Configuring CPU 1515-2 PN and KTP700 Basic PROFINET Communication

David Krause13 min read
SiemensTIA PortalTroubleshooting
Licensed PE Working through this on a live machine? A Maine-licensed engineer can take it from here — included with IMD hardware, by the hour for everything else. Book an engineer

Problem Overview

Field engineers routinely integrate SIMATIC HMI KTP700 Basic panels with S7-1500 CPUs over PROFINET, and the most common symptom of a misconfiguration is a panel that powers up, displays the loader/start screen, but never establishes a variable connection to the PLC. In the typical scenario, a CPU 1515-2 PN (article numbers 6ES7515-2AM01-0AB0 and successor 6ES7515-2AN03-0AB0) is used with its integrated two-port PROFINET switch on interface X1 to host both an ET 200SP distributed I/O station and a KTP700 Basic. The ET 200SP comes online and exchanges process data, but the HMI connection status remains red.

This article walks through the full bring-up sequence — from interface topology and IP plan, to TIA Portal device and connection configuration, to the online diagnostics an engineer runs when the panel refuses to talk. The procedure is independent of firmware revision but assumes the system is being commissioned in TIA Portal V16 or later (TIA V17/V18 recommended for current 6ES7515-2AN03-0AB0 hardware).

Hardware Identification and Interface Topology

The CPU 1515-2 PN manual describes two physically separate PROFINET interfaces on the front of the CPU:

Interface Ports Switch Typical Role
X1 (PROFINET IO, IRT capable) 2 (Port 1 + Port 2) Integrated 2-port switch Field level: ET 200SP, HMI panels, drives
X2 (PROFINET basic functionality) 1 None Plant/corporate network, routing, web server access

The two interfaces are logically and electrically separated. The X2 port cannot be used as a third port for the X1 switch, and the X1 switch cannot be split to extend the X2 network. If the second physical port on X1 is unused, the panel should be daisy-chained on X1 Port 2, or the X1 switch should be extended with an external managed switch (Scalance XC-100 or similar).

Recommended Topology

For a CPU 1515-2 PN that must host an ET 200SP and a KTP700 Basic, the supported topology is a linear daisy chain on X1:

CPU X1 Port 1 → ET 200SP Port 1 → ET 200SP Port 2 → KTP700 Basic

If a star topology is preferred, plug the ET 200SP and the KTP700 into a managed switch (Scalance XB-005, XC-100, or any third-party switch supporting PROFINET conformance class A or higher) and connect the switch to X1 Port 1 of the CPU. Avoid daisy-chaining more than two devices on the integrated switch; the internal switch fabric is rated for industrial use but adds latency and breaks the segment if one device powers down.

Note: The X2 interface is unsuitable for hosting the KTP700 Basic in this topology. The basic HMI requires a connection to the same PROFINET subnet as the PLC program that holds the tags. Routing across the X1↔X2 boundary requires an inter-network routing table inside the CPU and is not supported by the KTP700 Basic configuration tool.

Prerequisites

  1. Hardware on hand: CPU 1515-2 PN with firmware ≥ V2.0, KTP700 Basic (6AV2123-2GB03-0AX0 or current revision), one or more ET 200SP stations, PROFINET patch cables (Cat 5e or higher, industrial grade).
  2. Software: TIA Portal V16+ with the matching HSP (Hardware Support Package) for the CPU and the KTP700 Basic HMI HSP. The KTP700 Basic is supported natively as of TIA V13 SP1; verify the project is targeting the correct HMI image version.
  3. Firmware: Confirm the panel firmware and TIA Portal HSP revision. KTP700 Basic with a 7" display supports PROFINET from firmware V14.0.0.0 onward.
  4. Network plan: A documented IP address, subnet mask, and PROFINET device name list for every node in the X1 subnet.

IP Addressing and Subnet Plan

Every PROFINET device on the X1 subnet must share a single IP subnet. The default address of the CPU's X1 interface is 192.168.0.1 / 255.255.255.0. The ET 200SP and the KTP700 Basic must be on the same subnet — typically 192.168.0.x / 255.255.255.0 — with a router address pointing back to the CPU if any inter-VLAN traffic is required.

