WinCC to S7 PLC Communication: Profibus Class 2 & Ethernet

Overview: HW Config Does Not Contain the WinCC Connection

One of the most persistent points of confusion when commissioning a Siemens SIMATIC WinCC station against an S7-300, S7-400, S7-1200, or S7-1500 PLC is the assumption that any communication path used by WinCC must also be visible in the PLC's hardware configuration (HW Config in STEP 7 V5.x, or Device Configuration in TIA Portal). In practice, HW Config describes only what the PLC's CPU sees on its own backplane and on its own fieldbus segments: the central rack, the distributed I/O (DP slaves, PN devices), and the S7 connections that the PLC's user program opens via standard communication blocks (FB 12 'BSEND', FB 13 'BRCV', FB 14 'PUT', FB 15 'GET', or TIA Portal instructions PUT/GET).

WinCC is a supervisory client. It does not appear as a DP slave, a PN device, or an S7 partner in the PLC's project. The two communication paths WinCC uses are configured entirely inside the WinCC project:

• Profibus-DP: WinCC operates as a Class 2 master on the same Profibus segment as the PLC, opens an acyclic connection to the PLC (the Class 1 master), and reads or writes data on demand. No entry is required in HW Config because the Class 2 master has no cyclic I/O to configure.
• Industrial Ethernet (TCP/IP): WinCC uses the SIMATIC S7 Protocol Suite's TCP/IP channel unit, which is an RFC 1006 (ISO-on-TCP) client that talks to the PLC's PROFINET interface using only the CPU's IP address. The PLC's user program does not have to declare a connection to the WinCC PC; the connection is initiated by the WinCC side.

Understanding this separation between the PLC project and the WinCC project is what stops a field engineer from hunting a non-existent hardware entry for hours.

Profibus-DP Master Class 1 vs Class 2 Architecture

Profibus-DP (Decentralized Periphery) is the RS-485-based, master-slave variant of Profibus specified in IEC 61158 and EN 50170. The physical layer is a shielded twisted-pair cable with the characteristic violet sheath. Siemens order numbers: 6XV1 830-0EH10 for the standard cable and 6XV1 830-3FH10 for the trailing/flexible variant. The bus is terminated at both ends only, using 220 Ω terminating resistors (built into the Siemens 9-pin D-sub connectors 6ES7 972-0BA12 for the 90° version with PG socket, or 6ES7 972-0BA52 for the axial version).

Class 1 Master — the PLC

A Class 1 master is the central controller of a DP segment. On a SIMATIC station, this is typically:

• The integrated DP port of an S7-300 CPU, for example CPU 315-2 DP (6ES7 315-2AH14), CPU 317-2 DP (6ES7 317-2AJ13), or CPU 319-3 PN/DP.
• The integrated DP port of an S7-400 CPU (e.g., CPU 412-2 DP, CPU 414-3 PN/DP, CPU 416-3 PN/DP).
• An external Profibus CP on the S7-1200 or S7-1500, for example the CM 1542-1 (master on Profibus DP-V0/V1) or CP 1542-1.

The Class 1 master owns the token on the bus, sets the baud rate (the slaves auto-detect it during parameterization), and exchanges cyclic I/O with its assigned slaves in a fixed cycle (typically 1–10 ms per slave at 1.5 Mbps, sub-millisecond cycles are possible with DP-V2 / isochronous mode).

Class 2 Master — the WinCC Station

A Class 2 master is a supervisory station. It does not own the token, does not drive the bus, and does not exchange cyclic I/O with any slave. The Class 2 master is allowed to:

• Open an acyclic connection to a Class 1 master.
• Read and write data blocks, inputs, outputs, memory bits, timers, and counters on the PLC.
• Read diagnostic buffers, module status, and connection statistics.
• Download or upload the PLC program (this is exactly what STEP 7 / TIA Portal does when you go online).

