WinCC Flexible Runtime: S7-300 Communication via Profibus DP

Overview

WinCC flexible PC Runtime (often written WinCC flexible RT) is the SoftContainer-based HMI execution environment used to drive HMI screens on a SIMATIC Panel PC, an industrial PC, or a standard PC. When it is paired with S7-300 stations, the runtime connects to the PLCs through Siemens Softnet or the hardware DP card driver. The most common configuration is the CP 5611 (6GK1 561-1AA01) or the CP 5611 A2 (6GK1 561-1FA01) Profibus interface card combined with the S7OLINE access point.

In a three-CPU S7-300 layout, the operator panel must open three concurrent connections - one per CPU - and the runtime's tag service multiplexes area-pointers and variable requests across these connections. A common question that arises during commissioning is: why does WinCC flexible RT exchange data with the three CPUs when the SIMATIC HMI station has not yet been opened in SIMATIC Manager and the CP has not been added to the HMI station object? The short answer is that WinCC flexible Runtime has its own connection engine that uses the access point of the application (S7OLINE) at the operating system level. The HMI station in SIMATIC Manager is primarily a transfer, project documentation, and configuration gateway; it is not required for online data exchange once the runtime project is loaded and the connections are stored in the binary project file.

This reference explains the runtime architecture, the role of S7OLINE, the configuration steps in WinCC flexible 2008 SP3, the PG/PC interface, and the optional HMI station integration in SIMATIC Manager. It applies to WinCC flexible 2008 SP3 / SP5 and remains valid for the engineering runtime that succeeded it on legacy projects.

Runtime Architecture and the S7OLINE Access Point

WinCC flexible PC Runtime is built on top of two distinct components:

1. WinCC flexible RT core - manages tag polling, alarms, logging, screen navigation, and the area pointer model.
2. Communication subsystem - implemented through the SIMATIC NET OPC / S7 Communication layer that is bound to a Windows access point.

The subsystem reads the access point from the registry and uses the SIMATIC NET driver that has been assigned to that access point. For a Profibus DP card such as CP 5611, the assigned interface is CP 5611 Profibus, and the access point is S7OLINE (older versions also known as S7ONLINE). The same access point is used by STEP 7 / SIMATIC Manager when STEP 7 talks to the PLC for programming or diagnostics.

The defining fact is that the SIMATIC HMI station object in STEP 7 is a project-tree entry used for download, transfer, and configuration alignment only. Runtime data paths do not pass through this object once the connection list has been compiled into the runtime binary. This is the architectural reason that connections conn1, conn2, and conn3 in your project start working the moment you launch the runtime, even though SIMATIC Manager shows no HMI station configured for the project.

How S7OLINE Resolves a Connection

When WinCC flexible Runtime starts, it reads the connection definitions from the project database and, for each connection, asks the SIMATIC NET communication stack to open a channel bound to S7OLINE. The stack maps the requested logical address to the physical CP via the PG/PC interface setting:

The mapping S7OLINE -> CP 5611 is registered in the registry path:

HKEY_LOCAL_MACHINE\SOFTWARE\Siemens\SINEC\LogDevices\S7OLINE
  -> ParamDLL = S7ONLINE.dll
  -> Driver  = CP_5611.DLL  (or CP_5621.DLL, CP_5613.DLL)

Required Hardware and Software Components

Profibus Cabling and Termination

A Profibus DP segment is RS-485, terminated with 220 ohm resistors between data lines (A-B) plus 390 ohm pull-up/pull-down at each end. With three CPUs on one segment, the typical topology is:

• Segment end 1: CP 5611 on the PC with terminator ON.
• Segment end 2: Last S7-300 CPU with terminator ON.
• Between: All other devices have terminator OFF.

Common wiring pitfalls include powering the PLC with the Profibus connector screwed on but with only one terminator engaged (causing reflections), or using bus connectors without their switchable termination resistor engaged.

Configuring the PG/PC Interface

Open Control Panel -> Set PG/PC Interface (also reachable from SIMATIC Manager -> Options -> Set PG/PC Interface). The dialog shows three columns:

1. Access Point of the Application - select S7OLINE.
2. Used Interface Parameter Assignment - pick CP 5611 Profibus (or A2 / 5621 variant).
3. Properties - click Properties to set the station address, transmission rate, and segment file.

