mix 19.2 kbps and 187.5 kbps; tokens will not pass. |
| Highest station address (HSA) | 31 | 31 | Reserved addresses beyond the highest used node save token time. |
| Profile | Standard (DP/MPI) | Standard | "User-defined" only if a custom bus profile was generated. |
| CPU MPI address | 2 (default) | n/a | Verified in SIMATIC Manager > Hardware > CPU Properties > MPI/DP interface. |
| PC MPI address (PG) | n/a | 0 (default, "PG") | Set to 1 if the WinCC project expects an HMI node at address 1. |
MPI address allocation rule of thumb on a flat bus with one CPU and one PC:
- CPU = 2 (Siemens reserved range for non-PG nodes starts at 2).
- PC running WinCC Flex RT = 1 (HMI nodes are commonly addressed 1).
- Avoid 0 (PG default) for an HMI node unless the project is set to "PG".
5. Step 7 Project Configuration (PLC Side)
You do not modify the S7 program to enable WinCC. The HMI reads and writes the same DB/inputs/outputs the STL already uses. Confirm the data block the WinCC tags will reference is not optimized/block-protected in a way that prevents external access (not an issue on S7-300, but document it).
- In SIMATIC Manager, open your S7 project and double-click Hardware on the SIMATIC 300 station.
- Open the CPU 315-2DP > Properties > MPI/DP Interface. Confirm Address: 2, Subnet: MPI(1), Transmission rate: 187.5 kbps.
- Close HW Config, save and compile (Station > Save and Compile). Errors here usually indicate inconsistent module catalog / GSD mismatch, unrelated to WinCC.
- Download the station to the CPU: right-click the station > Download to Target. CPU should report RUN with green RUN LED, no SF/BF.
- Open a Variable Table (VAT) and force the contactor bits already wired in the STL to confirm tags like
Q 1.0,Q 1.1,Q 2.0,Q 2.1drive the real outputs. This isolates the PLC from the HMI bus.
6. WinCC Flexible Connection Configuration (HMI Side)
- Open the WinCC Flexible project in WinCC Flexible 2008.
- Open Project > Connections. A connection of type S7 300/400 must exist (auto-created when you insert an HMI tag pointing at the S7 station). Double-click to open.
- Set the connection parameters:
| Field | Value | Notes |
|---|---|---|
| Communication driver | S7 300/400 | Do not select "PROFIBUS DP" if the runtime is on MPI; the protocol is still DP-on-MPI for the S7-300. |
| HMI device | Configured PC RT node | Created with the correct MPI address (e.g. 1). |
| PLC address | 2 | Must match the CPU MPI address exactly. |
| Connection type | MPI | Not "PROFIBUS", not "Ethernet"; the CP5611 is MPI-only here. |
| Rack | 0 | Default for S7-300. |
| Slot | 2 | Slot of the CPU in the rack (power supply = 1, CPU = 2). |
- Open the HMI device's Device Configuration or Communication > Connection area and verify the HMI node MPI address. It must be unique on the bus. If the project was imported with an address of 1 and the PC is at 0, change the project, not the PC card's PG address.
7. CP5611 and Set PG/PC Interface
- Install SIMATIC NET on the PC. The CP5611 driver installs as part of the SIMATIC NET setup (not the SIMATIC Manager install).
- Open Start > SIMATIC > SIMATIC NET > Settings > Set PG/PC Interface.
- Select access point
S7ONLINEand interface parameterizationCP5611(MPI) -> MPI. Click Properties:
- MPI address: 1 (matches the HMI node configured in WinCC Flex).
- Transmission rate: 187.5 kbps.
- Highest station address: 31.
- Test by clicking Diagnostics and running Test -> Read. The CPU at address 2 must respond with its order number and module name. If it does not, the problem is below WinCC and must be solved here first.
