Problem Overview
Field engineers routinely integrate SIMATIC HMI KTP700 Basic panels with S7-1500 CPUs over PROFINET, and the most common symptom of a misconfiguration is a panel that powers up, displays the loader/start screen, but never establishes a variable connection to the PLC. In the typical scenario, a CPU 1515-2 PN (article numbers 6ES7515-2AM01-0AB0 and successor 6ES7515-2AN03-0AB0) is used with its integrated two-port PROFINET switch on interface X1 to host both an ET 200SP distributed I/O station and a KTP700 Basic. The ET 200SP comes online and exchanges process data, but the HMI connection status remains red.
This article walks through the full bring-up sequence — from interface topology and IP plan, to TIA Portal device and connection configuration, to the online diagnostics an engineer runs when the panel refuses to talk. The procedure is independent of firmware revision but assumes the system is being commissioned in TIA Portal V16 or later (TIA V17/V18 recommended for current 6ES7515-2AN03-0AB0 hardware).
Hardware Identification and Interface Topology
The CPU 1515-2 PN manual describes two physically separate PROFINET interfaces on the front of the CPU:
| Interface | Ports | Switch | Typical Role |
|---|---|---|---|
| X1 (PROFINET IO, IRT capable) | 2 (Port 1 + Port 2) | Integrated 2-port switch | Field level: ET 200SP, HMI panels, drives |
| X2 (PROFINET basic functionality) | 1 | None | Plant/corporate network, routing, web server access |
The two interfaces are logically and electrically separated. The X2 port cannot be used as a third port for the X1 switch, and the X1 switch cannot be split to extend the X2 network. If the second physical port on X1 is unused, the panel should be daisy-chained on X1 Port 2, or the X1 switch should be extended with an external managed switch (Scalance XC-100 or similar).
Recommended Topology
For a CPU 1515-2 PN that must host an ET 200SP and a KTP700 Basic, the supported topology is a linear daisy chain on X1:
CPU X1 Port 1 → ET 200SP Port 1 → ET 200SP Port 2 → KTP700 Basic
If a star topology is preferred, plug the ET 200SP and the KTP700 into a managed switch (Scalance XB-005, XC-100, or any third-party switch supporting PROFINET conformance class A or higher) and connect the switch to X1 Port 1 of the CPU. Avoid daisy-chaining more than two devices on the integrated switch; the internal switch fabric is rated for industrial use but adds latency and breaks the segment if one device powers down.
Prerequisites
- Hardware on hand: CPU 1515-2 PN with firmware ≥ V2.0, KTP700 Basic (6AV2123-2GB03-0AX0 or current revision), one or more ET 200SP stations, PROFINET patch cables (Cat 5e or higher, industrial grade).
- Software: TIA Portal V16+ with the matching HSP (Hardware Support Package) for the CPU and the KTP700 Basic HMI HSP. The KTP700 Basic is supported natively as of TIA V13 SP1; verify the project is targeting the correct HMI image version.
- Firmware: Confirm the panel firmware and TIA Portal HSP revision. KTP700 Basic with a 7" display supports PROFINET from firmware V14.0.0.0 onward.
- Network plan: A documented IP address, subnet mask, and PROFINET device name list for every node in the X1 subnet.
IP Addressing and Subnet Plan
Every PROFINET device on the X1 subnet must share a single IP subnet. The default address of the CPU's X1 interface is 192.168.0.1 / 255.255.255.0. The ET 200SP and the KTP700 Basic must be on the same subnet — typically 192.168.0.x / 255.255.255.0 — with a router address pointing back to the CPU if any inter-VLAN traffic is required.
| Device | PROFINET Name | IP Address | Subnet Mask | Router |
|---|---|---|---|---|
| CPU 1515-2 PN (X1) | plc1500 | 192.168.0.1 | 255.255.255.0 | 192.168.0.1 |
| ET 200SP head | et200sp-1 | 192.168.0.10 | 255.255.255.0 | 192.168.0.1 |
| KTP700 Basic | ktp700-1 | 192.168.0.20 | 255.255.255.0 | 192.168.0.1 |
| PG/Engineering station | pg-pc | 192.168.0.100 | 255.255.255.0 | 192.168.0.1 |
The PROFINET device name is mandatory. PROFINET IO uses the name — not the IP address — to identify devices during AR (Application Relationship) establishment. If the panel has a name assigned at the factory or from a previous project, the IO controller will reject it with the diagnostic message "Device name incorrect" or "DCP identify".
