WinCC Runtime V15 Not Connecting to PLCs on a Standalone PC: Set PG/PC Interface Fix

Symptom: A WinCC Advanced V15 Update 3 HMI project runs cleanly against three pairs of S7-1500R/H hot-standby PLCs from the engineering laptop using the TIA Portal integrated "Start Runtime" function, but the same compiled runtime files copied to a separate Windows 10 PC that has only WinCC Runtime Advanced V15 installed open without errors yet never establish any S7 connection. Ping from the runtime PC to every PLC succeeds. The runtime window stays on the start screen or shows the configured HMI tags frozen at their initial values, with no diagnostic message in the WinCC alarm window or in the Windows event log.

Root cause in 95% of these cases: the S7ONLINE access point on the runtime PC is bound to the wrong network interface or to no interface at all, so the S7 communication channel (ISO-on-TCP / RFC1006 / TCP port 102) is never opened against the configured PLC nodes. The TIA Portal engineering station implicitly uses the S7ONLINE access point that points to the development NIC; a clean runtime-only PC has no TIA Portal installed and ships with the S7ONLINE access point unbound or pointing to a virtual adapter that has no route to the plant network. The fix is the legacy Set PG/PC Interface tool that the S7 communications DLLs (and therefore WinCC Runtime) still rely on.

1. Environment and Versions Verified

• Engineering station: Windows 7 Professional SP1, STEP 7 / TIA Portal V15.1 with WinCC Advanced V15 Update 3, HMI_RT device configured for WinCC RT Advanced 15.0.0.0.
• Runtime PC: Windows 10 (1607 or later), WinCC Runtime Advanced V15.0.0.0 only, no TIA Portal components, no STEP 7, no SIMATIC NET CD installed.
• Controllers: Three S7-1500R/H redundant pairs (a.k.a. R-CPU and H-CPU systems) on a 192.168.x.x plant subnet.
• Protocols in use: S7 communication (Put/Get and HMI protocol) over ISO-on-TCP on TCP/102; PROFINET not in scope for the failing path.

2. Why the TIA Runtime Works but the Standalone Runtime Fails

The TIA Portal "Start Runtime" function loads the project directly from the engineering project tree using the local S7DLL channel driver, which resolves the S7ONLINE access point from the registry key

HKEY_LOCAL_MACHINE\SOFTWARE\Siemens\Automation\S7ONLINE\CurrentVersion\S7ONLINE_ACCESS_POINT

The TIA installer also registers an interface parameter assignment for every NIC it sees, so the access point is always valid on the development machine even after a NIC change. On a clean runtime PC, this registry hive is created by the WinCC Runtime Advanced setup with the access point pointed at the Remote S7 EP Mapping placeholder, which is intentionally empty. When the runtime then issues an S7 connection request, the S7DLL finds no real adapter to bind to and silently discards the connect attempt. No alarm, no log entry, no WinCC message in the alarm view — which is why the symptom looks like "the project is broken" when in fact the channel is broken.

Three independent failure modes can present identically:

1. S7ONLINE unbound. Most common on a freshly installed runtime PC. The Set PG/PC Interface tool will show "<none>" in the access point selector.
2. S7ONLINE bound to a virtual NIC. Common on Windows 10 with Hyper-V, VPN clients (Cisco AnyConnect, FortiClient), VMware, VirtualBox, or Hyper-V Virtual Ethernet Adapter enabled. The virtual adapter answers locally but cannot reach the PLC subnet.
3. S7ONLINE bound to the wrong physical NIC. Common on laptops with both Wi-Fi and Ethernet active, or with multiple Ethernet ports, where the access point was set against the LAN NIC and the runtime PC is now connected through Wi-Fi, or vice versa.

