WinCC Flexible Runtime: S7-200 Multi-PLC Connection Limits

Overview

WinCC Flexible Runtime (WinCC flexible RT) is the PC-based HMI runtime that pairs with the SIMATIC HMI panel configuration tool of the same name. The system supports direct communication with the SIMATIC S7-200 micro-PLC family over MPI or PROFIBUS DP using a Siemens PC communication card such as the CP 5611 (PCI) or CP 5612 (PCIe). A common integration task is to aggregate 20 or more S7-200 (CPU 226 classic) stations into one supervisory PC, but the runtime enforces a hard ceiling: only 8 simultaneously active HMI connections can be configured per WinCC flexible RT instance. This reference explains the underlying architecture, walks through DP slave configuration of the S7-226, and outlines the field-proven strategies for scaling beyond 8 PLCs.

WinCC Flexible Connection Architecture

Every WinCC flexible project — whether targeting a Panel or the PC Runtime — has a Connections editor. Each row in that editor represents one logical HMI-to-PLC link, and the runtime instantiates a separate communication task for every configured connection. The left side of a connection row is fixed: the local HMI / Runtime instance. The right side is the partner (the CP 5611, the CP 5612, an onboard MPI/DP port, or an Ethernet option module), which in turn talks to the S7-200.

For the PC Runtime, the documented maximum is 8 logical connections, regardless of the underlying bus. The limit is enforced at compile time and at runtime startup — the Runtime will refuse to come up if more than 8 connections are present in the project. The same document that defines the limit also defines the S7-200 partner behaviour: when an S7-200 is paired with WinCC flexible RT, it must be operated only as a DP slave on PROFIBUS. See the official Siemens application note "S7-200 and SIMATIC Panels or WinCC flexible PC Runtime" (Siemens Support, attachment 28263099).

The 8-Connection Limit Explained

The 8-connection ceiling is a license, resource, and tag-database limitation rolled into one. Each connection consumes one communication channel of the underlying PC communication hardware (e.g., CP 5611) and one tag database partition. The CP 5611 itself supports far more DP slaves on its wire — the PROFIBUS stack on a CP 5611 typically allows up to 64 DP slaves per segment and 126 station addresses on the bus — but WinCC flexible RT does not allow you to map more than 8 of those slaves into its connection table.

S7-200 Communication Protocols

The S7-200 CPU 226 classic provides two onboard RS-485 ports (Port 0 and Port 1) that natively speak PPI and MPI. PROFIBUS DP is added through the optional EM 277 PROFIBUS DP slave module plugged into the CPU's right-side expansion bus. For WinCC flexible RT integration, the EM 277 is the recommended path because it provides galvanic isolation, deterministic DP cycle times, and the baud rates that the CP 5611 expects.

For the use case of 20 S7-226 stations in a 25 m line (1 m pitch), the EM 277 at 12 Mbps is the practical choice: at 12 Mbps the maximum trunk segment is 100 m, well within the 25 m physical extent, and termination is straightforward.

Hardware Prerequisites

1. PC communication card. Siemens CP 5611 (PCI, PROFIBUS/MPI up to 12 Mbps) or CP 5612 (PCIe). Driver installed via SIMATIC NET PC software; the card must appear in the Windows Device Manager under "SIMATIC NET" with no yellow bangs.
2. PROFIBUS cable. Siemens 6XV1 830-0AH10 (violet, 2-core, shielded, characteristic impedance 150 Ω) or equivalent PROFIBUS DP cable. Strip length 5–7 mm; do not untwist the pair more than necessary.
3. PROFIBUS connectors. Siemens 6GK1 500-0FC10 (with PG socket and 220 Ω termination switch) at both physical ends of the bus. Activate the terminating resistor ON at the first and last connector, OFF everywhere else.
4. EM 277 PROFIBUS DP slave module on every S7-226. Order number 6ES7 277-0AA22-0XA0 (last compatible FW version 2.1 for classic S7-200 series).
5. STEP 7 Micro/WIN V4.0 SP9 or later for S7-200 project transfer and EM 277 address/configuration.
6. WinCC flexible 2008 SP5 (or SP5 + HF7 for Windows 10 support) with the WinCC flexible PC Runtime license key.

