Configuring Siemens Sm@rtServer for Remote HMI Web Access

Overview

Siemens Sm@rtServer (formerly branded as Sm@rtService in WinCC Flexible 2008) is the integrated web server in WinCC Runtime Advanced, Comfort Panels, and the TIA Portal HMI family. It exposes the running HMI project over TCP/IP so a remote PC browser, custom HTML page, or OPC client can read and write PLC tags without installing the full TIA Portal on the remote machine. Typical use cases include remote tank-level monitoring, pump-station telemetry, and supervisory dashboards where a thin client only needs tag values and acknowledge-only screens.

The most common failure when first deploying Sm@rtServer is no connection between the engineering station, the HMI/PC runtime, and the PLC on a shared switch. The browser shows "Cannot connect to server," the runtime logs 0x80040D14 or "Web server not started," or a script call such as GetVar("FillLevel_Water") returns an empty string. These faults are almost always the result of a missing web-server activation, a closed HTTP port, an empty user list, or a tag-name vs. absolute-address mismatch in the HTML script.

This reference consolidates the WinCC Flexible Options Getting Started and the modern WinCC Runtime Advanced / Comfort Panel web server documentation into one commissioning procedure. It targets the following hardware combinations:

• PC running WinCC Runtime Advanced (RT) on Windows 10/11, Ethernet-attached to S7-1200 or S7-1500.
• Comfort Panel TP700 / TP900 / TP1200 attached via PROFINET to an S7-1200/1500.
• Legacy PC station running WinCC Flexible 2008 SP5 with the Sm@rtService option.

Architecture and Topology

The reference topology mirrors the source setup: a single Ethernet switch fans out three nodes — the engineering/service PC, the runtime PC (or the HMI panel), and the S7 PLC. There is no router between them, so all three devices must share the same IP subnet.

[ Service PC ]                [ Runtime PC / Panel ]              [ S7-1200/1500 ]
 IP 192.168.0.10   <---->     IP 192.168.0.20 (Sm@rtServer) <--> IP 192.168.0.30
  Browser (port 80)   SWITCH   WinCC RT / Comfort         PROFINET / S7

Required components and addressing ranges:

Sm@rtService (WinCC Flexible 2008) vs. Sm@rtServer (TIA Portal / RT Advanced)

The source project uses the older WinCC Flexible 2008 product. The option key installed in the image was "Sm@rtService for WinCC flexible". In current TIA Portal releases the same capability is called Sm@rtServer and ships as the "WinCC Sm@rtServer" option in WinCC Runtime Advanced, or is built-in on every Comfort Panel from firmware V11 onward. The conceptual model is identical:

• The runtime hosts an HTTP server (port 80 by default, configurable up to 65535).
• Authorized users browse to http://<runtime-ip>/ and see standard service pages (start page, diagnostics, recipe views, alarm views).
• User-authored HTML pages in the project can call GetVar("TagName") / SetVar("TagName", value) to read/write HMI tags. The runtime then forwards the request to the connected PLC via the configured HMI connection.

If the project is being migrated from WinCC Flexible 2008 to TIA Portal V16/V17/V18/V19/V20, recompile the project on the new runtime. The legacy "Options" installer (Sm@rtService) is no longer licensed; the modern equivalent is the "WinCC Runtime Advanced" license with the Sm@rtServer add-on (article number 6AV2107-0CR00-0BB0 for V16/V17 single license) or a Comfort Panel image (built-in).

Prerequisites

1. Runtime license: WinCC Runtime Advanced with the Sm@rtServer option, or a Comfort Panel image. Verify in TIA Portal: Project tree → Runtime settings → Licenses. Without the option, the web server is present in the image but refuses remote connections and returns HTTP 402.
2. Web server activation in the runtime settings: Runtime settings → Services → Web server → Enable web server on this device. This checkbox is off by default; the missing check is the single most common cause of "cannot establish a connection."
3. HMI connection between the runtime and the PLC must be online (green status in the runtime diagnostics). Without an active connection, GetVar() still returns the last cached value or empty, but writes are silently dropped.
4. User list with at least one user assigned the HMI Web Administrator or Web User role. The default image ships with zero users; remote logins fail with HTTP 401 until a user is created.
5. Firewall rule on the runtime PC permitting inbound TCP 80 (and 443 if HTTPS is enabled). The Windows firewall blocks inbound HTTP by default on Windows 10/11.
6. Network reachability: ping the runtime IP from the service PC; if the ping fails, the switch port is wrong or the subnet mask is mismatched. If the ping succeeds but the browser fails, the firewall or web server activation is the cause.