8. WinCC Flexible Tag Configuration
For the motor control described in the source STL, the minimum tag set is:
| Tag name | PLC address | Type | Acquisition | Used by |
|---|---|---|---|---|
| CW_button | I 0.9 / DBX0.9 | Bool | Cyclic 1 s | Clockwise button press |
| CCW_button | I 0.10 / DBX0.10 | Bool | Cyclic 1 s | Anti-clockwise button press |
| Stop_button | I 0.11 / DBX0.11 | Bool | Cyclic 1 s | Stop button |
| CW_run | Q 1.0 / DBX1.0 | Bool | Cyclic 1 s | Clockwise contactor feedback |
| CCW_run | Q 2.0 / DBX2.0 | Bool | Cyclic 1 s | Anti-clockwise contactor feedback |
| Fault | Q 3.0 / DBX3.0 | Bool | Cyclic 1 s | Interlock fault lamp |
Configure each tag as a bit, mapped to the absolute address above or to a symbolic DB address. If you use symbolic DB access, define the DB in STEP 7 as not optimized and non-block-protected. HMI bit addresses use the notation DB1.DBX0.0 for data block 1, byte 0, bit 0.
9. Starting the Runtime on the PC
This is the part most often confused with a transfer:
- With the WinCC Flexible project open, choose Project > Compiler > Start Runtime (button: F5 / play icon). Do not look for a "Download to PLC" command. There isn't one.
- If a license dialog appears stating "WinCC Flexible Runtime: missing or invalid license", select Skip to proceed in demo mode. Periodic warnings are normal in demo mode and can be suppressed by installing a valid license key on the license server.
- Watch the status bar of the runtime window. On a successful start, the connection icon (bottom right) shows two green arrows: PC ↔ PLC.
- Click the HMI buttons (CW, CCW, Stop) and observe the corresponding output bits toggle in the SIMATIC Manager VAT.
10. Common Error Mapping and Fixes
| Error text | Real cause | Fix |
|---|---|---|
| Could not establish connection. Please check your settings, interfaces, cables etc. | Wrong S7 connection or wrong MPI address in WinCC Flex project, or CP5611 not selected as S7ONLINE. | Verify Connection parameters (Section 6) and Set PG/PC Interface (Section 7). |
| Interface not installed | CP5611 driver missing or wrong S7ONLINE access point. | Install SIMATIC NET, set access point to CP5611(MPI). |
| Partner not reachable / Timeout | Wrong partner address, wrong rack/slot, or CPU in STOP. | CPU in RUN, address 2 / rack 0 / slot 2. |
| Connection interrupted (periodic) | Baud rate mismatch or missing termination. | Set all nodes to 187.5 kbps, enable 120 Ω termination at both cable ends. |
| License missing, continue with Skip? | Runtime in demo mode; not an error. | Install license or accept demo mode. |
| WinCC: Download to PLC option greyed out | WinCC Flex does not download to PLC. | Use Start Runtime, not Download. |
11. Step-by-Step Resolution
- Stop the wrong workflow. Close any "Download to PLC" dialog from WinCC Flex. WinCC has no such transfer path; the S7 project is downloaded only from SIMATIC Manager.
-
Confirm the PLC is reachable from the PC. SIMATIC Manager > Options > Set PG/PC Interface =
S7ONLINE -> CP5611(MPI)> Accessible Nodes must show the CPU at address 2. - Align MPI addresses. CPU = 2, PC = 1. Set the PC's CP5611 MPI address to 1 in Set PG/PC Interface > Properties.
- Set the WinCC connection. Communication driver = S7 300/400, Connection type = MPI, PLC address = 2, Rack = 0, Slot = 2.
- Build and start Runtime on the PC. Project > Compiler > Start Runtime. Verify the status icon turns green.
- Drive the program from the HMI. Use the configured CW/CCW/Stop tags and confirm with a VAT that the real outputs toggle.
12. Verification Procedure
Verification has three independent layers; all three must pass:
-
Bus layer: Accessible Nodes in SIMATIC Manager lists the CPU 315-2DP with order number
6ES7 315-2AF03-0AB0at MPI address 2. - Runtime layer: WinCC Flexible Runtime starts without the connection dialog, and the status icon shows continuous connection (no red "break" symbol).