Configuring the S7-200 (CPU 226) as a DP Slave

The S7-200 is a DP slave only on the EM 277. It cannot be a DP master. The DP master in this topology is the CP 5611 on the PC, and the EM 277 exposes a fixed set of input and output slots that the master can read or write.

1. Power down the S7-226, snap the EM 277 onto the right side of the CPU until the latch clicks, power back up. The SF (system fault) LED on the EM 277 should extinguish after about 5 s.
2. Open STEP 7 Micro/WIN. From the menu select Tools → EM 277 Configuration (or use the wizard in the Instruction Tree under Wizard → PROFIBUS). Set the DP slave address in the range 3–99. Addresses 0–2 are reserved; 1 is the CP 5611 master by default.
3. Set the I/O mapping. The EM 277 supports up to 16 words of inputs and 16 words of outputs. Typical mapping for an HMI is: Master output area → S7-200 V-memory (e.g., VW100) and S7-200 V-memory (e.g., VW200) → master input area. The exact offsets are configured in the EM 277 wizard and exported to a GSD file for the master.
4. Download the project to the S7-200. Cycle power on the EM 277 to make the new address active.

Configuring the WinCC Flexible PC Runtime Connection

1. Open the WinCC flexible project in the engineering station. In the project tree, double-click Connections.
2. Click the first empty row. The Communication Driver on the right (the partner side) must be set to SIMATIC S7-200. The driver dialog opens.
3. In the driver dialog, set:
   • Station address = the PROFIBUS address of the EM 277 you set in Micro/WIN (e.g., 3).
   • Master address = the CP 5611 PROFIBUS address (typically 1).
   • Bus profile = PROFIBUS, baud 12 Mbps (or 1.5 Mbps if you use a 1.5 Mbps PROFIBUS segment for longer reach).
   • Slot = the EM 277 input/output slot used for the data exchange (default 0, 1, 2, 3 depending on I/O width).
4. Click OK. The connection row is filled. Repeat for up to 7 more S7-200 stations, each with its own unique PROFIBUS address and its own connection row.
5. In the tag editor, browse the S7-200 area via the connection. Use the address syntax V (V-memory), I / Q (process image, if mirrored), M (bit memory), AI / AQ (analog), and DB is not available on the S7-200 (no DBs — use V-memory instead).
6. Compile the project and start the WinCC flexible Runtime. The status bar in the Runtime should show all 8 connections in the green "connected" state.

Reading and Writing S7-200 Tags from WinCC flexible

The S7-200 tag addressing in WinCC flexible follows the standard SIMATIC syntax but is restricted to the S7-200 memory model. A common mapping is shown below.

Scaling Beyond 8 S7-200 PLCs

Three field-proven strategies exist to reach 20 S7-226 stations. The choice depends on license budget, long-term project direction, and how much engineering rework is acceptable.

Strategy A — Multiple WinCC flexible RT instances on one PC

Run two or three WinCC flexible RT instances side by side, each with up to 8 connections. Each instance is launched as a separate Windows process and binds to a separate CP 5611 (or to a different logical interface on the same card if the bus is shared and a PROFIBUS repeater is used). Field engineers commonly use this approach when the project is locked to WinCC flexible and the existing HMI panels must remain.

1. Create ProjectA with connections to S7-200 stations 1–8 and ProjectB with connections to stations 9–16. A third project, ProjectC, takes 17–20.
2. Install a second CP 5611 for the second instance, or place a PROFIBUS repeater (Siemens 6GK1 500-0AA00) to split the bus and keep the stubs short.
3. Configure the start order and recovery in Windows Task Scheduler or in the WinCC flexible autostart settings. Use one "head" Runtime with a navigation screen that opens the others as picture windows if user-friendliness is required.

