WinCC Unified V18 S7Plus Connection Drop on S7-1200 Arrays: License-Bound Auto-Reconnect Failure

A WinCC Unified PC Runtime V18 Update 3 HMI server that supervises more than ten S7-1200 controllers will intermittently drop S7Plus connections and fail to re-establish them until the runtime is restarted. The failure is rarely a network or PLC problem. It is, in the vast majority of field cases, a missing SIMATIC NET license combined with the default Auto selection in the PG/PC Interface tool. This reference documents the symptom, the precise error signature, the root cause, and the complete remediation path, including installation steps, registry-level configuration, and verification.

1. Problem Description

An installation of WinCC Unified PC Runtime V18 Update 3 is configured with thirteen S7-1200 CPUs (any firmware combination, typically V4.2 through V4.6). After several hours — sometimes minutes, sometimes a full shift — one or more HMI connections go into a disconnected state. The runtime fails to bring them back online automatically. The operator sees greyed-out tags, "connection failed" alarms, and frozen faceplate animations.

Two recovery methods work, both manual:

1. Restart the entire Unified Runtime from the Runtime Manager (Start → Stop → Start). All thirteen connections re-establish in roughly 30–60 seconds.
2. Cycle power on the affected S7-1200. The PLC comes back, but the Unified PC side does not re-dial the connection — the connection remains "established on the PLC side / broken on the HMI side" until the runtime is restarted.

This is a well-known signature. It is not a PLC defect, not a network switch defect, and not a Windows network stack defect. It is the runtime telling you, in a non-obvious way, that the license check at the moment of reconnect failed.

2. TraceViewer Signature

The following line is observable in WinCC Unified TraceViewer (Start → Siemens Automation → WinCC Unified → TraceViewer) under the S7PlusConnection channel at the moment of failure:

S7PlusConnection,  received open failed with error -9223348805376671612
for HMIConnection CONN%DB5_HMI cid 273 from session 0 err -9223348805376671612

Decoding the value:

• Module: S7PlusConnection — the Secure S7 Plus transport (TLS over TCP/102) used by Unified V17 and later.
• Operation: received open failed — the controller returned an Open rejection on the session layer.
• HMI connection: CONN%DB5_HMI — the symbolic connection name from the TIA Portal project, bound to a specific DB and area.
• Connection ID: cid 273 — internal channel identifier.
• Session: session 0 — primary session; the runtime has not yet escalated to a re-dial session.
• Error: -9223348805376671612 — a 64-bit signed WinCC internal error code. Hex form: 0x8007FFFFE2DC_FFFC-class. The negative-significant bit indicates a fatal open failed rather than a retryable transient.

Most importantly: the same connection ID can succeed at 09:00 and fail with this exact code at 11:47, which is the smoking gun that rules out cabling and IP topology. Network failures are deterministic with topology; license enforcement is not.

3. Root Cause: Licensing Threshold at Ten Connections

WinCC Unified PC Runtime licenses connections, not tags. The licensing model in V18 is structured as follows (see WinCC Unified V18 System Manual):

The critical threshold is this: the moment you define connection #11 in TIA Portal and download the HMI configuration, the Unified PC Runtime requires SIMATIC NET to be installed and licensed with at least eleven SOFTNET-IE S7 license units. The runtime does not warn about this with a popup. It does not write a clean license-related line in the diagnostic log. Instead, it accepts the connections at startup (because the licenses are technically present), and then fails to re-open them at the next reconnect attempt, producing the error signature in Section 2.

4. Required Components and Versions

For a clean remediation of the 13-PLC scenario the following software stack must be installed on the Unified PC in this order:

The SOFTNET-IE S7 license is per S7 connection. Thirteen S7-1200 controllers with one HMI connection each require thirteen license units. Each unit corresponds to one concurrent logical S7 connection from the PC station. SOFTNET-IE S7 licenses can be stacked by installing multiple license keys on the same Automation License Manager (ALM) container.

