Configuring Remote HMI Control for KTP1000 Basic PN Panels
The first-generation Siemens KTP1000 Basic PN (catalog number 6AV6 647-0AE11-3AX0) is a 10.4-inch PROFINET HMI panel based on WinCC Basic. Unlike Comfort, Unified or WinCC Runtime Advanced devices, the Basic line ships without the Sm@rtServer option. When a water-treatment, building-services or process plant needs to monitor and operate the system from a remote location, the engineer must either add remote-access capability on the controller side or replace the panel with one that natively supports remote desktop. This reference details three production-grade paths, the network engineering for sub-200 m and longer PROFINET runs, the TIA Portal migration steps, and a verification matrix for commissioning.
1. Hardware Identification and Firmware Baseline
Before selecting a remote-control path, confirm the exact part numbers and firmware on site. Mixing up a first-generation Basic panel with a Basic 2nd Generation panel or a Comfort panel is a common source of integration errors.
| Component | Catalog Number | Firmware / Software | Sm@rtServer | Built-in Webserver |
|---|---|---|---|---|
| KTP1000 Basic PN (1st gen) | 6AV6 647-0AE11-3AX0 | WinCC Basic V13 / V14 / V15 / V16 | No | No |
| KTP1000 Basic PN (2nd gen) | 6AV2 123-1DB02-0AX0 | WinCC Basic V16 / V17 | No | Yes (read-only standard pages) |
| TP900 Comfort | 6AV2 124-1JC01-0AX0 | WinCC Comfort/Advanced V14+ | Yes | Yes |
| TP1200 Comfort | 6AV2 124-1MC01-0AX0 | WinCC Comfort/Advanced V14+ | Yes | Yes |
| CPU 1214C DC/DC/DC | 6ES7 214-1AG40-0XB0 | Firmware V4.2 / V4.3 / V4.4 / V4.5 / V4.6 | N/A | Yes (user pages) |
| CPU 1214C AC/DC/RLY | 6ES7 214-1BG40-0XB0 | Firmware V4.2 / V4.4 / V4.5 / V4.6 | N/A | Yes (user pages) |
Read the firmware level online in TIA Portal via Online > Accessible devices, or from the CPU display by navigating to PLC > Information. Update to at least V4.4 for stable user-defined web pages and TLS support; V4.6 is required for S7-1200 secure communication and HTTPS-only webserver operation.
2. Solution Architecture Options
Three production-grade paths exist. Choose based on operator usage patterns, the number of remote clients, network reach, and licensing.
| Path | Remote Client | Read/Write | License | Hardware Cost | Best Use |
|---|---|---|---|---|---|
| S7-1200 webserver with user-defined HTML pages | Any modern browser (PC, tablet, phone) | Read always; write optional via HTML forms | None (CPU feature) | $0 | Status monitoring, alarms, setpoint changes via password |
| Replace KTP1000 Basic PN with a Comfort Panel | TIA Portal Sm@rtClient or third-party VNC viewer | Full remote HMI mirror with operator input | Sm@rtServer option for Comfort Panels | $$ (panel replacement) | Operator-grade mirror with touch interaction |
| WinCC Advanced Runtime on a panel PC or industrial PC | Sm@rtClient on a second station | Full remote HMI mirror | WinCC Runtime Advanced license | $$$ (IPC + licence) | Large screens, multi-user, archival |
3. Option 1 - S7-1200 Webserver with User-Defined Pages
The S7-1200 CPU 1214C includes a built-in webserver that can serve standard diagnostic pages and engineer-authored HTML fragments. This is the lowest-cost, lowest-effort path. It does not require the Basic panel at all for remote viewing - the panel keeps its local operator role while the browser takes the remote role.
3.1 Enable the Webserver
- In the TIA Portal project tree, expand PLC_1 [CPU 1214C DC/DC/DC].
- Open Device configuration > Properties > Web server.
- Check Activate web server on this module.
- Check Permit access only with HTTPS for any production deployment; uncheck only for bench commissioning.
- Set Automatic update to 5 s for status pages, 0 s for alarm pages.
- Open CPU > Properties > Protection & Security > Web server and add a user. Assign the right Function right (read or read/write). For full read/write set "Read tag" + "Write tag".
Confirm by browsing to http://<CPU-IP>/index.html. The standard welcome page should appear. If a 404 is returned, the webserver is not yet started - power-cycle the CPU or perform an online STOP/RUN.
3.2 Author a User-Defined Page
User-defined pages live inside the TIA Portal project under PLC_1 > Webserver > User-defined pages. Add a new HTML file (for example overview.html). The CPU serves it as https://<CPU-IP>/overview.html. Variables are referenced with AWP (Automation Web Programming) commands.