Device PROFINET Name IP Address Subnet Mask Router
CPU 1515-2 PN (X1) plc1500 192.168.0.1 255.255.255.0 192.168.0.1
ET 200SP head et200sp-1 192.168.0.10 255.255.255.0 192.168.0.1
KTP700 Basic ktp700-1 192.168.0.20 255.255.255.0 192.168.0.1
PG/Engineering station pg-pc 192.168.0.100 255.255.255.0 192.168.0.1

The PROFINET device name is mandatory. PROFINET IO uses the name — not the IP address — to identify devices during AR (Application Relationship) establishment. If the panel has a name assigned at the factory or from a previous project, the IO controller will reject it with the diagnostic message "Device name incorrect" or "DCP identify".

TIA Portal Device Configuration

Step 1 — Add the CPU to the project

Open the project in TIA Portal. In the project tree, navigate to Devices & Networks → Add new device → Controllers → SIMATIC S7-1500 → CPU → CPU 1515-2 PN. Select the exact article number visible on the front of the module:

  • 6ES7515-2AM01-0AB0 (work memory 500 KB code / 3 MB data)
  • 6ES7515-2AN03-0AB0 (successor, work memory 500 KB code / 3 MB data, firmware V2.9+)

Confirm the firmware version matches the actual module by reading the online diagnostic in Online → Accessible devices.

Step 2 — Configure the X1 PROFINET interface

Open the device view, select the CPU, and switch to the Properties → PROFINET interface [X1] tab. Apply the values from the table above:

  • IP address: 192.168.0.1
  • Subnet mask: 255.255.255.0
  • Use router: enabled, 192.168.0.1
  • PROFINET device name: plc1500

Under Advanced options → Port [X1 P1] and Port [X1 P2], set the transmission mode to Automatic (default) and check the diagnostics boxes for "Cable break" and "Port statistics".

Step 3 — Add the ET 200SP

Drag the ET 200SP head module (for example, IM 155-6 PN ST, 6ES7155-6AU01-0BN0) from the hardware catalog into the network view. Connect its PROFINET port to the CPU's X1 Port 1. Assign IP 192.168.0.10 and PROFINET name et200sp-1.

Step 4 — Add the KTP700 Basic

Drag the KTP700 Basic (6AV2123-2GB03-0AX0) into the network view. Connect its PROFINET port to the CPU's X1 Port 2 (or to a Scalance switch attached to X1 Port 1). Assign:

  • IP address: 192.168.0.20
  • Subnet mask: 255.255.255.0
  • PROFINET device name: ktp700-1
Note: The PROFINET device name on the HMI must match exactly. Names are case-sensitive. A common error is leaving the default "hmirt" or copying a name with a trailing space.

HMI Connection Configuration

Open the KTP700 Basic device view. Under Connections, double-click the default connection to open the properties dialog. Verify:

Parameter Value
Communication driver SIMATIC S7 1500
Station PLC_1 (or matching CPU name in the project)
Slot 1 (CPU 1500)
Connection type PN/IE
Interface PROFINET (corresponds to X1)
Address 192.168.0.1
Access password / Slot password (leave empty unless a protection level is configured)

Compile the HMI project (Right-click → Compile → Software (rebuild all)) and download the configuration to the panel. Use WinCC's "Extended download to target device" with the PROFINET/ethernet interface selected.

Assigning the PROFINET Device Name to the Panel

Even if the IP and name are correct in TIA Portal, the panel may still be running a name assigned by a previous project or by the factory. The PLC can only establish an AR to a device whose name matches. Use the following procedure to assign the name:

  1. In TIA Portal, right-click the CPU in the network view and choose Assign PROFINET device name.
  2. In the dialog, set the PG/PC interface to the same PROFINET adapter you use to reach X1.
  3. Select the target device from the discovered list. The MAC address is printed on the rear of the KTP700 Basic.
  4. Set the name ktp700-1 and the IP 192.168.0.20 and click Assign name.
Note: The KTP700 Basic also accepts the device name from the Control Panel (Network & Dial-up Connections → PN-XX1 → Properties → PROFINET) but the engineering workflow above is the recommended path.

