Configuring KTP1000 HMI Simulation with Real S7-300 PLC in TIA Portal

Engineers frequently need to develop, debug, and validate HMI screens for a Siemens KTP1000 (Basic Panel, second generation) before the physical panel arrives on site. With a real S7-300 CPU 314 wired to inputs and outputs, the WinCC Basic runtime in the TIA Portal can be started as a PC-based simulation and pointed at the physical controller instead of PLCSIM. This requires three coordinated configuration layers: the PG/PC interface on the engineering station, the S7ONLINE access point assigned to the bus interface, and the HMI connection defined inside the TIA project. Getting any one of those wrong is the most common cause of an "idle" simulation where the HMI starts but never updates tags.

1. Architecture and Communication Paths

A WinCC simulation running on the engineering PC communicates with the controller through the same software channel (SAPI-S7 / S7 communication) used by a real panel. The only difference is that the transport is handled by the PG/PC interface driver of the engineering PC, not by the panel's built-in Ethernet/PROFIBUS port.

Critical constraint: if the TIA project was created with a PROFINET HMI connection, the same bus must be used during simulation. WinCC will not auto-fallback from PROFINET to MPI. The error surface in this case is an idle HMI with no connection error in the diagnostics - the HMI simply does not cycle.

2. Prerequisites

2.1 Software

• SIMATIC STEP 7 Basic / Professional in TIA Portal V12 SP1 or later (V13, V14, V15 tested).
• WinCC Basic (Comfort/Advanced for larger panels) with the simulation option enabled. TIA V12 combo license activates both engineering and runtime simulation.
• For S7-300 targets: S7-PLCSIM V5.4 SP8 (or later V5.x patch) is used as the simulation backend. PLCSIM V13/V14/V15 integrated editions do not control an S7-300 - those versions target S7-1200/S7-1500 only.

2.2 Hardware

• Engineering PC with Windows 7 SP1 / Windows 10 (TIA V15.1 supports Win10 LTSC).
• Siemens PC Adapter USB (MPI/PROFIBUS) 6ES7972-0CB20-0XA0, or CP 5711 / CP 5621 PROFIBUS card, or on-board Ethernet port.
• SIMATIC S7-300 with CPU 314 (6ES7314-1AG14-0AB0) and PS 307 power supply.
• MPI cable (included with PC Adapter) or PROFIBUS cable with PROFIBUS connector (6ES7972-0BA12-0XA0) terminated at both ends.

2.3 Firmware / library state

• CPU 314 firmware V3.3 supports the full WinCC V13/V14/V15 tag set including 64-bit counters and string tags.
• KTP1000 Basic image version V11.0.2.0 or later is required for TIA V12 SP1 configuration. Older panel images may refuse to download a V12 project.

3. PG/PC Interface Configuration

The PG/PC interface dialog (Start > Control Panel > PG/PC Interface, or Start > Siemens Automation > PG/PC Interface) is the central registry of installed SIMATIC bus drivers. The S7ONLINE access point is a logical alias that points to one of those drivers; all engineering tools (STEP 7, WinCC, PLCSIM) resolve "S7ONLINE" to whichever physical interface the alias is currently bound to.

3.1 Set S7ONLINE to the right adapter

1. Open the PG/PC Interface applet.
2. For the Application Access Point "S7ONLINE", set the Interface Parameter Assignment to:
   • PC Adapter (MPI) - if the CPU 314 is connected via the PC Adapter USB cable on its MPI port.
   • PC Adapter (PROFIBUS) - if the CPU 314 is connected via PROFIBUS through a CP or the integrated DP port.
   • TCP/IP > Network card <your NIC> - if the S7-300 has a CP 343-1 or CPU 31x-2 PN/DP and the PC uses Ethernet.
3. Click Properties and set the bus parameters to match the PLC side:
   • MPI: Address 0 (master), Transmission rate 187.5 kbps, Highest station address 31.
   • PROFIBUS: Address 0, Transmission rate 1.5 Mbps (12 Mbps if cable is short and connectors are terminated correctly), Highest station address 126.
   • TCP/IP: S7-300 IP address (for example 192.168.0.1), subnet mask 255.255.255.0, router 0.0.0.0.
4. Do not select FW_LOAD for normal HMI simulation - that access point is reserved for firmware download to a CPU.