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<title>Plant Overview</title>
<meta http-equiv="refresh" content="5">
<style>
body { font-family: Segoe UI, Arial, sans-serif; margin: 16px; }
table { border-collapse: collapse; width: 100%; max-width: 720px; }
td, th { border: 1px solid #888; padding: 6px 10px; text-align: left; }
.ok { color: #1b8a2a; font-weight: bold; }
.alarm{ color: #b3261e; font-weight: bold; }
</style>
</head>
<body>
<h2>Water Treatment - Remote Overview</h2>
<table>
<tr><th>Tag</th><th>Value</th><th>Unit</th></tr>
<tr><td>Raw water level</td>
<td><!-- AWP_In_Variable Name='"Level_Raw"' -->:=Level_Raw:</td>
<td>%</td></tr>
<tr><td>Pump 1 running</td>
<td><!-- AWP_In_Variable Name='"Pump1_Run"' -->:=Pump1_Run:</td>
<td>bool</td></tr>
<tr><td>Chlorine setpoint</td>
<td><!-- AWP_In_Variable Name='"Cl2_SP"' -->:=Cl2_SP:</td>
<td>ppm</td></tr>
</table>
<h3>Commands</h3>
<form method="POST" action="overview.html">
<label>Setpoint (ppm):</label>
<input name='"Cl2_SP"' type="number" step="0.01">
<input type="submit" value="Write">
</form>
</body>
</html>
<form method="POST"> submission will be rejected by the CPU. Create a dedicated operator user with read/write and a separate viewer user with read-only.
3.3 Reference Documentation
- Siemens Support entry 68011496 - "S7-1200 webserver user-defined pages" - support.industry.siemens.com/cs/ww/en/view/68011496.
- SIMATIC S7-1200 Programmable Controller System Manual, chapter "Webserver" - support.industry.siemens.com/cs/ww/en/view/109747167.
4. Option 2 - Upgrade the HMI to a Comfort Panel
When the remote operator must run a true mirror of the HMI - with full touch, alarm acknowledgement and recipe handling - replace the Basic panel with a Comfort panel that has the Sm@rtServer option enabled. The Comfort line supports remote access through the Sm@rtServer service and the Sm@rtClient viewer on a remote PC.
4.1 Direct Replacement
For minimal project change, pick a Comfort panel with the same screen size and resolution family. The TP1200 Comfort (12.1", 1280x800) and TP900 Comfort (9.0", 800x480) are direct upgrades for the KTP1000 Basic PN (10.4", 640x480).
| KTP1000 Basic PN (640x480) | TP900 Comfort (800x480) | TP1200 Comfort (1280x800) |
|---|---|---|
| 5.7" equivalents, 4:3, low-cost | 9.0", 16:10, single-touch resistive | 12.1", 16:10, capacitive multi-touch |
| WinCC Basic | WinCC Comfort / Advanced | WinCC Comfort / Advanced |
| No Sm@rtServer | Sm@rtServer (option) | Sm@rtServer (option) |
4.2 Enable Sm@rtServer on the Comfort Panel
- Open the panel project in TIA Portal. Open Device configuration > Properties > Sm@rtServer (only visible on Comfort/Advanced devices).
- Check Activate Sm@rtServer.
- Set the Sm@rtServer port (default 1024) and create an operator password.
- Configure the HMI's PROFINET interface in the same subnet as the CPU; both must be reachable.
- Compile the project and download to the panel.
- From the remote PC, start the Sm@rtClient viewer (Start > SIMATIC > WinCC Runtime Advanced > Sm@rtClient), enter the panel's IP and operator password.
For Unified Comfort Panels (15"+ multi-touch), the equivalent path is documented under Remote connection in the Unified Comfort Panel operating manual - docs.tia.siemens.cloud - Remote connection.
5. Option 3 - WinCC Advanced Runtime on a PC
For multi-client access, larger screen real estate, or 24/7 archival of operator actions, install WinCC Runtime Advanced on a panel PC (for example SIMATIC IPC227G or IPC677G) connected to the PROFINET segment. The PC then exposes the same HMI screens to remote Sm@rtClients.
5.1 Required Components
- WinCC Runtime Advanced V16 or V17 installer (matches the engineering TIA Portal version).
- WinCC Runtime Advanced licence (single station or power-pack).
- WinCC Sm@rtServer runtime licence (if the PC will serve remote clients).
- Activated Ethernet port bound to the PROFINET subnet. Disable firewall or open TCP 1024.