TIA Portal Device Configuration
Step 1 — Add the CPU to the project
Open the project in TIA Portal. In the project tree, navigate to Devices & Networks → Add new device → Controllers → SIMATIC S7-1500 → CPU → CPU 1515-2 PN. Select the exact article number visible on the front of the module:
- 6ES7515-2AM01-0AB0 (work memory 500 KB code / 3 MB data)
- 6ES7515-2AN03-0AB0 (successor, work memory 500 KB code / 3 MB data, firmware V2.9+)
Confirm the firmware version matches the actual module by reading the online diagnostic in Online → Accessible devices.
Step 2 — Configure the X1 PROFINET interface
Open the device view, select the CPU, and switch to the Properties → PROFINET interface [X1] tab. Apply the values from the table above:
- IP address: 192.168.0.1
- Subnet mask: 255.255.255.0
- Use router: enabled, 192.168.0.1
- PROFINET device name:
plc1500
Under Advanced options → Port [X1 P1] and Port [X1 P2], set the transmission mode to Automatic (default) and check the diagnostics boxes for "Cable break" and "Port statistics".
Step 3 — Add the ET 200SP
Drag the ET 200SP head module (for example, IM 155-6 PN ST, 6ES7155-6AU01-0BN0) from the hardware catalog into the network view. Connect its PROFINET port to the CPU's X1 Port 1. Assign IP 192.168.0.10 and PROFINET name et200sp-1.
Step 4 — Add the KTP700 Basic
Drag the KTP700 Basic (6AV2123-2GB03-0AX0) into the network view. Connect its PROFINET port to the CPU's X1 Port 2 (or to a Scalance switch attached to X1 Port 1). Assign:
- IP address: 192.168.0.20
- Subnet mask: 255.255.255.0
- PROFINET device name:
ktp700-1
HMI Connection Configuration
Open the KTP700 Basic device view. Under Connections, double-click the default connection to open the properties dialog. Verify:
| Parameter | Value |
|---|---|
| Communication driver | SIMATIC S7 1500 |
| Station | PLC_1 (or matching CPU name in the project) |
| Slot | 1 (CPU 1500) |
| Connection type | PN/IE |
| Interface | PROFINET (corresponds to X1) |
| Address | 192.168.0.1 |
| Access password / Slot password | (leave empty unless a protection level is configured) |
Compile the HMI project (Right-click → Compile → Software (rebuild all)) and download the configuration to the panel. Use WinCC's "Extended download to target device" with the PROFINET/ethernet interface selected.
Assigning the PROFINET Device Name to the Panel
Even if the IP and name are correct in TIA Portal, the panel may still be running a name assigned by a previous project or by the factory. The PLC can only establish an AR to a device whose name matches. Use the following procedure to assign the name:
- In TIA Portal, right-click the CPU in the network view and choose Assign PROFINET device name.
- In the dialog, set the PG/PC interface to the same PROFINET adapter you use to reach X1.
- Select the target device from the discovered list. The MAC address is printed on the rear of the KTP700 Basic.
- Set the name
ktp700-1and the IP192.168.0.20and click Assign name.