4. S7-300 Hardware Project Setup

1. In TIA Portal, open the project and add the SIMATIC S7-300 station.
2. Insert the actual rack: Rack 300, PS 307 5A, CPU 314 (6ES7314-1AG14-0AB0), and any I/O modules present physically.
3. For PROFIBUS connection: add a CP 342-5 in slot 4 and connect it to a PROFIBUS subnet. Assign PROFIBUS address 2 to the CPU's MPI/DP port if you use the integrated DP interface, or address 3 if a CP 342-5 is used.
4. For PROFINET connection: add a CP 343-1 (6GK7343-1EX30-0XE0) in slot 4, attach an Ethernet subnet, and assign an IP address (e.g. 192.168.0.1/24).
5. Compile the S7-300 station (Right-click station > Compile > Hardware and Software (rebuild all)). Download the hardware configuration to the CPU via the same S7ONLINE access point set in Section 3.

5. HMI Project Configuration

1. Add a KTP1000 Basic PN or KTP1000 Basic DP to the project, matching the physical part number:
   • 6AV6647-0AG11-3AX0 - KTP1000 Basic DP, mono, MPI/PROFIBUS.
   • 6AV6647-0AE11-3AX0 - KTP1000 Basic PN, mono, PROFINET.
2. In the HMI device configuration, Connections, edit the HMI connection:
   • Set the Communication driver to S7 300/400.
   • Set the Interface to match the bus configured on the CPU: PROFINET, PROFIBUS, or MPI.
   • Set the HMI device address to a free node on the subnet (for example PROFINET 192.168.0.10).
   • Set the PLC address to the CPU or CP address on that subnet (for example PROFINET 192.168.0.1).
3. Compile the HMI station.

6. Starting the HMI Simulation

1. Select the HMI station in the project tree.
2. Right-click and choose Start simulation (or press the F5/Start Runtime toolbar button). TIA Portal launches the WinCC Runtime in a window.
3. Watch the status bar: it should transition from Connecting to Connected within 2-5 seconds.
4. Force a tag change in the CPU using the watch table (Online > Watch & Force Tables) to confirm tag updates flow to the HMI.

7. PLCSIM Backend vs. Real PLC

PLCSIM is the simulated S7 CPU; it is not required for a real S7-300. The WinCC runtime always opens the S7ONLINE channel, and the bus driver hands the connection off to whichever access point is bound.

When you need to develop the HMI offline (no PLC on the desk) and the project still targets an S7-300, install S7-PLCSIM V5.4 SP8 (V15 of TIA Portal has been verified with that patch level) and bind S7ONLINE to the PLCSIM (PROFIBUS) or PLCSIM (MPI) interface. The same WinCC runtime starts; only the S7 backend is virtual.

8. Verification Procedure

1. Open the HMI simulation. Confirm the status bar shows Connected.
2. In STEP 7, open an online watch table on the CPU 314 and toggle a bit in the process image (e.g. I 0.0 or a flag M 10.0).
3. In the HMI screen, place a momentary pushbutton linked to a tag (e.g. DB1.DBX0.0). Activate the button with the mouse; the corresponding bit must toggle in the watch table.
4. Right-click the HMI runtime and choose Diagnostics > Connections. Verify the connection is Established with the correct PLC IP/address.
5. Cycle power on the CPU. The HMI must reconnect within 5-10 seconds and resume tag polling without restarting the simulation.

9. Troubleshooting Matrix

10. Field-Proven Tips

• Always keep the S7-300 CPU in RUN or RUN-P during simulation. A CPU in STOP accepts the connection but rejects all write requests, which looks like a tag-update problem.
• Disable the Windows firewall on the engineering PC for the PROFINET subnet, or open UDP port 34964 (S7 communication). A blocked port produces the same "Connecting" hang as an unplugged cable.
• If you switch from MPI to PROFINET, re-download the hardware configuration to the CPU. A partial download leaves the CPU with the old bus parameters and breaks the simulation.
• Use Online > Accessible Nodes in STEP 7 to confirm the PC can see the S7-300 before starting the HMI simulation. If STEP 7 cannot see the CPU, WinCC will not be able to either.
• Reserve a unique PROFINET device name for the simulated KTP1000; the engineering PC will appear on the network as an additional PROFINET node during simulation.
• For long development sessions, lock the engineering PC from sleep - most PC Adapter USB drivers do not survive a S3 suspend and require a USB re-enumeration.

11. Security and Operational Notes

The WinCC simulation is a development tool. It runs with the same privileges as the user account that started TIA Portal and is not a hardened runtime. Do not connect the engineering PC to a production PROFINET network while the HMI simulation is active - the simulated KTP1000 will advertise itself on the network and may write to real I/O. For commissioning on a live plant, transfer the project to the physical panel and use a dedicated commissioning laptop with the simulation feature disabled.

12. Quick Reference - Parameter Set

FAQ