Configuring S7-1500 to KTP1200 HMI Communication Across TIA

Overview

Engineers frequently inherit a legacy SIMATIC S7-1500 CPU program that was created in an older TIA Portal version while the HMI side has already moved to a newer release. A common field configuration is an S7-1513-1 PN (6ES7 513-1AM02-0AB0) programmed in TIA Portal V15.1 paired with a KTP1200 Basic 2nd-generation panel (6AV2 123-2MA03-0AX0) configured in TIA Portal V17. The two devices live in two independent TIA projects, and the question is whether the HMI can still poll process tags from the CPU without merging the projects.

The short answer is yes. TIA Portal supports three practical paths to make this work:

1. Device Proxy / HMI device proxy – keep two projects, insert a proxy of the S7-1500 into the HMI project.
2. Absolute addressing only – drop HMI tags with raw I/O, DB, and Merker addresses; no project integration required.
3. Project migration – upgrade the PLC project to TIA V17 and combine both devices into a single project.

Because the S7-1500 is a symbolic-IO controller, symbolic access is the preferred runtime mode, which means Option 1 or Option 3 should be evaluated first. Absolute addressing works, but it removes symbolic naming, online tag diagnosis, and PLC type checks from the HMI side.

Prerequisites

Understanding the Mixed-Version Topology

The physical layer does not change with the TIA version – the S7-1500 and the KTP1200 still speak standard S7 communication over PROFINET (TCP/UDP, ISO-on-TCP port 102). What changes is the engineering representation:

• The CPU's symbol table, DB structures, and PLC tags live in the V15.1 project.
• The HMI tags, screens, and alarms live in the V17 project.
• The binding between them is created at compile/download time of the HMI project, either through a proxy of the CPU or through hand-typed absolute addresses.

Inline diagram – logical view of the two projects:

Option 1 – HMI Device Proxy (Recommended for S7-1500)

A device proxy is a placeholder of the CPU inserted into the HMI project. The proxy holds the type, firmware version, connection parameters, and the PLC tag name space. It lets WinCC TIA Portal compile and download fully symbolic HMI tags without ever opening the original PLC source.

1. Export the PLC station from the V15.1 project: in the project tree, right-click the S7-1513-1 device → Export device to TIA Portal Exchange Format (.tie file). The export contains the device description, PLC tag table, and DB interfaces.
2. Open the HMI project in TIA V17. In the project tree, choose Devices & Networks → Add new device → Siemens → PLC → SIMATIC S7-1500 → CPU 1513-1 PN and select "Create device proxy".
3. Import the .tie file you exported in step 1. The proxy is added to the HMI project and recognized by the HMI as a valid S7 partner.
4. Drag a new HMI connection from the KTP1200 to the proxy CPU. The connection uses the CPU's PROFINET interface and IP address (e.g., 192.168.0.10). WinCC will default to S7ONLINE as the access point.
5. Open the proxy's PLC tag table. All symbolic tags from the V15.1 project are present, including their data types. Build your HMI tags by referencing the proxy's symbolic names – no manual address entry is needed.
6. Compile the HMI project (Right-click KTP1200 → Compile → Software (all)) and download to the panel.

Option 2 – Absolute Addressing (No Project Integration)

When you cannot or do not want to share a TIA Exchange file, the HMI can be pointed directly at raw addresses. WinCC resolves the symbolic DB names at runtime through the S7 connection, but the engineering side loses symbolic validation.

1. In the HMI project, open Devices & Networks and add a new S7 connection to the KTP1200. Set Partner (PLC) IP = 192.168.0.10, Partner rack/slot = 0/1, and leave the Connection name as the default "Connection_1".
2. In the PLC's properties (accessible from the V15.1 project), navigate to Protection & Security → Connection mechanisms and enable "Permit access with PUT/GET communication from remote partner". Without this flag, the HMI connection will be refused with the S7 error 0x8030.
3. Create an HMI tag for each value the panel needs. Use absolute addressing such as:

DB100.DBD0      REAL   – ProcessValue1
DB100.DBX4.0    BOOL   – MotorRunning
DB100.DBW6      INT    – SetpointSpeed
I 0.0           BOOL   – DI_00
QW 100          WORD   – AO_100

4. On the screens, bind the IO fields, buttons, and indicators to these HMI tags. The acquisition cycle is set per tag (default 1 s; tighten to 250 ms for fast loops).
5. Compile and download to the KTP1200 Basic. The panel will poll the CPU over ISO-on-TCP port 102 using the configured IP.