Step-by-Step Configuration

Step 1 — Assign Static IPs

Configure static IP addresses on all three nodes. Avoid DHCP for HMI/PLC nodes so the browser bookmark does not break across reboots.

• PC: Control Panel → Network → Ethernet → Properties → IPv4 → Use the following IP address: 192.168.0.10 / 255.255.255.0.
• Runtime PC: Same path, IP 192.168.0.20 / 24.
• S7-1200/1500: In TIA Portal, Device properties → PROFINET interface → Ethernet addresses → IP address. Program into the PLC and download. Alternatively set online via the CPU display (S7-1500) or the TIA "Online → Accessible nodes" assignment.

Step 2 — Activate the Web Server

In TIA Portal (or WinCC Flexible for legacy projects):

1. Open the HMI device configuration.
2. Navigate to Runtime settings → Services → Web server.
3. Enable "Web server on this device".
4. Select HTTP port (default 80) and HTTPS port (default 443) if encryption is required.
5. For HTTPS, generate or import an X.509 certificate. Self-signed certificates trigger a browser warning; the warning can be accepted for commissioning.

Reference the standard service pages of the web server, as documented in the TIA Portal V20 manual: Service pages of the web server (Panels, Comfort Panels, RT Advanced).

Step 3 — Configure User Administration

Per the official "Remote Panels / RT Advanced" commissioning guide, the steps are:

1. In the runtime settings, click User Administration.
2. Create a user (e.g. SoapUser) with a strong password.
3. Assign the role HMI Web Administrator for full read/write, or HMI Web User for read-only of selected tags.
4. Apply. The user list is part of the runtime image and must be downloaded to the runtime.

For "Close with runtime" behavior (closing the Sm@rtServer window also stops the runtime), configure the same user for the local runtime session. Source: Remote Access to WinCC Runtime Advanced (PDF, Siemens Support, 109476153).

Step 4 — Define HMI Tags and Connections

Create the tags that will be exposed to the web. The HMI tag can be symbolic (e.g. FillLevel_Water) or an absolute PLC address (e.g. DB1.DBD20). Symbolic names are strongly recommended for web scripting because they remain stable across PLC address changes.

Make sure the HMI connection (e.g. HMI_Connection_1) is bound to the PLC at 192.168.0.30 with rack/slot 0/1 (S7-1500 default) or 0/0 (S7-1200 default). The connection mode must be "Active" on the HMI side; the PLC is passive.

Step 5 — Author Custom HTML Pages

Custom HTML pages are placed in the project under HMI → HTML pages and downloaded with the runtime. The runtime substitutes tag placeholders in the served HTML. A minimal page that displays a tag and a write-back button:

<html>
<head><title>Tank Level</title></head>
<body>
  <h1>Tank Level Monitor</h1>
  <p>Current level: <b><!--@FillLevel_Water--></b> m</p>
  <form method="post" action="set.html">
    Setpoint: <input name="Pump1_Cmd" type="checkbox" value="1"> Pump ON
    <input type="submit" value="Apply">
  </form>
</body>
</html>

For dynamic refresh without page reload, use the runtime's VBScript-like functions inside the HTML page (the runtime interprets the <script> blocks at serve time). Per the WinCC flexible Getting Started Options manual, the correct call is:

<script>
  var v = GetVar("FillLevel_Water");
  document.write("Level = " + v + " m");
</script>

Step 6 — Compile and Download

Compile the HMI project, then download the runtime image to the panel or PC runtime. The Sm@rtServer starts automatically when the runtime starts. If recipes are imported via Sm@rtService HTML pages, the runtime must be restarted for the new recipes to become active — this is a documented behavior, not a bug. See: Service pages of the web server.

