WinCC Flexible S7 Routing for MPI/DP and Ethernet Panel Transfer

Overview of S7 Routing in WinCC Flexible

When commissioning or maintaining SIMATIC HMI panels connected to S7-300/S7-400 controllers, engineers frequently need to transfer runtime projects across heterogeneous network boundaries. A typical configuration pairs a CPU 317-2 PN/DP with one Ethernet-attached Panel and a second PROFIBUS DP-attached Panel, then asks a simple question: can WinCC flexible 2007 HF4 download a project through S7 routing from a programming device on the PROFIBUS segment to a panel sitting on the Ethernet segment — and vice versa?

The answer is that S7 routing in WinCC flexible supports cross-network transfer when the S7 routing path is fully configured in STEP 7 and when the destination panel supports the transfer profile. Ethernet-to-PROFIBUS and PROFIBUS-to-Ethernet routing is supported in principle, but there are documented caveats when the programming device is on the same network as the target panel, when teleservice adapters replace a segment, and when the CPU's PROFINET interface must act as the routing gateway.

This reference covers the routing topology, the S7 routing table in STEP 7, the transfer mechanics in WinCC flexible 2007 HF4, alternative methods (ProSave, Backup/Restore, USB, Smart@Service), and the verification steps required to confirm a successful transfer. All product references are documented in the Siemens Industry Online Support portal.

Network Topology and Hardware Prerequisites

The reference topology consists of the following components:

• One SIMATIC S7-300 CPU 317-2 PN/DP (6ES7317-2EK14-0AB0 or compatible), firmware V3.3, with both a PROFINET/Ethernet interface (X1) and a combined MPI/PROFIBUS DP interface (X2).
• Panel A: an Ethernet-attached panel such as an MP 377 12" Touch or TP 177B PN/DP, configured with IP address 10.10.10.12, connected to the CPU 317-2 PN/DP PROFINET port or a switch on the same subnet.
• Panel B: a PROFIBUS DP-attached panel such as an OP 277 6" or MP 270B, configured with PROFIBUS address 12, connected to the CPU 317-2 PN/DP X2 MPI/DP port.
• A programming device (PG/PC) running WinCC flexible 2007 HF4 (6AV6612-0AA01-3CA0 or later) and STEP 7 V5.5 SP2 or later.
• Optionally, a TS Adapter II (6ES7972-0EA02-0XA0) on the MPI/DP port for remote maintenance.

Understanding S7 Routing Limitations

S7 routing is a feature of the S7 communication stack that allows a programming device to reach a station (CPU or HMI) located on a different subnet by traversing one or more S7 stations that act as routers. The CPU 317-2 PN/DP supports S7 routing between its PROFINET and MPI/DP interfaces. However, the WinCC flexible transfer channel adds two restrictions:

1. The target panel's connection in WinCC flexible must be configured for S7 routing.
2. The routing path must be programmed into the S7 project in STEP 7 — WinCC flexible alone cannot establish the route.

If a programming device sits on the PROFIBUS DP network and the target panel sits on Ethernet, the routing path is:

PG (PROFIBUS) → CPU 317-2 PN/DP (X2 MPI/DP) → CPU 317-2 PN/DP (X1 PROFINET) → Panel (Ethernet)

The CPU acts as a router, and the S7 routing table must include the panel's IP address as a destination on the PROFINET subnet. In the reverse direction:

PG (Ethernet) → CPU 317-2 PN/DP (X1 PROFINET) → CPU 317-2 PN/DP (X2 MPI/DP) → Panel (PROFIBUS address 12)

Both directions are theoretically supported. Real-world failures typically involve the CPU's PROFINET interface not being assigned a router role, WinCC flexible transfer settings not specifying the routing gateway, or a teleservice adapter interrupting one segment of the routing path.

When a teleservice adapter is present, the MPI/DP segment terminates at the TS Adapter rather than continuing to the CPU in a way that WinCC flexible can traverse. The community FAQ on this exact scenario states that Ethernet will not work through the teleservice adapter in the same way as direct routing — the panel must support a direct IP transfer (Smart@Service or ProSave over Ethernet) or accept the project via USB.