Physical Connection Verification

Before chasing software configuration, prove the physical layer. With the CPU, ET 200SP, and KTP700 Basic all powered, look at the link LEDs:

LED State Meaning
CPU X1 Port 1 / Port 2 LINK Solid green Ethernet link up, 100 Mbps
ET 200SP Port 1 / Port 2 LINK Solid green Ethernet link up, 100 Mbps
KTP700 Basic X1 LINK Solid green Ethernet link up, 100 Mbps
CPU X1 RX/TX Flashing yellow Traffic on the wire

If the link LED on the panel is dark, replace the patch cable. Industrial PROFINET cables fail most often at the M12 or RJ45 crimp, not in the bulk. Confirm the cable length is under 100 m, and that the cable is Cat 5e STP (shielded) with the shield bonded at the panel side per the wiring guide.

Online Diagnostics

CPU Diagnostic Buffer

Connect to the CPU online and open Online & Diagnostics → Diagnostics buffer. The buffer records every PROFINET AR failure with an event ID and timestamp. The following events are common with a panel that fails to connect:

Event ID Text Likely Cause
0x001E Station failure Device not reachable on the wire (cable, switch port, power)
0x001F Station return Device came back; useful for confirmation
0x002A PROFINET IO: Name of station differs PROFINET name on the device does not match the project
0x002B PROFINET IO: IP parameter mismatch IP address on the device does not match the project
0x0033 PROFINET IO: Device is not accessible AR establishment failed; check DCP discovery

Accessible Nodes

From TIA Portal, run Online → Accessible devices with the PG/PC interface pointed at the X1 PROFINET subnet. The panel's MAC address, IP, and PROFINET name appear in the list. If the panel is missing entirely, the problem is physical (cable, switch port, power). If the panel appears with the wrong name or IP, the project configuration and the runtime configuration are out of sync — re-assign the name as described in the previous section.

HMI Runtime Connection Status

On the KTP700 Basic, the connection status is shown in the runtime footer (yellow = connecting, green = connected, red = no connection). Tap the connection indicator to open the Channel Diagnosis dialog. The dialog reports the last error, for example:

  • HMIConn: 0x80072EE2 — connection partner not found; verify IP/name on the PLC side
  • HMIConn: 0x80004005 — generic IO error; check slot/connection parameters
  • HMIConn: 0x00000000 — no active connection yet; wait for full PLC startup

Common Faults and Resolutions

Symptom Root Cause Resolution
ET 200SP online, panel offline PROFINET name on the panel does not match the project Use "Assign PROFINET device name" to set ktp700-1
Both devices offline PG/PC on the wrong subnet, or X1 port disabled in the CPU properties Verify the PG/PC is in 192.168.0.x/24 and X1 is enabled
Panel shows IP 0.0.0.0 Panel booted with no name → no DCP IP assignment Assign the name first, then re-assign IP via TIA
Compile error "HMI connection: target CPU not unique" Multiple CPUs in the project with the same station name Rename the CPU station to a unique value
Panel starts, red connection dot, error 0x80072EE2 CPU protection level (access) blocks the HMI connection Open the CPU properties → Protection & Security, set a connection password or open access
Panel connects briefly, drops every 30 s Watchdog time mismatch Match the HMI update cycle to the CPU scan; default 1 s is safe
TIA online accessible nodes shows only the CPU KTP700 Basic on X2 instead of X1; X2 is not in the discovery path Reconnect the panel to X1 Port 2 or to a switch on X1

Verification Procedure

  1. Power-cycle the KTP700 Basic after downloading the project. The connection status in the HMI footer should change from yellow to green within 30 seconds of the CPU reaching RUN.
  2. Open a tag on the panel (for example, a status display bound to %MW0). Force a value from the PLC's watch table and confirm the value updates on the screen.
  3. From the PLC online, navigate to Devices & Networks → Network view → Topology view. All three devices should show the green "connected" indicator with their assigned names.
  4. Trigger a panel button and observe the corresponding tag in the PLC's watch table flipping value.
  5. Open the CPU's diagnostic buffer and confirm no new "Station failure" events have been logged since commissioning.

