WinCC S7 Protocol via CP342-5: Rack Slot Setup for S7-315

David Krause15 min read
ProfibusSiemensTutorial / How-to
Licensed PE Working through this on a live machine? A Maine-licensed engineer can take it from here — included with IMD hardware, by the hour for everything else. Book an engineer

Overview

Connecting WinCC 6.0 to a SIMATIC S7-315-2DP through a CP 342-5 communications processor over PROFIBUS is a standard configuration, but the WinCC channel parameters are often misunderstood. When a PC station talks to an S7-300 CPU directly, the WinCC S7 channel uses the CPU's PROFIBUS address together with rack 0 and the slot of the CPU. When a CP 342-5 sits between the WinCC station and the CPU, the PROFIBUS address used by WinCC must be the address of the CP 342-5, while the rack and slot must still point to the CPU that owns the data. Mixing these two parameters is the most common cause of a "no connection" or "0x0190/0x0131" S7 error on the CP 5612 / CP 5611 driver.

This reference covers the full configuration chain:

  • STEP 7 hardware configuration of the S7-300 station with CP 342-5
  • PROFIBUS address assignment for the CP 342-5 and CPU
  • WinCC S7 protocol (PROFIBUS CP 5612 / CP 5611) channel parameters
  • Multi-CPU setups (four S7-315 stations on a single PROFIBUS subnet)
  • Diagnostics, error codes, and verification checks

System Architecture

The reference topology consists of:

  • One or more S7-300 stations with CPU 315-2DP (6ES7 315-2AG10-0AB0 or later), occupying Rack 0, Slot 2.
  • A CP 342-5 (6GK7 342-5DA02-0XE0 for PROFIBUS, or 6GK7 342-5DF00-0XE0 for FO) installed in the same S7-300 rack at Slot 4, terminated on a separate PROFIBUS segment.
  • A PC station running WinCC 6.0 with a CP 5612 (PCI) or CP 5611 (PCI) or CP 5613 / CP 5614 (PCIe) PROFIBUS card.
  • PROFIBUS DP cable (6XV1 830-0AH10) with PROFIBUS connectors (6ES7 972-0BA12-0XA0) at each node, terminated with 220 Ω between pins 6 and 3 and 390 Ω to data lines on the segment ends.
S7-300 Station PS 307 Slot 1 CPU 315-2DP Slot 2 Addr 3 CP 342-5 Slot 4 Addr 4 PROFIBUS DP segment 2 PC Station (WinCC 6.0) CP 5612 / CP 5611 Configured address: 4 (CP 342-5) Rack 0 / Slot 2 (CPU) S7 Channel "PROFIBUS CP 5612"

Figure 1 — WinCC reaches the CPU through the CP 342-5; PROFIBUS address = CP, Rack/Slot = CPU.

Prerequisites

  • STEP 7 V5.4 or V5.5 (matches the WinCC 6.0 era) installed with the CP 342-5 HSP or hardware catalog entry.
  • WinCC 6.0 SP3 or later with the S7 Protocol Suite option (part of the WinCC base install for PC stations).
  • SIMATIC NET PC software (this ships with WinCC 6.0 but must be installed before WinCC for the CP 5612 driver to register correctly).
  • CP 5612 / CP 5611 firmware — current for the era is V6.x; check the device in the Windows Device Manager under "SIMATIC NET" → "PROFIBUS".
  • Programming cable (MPI/USB) for downloading the STEP 7 project to the CPU.
  • PROFIBUS bus analyzer or at minimum a BT 200 bus terminator active at both ends of the segment.
Important: The CP 342-5 is a "routable" S7 communications module but is not a DP slave. It is a DP master/active node on its own segment and forwards S7 functions (PUT/GET, S7 communication) to the CPU in its own rack. The WinCC station must always target the CP's PROFIBUS address, never the CPU's, on segment 2.