Typical Class 2 devices are programming devices (PG), PCs running STEP 7 / TIA Portal, and SCADA stations. The classic Siemens Profibus PC cards that put a PG/PC on the bus as a Class 2 master are the CP 5611 A2 (6GK1 561-1AA01, PCI), CP 5612 (6GK1 561-2AA00, PCI), CP 5621 (6GK1 562-1AA00, PCIe), CP 5622 (6GK1 562-2AA00, PCIe with DP-slave capability), and the USB adapter CP 5711. The SOFTNET-DP / SOFTNET-PB software packages activate equivalent Class 2 functionality on top of these CPs without needing additional hardware.

Why HW Config Shows No WinCC Entry

STEP 7 / TIA Portal hardware configuration is the engineering view of the PLC rack. It describes the central rack, the distributed I/O (DP slaves with their GSD files, PN devices with their GSDML), and the S7 connections that the user program uses. A Class 2 master is none of these things — it has no cyclic I/O and it has no GSD. The PLC does not "know" the Class 2 master exists until the master opens a connection, and that connection is established entirely by the master's stack. Consequently, there is nothing to configure in HW Config for the WinCC-to-PLC Profibus path. Uploading the PLC program to STEP 7 will never show the WinCC station, for the same reason that uploading a CPU program does not show the laptop that last programmed it.

How the WinCC Class 2 Master Talks to the PLC

When the WinCC Runtime is started, the S7 Protocol Suite's PROFIBUS channel unit opens an acyclic DP connection (a DPV1 read/write service) to the configured Class 1 master address. The CP 5611/CP 5621 sends an initialization request that the PLC's DP interface accepts, returning its bus parameters and diagnostic data. From that point on, WinCC reads tags on demand and writes tags on demand. Each acyclic exchange takes a single Class 2 slot, which the Class 1 master interleaves between its cyclic slots with a small overhead (typically 30–50 % added to the cycle time at 12 Mbps for one Class 2 master; more if multiple Class 2 masters are active).

The PLC is not aware that this is WinCC specifically. The PLC sees a standard DPV1 acyclic service from a Class 2 device and answers with the requested data. To the PLC, the WinCC PC is indistinguishable from a programming device running STEP 7.

Ethernet Communication and the S7 Protocol Architecture

For Ethernet-based WinCC connections, the situation is analogous. The PLC's CPU has an integrated PROFINET interface (or an external CP such as the CP 343-1 on the S7-300 or CP 443-1 on the S7-400). The interface has a single fixed IP address, subnet mask, and (if needed) router address. That is the only piece of information the PLC needs in order to be reachable.

The PLC's user program does not declare an individual WinCC connection in HW Config; it merely exposes the S7 communication services (PUT/GET, S7Comm over ISO-on-TCP, FETCH/WRITE) on the configured IP address. The WinCC PC opens the connection client-side. CPU models that ship with an integrated PROFINET port include the entire S7-1200 family (CPU 1211C, 1212C, 1214C, 1215C, 1217C), the S7-1500 family (CPU 1511, 1513, 1515, 1516, 1517, 1518), the ET 200SP CPU 1510SP / 1512SP, and the S7-300 CPUs that have a PN port (CPU 315-2 PN/DP, CPU 317-2 PN/DP, CPU 319-3 PN/DP). Older S7-300 stations without a PN port use the CP 343-1 for Ethernet.

S7 Protocol Suite Channel Units

WinCC V7.x ships with the SIMATIC S7 Protocol Suite, which provides the following channel units. Each one is added to the WinCC project in Tag Management and configured independently of the others.

For each channel unit, the operator creates one or more "Driver Connections" and assigns WinCC tags to those connections. The only required parameters are the PLC's IP address (for TCP/IP) or Profibus address (for PROFIBUS), plus the rack and slot of the CPU.