3. Resolution: Set the S7ONLINE Access Point to the Plant NIC

3.1 Locate the Set PG/PC Interface Tool on Windows 10

The Set PG/PC Interface applet is no longer surfaced in the Windows 10 Control Panel "All Items" view, although the underlying SetPgPC.exe binary is installed by every WinCC Runtime, STEP 7, and SIMATIC NET setup. To open it on Windows 10:

1. Press the Windows key.
2. Type pg. The search should resolve Set PG/PC Interface within 1–2 seconds.
3. Alternatively, press Win + R and run SetPgPC.exe directly, or control /name Microsoft.SetPGPCInterface.
4. If none of the above resolve, navigate to C:\Program Files (x86)\Siemens\Automation\Simatic OAM\bin and double-click SetPgPC.exe. On a runtime-only install the path may be C:\Program Files\Siemens\Automation\Simatic OAM\bin or under Common Files\Siemens\Automation\Simatic OAM\bin.

3.2 Bind S7ONLINE to the Correct Network Adapter

1. Launch Set PG/PC Interface as administrator (right-click → Run as administrator). Non-elevation produces a read-only view on UAC-enabled systems.
2. In the Access Point dropdown, select S7ONLINE.
3. In the Interface Parameter Assignment Used list, the dialog will show every network adapter on the PC plus the Remote S7 EP Mapping stub. Identify the physical NIC that has the IP address on the same subnet as the S7-1500 PLCs (verify with ipconfig /all).
4. Select the correct adapter (e.g. Intel(R) I211 Gigabit Network Connection — TCP/IP). Avoid any adapter marked Hyper-V Virtual Ethernet Adapter, VPN, VMware, or VirtualBox.
5. Click OK. The S7DLL writes the new binding into the registry under HKLM\SOFTWARE\Siemens\Automation\S7ONLINE.
6. Close the dialog. There is no service restart required for S7ONLINE; the change is read at the next S7 connect attempt.

3.3 Verify the Binding in the Registry (Optional but Recommended)

Open regedit and navigate to:

HKLM\SOFTWARE\Siemens\Automation\S7ONLINE\CurrentVersion

Confirm the value S7ONLINE_ACCESS_POINT equals the GUID of the chosen TCP/IP interface. A typical healthy entry is:

Cross-reference the GUID against HKLM\SOFTWARE\Siemens\Automation\S7ONLINE\CurrentVersion\TCPIP\<GUID> to confirm the binding points at the intended TCP/IP driver instance.

4. Restart the WinCC Runtime and Re-test the Connection

1. Close the standalone WinCC Runtime Advanced window fully (right-click the system tray icon → Exit).
2. Confirm the S7 process is not lingering in Task Manager — HmiRtm.exe and any CCLicSrv.exe instance.
3. Re-launch the runtime from the configured autostart entry, scheduled task, or by running the compiled *.fwx / project exe from the file share.
4. Watch the connection status indicators on the HMI screens (the standard WinCC "connection status" system diagnostic) or the plant overview screen. Status should transition from disconnected to connected within 5–10 seconds after the start screen.

5. Verification Checklist

6. Related Issues That Mimic the Same Symptom

6.1 Windows Firewall Blocking TCP/102

Symantec Endpoint Protection, McAfee, Bitdefender, and even stock Windows Defender on Windows 10 1903+ can drop outbound TCP/102 when the network profile is set to Public. Pin the runtime PC's NIC profile to Private and add an explicit outbound allow rule for %SystemRoot%\System32\drivers\TDI.sys traffic to the PLC subnet, or simply add a rule for TCP 102 to the PLC subnet. ping uses ICMP, so a green ping does not validate TCP/102.

6.2 Anti-virus Application Control

Trend Micro, Cylance, and SentinelOne frequently block CCRuntimeRt.exe from opening dynamic sockets. Add the WinCC runtime directory to the AV exclusion list and the Siemens\Automation registry hive as a write-protected path.

