Configuring TP1500 Comfort Dual-Network X1/X3 S7 Connections

Architecture Overview

The SIMATIC TP1500 Comfort (catalog number 6AV2 124-1QC02-0AX0) is a 15-inch widescreen HMI panel from the SIMATIC Comfort Panel family. Unlike Basic Panels, Comfort Panels ship with two physical PROFINET interfaces (X1 and X3) plus USB host/device, RS-422/485, and optional audio. This dual-port architecture lets a single Comfort Panel terminate S7 connections to two different automation networks that do not share a routing path — for example, a plant-floor S7-1500 cell on 192.168.1.0/24 and an enterprise S7-300/400 line on 10.236.147.0/8 — without requiring an external router.

This document describes the engineering path that has been validated by Siemens Industry Customer Care for connecting two SIMATIC PLCs from different IP subnets to one TP1500 Comfort: PLC_1 (S7-1500) on PROFINET port X1 and PLC_2 (S7-300/400) on PROFINET port X3.

TP1500 Comfort Hardware Interfaces

Both X1 and X3 are independent Layer-3 interfaces. They each maintain their own IP address, subnet mask, gateway, and PROFINET device name. There is no built-in routing between them; the panel will not forward IP packets from one interface to the other. This is critical: traffic to a PLC must originate from the interface that shares the PLC's subnet.

Reference Topology

The figure below shows the validated topology referenced by Siemens Asia Pacific Hub support.

IP Subnet Routing Constraints

The TP1500 Comfort uses standard Windows CE / Windows Embedded Compact networking stacks. Each PROFINET port is bound to a virtual adapter. The panel's connection manager (CCAgent / CCEServer) builds the S7-Comm PDU using the local IP that matches the destination subnet.

• Different subnets: Required. X1 and X3 must terminate networks that cannot be aggregated into a single supernet route. The reference case uses 192.168.1.0/24 on X1 and 10.0.0.0/8 on X3.
• Gateway: Configure the gateway only on the interface that must reach an upstream network. If both PLCs are local and reachable on-link, set both gateway fields to 0.0.0.0 to avoid asymmetric routing.
• PROFINET names: Each interface may carry an independent PROFINET device name (e.g. hmi-x1 and hmi-x3). The PROFINET name is required only when the panel acts as a PROFINET IO device; for pure S7-Comm traffic the IP is what matters.
• MTU and VLAN: Default MTU 1500. Comfort Panels do not support VLAN tagging on X1/X3 in firmware ≤ V17 — verify VLAN tagging support against your project firmware release notes before deploying a tagged infrastructure.

Prerequisites

1. TP1500 Comfort with image version supporting dual PROFINET interfaces (firmware V14 SP1 or higher; V17/V18/V19/V20/V21 recommended for current security patches).
2. TIA Portal V17 or higher installed on the engineering station. WinCC Comfort/Advanced is required for Comfort Panel configuration.
3. S7-1500 project (CPU 1511/1513/1515/1516/1517/1518 or ET200SP CPU) configured in the same TIA Portal project.
4. S7-300 (CPU 31x PN/DP) or S7-400 (CPU 41x PN/DP) project — STEP 7 V5.x project imported via TIA Portal, or co-located TIA Portal project if the CPU is part of the modern line.
5. Two Ethernet patch cables with shielded RJ45 connectors; one per PROFINET segment.
6. Physical separation of the two networks. Do not bridge X1 and X3 to the same physical switch unless a managed switch enforces two VLANs that map to the two interfaces.

TIA Portal Project Configuration

Step 1 — Insert the HMI device

Open the TIA Portal project. From the hardware catalog navigate to HMI → SIMATIC Comfort Panels → 1500 → TP1500 Comfort and drag the device onto the project tree. Confirm the catalog order number matches the physical panel (6AV2 124-1QC02-0AX0 for indoor, 6AV2 124-1QC13-0AX0 for Outdoor).

Step 2 — Configure PROFINET interface X1

Open Devices & Networks → TP1500 → PROFINET interface [X1]:

Step 3 — Configure PROFINET interface X3

Open Devices & Networks → TP1500 → PROFINET interface [X3]:

Step 4 — Create the HMI connections

Open Connections in the project tree of the TP1500. Two S7-Comm connections must be created — one for each PLC.

Connection_1 (PLC_1 — S7-1500):

• Communication driver: SIMATIC S7-1500
• PLC station: PLC_1 (S7-1500 CPU)
• Interface on HMI side: PROFINET [X1]
• Interface on PLC side: PROFINET [X1]
• Connection name: HMI_1_PLC1500

Connection_2 (PLC_2 — S7-300/400):

• Communication driver: SIMATIC S7-300/400
• PLC station: PLC_2 (S7-300/400 CPU)
• Interface on HMI side: PROFINET [X3]
• Interface on PLC side: PROFINET port of the CPU
• Connection name: HMI_1_PLC300
• Connection resource: An unused S7 connection resource on the S7-300/400 CPU. Slot 0/1 are typically reserved by STEP 7 and the panel; allow at least one resource for the HMI.