5. Step-by-Step: Install SIMATIC NET and Apply Licenses

1. Insert the SIMATIC NET V18 DVD or mount the ISO. Run Setup.exe with administrator privileges.
2. Select Install — SIMATIC NET PC Software. In the product selection tree, enable SIMATIC NET PC Software, S7 Communication, OPC UA, and Automation License Manager. The default install creates a "PC Station" with virtual Ethernet interfaces.
3. When prompted for licensing, leave the field blank and finish the installation. The runtime will start in a demo mode without the keys.
4. Open Automation License Manager (Start → Siemens Automation → Automation License Manager).
5. Connect the license USB stick or navigate to the license file path. Right-click the local PC entry and select Transfer License.
6. Transfer 13 SOFTNET-IE S7 V18 license units. Verify the entry reads SOFTNET-IE S7 V18.0 × 13 with status Valid.
7. Restart the PC once to ensure the S7Plus / SOFTNET-IE S7 driver stack re-initializes against a licensed state.

6. PG/PC Interface Configuration (Critical)

After installing SIMATIC NET, the PG/PC Interface tool must be configured correctly. The default selection — <Auto> — is the second-most common cause of the auto-reconnect failure. With Auto, the runtime will pick whichever NDIS adapter Windows reports first; this is unpredictable across reboots and can flip between a real Intel NIC, a Hyper-V virtual adapter, or the SIMATIC NET virtual NDIS adapter.

1. Open PG/PC Interface (Start → Siemens Communication → PG/PC Interface).
2. Under Interface parameterization used, select S7ONLINE → <your physical NIC>.TCPIP.1. For an Intel I219-LM, the entry reads Intel(R) Ethernet Connection — TCPIP.1.
3. Never select S7ONLINE → <Auto>. This setting causes the runtime to bind to whichever interface Windows routes first, and after a Windows update or network change the binding shifts silently.
4. Click OK and confirm the registry key HKLM\SOFTWARE\Siemens\SINEC\S7ONLINE\Interface shows the GUID of the physical NIC.

For multi-NIC servers, pin the S7Plus traffic to a dedicated subnet. Assign the 13 S7-1200 controllers to VLAN 10, give the HMI server a static IP in that VLAN (e.g. 192.168.10.5/24), and select that NIC in the PG/PC Interface.

7. Disable Windows Network Offloads on the HMI NIC

Several Windows TCP offloads interfere with the S7Plus TLS handshake and silently corrupt the open-pdu. Disable them on the NIC that carries S7 traffic:

netsh int tcp set global chimney=disabled
netsh int tcp set global rss=disabled
netsh int tcp set global netdma=disabled
netsh int tcp set global dca=disabled
netsh int tcp set global timestamps=disabled
netsh int tcp set global ecncapability=disabled

Then in Device Manager → Network Adapters → [NIC] → Properties → Advanced, disable the following:

• TCP/UDP Checksum Offload (IPv4 and IPv6) — Disabled
• Large Send Offload v2 (IPv4 and IPv6) — Disabled
• Receive Side Scaling — Disabled
• Energy Efficient Ethernet — Disabled

Reboot. These offloads are known to fragment TLS records at exactly the size S7Plus uses for its session-open handshake, producing a failure that the runtime logs as the Section 2 error.

8. HMI Connection Tuning in TIA Portal

Beyond licensing, the connection parameters in the TIA Portal project have a direct effect on reconnect behavior. Open HMI Devices → [Unified PC] → Connections and verify each of the 13 connections:

9. Runtime Diagnostics: How to Read TraceViewer for This Issue

TraceViewer is the unified diagnostic tool shipped with WinCC Unified PC. To use it for this specific failure:

1. Launch TraceViewer. Select File → Open → Online.
2. Set the filter to S7Plus* and click Start Recording.
3. Reproduce the failure (cycle a PLC).
4. Look for three patterns:
   • Pattern A — License: received open failed with the −9.22… code, no preceding open initiated within 200 ms. Confirms licensing.
   • Pattern B — Name parsing: received open failed with HMIConnection CONN%…. Confirms the percent-sign issue.
   • Pattern C — TLS offload: received open failed preceded by TLS handshake error 0x80131500. Confirms NIC offload.

