Configuring S7-300 Device Proxy for TP700 HMI in TIA Portal V20

Overview

The SIMATIC S7-300 (CPU 317-2) is programmed in SIMATIC Manager Step 7 V5.x, but modern HMI panels such as the TP700 Comfort are configured exclusively in TIA Portal using WinCC Comfort. Engineers who need to add visualization to a legacy S7-300 machine without rewriting the control logic in TIA Portal use the Device Proxy feature introduced in TIA Portal V14 SP1 and refined through V20. The device proxy represents an S7-300 / S7-400 station from a SIMATIC Manager project inside the TIA Portal project tree without duplicating the PLC program, allowing the TP700 to bind to PLC symbols and I/O areas over PROFINET without modifying the original SIMATIC Manager hardware configuration.

This article documents the engineering workflow for adding a TP700 Comfort to an existing CPU 317-2 + CP343 Lean (or CP343-1 Advanced) installation, including the hardware topology, the device proxy creation steps, the WinCC tag binding, and field-verification checks.

Architecture and Network Topology

A device proxy implementation always has three logical layers:

1. Control layer - the physical S7-300 station with CPU 317-2 and CP343-1 communication processor. The PLC program remains authored in SIMATIC Manager (Step 7 V5.5 / V5.6). The TP700 is never added to the S7-300 hardware configuration in HW Config; the HMI is a pure PROFINET client of the CP343.
2. Device proxy layer - a TIA Portal V20 placeholder that mirrors the PLC's PROFINET interface, IP address, and rack/slot topology. The proxy is initialized from a STEP 7 V5.x project file (*.s7p archive or *.zip export). It carries no program blocks; it only exposes the data interface and symbol table to WinCC.
3. Visualization layer - the TP700 Comfort, configured in TIA Portal as a standard HMI device with an S7-300/400 connection pointing at the CP343's PROFINET IP.

Prerequisites

Step-by-Step: Creating the Device Proxy in TIA Portal V20

The official procedure is documented in the Siemens TIA Portal V20 device proxy manual at docs.tia.siemens.cloud. The condensed engineer workflow is as follows.

1. Open the TIA Portal project that will host the TP700 (this is a separate project from the SIMATIC Manager *.s7p). Choose Project → New and select a V20 template.
2. Add a new device. In the project tree double-click Add new device. In the dialog switch the catalog filter to Controller → SIMATIC S7-300 → Device Proxy. The proxy entry shows a dashed icon to distinguish it from a real CPU.
3. Initialize the proxy from a project file. With the new proxy selected, click Initialize device in the device view toolbar. Choose Via project file and browse to the STEP 7 V5.x *.s7p archive. TIA Portal imports the rack layout, CP343 PROFINET interface, and the symbol table. Symbols appear under PLC tags → Show all tags.
4. Verify the imported interface. Open Device view → PROFINET interface → Ethernet addresses. The IP and subnet mask must match the CP343 settings in the live machine. Update if the SIMATIC Manager and TIA Portal projects disagree.
5. Disable the proxy's compile output. Right-click the device proxy and select Properties → General → Protection. Set the access password to match the S7-300's CPU protection level so that online operations initiated from the proxy use the correct authority.
6. Compile the proxy (Project tree → Device proxy → Compile → Software (only rebuild)). The proxy has no blocks to download; compilation only validates the symbol import.

Step-by-Step: Configuring the TP700 Comfort Connection

1. In the same TIA Portal project, Add new device → HMI → SIMATIC Comfort Panels → 7" → TP700 Comfort.
2. Open Devices & Networks and drag a PROFINET connection from the TP700's PN port to the device proxy's PN port. TIA Portal automatically creates the S7 connection on the HMI side.
3. Open the TP700's Connections editor. The auto-generated connection will be of type S7-300/400 with the following default parameters:

4. For the device proxy, change the access point to SIMATIC S7-300/400 symbolic instead of absolute. This binds the HMI to the imported symbol table, not to raw I/Q/M addresses. Symbolic access is mandatory when the S7-300 program uses symbolic I/O names (e.g. I_StartButton), which is the recommended Step 7 style.
5. Set the HMI acquisition mode to Cyclic in operation with an update cycle of 500 ms for operator-level tags and 200 ms for fast status indicators (e.g. machine running, fault present). Slower cycles reduce PROFINET load on the CP343 Lean.