For each CP, set the Profibus address of the PC. Convention is addresses 0 (PG/PC) and 1 through 126 for PLCs. With three S7-300 CPUs, a typical layout is:

Click Diagnostics to verify that the CP can see all three stations. Successful readout of device type, station name, and module configuration confirms the bus is wired correctly.

Configuring Connections in WinCC flexible

Connections in WinCC flexible are project-level objects that map runtime variables to a logical PLC. They are independent of the SIMATIC HMI station object.

1. Open the WinCC flexible project. Select the HMI device - in this case PC (WinCC flexible RT).
2. Open the Connections editor (left tree under the HMI node).
3. Insert three connections: Insert -> New Object -> Connection three times. Name them conn1, conn2, conn3.
4. For each connection set:
   • Communication driver: SIMATIC S7 300/400
   • HMI device connection point: S7ONLINE (this is internally aliased to S7OLINE during runtime)
   • PLC device: S7-300 (or specific CPU if required)
   • Station address: the DP address of the target CPU (2, 3, 4)
   • Rack/Slot: 0 / 2 for an S7-300 on rack 0 with CPU in slot 2
   • Cycle time: 1 s default; reduce for fast tags, increase for slow diagnostics
   • Area pointers: configure as required (date/time, user version, coordination, screen number, etc.)
5. Compile the project: Project -> Compiler -> All. The compiled runtime binary includes the connection list.

The official Siemens PDF "How do you configure a connection between WinCC flexible ..." (24109937_WinCC_flexible_Kommunikation_Ethernet_e.pdf) walks through this same flow using Ethernet as the medium; the project-side steps for Profibus DP are identical, only the Parameters dialog differs. The companion PDF "How can you transfer a WinCC flexible project via Ethernet" (23800567_WinCC_flexible_Ethernet_Transfer_en.pdf) covers the same Communication -> Connections tab in detail.

Area Pointers and Cyclic Tags

Area pointers are reserved data blocks in the PLC that the runtime reads or writes to coordinate behaviour. For WinCC flexible / S7-300 use the following pointers, all configured per connection:

The same DB can host all six area pointers - the runtime does not care about the location as long as the byte offset is configured correctly. Mismatched offsets are the most common reason for "communication works but the PLC clock is wrong" or "screen changes do not occur when triggered from the PLC".

Optional HMI Station Configuration in SIMATIC Manager

The HMI station object in SIMATIC Manager is added by opening SIMATIC Manager -> Insert -> Station -> SIMATIC HMI station. Once inserted, you populate it with the correct HMI type, the CP, and any line/modem modules. The HMI station serves four purposes:

1. Project transfer: permits Target System -> Download from STEP 7 over the same bus to push the WinCC flexible project to the runtime.
2. Cross-reference: variables in the WinCC flexible project can be cross-referenced against PLC symbols if the STEP 7 and WinCC flexible projects are part of the same scope.
3. Consistency check: STEP 7 validates that the configured connection rack/slot matches the actual PLC configuration.
4. Diagnostics gateway: lets you use the SIMATIC Manager's online view to inspect the HMI target.

If your project is transferred by another route (USB stick, Ethernet, manual copy) or you have already loaded the runtime directly from WinCC flexible, the HMI station in SIMATIC Manager is technically unnecessary for runtime data exchange. It remains an engineering convenience, especially when integrating into a larger STEP 7 / WinCC / PCS 7 architecture.

Runtime Startup Sequence

When WinCC flexible Runtime is launched from the start menu or from Start Center, it performs the following sequence:

1. Reads the access point S7OLINE from the registry.
2. Loads the compiled project file (.fwx or runtime load file).
3. For each connection in the connection list, calls the S7 communication layer to connect to the configured station address.
4. Begins cyclic polling of variables and area pointers.

The result of step 3 can be observed in the runtime log file - winccflexiblert.log in the runtime installation directory - and in the system events inside the runtime. Successful connections are reported as Connection OK; failures report specific S7 error codes such as 0x0014 (CPU unreachable) or 0x0004 (bus fault).

Diagnostics and Verification

1. PG/PC Interface Diagnostics

In Set PG/PC Interface click Diagnostics. The diagnostic window shows every reachable Profibus station with its address, station type (DP slave/master), input/output byte counts, and module diagnostics. If your three S7-300 CPUs are visible here, the hardware side is healthy.

