WinCC S7-1500 Channel: Configuring Per-Connection Access Points

Problem Overview: Multi-Network WinCC Server Cannot Reach a New PLC

In a redundant SIMATIC WinCC Server topology with two physically isolated industrial Ethernet rings, a single server hosts one network interface per ring. When the existing project already uses one ring and a new PLC must be added to the other, the default channel-to-adapter binding in the SIMATIC S7-1200, S7-1500 Channel routes every connection through the originally configured NIC. The new PLC on the second ring becomes unreachable even though TCP/IP connectivity, TIA Portal online, and ICMP ping from the same server all succeed.

This article documents the field-proven procedure that resolves this issue: assigning a separate access point per connection inside the S7-1200, S7-1500 Channel so each PLC is reached through the correct network interface.

System Architecture Context

The reference plant has the following structure:

The two rings are physically isolated, so the server is the only node that bridges them. Therefore, traffic to a PLC in ring B must egress through CARD 2 even if the same driver was originally configured for ring A.

Root Cause: Channel-Level vs Connection-Level Access Point Binding

SIMATIC WinCC drivers bind their connections to network adapters through access points. The access point is a symbolic name (e.g., S7ONLINE, TCPIP) that is mapped to a physical interface in the Windows Set PG/PC Interface dialog. The binding rules differ by channel:

• SIMATIC S7 Protocol Suite: A single access point is assigned at the channel (driver) instance. All connections under that driver share the same physical adapter. Per-connection override is not available.
• SIMATIC S7-1200, S7-1500 Channel: An access point can be assigned per connection. The default is the channel-level setting, but individual connections may use a different access point pointing at a different NIC.

When the S7-1200, S7-1500 Channel was first commissioned for the four S7-1500 PLCs on ring A, the project automatically adopted S7ONLINE bound to CARD 1. The new S7-1500 PLC on ring B inherits the same channel-level setting, so every connection attempt leaves the server through CARD 1 and never reaches 192.168.2.x. TIA Portal works because it explicitly binds its own online session to the local network card selected in the PG/PC interface at the moment the user clicks Go online, independent of the WinCC runtime.

This is why the S7 Protocol Suite TCP/IP fallback also fails: it allows only one channel-wide access point, so either the Automation or Visualization PLCs work, never both at the same time on the same driver instance.

Error Code 8104 in WinCC Diagnostics

Error 8104 appears in the WinCC Channel Diagnosis and the corresponding log file SIMATIC_S7_PROTOCOL_SUITE_01.LOG when an S7 connection cannot be established. The detailed meaning of every status code, including 8104, is documented in the Siemens Knowledge Base article What do the entries in the WinCC diagnostics file "SIMATIC_S7_PROTOCOL_SUITE_01.LOG" mean in the case of a connection fault?

For the S7-1200, S7-1500 Channel, the analog log file is named after the connection's logical name and is located under the project's Diagnostics folder. In practical terms, error 8104 means the channel opened the TCP socket but the S7 partner never completed the ISO-on-TCP / S7 communication handshake within the configured timeout, which is the expected symptom when the request goes out the wrong network interface.

Channel Comparison: Per-Connection Access Point Support

This comparison is the engineering rationale for choosing the S7-1200, S7-1500 Channel as the only path that supports mixed-ring deployments on the same server. The channel's per-connection override is documented in the application note WinCC Communication to S7-1500, S7-1200 and ET 200SP.

Prerequisites

• WinCC V7.2 or later. The S7-1200, S7-1500 Channel DLL was introduced in V7.2; the V7.5 release remains the most widely deployed version for this configuration.
• SIMATIC NET installed on the WinCC server with the TCP/IP driver enabled. The version must match the WinCC version (e.g., SIMATIC NET V18 with WinCC V8.0).
• Administrator privileges on the server to modify access points in the Set PG/PC Interface dialog and to restart the S7DOS service.
• Both physical NICs visible in Windows Device Manager and in Set PG/PC Interface.
• Validated connectivity: ping <PLC IP> from an elevated command prompt must succeed on both rings when the corresponding adapter is the only one with an active default gateway.
• Firewall rules allowing TCP port 102 (ISO-on-TCP / S7) on both interfaces.