Advanced Notes

Using the X2 Interface

If the panel must be located on the plant network (X2), the CPU can act as a PROFINET router, but the KTP700 Basic configuration must be set to "PN/IE" with a routing entry. In practice, the engineering overhead and the lack of PROFINET performance on X2 make this configuration undesirable. Keep the panel on X1 with the field I/O.

MRP / Redundancy

If the network uses Media Redundancy Protocol (MRP) on X1, the KTP700 Basic is not an MRP-capable device and must be connected as a non-MRP node (a normal participant on the ring). Add it to the MRP domain as a "non-MRP device" or use an external switch in the ring to break the redundancy for the panel segment.

Security and Access Levels

When the CPU has the Full access (no protection) setting, the HMI connects without authentication. With Read access or higher, the HMI connection is rejected and the panel shows connection error 0x80072EE7. Either open access for the commissioning phase or assign a connection password in the CPU protection settings and enter the same password in the HMI connection properties.

Replacing a Panel

When replacing a defective KTP700 Basic with a new one of the same article number, the new device has a different MAC and PROFINET name. The PLC will report a "Station failure" until the new panel receives the correct PROFINET name and IP. Use Online → Accessible devices → Assign PROFINET device name to push the saved project configuration onto the replacement.

Commissioning Checklist

  • [ ] Article number on the CPU matches the TIA Portal project (6ES7515-2AM01-0AB0 or 6ES7515-2AN03-0AB0).
  • [ ] X1 enabled; X2 optional, on a different subnet.
  • [ ] All devices on X1 share the 192.168.0.0/24 subnet.
  • [ ] PROFINET device name on the panel matches the project (ktp700-1).
  • [ ] HMI connection in TIA Portal uses the S7-1500 driver and points to the correct CPU slot.
  • [ ] PG/PC is in the same subnet during commissioning.
  • [ ] Diagnostic buffer free of 0x001E/0x002A/0x002B events after a 5-minute burn-in.
  • [ ] Connection status indicator on the panel is green.

Why does the ET 200SP come online but the KTP700 Basic does not?

PROFINET device name mismatch is the most frequent cause. The PLC establishes an AR with the ET 200SP because its name matches, but the panel still carries the factory or a previous project name. Use Online → Accessible devices → Assign PROFINET device name to push the project name ktp700-1 to the panel, then re-assign IP 192.168.0.20.

Can I connect the KTP700 Basic to the X2 interface of the CPU 1515-2 PN?

Technically yes, but TIA Portal routes the HMI connection through the X1↔X2 boundary and the configuration becomes brittle. The recommended topology is to keep the panel and the ET 200SP on the X1 two-port switch (or on a managed switch off X1 Port 1) so that all field-level devices share the same PROFINET subnet.

What is the default IP address of the CPU 1515-2 PN on X1?

Out of the box the X1 interface has no IP. The first time the CPU is commissioned, TIA Portal assigns the project IP (192.168.0.1 / 255.255.255.0 in the example above). The default fallback address for emergency access via the display is documented in the CPU manual.

Which TIA Portal version supports the current CPU 1515-2 PN (6ES7515-2AN03-0AB0)?

TIA Portal V17 Update 4 or later is required for the 6ES7515-2AN03-0AB0 successor. The predecessor 6ES7515-2AM01-0AB0 is supported from TIA V16. Confirm the HSP for the panel is also installed to recognize the current KTP700 Basic image.

The panel boots but the connection dot stays red; what diagnostic should I run first?

Open TIA Portal Online → Accessible devices on the X1 subnet. If the panel is missing, the fault is physical (cable, switch, power). If the panel is present with the wrong name or IP, re-assign the device name and IP. Only after both checks pass should you proceed to the diagnostic buffer for the CPU event ID and to the HMI channel diagnosis for the runtime error code.

Back to blog