Option 3 – Migrate the PLC Project to TIA V17 and Combine

If the V15.1 project can be moved forward, the cleanest engineering result is a single V17 project that contains both the S7-1513-1 and the KTP1200.

1. Back up the V15.1 project (File → Archive). Do not skip this – the migration modifies block signatures and the archive is the only rollback path.
2. Open the project in TIA V17. The Portal prompts to Migrate project; accept. Expected warnings: unsupported libraries, hardware catalog updates, and SCL syntax tightening.
3. Resolve the migration log. Common items:

4. Insert the KTP1200 Basic (6AV2 123-2MA03-0AX0) in the V17 project, drag an HMI connection to the migrated S7-1513-1, and select symbolic tags from the PLC tag table directly.
5. Compile the combined project. Translate HMI messages (WinCC will prompt to translate any text DBs). Download PLC first, then HMI.

S7 Connection Parameters

CPU Security Settings That Block Cross-Project HMI

Even with a correct proxy or absolute tag, the S7-1500 will reject the HMI's request if protection is too tight. The following CPU properties are checked at runtime:

• Protection & Security → Access level – leave at "Full access (no protection)" or grant the HMI connection a dedicated password level.
• Permit access with PUT/GET communication from remote partner – must be ON for absolute addressing and for the HMI proxy when the proxy does not include the PLC's access password.
• Secure Communication – if the project uses TLS-secured S7 communication, the KTP1200 Basic runtime image must support it. The 2nd-generation Basic Panels (firmware ≥ V17) do support secure PG/HMI communication; older images will silently fall back to plain S7 and may be rejected.

Verification

1. Download the HMI configuration. After the panel restarts, open the Control Panel → Transfer to confirm the IP/Subnet matches the CPU's PROFINET interface.
2. From the engineering PG, use Online → Accessible devices in the V17 project to confirm the S7-1513-1 responds. The CPU's MAC should appear under the configured PROFINET subnet.
3. Open a WinCC screen that uses one of the HMI tags. Force a value in the V15.1 project via the watch table (e.g., DB100.DBD0 = 12.5) and confirm the HMI IO field updates within one acquisition cycle.
4. From the V17 HMI project, right-click the HMI connection → Connection diagnostics. The status must read "Connected" and the connection path "S7ONLINE → S7 connection → CPU 1513-1 PN".
5. Trigger an alarm on the HMI that uses a PLC tag bit (e.g., DB100.DBX4.0) to confirm both directions of communication.

Troubleshooting Matrix

Performance and Load Considerations

Each polled HMI tag counts as a request on the CPU's S7 connection. On an S7-1513-1 PN the practical limit is around 200 HMI tags per second of update rate before the connection resources are saturated. Group related values into DBs and use a single multiplexed handshake word if your application pushes hundreds of tags. For very dense dashboards, switch the tag acquisition to "On demand" in the HMI tag properties – values are only read when the screen is active.

Field-Proven Recommendations

• Use the device proxy (Option 1) whenever the S7-1500 side is symbolic – it keeps online diagnostics and tag type checking alive.
• Reserve absolute addressing (Option 2) for legacy retrofits where the PLC project is frozen and the HMI is being rewritten.
• Prefer project migration (Option 3) for new machines – the engineering overhead pays back during commissioning and future service.
• Always export both projects to TIA Exchange Format on every release; this gives you a clean import path if a workstation has to be rebuilt.
• Document the CPU's access level and PUT/GET state in the project README – these are the two settings that fail most often when a third-party panel is bolted on.