WinCC Tag Management: Configuring PROFIBUS vs MPI for Remote PLCs

Selecting the correct communication channel in WinCC Tag Management is the first decision an integrator must make when a SIMATIC HMI/SCADA station needs to read data from a remote PLC. The Tag Management tree exposes both PROFIBUS and MPI drivers, and PLCSIM will accept either one even when it does not match the physical wiring on the shop floor. This document explains the architectural difference between the two channels, when each one is the correct choice, and how to configure, validate, and troubleshoot tags for a remote PLC over either bus.

1. Overview of WinCC Tag Management

WinCC (SIMATIC WinCC V7.x and WinCC Professional / TIA Portal) organizes external variables under the Tag Management editor. Each logical driver is implemented as a channel unit (e.g. MPI, PROFIBUS, Industrial Ethernet, TCP/IP). The channel unit compiles to a communications DLL (CP-DLL) that WinCC loads at runtime to issue read/write requests to PLCs on that bus.

A tag is the binding between a WinCC symbol (used in graphics, scripts, archives) and a PLC address (e.g. DB111.DBW0). The address parser inside the channel unit uses the bus type to determine the telegram layout, the slot on the CP, and the connection parameters (baud rate, master/slave role, rack/slot, partner address).

For a complete description of the channel architecture refer to the WinCC V7.5 Communication Manuals on the Siemens Support Portal: SIMATIC WinCC V7.5 - Communication and the WinCC Professional manual at WinCC Professional V17 Communication.

2. PROFIBUS vs MPI: Protocol Comparison

PROFIBUS (Process Field Bus) and MPI (Multi-Point Interface) are both Siemens-proprietary serial protocols that operate over RS-485 physical layers, but they differ in baud rate, addressing, token handling, and intended use. The table below summarizes the values relevant to WinCC channel selection. Values for MPI and PROFIBUS are taken from the SIMATIC S7-300/400 Communication manual and the PROFIBUS & PROFINET International (PI) specification documents.

Sources for the values above: SIMATIC S7-300 Communication Manual, SIMATIC S7-400 Communication Manual, and the PROFIBUS System Description at PI - PROFIBUS.

3. Channel Selection Rules for a Remote PLC

When the HMI is on the same bus segment as the remote PLC, pick the channel that matches the segment the bus is wired to. When the HMI is on a different network, the question becomes whether a gateway route exists.

3.1 Same segment — direct connection

• If the HMI and remote PLC are wired to a PROFIBUS DP trunk (baud rate 1.5 Mbps or 12 Mbps, terminated with 220 Ω at both ends, addresses 0..125), use the WinCC PROFIBUS channel unit and configure the connection with the PLC's PROFIBUS address, rack, and slot.
• If the HMI and remote PLC are wired to a MPI network (baud rate 187.5 kbps typical, addresses 0..31, often two nodes only — HMI address 1, PLC address 2), use the MPI channel unit.

3.2 Routed connection — different segments

When the remote PLC sits behind a PROFIBUS router or an S7 routing-capable CPU, the WinCC channel must use the physical bus the HMI is on and pass the S7 routing path through the gateway. For example:

• HMI is on Industrial Ethernet, remote PLC on PROFIBUS DP. Use the Industrial Ethernet or TCP/IP channel with an S7 routing entry (PG/PC interface, S7ONLINE access point, target PROFIBUS address).
• HMI is on MPI, remote PLC on PROFIBUS DP via a CP 342-5 acting as a router. Use the MPI channel; the S7 routing is built into the CPU firmware and is transparent to WinCC.

4. Configuring the PROFIBUS Channel

The following steps apply to WinCC V7.5 SP2. Earlier versions use the same parameter names; the editor location differs only slightly.

4.1 Prerequisites

• WinCC V7.5 project with a target HMI station created.
• CP 5611 / CP 5612 / CP 5621 PROFIBUS board installed in the HMI PC with the SIMATIC NET PC software driver loaded.
• PROFIBUS cable properly terminated; PLC and HMI addresses set on the DIP switches or in the CPU's hardware configuration (HW Config / TIA Portal Device Configuration).
• PLC program compiled and downloaded; the DBs referenced by WinCC tags must exist in the PLC and be marked as non-optimized (S7-300/400) or have non-optimized access enabled (S7-1500 with PUT/GET access enabled in CPU properties).

4.2 Step-by-step

1. Open the WinCC Explorer and right-click Tag Management → Add New Driver → SIMATIC S7 Protocol Suite → PROFIBUS.
2. Right-click PROFIBUS → New Connection. Name the connection after the remote PLC (e.g. PLC_FURNACE02).
3. In the Connection Properties dialog set:
   • Station Address: the PROFIBUS node address of the remote PLC (1..125, decimal).
   • Rack: 0 (for S7-300/400 CPU, or the ET 200S/IM rack number).
   • Slot: 2 (for S7-300 CPU 31x), 3 (for S7-400 CPU 41x-43x), or the slot of the PROFIBUS CP if accessing through a CP.
   • Connection Type: S7 connection, function 1 (read), 2 (write), 3/4 (read/write on DB).
4. Click Properties → Operating Mode and verify the CP access point is S7ONLINE and the board assignment points to the physical PROFIBUS interface.
5. Create tags under the new connection. Address format: DB<number>.DBX<bit>, DBW<word>, DBD<dword>, DBB<byte>, or I / Q / M for process I/O and merkers.
6. Save the project and start WinCC Runtime. Watch the Tag Management Runtime log: each successful connection produces an OPC/S7 handshake OK entry; failures show WSAECONNREFUSED or S7_ERR_TIMEOUT (hex 0x80).

For full procedure see the WinCC V7.5 help topic "Creating a PROFIBUS Connection" in the online manual at SIMATIC WinCC V7.5 - Communication.

