Connecting a Single WinCC OS to Multiple PLCs Across Different Ethernet Subnets in SIMATIC PCS 7

To connect a single WinCC OS station (using a standard onboard network adapter configured as 'IE General') to multiple S7 PLCs residing on different IP subnets routed through an existing plant router, configure two separate Industrial Ethernet subnets in NetPro. In HW Config, configure the default gateway IP address on the IE General adapter and on the remote PLC's CP or PN interface pointing to the router's local interfaces. Configure the S7 Connections in NetPro using ISO-on-TCP (RFC 1006) protocol rather than raw ISO transport, allowing S7 communication packets to traverse the layer-3 routing boundary seamlessly.

Network Architecture: Connecting WinCC Across Routed IP Subnets

In industrial facilities expanding over time, PLCs are frequently grouped into isolated physical or logical subnets (e.g., Subnet A: 192.168.1.0/24 for Boiler Plant, and Subnet B: 192.168.2.0/24 for Water Treatment). When a centralized SIMATIC PCS 7 OS station (or standalone WinCC station) is deployed on Subnet A using a standard commercial network adapter (IE General), it must acquire process tags and alarms from PLCs in both subnets.

If an enterprise IP router or layer-3 managed switch links the two subnets, the OS station can communicate with both controllers without requiring secondary network cards or hardware rewiring, provided the protocol stack and routing parameters are correctly modeled in NetPro.

Why ISO Transport Fails and RFC 1006 (ISO-on-TCP) Is Mandatory

In standard SIMATIC PCS 7 Plant Bus architectures using CP 1613 or CP 1623 cards, communication often defaults to native ISO Transport Protocol (based on layer-2 MAC addresses). While ISO transport offers high immunity against IP address conflicts, ISO transport is strictly non-routable; network routers drop layer-2 MAC frames at the subnet boundary.

For communication across IP subnets using a standard network card (IE General), the S7 connection must be configured using ISO-on-TCP (RFC 1006). RFC 1006 encapsulates ISO transport packets inside standard TCP/IP packets on registered TCP port 102. This allows standard IP routers to forward S7 communication between subnets based on destination IP addresses.

Configuring NetPro Subnets and Gateway Routing in HW Config

To establish valid network paths across subnets in SIMATIC Manager:

Create Distinct Subnets in NetPro: In NetPro, create two Industrial Ethernet subnets: Ethernet_Subnet_A (e.g., 192.168.1.0) and Ethernet_Subnet_B (e.g., 192.168.2.0).
Connect Stations to Respective Subnets: Connect the OS station's IE General and PLC 1 to Ethernet_Subnet_A. Connect PLC 2 to Ethernet_Subnet_B.
Configure Router Gateway in HW Config:
- On the OS station, open HW Config for IE General > Properties > Parameters. Enable 'Use router' and enter the IP address of Router Interface A (192.168.1.254).
- On PLC 2, open HW Config for the CP 443-1 or integrated PN port. Enable 'Use router' and enter the IP address of Router Interface B (192.168.2.254).
Router Port Forwarding: Ensure the router allows bidirectional traffic on TCP port 102.

Step-by-Step Multi-Subnet S7 Connection Setup in PCS 7

Follow this sequence in NetPro to configure the cross-subnet S7 connections:

Open NetPro: From SIMATIC Manager, open NetPro.
Select OS Station WinCC Application: In the OS station table, select the WinCC Application row.
Insert Connection to PLC 1 (Local Subnet):
- Right-click the connection table and select Insert New Connection.
- Select PLC 1 CPU. Choose S7 connection. Click OK.
- Set the connection interface to IE General and protocol to TCP/IP (RFC 1006).
Insert Connection to PLC 2 (Remote Subnet):
- Right-click and select Insert New Connection.
- Select PLC 2 CPU across Ethernet_Subnet_B. Select S7 connection.
- NetPro automatically recognizes the routed path via the configured router gateways.
Save and Compile Network: In NetPro, execute Network > Save and Compile with 'Check all connections'.
Compile OS: Right-click the OS project in SIMATIC Manager and run Compile OS. WinCC creates Named Connections pointing to both PLCs with correct IP addressing.

Industrial Ethernet Protocol Comparison Across Routers

The following table compares Industrial Ethernet protocol capabilities when bridging IP subnets:

Communication ProtocolOSI LayerLayer-3 Routable?Default PortHardware Required on OSISO Transport (MAC-based)Layer 2 / TransportNO (Dropped by routers)None (Raw Ethernet)CP 1613 / CP 1623 onlyISO-on-TCP (RFC 1006)Layer 4 (TCP/IP)YES (Routable across subnets)TCP Port 102Standard NIC (IE General) or CPTCP/IP Native SocketLayer 4YES (Routable)User-definedStandard NIC (IE General)UDP / MulticastLayer 4Conditional (Requires PIM/IGMP)User-definedStandard NIC (IE General)

Verification

Verify cross-subnet communication through the following procedure:

In Windows PowerShell on the OS station, verify IP reachability to both PLCs:
powershell Test-NetConnection -ComputerName 192.168.1.10 -Port 102 Test-NetConnection -ComputerName 192.168.2.10 -Port 102
Both tests must return TcpTestSucceeded : True.
Open WinCC Channel Diagnosis on the OS station during runtime.
Verify that both S7 connections (Named Connections or SIMATIC S7 PROTOCOL SUITE > Industrial Ethernet) display connection state 'Logical connection established' with green checkmarks.
Open a process screen displaying tags from both PLCs; confirm that process values update smoothly without quality code errors.

Commercial Accuracy Disclaimer: Software order numbers (MLFBs), package structures, and hardware capacity prerequisites vary across PCS 7 versions and hardware platforms. System integrators must confirm exact software entitlements and licensing requirements against the official Siemens Catalog CA 01 and obtain an authorized Siemens distributor quotation prior to purchasing.

Limitations and Operational Precautions

Consider these operational rules when routing DCS communications:

Never Route Hardnet Fault-Tolerant H-Connections Over Low-Grade Routers: High-availability S7-400H connections require specialized 4-way redundancy switching that commercial routers may delay or disrupt.
Router Throughput and Latency: Ensure the inter-subnet router maintains low packet latency (<10 ms); excessive jitter can trigger S7 connection timeout aborts on WinCC channels.
Firewall Port Blocking: Security firewalls between subnets must explicitly permit bidirectional TCP port 102 and ICMP echo.

Engineer FAQ

How do I configure the gateway IP address on an S7-400 CPU?

In HW Config, open the object properties of the Ethernet CP (e.g., CP 443-1) or CPU PN port, select 'Parameters', check 'Use router', and enter the gateway IP address.