Hardware Components and Order Numbers

For Ethernet, the SIMATIC S7 Protocol Suite ships as a standard component of WinCC V7.x and of WinCC Professional (TIA Portal). No additional hardware is required beyond a commercial Intel/Realtek NIC; the S7 protocol stack runs over the standard Windows TCP/IP socket API. The default TCP port for S7 communication is 102; make sure the Windows firewall and any anti-virus package are configured to allow inbound and outbound traffic on this port.

Configuring the WinCC Profibus Class 2 Connection

Prerequisites

• STEP 7 V5.x or TIA Portal project for the PLC is available on the engineering PC and has been downloaded to the PLC.
• WinCC V7.x or WinCC Professional is installed with a valid license for the SIMATIC S7 Protocol Suite. Verify in the License Analysis tool that the S7 Protocol Suite license is active.
• The CP 5611 / CP 5612 / CP 5621 / CP 5622 driver package (SIMATIC NET PC software) is installed. Open SIMATIC NET Commissioning → Modules and confirm that the CP shows status "OK" with the current firmware.
• Profibus cable from the PC's CP to the PLC's DP port, terminated at both end devices only, with the on-board termination switch set to ON only at the two physical ends of the segment.

Procedure

1. Open the WinCC Explorer. In the navigation tree, open Tag Management.
2. Right-click Tag Management and choose Add New Driver. Select SIMATIC S7 PROTOCOL SUITE from the list and confirm.
3. Expand the new driver node. Right-click the PROFIBUS channel unit and choose New Driver Connection.
4. In the Connection Properties dialog, enter a logical connection name such as S7_PROFIBUS_PLC01. Click Properties.
5. In the Connection Parameters dialog the CP 5611 / CP 5621 / CP 5622 is selected automatically. Enter the PLC's Profibus address (the Class 1 master's DP address) in the Station address field. Enter the CPU's rack and slot — for an S7-300, rack 0 and slot 2; for an S7-400, rack 0 and slot 3.
6. Click OK. A new logical connection appears under the PROFIBUS channel unit.
7. Right-click the connection and choose New Tag. In the Tag Properties dialog choose the address type (DB, M, I, Q, T, C) and enter the bit/byte/word/dword offset. The address format for an S7-300 is, for example, DB1,DD0 for a 32-bit double-word at data block 1, byte 0.
8. Repeat for all tags required by the WinCC screens. Save the project and start WinCC Runtime.

Verification

Once Runtime is active, open Channel Diagnosis in the Tag Management tree (right-click the connection → Channel Diagnosis). A green status with a current event log indicates the Class 2 connection is established. In the WinCC Tag Simulator or the online tag test, issue a read against a known tag and confirm the value is updated.

Configuring the WinCC Ethernet (TCP/IP) Connection

Prerequisites

• The PLC PROFINET interface (CPU PN port, CP 343-1, or CP 443-1) has a configured IP address, subnet mask, and (if routed) router address. The IP address is assigned either in HW Config of STEP 7 / TIA Portal, or directly in the PLC's online interface.
• The WinCC PC and the PLC are in the same IP subnet, or a routable path exists through managed switches and routers.
• PUT/GET communication is permitted on the S7-1200/1500 CPU. In TIA Portal, under CPU Properties → Communication / Connection Mechanisms, the checkbox Permit access with PUT/GET communication from remote partner must be enabled; otherwise the CPU rejects the S7 partner connection.

Procedure

1. Open the WinCC Explorer and the Tag Management tree.
2. Add the driver SIMATIC S7 PROTOCOL SUITE.
3. Right-click the TCP/IP channel unit and choose New Driver Connection.
4. Enter a logical connection name (e.g., S7_TCP_PLC01) and click Properties.
5. In the Connection Parameters dialog enter the PLC's IP address in the IP Address field. The CP selection is replaced by TCP/IP — no CP is required. Enter the rack and slot (S7-300: 0/2; S7-400: 0/3; S7-1200: 0/1; S7-1500: 0/1).
6. Click OK. The connection is created.
7. Add tags as in the Profibus procedure. Save and start WinCC Runtime.