For each connection set Mode → Active on the HMI. The S7-Comm connection establishment is initiated from the HMI; the S7-300/400 only answers.

PLC-Side Configuration

S7-1500 (PLC_1)

1. In the S7-1500 device configuration, open Properties → Protection & Security.
2. Under Connection mechanisms, tick Permit access with PUT/GET from remote partner only if the HMI uses PUT/GET and not the symbolic optimized access.
3. Confirm that the PROFINET interface IP matches 192.168.1.1, subnet 255.255.255.0.
4. Ensure the S7-1500 CPU has enough free connection resources. S7-1500 supports up to 128 S7-Comm server connections depending on CPU type. The HMI consumes one resource per connection.

S7-300 / S7-400 (PLC_2)

1. Open the CPU properties in STEP 7 (TIA Portal or STEP 7 V5.x depending on project origin).
2. Navigate to Protection and ensure Permit access with PUT/GET from remote partner (RFC1006) is enabled. Without this, the S7-300/400 will silently drop the HMI's S7-Comm request even when IP and routing are correct.
3. Confirm the IP address 10.236.147.125 and subnet mask 255.0.0.0 on the CPU PROFINET interface.
4. Open Communication → Connections on the S7-300/400. Confirm at least one S7 connection (ISO-on-TCP / TCP) resource is free. S7-300 supports up to 16; S7-400 CPU 41x PN/DP supports 32 by default. If the project already consumes all slots, the HMI connection cannot be established.
5. If a firewall is enabled on the S7-300/400 (rare, but supported on newer S7-300 CPUs with security module), open port 102 (ISO-on-TCP) for the HMI's X3 IP.

HMI-Side Runtime Configuration

1. Compile the HMI project. TIA Portal will warn if the connection resource cannot be allocated. Resolve any warnings before downloading.
2. Download the project to the TP1500 Comfort via X1 or X3. Siemens recommends using the X1 port for engineering download because the service stack on X3 may be disabled in some configurations.
3. After project download, restart the panel. The two connections appear in the Connections runtime view on the Service Desktop.
4. If the project was modified after first commissioning, also reset the runtime. From Service Desktop: Start → Settings → OP → Reboot.

Verification and Diagnostics

Network reachability

Open the Service Desktop on the panel (Start → Programs → Service Desktop). Launch Start → Programs → Accessories → Command Prompt and run:

ping 192.168.1.1     :: PLC_1
ping 10.236.147.125  :: PLC_2
ipconfig
  - X1 must show 192.168.1.2 / 255.255.255.0
  - X3 must show 10.236.147.126 / 255.0.0.0
tracert 10.236.147.125
  - First hop must be X3 local subnet (no router needed if on-link)

If ping from one interface fails, verify the cable, the switch VLAN, and the PLC PROFINET interface status LEDs.

S7-Comm diagnostic on the panel

From the Service Desktop:

1. Start → Programs → HMI Tools → HMI Diagnose (or Connection Status on older firmware).
2. Each connection displays Established / Not established / Fault.
3. If a connection shows Fault, expand the detail to view the S7 error code (e.g. 0x00 = no error, 0x01 = connection aborted, 0x05 = resource missing, 0x06 = access error).

PLC-side diagnostic

For the S7-1500: open TIA Portal online → Diagnostics → Connection information. For the S7-300/400: in STEP 7 open PLC → Information → Communication. Look for:

• Connection establishment count
• Active partner IP — must be 192.168.1.2 (X1) or 10.236.147.126 (X3)
• Connection error counter — non-zero indicates authentication or access rejection

Wireshark capture

For deep analysis, mirror the X1 or X3 switch port and capture with Wireshark. Filter on s7comm. Validate the S7 PDU header source TSAP and destination TSAP. The HMI uses TSAP 01.01 by default; the S7-300/400 returns its slot TSAP (e.g. 03.01). If the TSAP differs, the project mismatch is the root cause.

Known Limitations and Workarounds

Comparison With Other Architectures

Troubleshooting Matrix

Security Considerations

With TIA Portal V18 and Comfort Panel firmware V18 onwards, the panel supports Security Integrated. To harden the dual-network configuration:

• Enable user management on the panel and assign operator/admin roles.
• Disable unused services (SmartServer, SmartClient, Web Server) on the X3 interface if PLC_2 is a critical infrastructure segment.
• Use a managed switch with port security on the X3 segment to prevent accidental bridging from X1.
• Apply firmware updates through Siemens Industry Online Support and verify SHA-256 checksum before download.

Documentation References

• Performance Features of Comfort Panels — TIA Portal V21
• SIMATIC HMI TP1500 Comfort Operating Instructions (6AV2 124-1QC02-0AX0) — Siemens Industry Online Support, entry ID 109749262
• TIA Portal Help Portal — Comfort Panel Communication (S7-Comm, PROFINET IO)

FAQ