2. SIMATIC NET Diagnostics Tool

The SIMATIC NET installation provides Diagnostics -> Set PG/PC Interface and a deeper Diagnostics -> SIMATIC NET Diagnostics. The latter shows live bus traffic and per-station statistics. Repeat counters, alive time, and timeout counts are reported.

3. Runtime System Events

Inside WinCC flexible Runtime open System -> Runtime Logging. The connection state per conn1/conn2/conn3 is displayed in real time. Common entries:

4. STEP 7 Online Test

From SIMATIC Manager (with HMI station optionally present) you can connect to the S7-300 directly and view online tags. If STEP 7 reads tags reliably, the bus is healthy and the WinCC flexible runtime's failure is on its own side (configuration or access point).

Multi-CPU Project Layout (conn1, conn2, conn3)

Three CPUs on one PC require careful variable partitioning. Some best practice:

• Allocate each CPU its own connection and its own pool of tag prefixes. Avoid sharing the same DB number across CPUs because the WinCC flexible connection editor maps variables to a connection -> DB space.
• Configure distinct cycle times for fast (e.g. machine state) and slow (e.g. temperature) tags to minimise bus load.
• If any CPU needs a large DB, configure the Limit parameter for that connection to prevent the runtime from pre-loading more data than the PLC can serve.
• Use Signed or Unsigned types consistently. S7 areas are byte-oriented in Profibus but word-oriented in the application; mismatches lead to display errors that look like communication failures.

Common Configuration Errors and Resolutions

Key Performance and Bus-Load Indicators

For a Profibus DP at 12 Mbit/s the theoretical throughput is roughly 1.5 MByte/s of useful payload after accounting for token and frame overhead. A single S7 read/write frame of 240 bytes is typical for the connection's first read; subsequent polls are smaller. A rough budget for three CPUs and 200 tags looks like this:

Bus load [%] = (sum_of_cyclic_bytes * 8 * 100) / (baud_rate * util_factor)

Example: 200 tags * 4 bytes = 800 bytes per cycle
        = 6400 bits per cycle
        = 6400 / 12,000,000 * 100 = 0.053 % per pass (at 12 Mbit/s)
With retries and acks, observed load often measured at 2-5 % for this size.

Bus load over 30-40% is risky. Use the SIMATIC NET diagnostics counter to monitor utilisation; if you see >50%, drop the baud rate to 1.5 Mbit/s for more reserved bandwidth per frame and reduce the tag count per cycle.

Best Practices for CP 5611 and WinCC flexible PC RT

• Keep CP 5611 driver version aligned with WinCC flexible RT version. SIMATIC NET 7.1 with WinCC flexible 2008 SP3 is a known-good combination.
• Use a unique Profibus address (typically 0) for the PC master and never duplicate it with a CPU address.
• Disable energy-saving mode for the PCI / PCIe slot in the BIOS; an idle slot can power down and break DP communication.
• Configure a "watchdog" tag cyclically written from the PLC and read by the HMI for bus health validation.
• Lock the project in WinCC flexible after commissioning to prevent accidental tag changes. The runtime cannot detect a hot-swap of tags.
• Backup the SIMATIC NET, STEP 7, and WinCC flexible projects together. The PG/PC Interface setting is also worth exporting via File -> Export in the PG/PC Interface dialog.

Project Transfer Alternatives

Even without an HMI station in SIMATIC Manager, the WinCC flexible project can be loaded to the runtime via:

1. WinCC flexible - Transfer mode over Ethernet or Profibus (see 23800567_WinCC_flexible_Ethernet_Transfer_en.pdf for the Ethernet variant).
2. USB stick - copy the compiled runtime folder onto the runtime PC and launch the runtime.
3. SIMATIC Manager - HMI station download - alternative that uses STEP 7 as the transfer engine.

Each path writes the runtime project into the PC's runtime directory. Once there, the connection list is part of the file and is loaded on next start.

Official Documentation and Standards

• How do you configure a connection between WinCC flexible ... (Siemens KB 24109937)
• How can you transfer a WinCC flexible project via Ethernet (Siemens KB 23800567)
• SIMATIC WinCC flexible product page (PI - PROFIBUS & PROFINET International)

Additional context: the Siemens Manual Collection DVD for WinCC flexible 2008 contains the manual WinCC flexible - Communication, which lists the S7 communication error codes and the area pointer layout in full. If your installation predates SP3, refer to the Communications part of the manual for the supported CP list and driver compatibility.

Frequently Asked Questions