Physical Connection Verification
Before chasing software configuration, prove the physical layer. With the CPU, ET 200SP, and KTP700 Basic all powered, look at the link LEDs:
| LED | State | Meaning |
|---|---|---|
| CPU X1 Port 1 / Port 2 LINK | Solid green | Ethernet link up, 100 Mbps |
| ET 200SP Port 1 / Port 2 LINK | Solid green | Ethernet link up, 100 Mbps |
| KTP700 Basic X1 LINK | Solid green | Ethernet link up, 100 Mbps |
| CPU X1 RX/TX | Flashing yellow | Traffic on the wire |
If the link LED on the panel is dark, replace the patch cable. Industrial PROFINET cables fail most often at the M12 or RJ45 crimp, not in the bulk. Confirm the cable length is under 100 m, and that the cable is Cat 5e STP (shielded) with the shield bonded at the panel side per the wiring guide.
Online Diagnostics
CPU Diagnostic Buffer
Connect to the CPU online and open Online & Diagnostics → Diagnostics buffer. The buffer records every PROFINET AR failure with an event ID and timestamp. The following events are common with a panel that fails to connect:
| Event ID | Text | Likely Cause |
|---|---|---|
| 0x001E | Station failure | Device not reachable on the wire (cable, switch port, power) |
| 0x001F | Station return | Device came back; useful for confirmation |
| 0x002A | PROFINET IO: Name of station differs | PROFINET name on the device does not match the project |
| 0x002B | PROFINET IO: IP parameter mismatch | IP address on the device does not match the project |
| 0x0033 | PROFINET IO: Device is not accessible | AR establishment failed; check DCP discovery |
Accessible Nodes
From TIA Portal, run Online → Accessible devices with the PG/PC interface pointed at the X1 PROFINET subnet. The panel's MAC address, IP, and PROFINET name appear in the list. If the panel is missing entirely, the problem is physical (cable, switch port, power). If the panel appears with the wrong name or IP, the project configuration and the runtime configuration are out of sync — re-assign the name as described in the previous section.
HMI Runtime Connection Status
On the KTP700 Basic, the connection status is shown in the runtime footer (yellow = connecting, green = connected, red = no connection). Tap the connection indicator to open the Channel Diagnosis dialog. The dialog reports the last error, for example:
-
HMIConn: 0x80072EE2— connection partner not found; verify IP/name on the PLC side -
HMIConn: 0x80004005— generic IO error; check slot/connection parameters -
HMIConn: 0x00000000— no active connection yet; wait for full PLC startup
Common Faults and Resolutions
| Symptom | Root Cause | Resolution |
|---|---|---|
| ET 200SP online, panel offline | PROFINET name on the panel does not match the project | Use "Assign PROFINET device name" to set ktp700-1
|
| Both devices offline | PG/PC on the wrong subnet, or X1 port disabled in the CPU properties | Verify the PG/PC is in 192.168.0.x/24 and X1 is enabled |
| Panel shows IP 0.0.0.0 | Panel booted with no name → no DCP IP assignment | Assign the name first, then re-assign IP via TIA |
| Compile error "HMI connection: target CPU not unique" | Multiple CPUs in the project with the same station name | Rename the CPU station to a unique value |
| Panel starts, red connection dot, error 0x80072EE2 | CPU protection level (access) blocks the HMI connection | Open the CPU properties → Protection & Security, set a connection password or open access |
| Panel connects briefly, drops every 30 s | Watchdog time mismatch | Match the HMI update cycle to the CPU scan; default 1 s is safe |
| TIA online accessible nodes shows only the CPU | KTP700 Basic on X2 instead of X1; X2 is not in the discovery path | Reconnect the panel to X1 Port 2 or to a switch on X1 |
Verification Procedure
- Power-cycle the KTP700 Basic after downloading the project. The connection status in the HMI footer should change from yellow to green within 30 seconds of the CPU reaching RUN.
- Open a tag on the panel (for example, a status display bound to
%MW0). Force a value from the PLC's watch table and confirm the value updates on the screen. - From the PLC online, navigate to Devices & Networks → Network view → Topology view. All three devices should show the green "connected" indicator with their assigned names.