Step-by-Step: Configure a Per-Connection Access Point

The procedure below adds a new access point, binds it to CARD 2, and selects that access point on the new connection inside the S7-1200, S7-1500 Channel.

1. Create a new access point bound to CARD 2

1. Open Start > Siemens Automation > SIMATIC > SIMATIC NET > Communication Settings. If the start menu entry is missing, launch SETPCPT.EXE from the SIMATIC NET install directory (typically C:\Program Files\Siemens\Automation\SimaticNet\bin).
2. In the Access Points area of the left tree, right-click and select Add.
3. Type a descriptive name such as S7_VIS for the visualization network. Avoid names already used by STEP 7 or TIA Portal.
4. Confirm. The new access point now appears in the list with an empty assignment.
5. Right-click S7_VIS and choose the network adapter that physically connects to the visualization ring (CARD 2). Use the LLDP / switch port description to confirm the right NIC if both are Intel or Realtek.
6. Click Apply or OK. Windows may prompt for elevation.

2. Verify Set PG/PC Interface dialog

Open Control Panel > Set PG/PC Interface. Confirm that the new access point S7_VIS is listed and bound to the visualization NIC. Repeat the verification for S7ONLINE to ensure it still binds to CARD 1 (the original automation ring). If S7ONLINE is missing or pointing at CARD 2, STEP 7 / TIA Portal online browsing will also fail.

3. Restart S7DOS and SIMATIC NET services

1. Open services.msc as administrator.
2. Restart SIMATIC S7DOS Help Service and SIMATIC NET Configuration Service.
3. Wait until both services report Running before launching the WinCC Runtime.

4. Add the new connection inside WinCC

1. Open the WinCC Explorer on the server.
2. Expand Tag Management > SIMATIC S7-1200, S7-1500 Channel.
3. Right-click the channel and select New Connection. The dialog exposes the following fields:
   • Name: free text, e.g. PLC5_VIS_S71500.
   • IP Address: 192.168.2.x of the new S7-1500 PLC.
   • Access Point: change from the default S7ONLINE to S7_VIS (the new access point created in step 1). This single override is what makes the connection egress through CARD 2.
   • Rack: 0 for S7-1500 in slot 1 of a centralized PROFINET configuration.
   • Slot: 1 for CPU 1511/1513/1515/1516, 2 for CPU 1517/1518, etc. Match the TIA Portal device configuration.
4. Click OK.

5. Add tags to the new connection

Under the new connection, create process tags pointing at the PLC's data blocks. The default update cycle (2 s) is fine for monitoring; use 500 ms or 1 s for closed-loop control signals. For optimized blocks, prefer symbolic addressing with the S7-1200, S7-1500 Channel, which is one of the main reasons this driver exists (see channel application note).

6. Activate the project and restart the WinCC Runtime

The new access point is read at runtime start. If the runtime is already running on the redundant partner, transfer the project, stop the runtime, and start it again. Verify that the new connection shows green status in Channel Diagnosis.

Verification and Channel Diagnosis

After the project is running, perform the following checks:

1. In the WinCC Explorer, right-click the S7-1200, S7-1500 Channel and choose Diagnosis. The new connection should show OK with an established timestamp. The four original connections on CARD 1 remain on S7ONLINE and should also be OK.
2. Open Tag Management, right-click the new connection, and choose Find. Force an immediate read on a tag and verify the value changes when the PLC is updated.
3. On the server command prompt, run netstat -an | findstr :102. There must be one ESTABLISHED entry per active S7 connection, with the local address matching the corresponding NIC IP. For ring B (192.168.2.x) the local side must be CARD 2's IP, confirming that the access point override worked.
4. Open Control Panel > Administrative Tools > Event Viewer > Windows Logs > Application. Filter by source SIMATIC NET or S7DOS. No 8104 entries should appear after a fresh start.
5. Inspect the project's Diagnostics folder. For the S7-1200, S7-1500 Channel the relevant log files have the connection name as prefix, e.g. PLC5_VIS_S71500_<date>.LOG. Successful connections produce short status entries; failures add lines containing 8104 or timeout markers.
6. From the PLC side, in TIA Portal open Online & Diagnostics > Connections and verify that exactly one S7 connection from the WinCC server appears on CARD 2.