STEP 7 Hardware Configuration for the S7-300 Station

  1. Open the SIMATIC Manager and open (or create) the S7-300 project.
  2. Open HW Config. The rack is pre-populated with the PS 307 (Slot 1) and the CPU 315-2DP (Slot 2).
  3. Insert the CP 342-5 in Slot 4: open the catalog SIMATIC 300 → CP 300 → PROFIBUS → CP 342-5 and drag it to Slot 4.
  4. When the CP is dropped, the PROFIBUS subnet dialog opens. Either select the existing subnet (e.g. PROFIBUS(1)) or create a new one. For the four-CPU topology, create a separate PROFIBUS subnet for the WinCC backbone; this is the network that the CP 342-5 will master, while the CPU's integrated DP port is reserved for slave I/O on segment 1.
  5. Open the CP 342-5 properties → PROFIBUS interface → Address. Set the PROFIBUS address of the CP 342-5 to 4 (each CP must be unique across the segment).
  6. Switch to Operating Mode on the CP properties. For S7 communication with WinCC, choose "S7 communication" or, if the CP is also acting as a DP master for further slaves, "DP master" combined with the S7 communication option. CP 342-5 supports both simultaneously as long as the connection resources in the CPU are sufficient.
  7. Compile and download the hardware configuration to the S7-300 station. The CPU's SF and BF LEDs should be off and the CP 342-5 RUN LED should be solid green after power cycle.

CP 342-5 Address vs. CPU Address — Key Concept

The WinCC S7 channel uses three physical parameters to find a target:

Parameter Meaning Direct-to-CPU scenario Via CP 342-5 scenario
PROFIBUS address The MAC-level station on the wire the PC will send the S7 telegram to. = CPU's DP address (e.g. 3) = CP 342-5 address (e.g. 4)
Rack S7-300 logical rack number. Always 0 for S7-300. 0 0
Slot Slot of the CPU inside that rack. For S7-300 the CPU is always slot 2. 2 2 (the CPU, not the CP slot)
Common mistake: Users set the WinCC slot to the CP's slot (4) because the S7 frames are physically terminated there. The S7 driver must still target the CPU that owns the data, which is slot 2 of rack 0. The CP only routes the S7 connection to the CPU; it does not provide a process image or DB access on its own.

WinCC S7 Channel Configuration (PROFIBUS CP 5612 / CP 5611)

  1. Open the WinCC Explorer and load your project.
  2. Right-click Tag Management → Add New Driver → select S7 PROTOCOL SUITE. Click Open.
  3. Expand the S7 PROTOCOL SUITE node. The available channel units include PROFIBUS(1), PROFIBUS(2), Industrial Ethernet, TCP/IP, Named Connections, and Slot PLC.
  4. Right-click the PROFIBUS(1) channel unit and select System Parameters → Unit. In the device list choose the installed card (CP 5612 or CP 5611) and confirm the PROFIBUS address is the one assigned to the PC station (typically 0 or 1 — does not need to match any S7 address).
  5. Right-click PROFIBUS(1) → New Connection. A new connection named NewConnection_0 appears under the channel unit.
  6. Open the connection's Properties dialog and configure the following:
Field Value (example) Notes
Station Address (PROFIBUS) 4 Address of the CP 342-5 on the segment the PC is connected to. Not the CPU's address.
Rack 0 Always 0 for S7-300.
Slot 2 Slot of the CPU in the S7-300 station. Not the CP's slot.
Connection Name free text Used by WinCC tags; can be renamed for clarity, e.g. CPU315_1_CP342.
Connection Type S7 Communication (default) Leave default. The CP 342-5 supports the standard S7 protocol on its interface.
  1. Click OK and save the project.

STEP 7 Connection Resource for the CP 342-5

Each S7 connection the WinCC client opens consumes one of the CPU's S7 connection resources as well as one of the CP 342-5's FDL / S7 connection resources. S7-300 CPUs typically allow up to 16 S7 connections for the CPU itself, while the CP 342-5 supports up to 16 (firmware-dependent) S7 connections on its PROFIBUS interface. If you have 4 WinCC stations and 4 S7-300 stations, plan the connection resources accordingly.