- Trigger a panel button and observe the corresponding tag in the PLC's watch table flipping value.
- Open the CPU's diagnostic buffer and confirm no new "Station failure" events have been logged since commissioning.
Advanced Notes
Using the X2 Interface
If the panel must be located on the plant network (X2), the CPU can act as a PROFINET router, but the KTP700 Basic configuration must be set to "PN/IE" with a routing entry. In practice, the engineering overhead and the lack of PROFINET performance on X2 make this configuration undesirable. Keep the panel on X1 with the field I/O.
MRP / Redundancy
If the network uses Media Redundancy Protocol (MRP) on X1, the KTP700 Basic is not an MRP-capable device and must be connected as a non-MRP node (a normal participant on the ring). Add it to the MRP domain as a "non-MRP device" or use an external switch in the ring to break the redundancy for the panel segment.
Security and Access Levels
When the CPU has the Full access (no protection) setting, the HMI connects without authentication. With Read access or higher, the HMI connection is rejected and the panel shows connection error 0x80072EE7. Either open access for the commissioning phase or assign a connection password in the CPU protection settings and enter the same password in the HMI connection properties.
Replacing a Panel
When replacing a defective KTP700 Basic with a new one of the same article number, the new device has a different MAC and PROFINET name. The PLC will report a "Station failure" until the new panel receives the correct PROFINET name and IP. Use Online → Accessible devices → Assign PROFINET device name to push the saved project configuration onto the replacement.
Commissioning Checklist
- [ ] Article number on the CPU matches the TIA Portal project (6ES7515-2AM01-0AB0 or 6ES7515-2AN03-0AB0).
- [ ] X1 enabled; X2 optional, on a different subnet.
- [ ] All devices on X1 share the
192.168.0.0/24subnet. - [ ] PROFINET device name on the panel matches the project (
ktp700-1). - [ ] HMI connection in TIA Portal uses the S7-1500 driver and points to the correct CPU slot.
- [ ] PG/PC is in the same subnet during commissioning.
- [ ] Diagnostic buffer free of 0x001E/0x002A/0x002B events after a 5-minute burn-in.
- [ ] Connection status indicator on the panel is green.
Why does the ET 200SP come online but the KTP700 Basic does not?
PROFINET device name mismatch is the most frequent cause. The PLC establishes an AR with the ET 200SP because its name matches, but the panel still carries the factory or a previous project name. Use Online → Accessible devices → Assign PROFINET device name to push the project name ktp700-1 to the panel, then re-assign IP 192.168.0.20.
Can I connect the KTP700 Basic to the X2 interface of the CPU 1515-2 PN?
Technically yes, but TIA Portal routes the HMI connection through the X1↔X2 boundary and the configuration becomes brittle. The recommended topology is to keep the panel and the ET 200SP on the X1 two-port switch (or on a managed switch off X1 Port 1) so that all field-level devices share the same PROFINET subnet.
What is the default IP address of the CPU 1515-2 PN on X1?
Out of the box the X1 interface has no IP. The first time the CPU is commissioned, TIA Portal assigns the project IP (192.168.0.1 / 255.255.255.0 in the example above). The default fallback address for emergency access via the display is documented in the CPU manual.
Which TIA Portal version supports the current CPU 1515-2 PN (6ES7515-2AN03-0AB0)?
TIA Portal V17 Update 4 or later is required for the 6ES7515-2AN03-0AB0 successor. The predecessor 6ES7515-2AM01-0AB0 is supported from TIA V16. Confirm the HSP for the panel is also installed to recognize the current KTP700 Basic image.
The panel boots but the connection dot stays red; what diagnostic should I run first?
Open TIA Portal Online → Accessible devices on the X1 subnet. If the panel is missing, the fault is physical (cable, switch, power). If the panel is present with the wrong name or IP, re-assign the device name and IP. Only after both checks pass should you proceed to the diagnostic buffer for the CPU event ID and to the HMI channel diagnosis for the runtime error code.