5.2 Project Transfer
- In TIA Portal, change the HMI device type from KTP1000 Basic PN to WinCC Runtime Advanced using right-click > Change Device.
- Adapt tag connections - WinCC Runtime Advanced communicates to the S7-1200 via S7 communication (PUT/GET or HMI connection).
- Compile, then transfer the runtime project to the IPC through Ethernet using Online > HMI device maintenance > Project transfer.
- On the IPC, configure the Sm@rtServer settings (Start > WinCC Runtime Advanced > Sm@rtServer Configuration).
6. PROFINET and Ethernet Distance Engineering
PROFINET runs on standard IEEE 802.3 Ethernet. Cable length and topology determine the choice of media.
| Segment | Maximum Length | Media | Typical Hardware |
|---|---|---|---|
| Copper twisted pair (Cat 5e / Cat 6 / Cat 7) | 100 m per segment | 2x2x AWG 24/1, RJ45 | Direct cable between CPU/HMI and SCALANCE switch |
| Fibre-optic multimode (POF / PCF) | 50 m (POF) / 100 m (PCF) | POF 980/1000 µm, SC-RJ | SCALANCE XC-200 with POF transceiver |
| Fibre-optic multimode (glass) | 5 km | 50/125 µm OM3, LC | SCALANCE XC-200/XR-300 with SFP |
| Fibre-optic singlemode (glass) | 40-100 km | 9/125 µm OS2, LC | SCALANCE XR-500 with LH SFP |
For a remote location at ~200 m:
- If the run is a single copper pull, 200 m exceeds the 100 m copper limit. Insert a SCALANCE X-100, X-200 or XB-200 managed switch at the 90 m mark, or replace the segment with a multimode fibre link using two media converters or SCALANCE switches with POF/PCF SFP transceivers.
- If fibre is not feasible and the run stays under 100 m, a single cable from the CPU/HMI to a remote switch is sufficient - no extra HMI device is required. The webserver or Sm@rtServer traffic rides on the same PROFINET network.
Reference: SIMATIC NET PROFINET Planning Guideline, chapter "Cabling and distance" - support.industry.siemens.com - PROFINET Planning.
7. Migrating the TIA Portal Project to a New HMI
When replacing the panel, follow this migration sequence to keep screens, tags and alarms intact.
- Back up the existing TIA Portal project and the active HMI runtime project (HMI backup via ProSave or the panel's Service concept).
- Change device type. Right-click the HMI in the project tree, choose Change Device > SIMATIC HMI > ... and pick the new panel. If the resolution is identical, TIA Portal preserves screen geometry.
- Enable screen resizing first. Before changing the device, open Options > Settings > Visualization > Resize Screen and select "Scale screen contents". This causes TIA Portal to scale all screen objects on the new resolution rather than anchor them to the top-left.
- Recompile the HMI project. Resolve any tag that turns red - these are typically references to functions or system screens that the new panel does not support (for example Basic to Comfort: Recipe view, Trend view and Alarm view are all present but their property set is wider; the migrated tag remains valid).
- Adapt the connection. Verify the HMI connection to the S7-1200 still resolves and the area pointer "Coordination" and "Date/Time" are bound.
- Download the new project to the panel, then commission in Online > Commissioning mode.
8. Security Hardening for Remote Access
Remote access introduces cyber exposure. Apply the following minimum controls on any production deployment.
- HTTPS only on the S7-1200 webserver (CPU firmware V4.2 and above). Disable the HTTP listener.
- User separation: distinct accounts for viewer (read), operator (read/write setpoints) and maintenance (read/write all + diagnostics). Do not use the Anonymous account.
- Password policy: 12+ characters, complexity, and 90-day rotation. CPU firmware V4.5+ enforces 30-character hashes.
- Network segmentation: place the CPU/HMI in a private VLAN, place remote clients in a separate VLAN, and route through a stateful firewall. Allow only TCP 443 (webserver) or TCP 1024 (Sm@rtServer) inbound.
- TLS certificates: install a CA-signed certificate on the CPU or generate a project-specific certificate through TIA Portal > CPU > Properties > Security > Certificates.
- Disable unused services: SNMP, SMTP, NTP if not used; disable PUT/GET on the S7-1200 unless the HMI requires it.
- Centralised logging: enable the CPU diagnostic buffer pull, forward to a syslog server for audit trail of remote setpoint changes.
Reference: SIMATIC S7-1200 Security Guidelines - support.industry.siemens.com - Security Guidelines.