For Pattern A, the remediation is Section 5. For Pattern B, the remediation is Section 8. For Pattern C, the remediation is Section 7. Most field reports show two of three patterns active simultaneously.

10. Verification Procedure

After applying the licensing fix and the PG/PC interface fix, verify the installation by running the following sequence on the Unified PC. The sequence is designed to force every connection to drop and re-establish, which is exactly the action that was failing before.

1. Start the Unified runtime. Confirm in Runtime Manager that all 13 connections reach Connected within 90 seconds.
2. Open a command prompt with admin rights. From a workstation on the same VLAN, ping each S7-1200 to confirm reachability.
3. Use Set-NetFirewallRule or unplug/replug the NIC to simulate a 30-second outage on the HMI PC.
4. Wait 60 seconds. Without restarting the runtime, verify that all 13 connections return to Connected within 90 seconds.
5. Cycle one S7-1200 (power off, wait 10 s, power on). The other twelve must remain Connected throughout.
6. Within 90 seconds, the cycled PLC must reconnect automatically.
7. Repeat step 5 for each of the 13 PLCs in sequence.

Acceptance criteria: 0 manual runtime restarts, 0 connection drops lasting > 90 s over a 24-hour soak. If any single connection fails the auto-reconnect test, the licensing stack is still incomplete — verify the SOFTNET-IE S7 count with ALM.

11. Service Mode: Diagnostic Logging for Persistent Failure

If the verification still shows a failure, enable the SOFTNET-IE S7 verbose log. The log is the deepest level available short of a WireShark capture, and it records the exact TLS open-pdu exchange with the controller.

1. Open SIMATIC NET Configuration → PC Station → Properties → Logging.
2. Set Log level to Diagnostic and the path to C:\Siemens\S7Net\Trace.
3. Restart the runtime.
4. Trigger the failure.
5. Open S7trace.log and search for ERROR_OPEN_FAILED. The line preceding it shows the exact TLS alert description (e.g. tls_alert_unexpected_message or tls_alert_certificate_unknown).

A tls_alert_certificate_unknown response from the PLC indicates a certificate trust issue on the Unified PC. The fix is to import the PLC's TLS certificate under WinCC Unified → Settings → Certificates → Trusted. This is a separate failure mode from the licensing issue and is independent of it.

12. Fallback: Reducing Connection Count Below the Threshold

If licensing cannot be obtained in time (waiting on procurement), the only legal mitigation is to bring the deployment under the ten-connection threshold by combining PLCs into a single logical connection through a CP/PN coupler. For example, two S7-1200 stations can be bridged with one of them acting as I-Device for the other, halving the connection count. This is operationally ugly but compliant.

What must not be done:

• Do not disable SIMATIC NET to "make it stop checking" — the runtime still needs the SOFTNET-IE S7 driver stack for any TLS S7Plus connection beyond ten.
• Do not use the WinCC Unified demo license past the 21-day window. The demo license transparently downgrades to non-persistent and produces exactly this fault.
• Do not switch the connection mode from S7 Plus to legacy S7. Legacy S7 is not TLS-protected and is not supported by Unified V18 for new deployments.

13. Quick Reference: Causes and Fixes

14. Field-Proven Caveats

• The error code -9223348805376671612 is not a Windows Sockets error (0x80072EE2 etc.). It is a WinCC Unified internal code. Do not waste time correlating it with errno.h.
• SIMATIC NET V18 must be installed before WinCC Unified Runtime, or the runtime's S7Plus layer will not find the SOFTNET-IE S7 driver. The installer enforces this order, but a manual install can break it.
• Restarting only the WinCC Unified Runtime service is not sufficient after a license change. A full OS reboot is required so the SIMATIC NET license seat pool is re-allocated.
• Windows Defender Firewall will silently drop S7Plus packets if the rule "Siemens S7Plus" is not enabled. Confirm it is enabled in wf.msc after any Windows feature update.
• Do not run WinCC Unified Runtime on the same Windows instance as TIA Portal running an active online connection — it competes for SOFTNET-IE S7 license seats and produces exactly this fault in the running HMI.