Industrial Wireless LAN (IWLAN) Rules in SIMATIC PCS 7: Plant Bus vs Terminal Bus

Industrial Wireless LAN (IWLAN) Rules in SIMATIC PCS 7: Plant Bus vs Terminal Bus

In SIMATIC PCS 7, the deployment of Industrial Wireless LAN (IWLAN) is governed by strict architectural boundary rules. Under official Siemens guidelines, IWLAN is strictly NOT released for use on the Plant Bus (communication between automation stations and OS servers), because fault-tolerant S7-H protocols and deterministic process polling cannot tolerate RF latency spikes, multipath interference, or packet dropouts. Conversely, IWLAN is officially released to a limited extent on the Terminal Bus to connect mobile operator stations (such as SIMATIC Industrial Tablet PCs) and WebNavigator clients via SCALANCE W industrial access points. For basic IP connectivity, SCALANCE W access points act as transparent Layer 2 Ethernet bridges and do not require configuration in STEP 7 HW Config.

Table of Contents

• PCS 7 Network Segmentation: Plant Bus vs Terminal Bus Boundaries
• Why IWLAN is Prohibited on the PCS 7 Plant Bus
• Approved Use Cases for IWLAN on the Terminal Bus
• SCALANCE W Hardware Configuration and Security Best Practices
• PCS 7 Wireless Subsystem Release and Topology Matrix
• Verification
• Limitations and Operational Precautions
• Engineer FAQ
• Technical References
• Related Articles
• Related Tags

PCS 7 Network Segmentation: Plant Bus vs Terminal Bus Boundaries

In SIMATIC PCS 7, process network architecture is strictly partitioned into two independent physical or logical tiers:

1. Plant Bus (Anlagenbus)

Connects automation stations (AS controllers) to each other, to engineering stations (ES), and to WinCC OS Servers. It carries mission-critical, time-deterministic automation traffic: S7 communication telegrams, AS-to-AS cross-interconnections, and fault-tolerant S7-H redundancy synchronization.

2. Terminal Bus (Terminalbus)

Connects WinCC OS Servers to OS Clients, WebNavigator servers, Process Historian, and Information Server. It carries standard TCP/IP client-server traffic, screen graphics, operator commands, and historical data streams.

The physics of wireless radio transmission dictates where IWLAN can be deployed safely within this hierarchy.

Why IWLAN is Prohibited on the PCS 7 Plant Bus

Siemens explicitly states in product documentation (Entry 44443744) that IWLAN is not released for the Plant Bus:

• Lack of Determinism: Radio frequency (RF) channels are subject to multipath fading, electromagnetic interference from high-voltage motors, and roaming delays as clients transition between access points.
• S7-H Redundancy Sensitivity: In redundant S7-400H or AS 410 systems, S7-REDCONNECT continuously monitors sub-connections with aggressive millisecond keep-alive watchdogs. Transient RF packet drops cause false redundancy switchovers or communication alarms.
• Safety Integrated Restrictions: Fail-safe communications (PROFIsafe) on the plant bus require deterministic delivery within configured F-monitoring times (F_WD_Time), which cannot be guaranteed over non-deterministic wireless links.

Approved Use Cases for IWLAN on the Terminal Bus

On the Terminal Bus, Siemens officially releases IWLAN under controlled conditions (Entry 109736624):

1. Mobile Operator Clients: Ruggedized industrial tablets (e.g., SIMATIC ITP1000) running standard WinCC OS Client or WebNavigator client software, allowing operators to perform local valve lineup audits and equipment testing while maintaining full SCADA access.
2. Maintenance Engineering Access: Temporary wireless connection for engineering laptops to perform non-intrusive diagnostics via WebNavigator or PDM without physical network plug-in.
3. Web Thin Clients: Viewing read-only dashboards and Information Server reports on mobile devices across plant workshops.