- Application layer: Pressing the HMI CW button drives Q1.0 in the PLC (visible in VAT and at the real output terminal); pressing CCW drives Q2.0; both cannot be active simultaneously because of the STL interlock (AN Q 2.1 / AN Q 1.2). The fault bit Q3.0 never asserts under correct operation.
13. Troubleshooting Matrix
| Symptom | Check 1 | Check 2 | Check 3 | Resolution |
|---|---|---|---|---|
| Connection error on RT start | Accessible Nodes sees CPU? | MPI addresses unique? | WinCC connection → PLC address = 2, slot = 2? | Fix address, rebuild RT. |
| Tags show "connection error" in RT | Set PG/PC Interface correct? | CPU in RUN? | Cable termination? | Re-apply S7ONLINE; power CPU; terminate bus ends. |
| RT starts but outputs never change | WinCC tags mapped to right DB? | DB optimized access (S7-1200/1500)? | Symbolic vs absolute address correct? | Recreate tags with absolute addresses or disable optimized access. |
| BF LED on CPU steady | Baud rate mismatch? | Duplicate MPI address? | Cable broken? | Standardize on 187.5 kbps; reassign addresses; swap cable. |
| License warning reappears every minute | Demo mode active? | License key installed? | Automation License Manager service running? | Transfer license to PC; start the service. |
14. Field-Proven Caveats
- WinCC Flexible 2008 has no native x64 runtime. On a 64-bit OS, install WinCC Flex in Windows XP Mode (Windows 7) or use a 32-bit image. New deployments should move to TIA Portal with WinCC Comfort/Advanced.
- The CP5611 MPI card shares the bus with a CP5613 PROFIBUS card only if both are explicitly set to the correct bus profile; do not rely on auto-detection.
- MPI address 0 is reserved for a programming device (PG) in legacy configurations. Modern WinCC Flex expects the HMI to be on a non-zero address; address 1 is conventional.
- The interlock in the source STL (Q1.0 gated by AN Q 2.1; Q2.0 gated by AN Q 1.2) is the right pattern for a reversing contactor. Keep the same logic on the HMI side using a tag-level conflict detector so an HMI fault cannot start both contactors.
- If you later migrate this project to TIA Portal, the WinCC Flex project converts via "Migration" tooling; the S7 connection migrates as an HMI connection in the device configuration. The CP5611 must be replaced with CP5621 (PCIe) on a 64-bit host.
15. FAQ
Why does WinCC Flexible show "Could not establish connection" when I try to transfer the project to the S7-300?
WinCC Flexible does not transfer a project to a PLC. The dialog is misleading: it actually appears when Runtime is started and the configured S7 connection cannot reach the CPU. The fix is to set the correct MPI address in the WinCC connection, the CP5611 access point, and use Start Runtime, not a download command.
What MPI address should I assign to the PC running WinCC Flexible Runtime?
Use a non-zero address; 1 is the convention. The PC's CP5611 MPI address is configured via Set PG/PC Interface > CP5611(MPI) > Properties > MPI Address. It must differ from the CPU's address (2 by default) and from any other node on the bus.
Can I download a WinCC Flexible project to the S7-300 CPU and have it serve HMI pages?
No. S7-300 CPUs do not host HMI runtime. WinCC Flexible Runtime runs on a PC (PC RT) or on a Siemens panel (e.g. OP/TP/MP). The S7-300 only provides the process data and accepts/replies S7 protocol frames; it never executes the HMI logic.
Do I need a separate runtime license to use WinCC Flexible on the PC?
Yes for production use. Without a valid license, the runtime starts in demo mode and periodically issues a "License missing or invalid" warning. Install the license via the Automation License Manager on the engineering PC or a license server.
Should I migrate this WinCC Flexible + S7-300 + CP5611 stack to TIA Portal?
Yes, for any new project. WinCC Flexible 2008 is end-of-life, lacks 64-bit support, and the CP5611 is no longer orderable. Use TIA Portal with WinCC Comfort/Advanced, an S7-300 (or S7-1500) CPU, and a CP5621 (PCIe) or a native PROFINET interface. The MPI network itself is the only piece you can keep; everything else should be refreshed.