Configuring S7 Routing in STEP 7

Before WinCC flexible can use S7 routing, the routing table must be set in STEP 7. Procedure:

1. Open the S7 project in STEP 7 V5.5 SP2 or later.
2. In HW Config, double-click the CPU 317-2 PN/DP.
3. Open the "Properties" dialog of the PN-IO interface (X1).
4. Select the "Router" sub-tab.
5. Click "Add" to enter the IP address of the panel on the PROFINET subnet (10.10.10.12) and assign it to the local PROFINET subnet of the CPU.
6. Click "Add" again for any additional Ethernet nodes that must be reachable through the CPU.
7. For the MPI/DP interface (X2), repeat the procedure on its Router sub-tab to make the Ethernet panel reachable from the PROFIBUS side.
8. Save and compile (Station → Save and Compile).
9. Download the hardware configuration to the CPU.

Sample routing entries:

Router: CPU 317-2 PN/DP
  Subnet PROFINET_1 (10.10.10.0/255.255.255.0)
    Panel A: 10.10.10.12
  Subnet MPI/DP_1 (PROFIBUS, address range 1-126)
    Panel B: PROFIBUS address 12

The CPU's router sub-tab is documented in the STEP 7 online help under "S7 routing" and in the S7-300 CPU 31xC and CPU 31x operating instructions, accessible from the Siemens Industry Online Support portal. The CPU's maximum number of routing entries is firmware-dependent; V3.3 supports up to 16 routing entries across both interfaces.

Configuring the Panel Connection in WinCC Flexible

In WinCC flexible 2007 HF4, the panel's connection to the CPU must be configured for S7 routing. Procedure:

1. Open the WinCC flexible project for the target panel.
2. In the project tree, open "Connections".
3. Double-click the active connection.
4. In the "PLC" dropdown, select "SIMATIC S7 300/400".
5. In the "HMI device" dropdown, select the panel type (e.g., MP 377).
6. In the "HMI address" field, enter the panel's network address:
   • For the Ethernet panel: IP 10.10.10.12 (PROFINET)
   • For the PROFIBUS panel: PROFIBUS address 12
7. In the "PLC address" field, enter the CPU's network address on the same subnet as the panel.
8. In the "Profile" field, select "S7 routing" if the transfer must traverse the CPU.
9. Click "OK" and save the project.

When the WinCC flexible transfer is started (Project → Transfer → Transfer or HMI Device → Transfer), the dialog prompts for the connection mode. Select the path that matches where the programming device is connected:

• PG on Ethernet → PROFIBUS panel: select "Ethernet" as the PC interface and "S7 routing" as the panel access point. WinCC flexible routes the transfer through the CPU.
• PG on PROFIBUS → Ethernet panel: select "MPI/DP" as the PC interface, set the PROFIBUS address of the CPU, and let S7 routing take the path through the CPU to the Ethernet panel.

ProSave and Backup/Restore: Free Transfer Methods

ProSave is the Siemens service tool for backing up and restoring panel images and runtime projects. It is bundled with WinCC flexible and located in the WinCC flexible installation directory (typically C:\Program Files\Siemens\Automation\WinCC flexible\WinCC flexible Support\ProSave\). ProSave supports transfer over Ethernet, PROFIBUS/MPI, USB, and serial. It does not require STEP 7 to be installed and is free of charge.

Steps to use ProSave for a panel transfer:

1. Launch ProSave on the programming device.
2. In the "Device type" dropdown, select the target panel (e.g., MP 377).
3. In the "Connection" dropdown, select the connection type: Ethernet, MPI/DP, or USB.
4. Enter the panel's network address.
5. Click "Connect". ProSave establishes a connection to the panel.
6. Select the "Backup" tab to back up the current panel image, or the "Restore" tab to push a new image.
7. Click "Start" to begin the operation.