6.3 Multiple Network Adapters and Routing

When the PC has both a plant NIC (192.168.0.0/24) and a corporate NIC (10.0.0.0/8), the S7ONLINE binding alone is not enough — the OS route table must place the plant subnet on the plant NIC. Inspect with route print and add a persistent route if needed:

6.4 Hot-Standby PLC Pair Only Resolves via Virtual IP

For S7-1500R/H systems, the WinCC connection must point at the system IP (SYS-IP) of the redundant pair, not at either CPU's individual IP. The HMI connection in TIA Portal → Connections → WinCC RT → partner must show the system IP. If the project on the engineering PC was compiled against a wrong CPU IP, the runtime will fail to connect regardless of the S7ONLINE binding.

6.5 Certificate Prompts on WinCC Unified

For projects migrated to WinCC Unified V17 / V18 / V19 / V20 (TIA Portal V20), the runtime PC must trust the Unified Runtime self-signed certificate of the engineering station, or the runtime will start but the WebSocket-based connection to the PLC is refused. Install the certificate per the official procedure at Displaying runtime (RT Unified) - WinCC Unified. This does not apply to the V15 Advanced runtime in the original symptom, but is a common follow-up failure on sites that have upgraded.

7. Field-Proven Caveats

• Set PG/PC Interface requires elevation. If launched without administrator rights, the OK button commits the change in some Windows 10 builds but writes to HKCU instead of HKLM, which is then ignored by services. Always right-click → Run as administrator.
• Windows 10 hibernation and fast startup re-randomize the NIC ordering after every reboot. Bind S7ONLINE to a specific adapter GUID, not to a friendly name, to survive renaming.
• USB-to-Ethernet adapters and Thunderbolt dock NICs change GUID when re-plugged. For fixed-installation runtime PCs, use a built-in PCIe NIC and disable power management on the adapter (Device Manager → NIC → Power Management → uncheck "Allow the computer to turn off this device to save power").
• TeamViewer / AnyDesk unattended access installs a virtual NIC that frequently takes priority in the S7ONLINE dialog. Disable the remote-access virtual adapter or bind S7ONLINE explicitly to the plant NIC.
• SIMATIC NET vs. TIA-only install. Sites that previously had STEP 7 V5.5 and SIMATIC NET installed, then uninstalled, are left with stale registry keys. Run reg delete HKLM\SOFTWARE\Siemens\Automation\S7ONLINE /f (after backing up the hive) and re-bind.

8. Long-Term Recommendation

Image the runtime PC with the binding pre-configured and lock the image. A robust production image should contain:

1. Windows 10 LTSC 2019 or 2021 (no consumer feature updates that change NIC ordering).
2. WinCC Runtime Advanced V15 Update 3 installed and activated against the Automation License Manager.
3. S7ONLINE access point pre-bound to the production plant NIC GUID.
4. Outbound firewall rules for TCP/102 to the plant subnet.
5. Power management disabled on the plant NIC and on the PC sleep/hibernate.
6. Anti-virus exclusions for C:\Program Files\Siemens\ and the S7ONLINE registry hive.

Document the binding procedure in the site IT/OT handover so the next engineer does not have to rediscover the Set PG/PC Interface applet via the Windows Start menu search box.

9. Quick Diagnostic Flowchart

Standalone WinCC RT cannot see PLCs
        |
        v
Ping PLCs from runtime PC  -------->  FAIL  ---> Fix IP / VLAN / cable
        |
       OK
        |
        v
Test-NetConnection PLC-IP -Port 102  ->  FAIL  ---> Fix firewall / route
        |
       OK
        |
        v
Open Set PG/PC Interface (admin)  -->  S7ONLINE = <none> or wrong NIC
        |                                    |
        |                                    v
        |                          Bind S7ONLINE to plant NIC
        |                                    |
        <------------------------------------+
        |
        v
Restart runtime → connections establish → DONE

10. Related Siemens Manuals and References

• Siemens Industry Online Support — Knowledge base for WinCC Runtime Advanced V15.
• Displaying runtime (RT Unified) - WinCC Unified — Certificate handling on first runtime start (Unified, not Advanced V15, but commonly the next failure mode on upgraded sites).