5. Configuring the MPI Channel

The MPI driver uses the same SIMATIC S7 Protocol Suite but selects the MPI channel unit. The address range is 0..31, the default baud rate is 187.5 kbps, and the maximum bus length is 50 m at the highest rate. No DP slaves are allowed on a pure MPI segment.

5.1 Step-by-step

1. In WinCC Explorer right-click Tag Management → Add New Driver → SIMATIC S7 Protocol Suite → MPI.
2. Right-click MPI → New Connection.
3. Set Station Address = 0..31 (decimal), Rack = 0, Slot = 2/3 per CPU family as above.
4. Open Set PG/PC Interface in the Windows Control Panel (Siemens entry) and assign the MPI CP to access point S7ONLINE.
5. Create the tags using the same address syntax as PROFIBUS; the address parser is identical once the connection is open.

6. PLCSIM Behavior and Common Misconceptions

PLCSIM (S7-PLCSIM V5.4 for S7-300/400, PLCSIM V16/V17 for S7-1200/1500) is a software PLC that runs as a Windows process. It exposes a virtual MPI/DP/Ethernet interface through the Softbus driver (S7DOS). Because PLCSIM only ever emulates a single node, it can answer both MPI- and PROFIBUS-flavored requests on the same logical port.

This is why both channels work in PLCSIM but only one is correct on real hardware. The diagnostic rule is: trust the wiring, not the simulator. If the project will eventually be moved to a real PLC, build the channel around the cable that is in the cabinet.

7. Network Topology and Performance

Two performance levers determine tag update time in WinCC:

1. Acquisition cycle per tag (default 1 s, minimum 250 ms for fast process values). WinCC schedules one request per cycle; the S7 Protocol Suite serializes requests on a single CP.
2. Bus baud rate. A 1.5 Mbps PROFIBUS segment with 10 nodes will saturate long before a 12 Mbps segment. For an HMI with 500 tags at 1 s cycle, expect 30–40% bus utilization on 1.5 Mbps; move to 12 Mbps if utilization exceeds 70% or tag values stutter.

For MPI at 187.5 kbps, the practical tag count per HMI is around 200 before bus cycle time becomes noticeable. For PROFIBUS DP at 1.5 Mbps, 1,000 tags per HMI is routine; at 12 Mbps, 4,000+ tags is achievable with proper partitioning (multiple CP channels or use of S7 connection multiplexing).

8. Tag Quality Codes and Diagnostics

WinCC reports a quality code on every tag. The values that indicate a wrong-channel selection are listed below.

Activate the diagnostic channel in WinCC Explorer → Tools → Display Runtime Diagnosis. The log lists each connection attempt with the S7 function code, slot, and hex status returned by the CP. Typical S7 error codes:

• 0x0A – Object does not exist (DB not loaded, or address beyond DB length).
• 0x0B – Access type not supported (e.g. byte-write to a BOOL-only slot on an optimized DB).
• 0x05 – Address out of range.
• 0x02 – Negative acknowledgement at layer 2 (physical / wrong protocol).

Reference: S7-300/400 error code list in the SIMATIC S7-300 Communication Manual.

9. Troubleshooting Matrix

10. Best Practices

• Match the channel to the wire. The number-one rule. If the remote PLC is on PROFIBUS, configure PROFIBUS in WinCC — regardless of what worked in PLCSIM.
• Reserve one HMI address per station. Standard convention: PG = 0, HMI station 1..15 = HMIs, PLCs = 2..31. Document the address on the cabinet label.
• Use structure tags for DBs. Import a STEP 7 / TIA Portal tag table as a CSV and bulk-create WinCC tags against it. This eliminates 90% of address typos.
• Avoid mixing many small tags on a slow bus. Aggregate process values into a single DB and read a contiguous block; one DBW read is cheaper than 16 bit-tag reads.
• Disable PUT/GET only if you understand it. S7-1200/1500 CPUs ship with PUT/GET access disabled by default. WinCC uses the PUT/GET mechanism — you must enable it in the CPU properties → Protection → Permit access with PUT/GET communication.
• Use S7 routing for Ethernet-attached WinCC talking to PROFIBUS PLCs. A single CP 1623/CP 1628 plus an S7 connection in NetPro gives WinCC a transparent route to the PROFIBUS station with no extra gateway hardware.
• Document the channel decision in the project header. A comment in the WinCC project root ("Channel = PROFIBUS, baud = 1.5 Mbps, addr 7, rack 0 slot 2") prevents the next engineer from second-guessing it.

11. Migration Notes: MPI → PROFIBUS, PROFIBUS → Ethernet

Many legacy systems use MPI because the wiring is identical to PROFIBUS but the configuration is simpler. When the application grows beyond 200 tags or requires more than 50 m bus length, migrate to PROFIBUS. The migration path is:

1. Switch the CPU's MPI/DP combined port to DP-master mode in HW Config (Interface → Operating Mode → DP Master).
2. Set the PROFIBUS address (typically 2) and baud rate (1.5 Mbps or 12 Mbps).
3. Update the WinCC channel from MPI to PROFIBUS; address parsing remains identical.
4. Rebuild Set PG/PC Interface to point to the DP CP.

For greenfield designs, prefer PROFINET (Industrial Ethernet) over PROFIBUS. The SIMATIC S7-1200/1500 + WinCC Professional combination uses the TCP/IP or Industrial Ethernet channel with S7 connection; baud rate and node count limits disappear. The same Tag Management structure is preserved — only the channel unit changes.

12. Summary of Decision Logic

Choose the channel that matches the wiring, set the station address to the PLC's DIP/Configured address, set rack 0 and slot to the CPU slot, create the tags, and validate with WinCC Runtime diagnosis. PLCSIM is useful for tag wiring but does not validate the bus choice.