To monitor and limit the connections:

  1. In STEP 7 HW Config, open the CPU 315-2DP properties → Communication. The number of S7 connections in use is shown live when online.
  2. In NetPro, the active S7 connections to and through the CP 342-5 are listed in the connection table. Right-click the CP and select Connection Status (only visible when an online connection to the CP is active).

Configuring the S7-300 to Permit External Read/Write Access

Even with the right PROFIBUS address and rack/slot parameters, WinCC may fail to read/write DBs if the S7-300 protection level is set too high. The CP 342-5 forwards the S7 user-data request, but the CPU still enforces its own password protection.

  1. Open the S7-300 station's hardware configuration and double-click the CPU.
  2. Select Protection tab.
  3. Set the protection level to "No protection" for HMI access, or assign a password and provide it in the WinCC connection if the project requires it.
  4. Make sure Allow access via PUT/GET communication from remote partner (PLC, HMI, OPC, ...) is checked (this option is on by default in CPU 315-2DP from firmware V2.x onward; older firmware may not show this checkbox).
  5. Download the new CPU properties to the S7-300 station.

Tag Configuration in WinCC

Tags that should ride the connection CPU315_1_CP342 are configured under the S7 PROTOCOL SUITE → PROFIBUS(1) → CPU315_1_CP342 node. The data address is typed in standard S7 syntax:

Tag Data type Address syntax in WinCC Meaning
Motor_Run Binary DB100.DBX0.0 Bit 0 of byte 0 in DB100
Speed_SP Float DB100.DBD4 DWORD at offset 4 in DB100 (REAL)
Cycle_Cnt Word MW20 Memory word 20 in the CPU
Inputs Word IW0 Input word 0 of the CPU
DB length: WinCC cannot read a DB unless the entire DB has been defined in the S7 project (i.e. it is not a "free" DB). A free DB returns error 0x0A (item not available) on the first read. Define every byte of the DB in STEP 7 with a symbolic name, or set the DB length manually in the DB properties.

Multi-CPU Configuration (Four S7-315 Stations on One PROFIBUS Segment)

When the WinCC PC must talk to several S7-315-2DP stations, the CP 342-5 of each station sits on the same PROFIBUS backbone as the PC. Each station is a unique S7 connection in WinCC, and each CP must have a unique PROFIBUS address.

Station CPU rack / slot CP 342-5 slot CP PROFIBUS address WinCC connection name WinCC slot WinCC rack WinCC address
S7-300 #1 0 / 2 4 4 CPU315_1 2 0 4
S7-300 #2 0 / 2 4 5 CPU315_2 2 0 5
S7-300 #3 0 / 2 4 6 CPU315_3 2 0 6
S7-300 #4 0 / 2 4 7 CPU315_4 2 0 7

Rules to enforce:

  • PROFIBUS addresses 1 (PC/master) and 0 (PC master, alternate) are reserved for the WinCC station on the CP 5612 / CP 5611; addresses 1–127 are valid. Typical practice is PC=1 and the CP 342-5 stations start at 4.
  • Each S7-300 station must have its CPU's integrated DP port (segment 1) and the CP 342-5's DP port (segment 2) on different PROFIBUS subnets, otherwise the CP 342-5 will see its own master's slave frames and may experience bus errors. In STEP 7, assign a different PROFIBUS(1) vs. PROFIBUS(2) subnet ID.
  • All CP 342-5 modules must be configured as active PROFIBUS nodes (default). They are not DP slaves.
  • The CPU's PG/OP communication access (SFC 87 / SZL 0x0011 C_T) must allow at least 2 free S7 connection resources for WinCC; with 4 stations × 1 connection each = 4, plus 1–2 for STEP 7 online = 5–6 free resources required. S7-315-2DP provides 16 by default, so this is normally OK.