Verification Procedure

1. From the service PC, open a browser and navigate to http://192.168.0.20/. The expected response is the Sm@rtServer start page (Comfort Panels display a Siemens logo, the project name, and the firmware version). If the page loads, Layer 3 connectivity and the web server are healthy.
2. Click Diagnostics on the start page. Confirm the HMI connection to the PLC shows Connected in green.
3. Open the project HTML page (e.g. http://192.168.0.20/index.html). Verify the FillLevel_Water placeholder is replaced with a real numeric value, not the literal text <!--@FillLevel_Water-->.
4. Submit the write form (Pump ON). Confirm on the PLC side via TIA "Monitor & Modify" that the bit at DB1.DBX30.0 transitions to 1 within one cycle (typical scan 50–200 ms).
5. Force a controlled PLC stop or disconnect. The HTML page should show "--- (no connection)" or the last cached value, and the diagnostics page should show the connection in red. This confirms the runtime is correctly handling loss of the PLC link rather than freezing the browser.
6. Reboot the runtime and confirm the start page loads within 30–60 s. Comfort Panels are typically up in 20 s; PC runtimes with antivirus can take 60–90 s.

Network, Firewall, and Port Reference

On the runtime PC, allow inbound traffic with Windows Firewall with Advanced Security:

netsh advfirewall firewall add rule name="Sm@rtServer HTTP" dir=in action=allow protocol=TCP localport=80
netsh advfirewall firewall add rule name="Sm@rtServer HTTPS" dir=in action=allow protocol=TCP localport=443
netsh advfirewall firewall add rule name="S7 Comm" dir=in action=allow protocol=TCP localport=102

For Comfort Panels, the firewall is part of the panel image and the relevant ports are open by default. If a corporate switch has port-based ACLs, request that 80/443/102 be unrestricted between the service-PC and the panel VLAN.

Troubleshooting Matrix

Scripting Reference: GetVar / SetVar and Alternatives

The runtime-side script engine inside the served HTML is intentionally limited compared to browser JavaScript. The documented built-ins are:

Example — periodic refresh of a level value without page reload (using META refresh; AJAX is not supported by the runtime's script engine):

<html>
<head>
  <meta http-equiv="refresh" content="5">
</head>
<body>
  <h2>Level: <script>document.write(GetVarEx("FillLevel_Water"));</script> m</h2>
  <p>Status: <script>document.write(GetTagInfo("FillLevel_Water"));</script></p>
</body>
</html>

For high-frequency updates (> 2 Hz) or large tag counts, use the OPC UA server of the runtime (TIA Portal → Runtime → Services → OPC UA Server) rather than custom HTML. The OPC UA server can also expose the same tags to SCADA, historians, and Python clients without HTML round-trips.

Migration Notes: WinCC Flexible 2008 → TIA Portal

If the source project is being upgraded because the Sm@rtService option is end-of-life:

1. Open the project in TIA Portal (use “Migrate project” wizard if it is a WinCC Flexible 2008 SP5 archive).
2. Re-enter the option license (article 6AV2107-0CR00-0BB0 for V16, 6AV2107-0CR05-0BB0 for V17).
3. Recompile and re-download the runtime. The compiled Sm@rtService HTML from the legacy project will be converted, but VBScript blocks must be reviewed — some legacy VBS functions have no equivalent in the modern runtime.
4. Re-test all GetVar() calls. TIA Portal V20 enforces symbolic tag names; any direct address DB1.DBD20 must be wrapped in an HMI tag with a name such as DB1_DBD20 (underscore, no dot) to remain valid.

Safety and Operational Caveats

For tank-level control specifically, the recommended design is:

• Level sensing and pump on/off in PLC ladder / SCL; PLC owns the safety envelope.
• HMI displays the level and accepts setpoint changes; HMI writes the setpoint to the PLC, the PLC applies its own safety limits.
• Sm@rtServer exposes the level for remote viewing; remote control is restricted to a separate "Remote-Authorized" user with an explicit confirm step.

FAQ