Redundant Server Replication

In a redundant WinCC pair, the access point override must exist on both servers identically. Replicate the SIMATIC NET configuration by re-running the steps on the standby server, or export the SIMATIC NET configuration from the primary and import it on the standby. Verify with sc.exe query S7DOS and sc.exe query SNMPLite on both nodes that the services run under the same account and that the registry key HKLM\SOFTWARE\Siemens\SIMATIC_NET\COMSettings contains both access points.

WinCC Unified (TIA Portal) Equivalent

WinCC Unified, the successor runtime configured inside TIA Portal, handles network adapter binding per connection by design. To re-bind a connection:

1. Open the HMI project in TIA Portal.
2. Navigate to Devices & Networks > HMI device > Connections.
3. Select the affected PLC connection and edit the Interface parameter to the appropriate PROFINET interface of the HMI Runtime.
4. For each tag, open the tag properties and verify the connection assignment. The detailed procedure is documented at Connecting a tag to another PLC (RT Unified).

The WinCC V7 / WinCC RT classic path described above remains the correct procedure for existing V7.x installations. Migration to Unified is a separate effort that also affects the licensing model (RT Unified counts) and the security model (Unified does not expose the classic access point dialog).

Common Pitfalls and Field Notes

• Setting the access point at the channel level only. WinCC Explorer allows you to change the access point of the channel (driver instance). This change applies to all existing connections that still use the default, but it does not retroactively change connections you have already configured for a specific access point. After modifying the channel-level access point, re-open every connection and verify the override field.
• Stale S7DOS configuration. The S7DOS service caches access point assignments. After modifying access points, restart the SIMATIC S7DOS Help Service and the SIMATIC NET Configuration Service from services.msc before restarting the WinCC Runtime. Skipping this step leaves the runtime reading the cached map and the new connection still goes out through CARD 1.
• Default gateway on the wrong interface. When both NICs are present, Windows only uses one default gateway (the one with the lowest metric). If the visualization ring has no gateway, leave the metric blank. If a stray gateway exists on CARD 2 with a non-existent next hop, the server may attempt to send CARD 1 traffic out CARD 2, producing intermittent errors. Use route print to confirm.
• Windows Firewall blocking inbound TCP/102 on CARD 2. When the firewall profile on CARD 2 is Public or Domain with strict rules, the S7 handshake is dropped. Add an inbound rule scoped to CARD 2's profile allowing TCP/102 from the visualization subnet.
• Optimized data block access. Accessing an optimized data block through the S7-1200, S7-1500 Channel requires either the symbolic names exposed by the channel or the correct absolute offset with the Access optimization toggle off in TIA Portal. Misalignment causes the connection to be established successfully (no 8104) but tags return quality bad or uncertain.
• Port already used by another application. The S7DOS service owns TCP/102 locally. If another SCADA or routing tool binds 102 first, WinCC will report 8104 with no apparent reason. Use netstat -ano | findstr :102 to verify ownership before adding firewall or routing rules.
• Wrong IP in the connection dialog. When two PLCs share the same access point, it is easy to copy an existing connection and forget to update the IP. The diagnostic then points at the new PLC but the channel resolves to the old one. Always re-paste the IP from TIA Portal device configuration.

Specifications and Limits

Troubleshooting Matrix

Commissioning Checklist

1. Confirm physical connectivity on both rings: link LED on switch and on the corresponding NIC.
2. Confirm IP configuration: ipconfig /all shows both NICs with the correct subnet and no stray gateway.
3. Confirm ping reaches the new PLC on CARD 2 with the source address forced to CARD 2 if Windows routes via CARD 1 by default.
4. Create the access point S7_VIS bound to CARD 2.
5. Verify both S7ONLINE (CARD 1) and S7_VIS (CARD 2) in Set PG/PC Interface.
6. Restart S7DOS and SIMATIC NET Configuration Service.
7. Add the new connection in Tag Management with Access Point = S7_VIS.
8. Add tags, activate the project, restart the WinCC Runtime.
9. Verify in Channel Diagnosis and via netstat that the new TCP connection's local address is CARD 2.
10. Replicate to the redundant server, run the same checklist.

Frequently Asked Questions