Strategy B — S7-200 PC Access as the OPC aggregator

Use the free Siemens S7-200 PC Access OPC server as the gateway to the S7-200 bus. S7-200 PC Access can address many more than 8 S7-200 stations over MPI/PPI/DP. The OPC server then exposes all PLC tags to a single WinCC flexible RT instance through the OPC channel. This bypasses the WinCC flexible RT native 8-connection ceiling because the OPC driver uses a single "connection" entry that points to the OPC server instead of directly to a CPU.

1. Install S7-200 PC Access on the supervisory PC and add one item per S7-200 station by browsing the PC Access tag list.
2. In WinCC flexible, change the connection driver from SIMATIC S7-200 to OPC and point it at the local S7-200 PC Access server.
3. Map WinCC flexible tags to OPC items. The quality code and timestamp from OPC are preserved on the HMI tags.

Strategy C — Migrate to WinCC Professional / TIA Portal

WinCC Professional (part of the TIA Portal engineering suite) does not have the 8-connection ceiling. The lowest WinCC Professional license tier supports 16 connections; the higher tiers support 64, 256, 512, and 3,200 PowerTags with up to 16 S7 connections, while WinCC Professional as part of WinCC V7.x can scale to 128 or more connections. A migration of the 20-PLC project to TIA Portal / WinCC Professional is the recommended long-term path for any new system, but it requires:

• Re-creating the HMI screens (WinCC flexible to WinCC Comfort/Advanced via migration tool, then on to WinCC Professional if needed).
• Converting STEP 7 Micro/WIN programs to STEP 7 Basic / S7-1200 — the S7-200 is a discontinued platform, so a true "scale-up" usually means S7-1200 with the original wiring retained and the EM 277 swapped for a CM 1243-5 PROFIBUS master on the supervisory side.

Network Topology and Cable Lengths

For the 20-PLC, 25 m total extent, 1 m pitch scenario, a single PROFIBUS segment at 12 Mbps is feasible but tight. The DP standard mandates 100 m segment length at 12 Mbps. With 25 m total and EM 277 stubs up to 1 m each, you are well within the limit. A recommended topology is a backbone PROFIBUS cable run past the line of 20 PLCs, with short stubs (≤ 1 m) tapping each station via a 6GK1 500-0FC10 connector with the PG socket capped.

Troubleshooting Matrix

Verification

After commissioning, run the following verification sequence:

1. Open the WinCC flexible Runtime. In the Tools → Diagnostics → Connections view, confirm all configured connections show a green "connected" icon.
2. Toggle a tag in the HMI (e.g., a momentary button that writes 1 to VW100) and read it back in the Runtime tag list. The value should round-trip in under 1 s at 12 Mbps.
3. Disconnect the PROFIBUS connector at one EM 277. The Runtime should report "connection lost" for that station only; all others remain green. This confirms the per-connection fault isolation.
4. Reconnect and confirm the Runtime re-establishes the connection without needing a restart of the Runtime itself.

Field-Proven Caveats

• The S7-200 platform has been officially discontinued. For new installations, weigh the S7-200 vs. S7-1200 decision. The wiring, addressing, and toolchain are not interchangeable.
• The CP 5611 is a PCI card and may not be available on modern industrial PCs. The CP 5612 (PCIe) or CP 5622 are the modern equivalents. The driver is the same SIMATIC NET package.
• WinCC flexible itself is in the "legacy" phase, with TIA Portal / WinCC Comfort & Professional as the supported successor. Plan a migration path before the S7-200 / WinCC flexible stock becomes unobtainable.
• For very long busses or harsh EMC environments, fibre-optic PROFIBUS (OLM / OBT) is a field-proven alternative to copper and is immune to ground loops across long distances.

FAQ