Verification, Channel Diagnosis, and S7 Error Codes

WinCC's Channel Diagnosis tool (Tag Management → right-click connection → Channel Diagnosis) provides the following state information for each configured connection:

S7 Error Codes Seen in WinCC Channel Diagnostics

Troubleshooting Matrix

Specifications and Limits

For the Profibus cable, observe the baud-rate-vs-length relationship strictly. At 12 Mbps a 100 m segment is the upper limit and any unterminated stub causes reflections that show up as diagnostic interrupts on the slaves. If the bus must run farther than 100 m at 12 Mbps, insert a Profibus repeater (6ES7 972-0AA01-0XA0) to refresh the signal, or reduce the baud rate.

Field-Proven Caveats and Edge Cases

1. Optimised DBs on S7-1500 and S7-1200. Starting with TIA Portal V13 and S7-1500 firmware V1.8, every newly created data block is "optimised" by default. An optimised DB does not expose its memory layout as a fixed byte offset; the absolute WinCC tag DB1,DD0 returns S7 error 0x000D. Either uncheck Optimised block access on the DB properties, or use symbolic tag access in the WinCC Professional / TIA Portal tag editor. The same applies to S7-1200 firmware V4.0 and above.

2. Routing through multiple IP subnets. When the WinCC station and the PLC are separated by an IP router (e.g., a plant WAN), the standard S7 Protocol Suite in WinCC V7.x does not route S7 packets on its own. Use a "Named Connection" configured in STEP 7 NetPro, or set up S7 routing in TIA Portal using an S7-1500 as a routing gateway. The CP 1623 and CP 1628 industrial Ethernet PC cards support hardware-based routing on the PC side.

3. CP 5611 vs SIMATIC NET version. SIMATIC NET PC software V14 SP1 and above requires the CP firmware to be at least V6.x. CP 5611 cards shipped before 2010 may need a firmware update using the SIMATIC NET Commissioning tool before they enumerate on a modern Windows version.

4. Windows firewall blocking S7. The SIMATIC NET S7 service listens on TCP port 102 (ISO-on-TCP) and on UDP port 500 (for S7 discovery in newer WinCC versions). Windows Defender Firewall with the default profile blocks inbound on port 102 since Windows 7 SP1. The SIMATIC NET installer normally adds the exception; a manual installation on a hardened image requires a firewall rule for ports 102/TCP, 500/UDP, and 34964/UDP (PN discovery).

5. Class 2 master on a heavily loaded DP segment. A Class 2 master increases the master's cycle time by approximately 30–50 % because it opens an additional acyclic slot. On a segment with tight cycle budgets (e.g., 2 ms with 6 slaves at 12 Mbps), prefer Ethernet-based WinCC connections to keep the cyclic budget reserved for I/O.

6. WebUX and Unified Comfort Panel coexistence. When a TIA Portal project contains both WinCC Unified and a Unified Comfort Panel, the S7 connection resources on the PLC are shared. Plan for at least 4 S7 connections per WinCC Runtime client and 2 per Comfort Panel; budget these against the CPU's documented maximum.

7. GSD file version mismatch. If the DP slave is described by an older GSD (e.g., GSD Revision 1) and the Class 1 master expects GSD Revision 5 (DP-V2), the slave may be accepted but report the wrong diagnostic length. Always import the GSD shipped with the specific hardware revision of the slave.

8. Energy-efficient Ethernet (EEE) and 1 Gbit/s ports. Many managed switches enable EEE (IEEE 802.3az) by default to save power. The link briefly drops out of low-power states and S7 connection timers may misinterpret these blips as timeouts. Disable EEE on the switch port that carries the WinCC connection.

9. Hot-standby / redundant PLC pairs. WinCC V7.x does not natively follow a switched S7 connection between two redundant S7-400H CPUs. Use the SIMATIC S7 Redundancy option or design the WinCC tags against a stable IP address that floats between the two PLCs via a 3rd-party redundancy manager.