HMI Tag Configuration (Symbol-Based Access)

Open HMI tags → Show all tags → Add new tag. In the Connection column select the TP700-to-proxy connection. In the PLC tag / DB column, browse the symbol table imported into the proxy. The HMI tag automatically inherits the data type and address from the symbol.

Example mapping for a typical machine:

Network Configuration Requirements

The CP343 must have the PROFINET IO device role enabled in NCM S7 (Properties → PROFINET → Operating mode → IO device). When the CP is in pure PN interface mode (default on CP343-1 Lean), the HMI connects via the standard S7 protocol over TCP/IP on port 102; this is the case that the device proxy supports natively.

For CP343-1 Advanced installations, enable the Number of S7 connections parameter so that the HMI does not consume the only available connection slot for PG/OP communication. Typical settings: 1 PG, 1 OP, 2 reserved for other partners.

Download and Commissioning

1. In TIA Portal, right-click the TP700 and select Download to device → PC interface. Select the PROFINET network adapter that reaches the panel.
2. Confirm the target via the Show devices of the same type checkbox; the TP700 will respond with its PROFINET name hmi-tp700 and IP 192.168.0.20.
3. Once the HMI image is loaded, restart the panel and verify the Start Center → Connections shows the S7 connection as Connected (green check).
4. Force inputs in SIMATIC Manager using Monitor/Modify (VAT table) and verify the corresponding HMI tag changes within one acquisition cycle. For symbolic inputs, modify the symbol's address (e.g. StartButton at %I0.0).

Verification Checklist

Troubleshooting Matrix

Direct I/O Access vs. Symbol Access

The device proxy supports both. Best practice for HMI read-only monitoring is symbolic access for the following reasons:

• Symbol names are imported automatically from the STEP 7 symbol table; the engineer does not re-enter %I0.0 by hand.
• Renumbering of inputs in HW Config does not break the HMI binding as long as the symbol name is preserved.
• Symbolic access is the only method that survives a SIMATIC Manager Rewire or address swap.

For write operations from the HMI (operator set-points, mode changes), bind to a DB field rather than directly to %Q. The S7-300 program remains the single authority over outputs; the HMI only sets commands in a DB, and the PLC code latches and de-bounces them in OB1/OB35.

Limitations of the Device Proxy Workflow

• Read-only online functions. The proxy is not a real CPU; functions such as Download to device on the proxy are intentionally disabled. Block changes must still be performed in SIMATIC Manager and downloaded to the physical CPU.
• No program-level objects. FBs, FCs, OB blocks, and the S7 program cannot be edited through the proxy. Only tags and the PROFINET/connection interface are exposed.
• TP700 to S7-400 is supported in the same way as S7-300, but a separate proxy must be created for each PLC station. A TIA Portal project cannot merge two device proxies into a single HMI connection.
• Firmware consistency. The CPU 317-2 firmware must be ≥ V3.3 for full S7-symbolic access over PROFINET; older firmware is limited to absolute address access.

Field Commissioning Notes

• Before powering up the panel for the first time on a live machine, perform a one-time Assign PROFINET device name from TIA Portal against the physical TP700 MAC address label.
• Keep a printed copy of the Cross-reference (TIA Portal → HMI tags → Cross-reference) on-site so maintenance technicians can map HMI objects back to PLC symbols without opening TIA Portal.
• Schedule a nightly Backup of Runtime on the TP700 (Start Center → Service → Backup) to the SD card slot; this captures the active HMI project independent of the SIMATIC Manager archive.