Diagnostics and Common Error Codes

When the WinCC connection does not come up, the symptom shows up in three places:

  1. WinCC Tag Management — connection icon shows a yellow / red triangle.
  2. WinCC Explorer → Tools → Status of Driver Connections — the connection state and last error code are listed.
  3. CP 5612 / CP 5611 driver log under SIMATIC NET → Commissioning → PC Station (Stationseditor).
Symptom Likely cause Fix
Connection stays "Disconnected", WinCC log shows 0x0190 / 0x01FF Wrong PROFIBUS address — WinCC is talking to a node that does not exist or that is not the CP 342-5. Set WinCC's station address to the CP 342-5's address, not the CPU's.
Connection establishes but tags show quality "Bad" with WinCC error 0x0002 (item not available) Wrong slot — WinCC is talking to a slot that is not the CPU. Set WinCC slot to 2 (CPU slot in S7-300), not 4 (CP slot).
Connection establishes, some tags good, others 0x000A (item not available) DB has not been fully defined in STEP 7; reading past the end of the DB. Open the DB in STEP 7 and ensure every byte the WinCC tag references is declared.
Connection drops after a few minutes with 0x0001 (local fault) Bus termination missing, broken cable, or duplicate PROFIBUS address on the segment. Verify 220 Ω terminator at both ends; check no two nodes share an address with the BT 200 or the CP 5612 online diagnostics.
BF (bus fault) LED on the CP 342-5 lit solid CP 342-5 is configured for a different PROFIBUS subnet than the one it is physically on, or its address was downloaded wrong. In STEP 7 HW Config, verify the CP's subnet and address; re-download HW Config.
SF (system fault) LED on the CPU 315-2DP lit CPU protection level set, or connection resources exhausted. Lower protection, check SZL 0x0011, free an S7 connection resource.
WinCC log shows "Configured connection not established" 0x0302 CP 5612 has no active driver, or the CP 5612 is configured for a different access point than the WinCC S7 channel. Open the Stationseditor of SIMATIC NET and verify the CP 5612 is assigned to access point "S7ONLINE".

Hex error codes for the WinCC S7 channel unit are documented in the SIMATIC HMI WinCC Information System under Communication → S7 Protocol Suite → Error Codes. Some of the most useful for this scenario:

  • 0x0001 — local bus fault (physical layer).
  • 0x0002 — partner not reachable / wrong target address.
  • 0x000A — object (DB / address) not available in the target CPU.
  • 0x0190 — S7 connect timeout; partner did not ACK.
  • 0x0302 — configuration mismatch between WinCC and SIMATIC NET driver.

Verifying the Connection

  1. In WinCC Explorer open Tools → Status of Driver Connections. The connection CPU315_1 must show OK / green. If it stays red, click Details for the last error code.
  2. In the Stationseditor of SIMATIC NET, expand the CP 5612 and view Online → Diagnostics → S7 Connections. Each active S7 connection to a CP 342-5 is listed with the partner's PROFIBUS address, the local TSAP, and the connection state.
  3. Create a WinCC tag on the new connection (e.g. DB100.DBW0 on CPU315_1) and add a small I/O field to a WinCC screen. Trigger the tag from STEP 7 (e.g. L 1234; T DB100.DBW0) and verify the value updates in the runtime window. The update should be visible within one WinCC acquisition cycle (default 500 ms for the S7 channel).
  4. From STEP 7, go PLC → Accessible Nodes over PROFIBUS and check that the CP 342-5 responds on its configured address (4) and that the CPU is reachable through the CP at rack 0 slot 2.
  5. Repeat for each of the four stations if running a multi-CPU setup.