Backup/Restore is available directly on the panel's Windows CE / Windows XP Embedded control panel (Start → Settings → Control Panel → Backup/Restore, or via the Service Center on newer panels). It does not require any software on the programming device and is free of charge.

Steps:

1. On the panel, open Control Panel → Backup/Restore.
2. Insert a USB stick formatted as FAT32.
3. Select "Backup" to copy the current project, registry, and firmware settings to the USB stick.
4. Remove the USB stick and ship or hand-carry it to the remote site.
5. At the remote panel, plug the USB stick into the panel.
6. Open Control Panel → Backup/Restore → "Restore" and choose the backup file.
7. Confirm; the panel reboots with the restored image.

USB Stick Project Transfer Procedure

WinCC flexible supports direct transfer of the compiled runtime project (.fwx file) to a USB stick, which can then be loaded onto the panel via its USB host port. This method is the most field-proven for transferring projects to remote panels with intermittent or unreliable network connections.

1. In WinCC flexible, select "Project → Compiler → Generate" to produce the runtime file, or use "Project → Transfer → Transfer" for a direct push.
2. The compiled file is placed in the project's "Transfer" subfolder with a name matching the panel type (e.g., MP377.fwx).
3. Copy the .fwx file to a FAT32-formatted USB stick.
4. On the panel, open the Control Panel → Transfer or Service Center.
5. Select "USB" as the source.
6. Browse to the .fwx file and confirm the transfer.
7. The panel installs the new runtime and restarts.

Smart@Service and Teleservice Integration

Smart@Service is a WinCC flexible option that enables remote transfer and remote maintenance of panels over IP-based networks (including the Internet, VPN, or company intranet). It is a separately licensed option (6AV6618-7AA01-0AB0 or current part number) that installs a service agent on the panel.

Steps:

1. Install the Smart@Service option on the engineering station.
2. Configure the panel with the Smart@Service agent (enabled in WinCC flexible at compile time).
3. On the panel, configure the network settings (IP, gateway, DNS) and ensure outbound IP connectivity to the Smart@Service server.
4. From WinCC flexible, use the Smart@Service console to push the project to the panel over the IP network.

Teleservice integration: a TS Adapter II (6ES7972-0EA02-0XA0) installed on the CPU's MPI/DP port terminates the MPI/DP segment and provides a remote IP-based maintenance channel. When the TS Adapter is in use, the routing topology becomes:

Remote PG (IP) → TS Adapter (MPI/DP) → CPU 317-2 PN/DP (X2) → CPU 317-2 PN/DP (X1) → Ethernet panel

In this configuration, S7 routing enters the CPU via the MPI/DP interface (through the TS Adapter) and exits via the PROFINET interface. The S7 routing table in STEP 7 must include both the Ethernet panel and the TS Adapter's MPI address. In practice, the simpler approach is to use Smart@Service on the Ethernet panel and let the panel's IP-based agent handle the transfer, bypassing S7 routing altogether. The community FAQ cited for this scenario confirms that Ethernet will not work through the teleservice adapter path in the same way as direct routing.

Verification and Commissioning Steps

After performing a transfer (by any method), verify that the project is correctly installed on the panel:

1. Power-cycle the panel if required by the transfer method.
2. Wait for the panel to boot to the WinCC flexible runtime.
3. Verify that the configured connection to the CPU is active (no red "connection error" indicator).
4. Open the HMI diagnostics screen (Start → Settings → Control Panel → OP/PC diagnostics or HMI diagnostics). Confirm:
   • Active connection to the CPU
   • PLC address matches the configured CPU address
   • Project version is the expected one
5. Test a tag or screen change to confirm data exchange.
6. If the project was transferred via S7 routing, also check the S7 routing counters in the CPU diagnostics:

STEP 7 → PLC → Module Information → Communication
  Tab "S7 Routing"
  Check:
    - Routing entries configured
    - Routing counters incrementing
    - Routing errors at 0

Troubleshooting Common Issues

FAQ