9. Verification and Commissioning Checklist
| Check | Webserver | Comfort Panel Sm@rtServer | WinCC Runtime Advanced |
|---|---|---|---|
| CPU webserver page reachable from remote subnet | Yes - browse to https://<CPU-IP>/ | N/A | N/A |
| Sm@rtServer port (default 1024) responds | N/A | Yes - telnet <HMI-IP> 1024
|
Yes - telnet <IPC-IP> 1024
|
| User-defined tag read returns current value | Confirm via browser refresh | Confirm in Sm@rtClient | Confirm in Sm@rtClient |
| User-defined tag write updates CPU tag | Submit form, monitor tag in TIA Portal watch table | Operate on panel, monitor remote | Operate on remote, monitor on local |
| Automatic page refresh at 5 s interval | Visible change in browser | Visible change in client | Visible change in client |
| Session timeout enforced | CPU logoff after configured idle | Panel logoff after configured idle | Runtime logoff after configured idle |
| Firewall log shows only allowed traffic | TCP 443 only | TCP 1024 only | TCP 1024 only |
End-to-end latency should be measured from the remote client to the tag in the CPU. A healthy PROFINET network delivers <100 ms round-trip. Use wireshark or ping with 1 s interval for a five-minute sample; reject any sequence where jitter exceeds 50 ms.
10. Troubleshooting Matrix
| Symptom | Likely Cause | Action |
|---|---|---|
Browser returns 404 on /index.html
|
Webserver not started after CPU STOP/RUN | Power-cycle CPU, verify Activate web server in project |
AWP tag shows NaN or empty |
Tag not declared in Webserver > User-defined pages > Tag assignment | Add the tag to the assignment list, recompile, download |
| Form submit returns 403 Forbidden | User lacks write rights | Edit CPU > Protection & Security > Users, grant "Write tag" |
| Sm@rtClient reports "connection refused" | Sm@rtServer port blocked or wrong IP | Confirm port 1024/TCP open on firewall, ping HMI IP, restart panel |
| Sm@rtClient connects but screen is blank | Panel in transfer mode or wrong runtime project loaded | Start runtime on panel, set startup mode to Runtime in TIA Portal |
| PROFINET station drops at 200 m copper | Copper segment over 100 m | Insert SCALANCE switch at 90 m or replace with fibre |
| Tags not updating in browser | User-defined page refresh disabled | Set automatic update interval > 0 s in CPU webserver properties |
| Webserver reachable on local subnet only | Router ACL blocks inbound | Open TCP 443, NAT, and place CPU in DMZ behind VPN |
11. Recommended Path by Scenario
- Read-mostly status, no panel replacement budget: S7-1200 webserver with user-defined pages (Option 1).
- Operator-grade mirror, single remote client, existing cabinet space: Comfort Panel upgrade (Option 2).
- Multi-user, 24/7 access, large screens: WinCC Runtime Advanced on an industrial PC (Option 3).
For most water-treatment SCADA retrofits, Option 1 is sufficient when combined with a VPN (WireGuard or IPsec) and a small reverse proxy. Option 2 is selected when the operator must retain the same on-site touch experience while allowing off-site engineers to drive the screen during commissioning or incidents.
FAQ
Can the KTP1000 Basic PN be enabled with Sm@rtServer through a firmware update?
No. Sm@rtServer is a hardware/firmware-level feature of Comfort Panels and WinCC Runtime Advanced. The first-generation KTP1000 Basic PN does not expose the option in TIA Portal and no service pack or hotfix adds it. Replace the panel or use a controller-side path such as the S7-1200 webserver.
What is the maximum PROFINET cable length between the CPU 1214C and the HMI?
100 m for a copper twisted-pair segment. For 200 m, insert a managed switch such as SCALANCE X-200 at the 90 m midpoint, or use a multimode fibre pair with media converters / SCALANCE switches with POF/PCF SFPs.
Do user-defined web pages support writing setpoints back to the S7-1200?
Yes, when the page uses a POST form and the webserver user is granted the "Write tag" function right. AWP syntax <input name='"TagName"'> binds the field to a CPU tag and submits its current value on form post.
Which CPU 1214C firmware is required for HTTPS-only webserver?
Firmware V4.2 introduced HTTPS support. V4.4 or later is recommended for stable user-defined pages and security fixes. V4.6 is required for secure PG/PC and HMI communication over TLS 1.2/1.3.
How is a Comfort Panel configured for remote access on a different subnet?
Enable Sm@rtServer in TIA Portal under Device configuration > Properties > Sm@rtServer, set the port (default 1024) and password, assign an IP in the same subnet as the S7-1200, then route between the remote client subnet and the panel subnet through a managed switch or router. Confirm TCP 1024 is open end-to-end.