SCALANCE W Hardware Configuration and Security Best Practices

When integrating SCALANCE W access points (e.g., SCALANCE W788 / W774) and client bridges:

1. Do SCALANCE W Modules Need to be Added in HW Config?

• No, for Basic Network Bridging: SCALANCE W devices function as transparent Layer 2 network bridges. They forward Ethernet frames between radio channels and copper switches without needing insertion into STEP 7 HW Config.
• Yes, Only for PROFINET Diagnostics: If an engineer wishes to supervise access point power supplies, radio channel health, or link quality directly in CFC via PROFINET IO diagnostic alarms, the SCALANCE W GSDML file can be inserted into HW Config as a PROFINET IO device.

2. Cybersecurity Hardening

• Use WPA2-Enterprise (IEEE 802.1X) with EAP-TLS certificate authentication; never use unencrypted or pre-shared key (PSK) Wi-Fi in process facilities.
• Create a dedicated VLAN for wireless traffic, isolated from physical wired terminal bus ports via an industrial firewall (e.g., SCALANCE S615).
• Enable iPCF (industrial Point Coordination Function) on SCALANCE W to achieve deterministic cyclic polling and ultra-fast roaming (< 50 ms).

PCS 7 Wireless Subsystem Release and Topology Matrix

The following table summarizes the release status, allowable traffic, and hardware recommendations for wireless in PCS 7:

Adhering to certified network topologies protects process plants from wireless-induced shutdowns.

Verification

To verify successful IWLAN integration on the Terminal Bus:
1. Connect a mobile SIMATIC tablet to the plant's dedicated industrial SSID via SCALANCE W.
2. Verify that the tablet acquires a valid Terminal Bus IP address from DHCP or static configuration.
3. Launch WinCCViewerRT or Internet Explorer WebNavigator; confirm that process pictures load smoothly without graphic lag.
4. Walk across the production plant: Confirm that roaming between SCALANCE W access points occurs seamlessly without dropping the WinCC runtime session.
5. In the SCALANCE W web-based management interface, verify that Signal-to-Noise Ratio (SNR) remains above 25 dB throughout operating zones.

Limitations and Operational Precautions

• Never attempt to connect an AS controller or remote I/O rack over standard office Wi-Fi routers; industrial electromagnetic compatibility (EMC) compliance is mandatory.
• Mobile clients must implement strict operator authentication and screen timeout locks to prevent unauthorized equipment operation from plant walkways.
• Conduct a comprehensive RF site survey before deploying access points to identify metal vessel shadowing and dead zones.
• Always validate final license quantities, module availability, and MLFBs against the applicable Siemens catalog and authorized distributor quotation.

Engineer FAQ

Can I use WirelessHART on the Plant Bus?

WirelessHART is an instrument-level fieldbus (IEC 62591) for sensors, not a controller bus. It connects to the plant through an IE/WSN-PA LINK gateway, which itself connects to the controller via wired Industrial Ethernet.

Why does roaming drop WinCC OS Client connections on standard Wi-Fi?

Standard commercial Wi-Fi can take 500 ms to 3 seconds to re-authenticate when roaming, exceeding WinCC TCP session keep-alive limits. Siemens SCALANCE W with iPCF completes roaming in under 50 ms, preserving active sessions.

Does SCALANCE W require additional runtime licenses in PCS 7?

SCALANCE W hardware includes base operational firmware. Advanced features like iPCF require an optional iFeatures KEY-PLUG (6GK5907-0PA00).

Technical References

• SIMATIC Process Control System PCS 7 Compendium Part A - Configuration Guidelines (Section 3.9)
• Siemens Industry Online Support Entry 44443744: Using Industrial Wireless LAN in SIMATIC PCS 7
• SCALANCE W780/W740 Operating Instructions

Related Articles

• Configuring Terminal Bus and Plant Bus Network Adapters in SIMATIC PCS 7
• How to Configure WirelessHART Field Instruments with SITRANS AW210 and IE-WSN-PA LINK in PCS 7
• Recommended Antivirus and Security Exclusions for SIMATIC WinCC Workstations

Related Tags

• IWLAN
• SCALANCE W
• Terminal Bus Wireless
• Plant Bus Restrictions
• Mobile Operator Clients