Field-Proven Caveats

  • CP 5612 vs CP 5611: the CP 5612 supports up to 32 S7 connections on a single PC station; the older CP 5611 supports 8. If the project plans to add more than 8 simultaneous connections, swap to CP 5612 / CP 5613 / CP 5614.
  • TSAP conflict: the CP 342-5 assigns TSAPs based on the S7 connection configured in NetPro. If you change a WinCC connection name, the CP side may keep an old TSAP. In NetPro right-click the CP 342-5 → Object Properties → S7 Connection and re-verify.
  • Sub-D 9-pin orientation: PROFIBUS connectors (6ES7 972-0BA12-0XA0) come with a switchable terminator. Leave it ON only at the physical ends of the segment. With a chain of four S7-300 stations plus the PC station, only the first and last physical device should be terminated.
  • CPU integrated DP port is busy: the user noted that PROFIBUS 1 of the CPU is used for slave I/O. This is the standard reason to use the CP 342-5 on PROFIBUS 2 for HMI/SCADA. Do not try to multiplex HMI traffic onto the slave segment — cycle time jitter and acyclic broadcast storms from the HMI driver can disturb deterministic slave I/O.
  • CP 342-5 firmware: firmware V4.x is the minimum recommended for WinCC 6.0 SP3. Firmware V2.x works for direct S7 communication but does not support some newer connection diagnostics.

Summary of Required WinCC Settings

Setting Value Reason
PROFIBUS address 4 (CP 342-5) PROFIBUS frames stop at the CP; the CP forwards to the CPU via the backplane.
Rack 0 S7-300 has a single logical rack.
Slot 2 (CPU) The S7 user-data must be addressed to the CPU that owns the program/data blocks.
Access point S7ONLINE Set in SIMATIC NET Stationseditor on the CP 5612.
CPU protection No protection / password known Otherwise all reads/writes through the CP are rejected with SF on the CPU.

Frequently Asked Questions

Why does the WinCC S7 channel fail when I set the slot to the CP 342-5's slot (4)?

The S7 protocol uses rack/slot to identify the CPU that owns the program and the data blocks. The CP 342-5 is a routing module without its own process image. WinCC must address rack 0, slot 2 (the CPU); only the PROFIBUS address should change to the CP 342-5's address (e.g. 4).

What PROFIBUS address do I enter in WinCC — the CPU's or the CP 342-5's?

Enter the CP 342-5's PROFIBUS address. WinCC sends S7 frames to the physical node on the wire, which is the CP 342-5. The CP then routes the request to the CPU in its rack over the S7-300 backplane. The CPU's own DP address is on a different segment and is not reachable by the WinCC station.

Can multiple S7-300 stations share one CP 342-5?

No. Each S7-300 station has its own CP 342-5. The CP is a slot module of a specific S7-300 rack and only routes frames for the CPU in that rack. To talk to four S7-315 stations, you need four CP 342-5 modules on the WinCC backbone segment, each with a unique PROFIBUS address.

The connection shows OK in WinCC but all DBs report 0x000A — what's wrong?

WinCC can connect to the CPU but cannot read the DB. This is typically because the DB is not fully defined in STEP 7, or the address you entered is past the DB length. Open the DB in STEP 7, ensure every byte from byte 0 to the highest byte referenced by a WinCC tag is declared, then re-download the DB to the CPU.

Do I need to configure the CP 342-5 in NetPro to accept WinCC connections?

Yes, for S7 communication the CP 342-5 must have at least one free S7 connection resource. In STEP 7 NetPro, add an S7 connection targeting the WinCC station, or simply leave the CP in "S7 communication" operating mode and ensure the connection count in the CPU's SZL 0x0011 C_T is below the maximum (16 for S7-315-2DP).

David KrauseIndustrial Controls Specialist – Siemens Platforms

Industrial controls specialist focused on Siemens SIMATIC S7 platform, from the S7-300/400 series through the latest S7-1200/1500 controllers. Expert in TIA Portal configuration and WinCC SCADA integration.

Planning your next automation project? Explore IMD panel PCs and touch monitors.

Back to blog

Related Articles

Browse more on: ProfibusSiemens

Latest Knowledge Base Articles