Configuring TP177B Ethernet Bridging in WinCC Flexible

Overview

The Siemens SIMATIC TP177B (PN/DP 6-inch) is a compact HMI panel with an integrated Ethernet interface (PN variant) or PROFIBUS DP (DP variant). When the PC-based engineering station or a secondary visualization client needs to share the same tag database as the panel without rerouting PLC traffic, WinCC Flexible provides two native options:

1. Simatic HMI HTTP connection – a peer-to-peer tag exchange channel between two WinCC Flexible devices in the same project, where one device is configured as a PC with WinCC Flexible Runtime and the other is the TP177B.
2. SmartAccess – a licensed service that opens a direct service/remote-assistance tunnel over TCP from a WinCC Flexible Runtime PC to the panel's WinCE image.

Both options rely on the panel's Configuring WinCC flexible Internet Settings block on the WinCE Control Panel (Start > Settings > Network and Dial-up Connections or Control Panel > Internet Settings) and on the engineering PC's IP being routable to the panel's IP. This document covers the engineering procedure in WinCC Flexible 2008 SP2/SP3 and 2009, the wiring/cabling prerequisites, the HTTP connection parameter set, the tag-address syntax used to point PC-side tags to panel-side tags, and the verification sequence that confirms end-to-end tag refresh.

Prerequisites

Network Topology

The recommended layout keeps the PLC on its native fieldbus (MPI/PROFIBUS or PROFINET) and places the PC and the TP177B on a parallel Ethernet segment. The HTTP channel between the two HMI stations is independent of PLC address layout.

+-------------------+      Ethernet (HTTP)       +-------------------+
|  Engineering PC   | <----------------------> |   TP177B PN/DP    |
|  192.168.0.10/24  |                            |  192.168.0.20/24  |
|  WinCC Flex ES +  |                            |  WinCE 5.0        |
|  Runtime          |                            |  HTTP server      |
+---------+---------+                            +---------+---------+
          |                                                |
          | MPI / DP / PN (PLC connection in project)      | MPI / DP / PN
          v                                                v
   +-------------+                                  +-------------+
   | PLC S7-300/ | <- shared tag database ->        |  PLC same   |
   |  S7-400     |                                  |  network    |
   +-------------+                                  +-------------+

If a managed switch is between the PC and the TP177B, ensure port 80 (HTTP default) and, when SmartAccess is used, port 5900/5901 are not filtered. Corporate firewalls between office and plant floor typically block port 80 — bring the engineering PC onto the same VLAN as the panel.

WinCC Flexible Project Configuration: Two-Device Setup

WinCC Flexible supports multiple HMI devices inside one project. To bridge a PC runtime with a TP177B over HTTP, add both devices to the same project so they share the tag database.

1. Open the project in WinCC Flexible ES.
2. In the project tree, right-click the root project node.
3. Select Add Device with Wizard.
4. Choose HMI device as the device class.
5. For the connection type, select Simatic HMI HTTP as the symbolic protocol when prompted, or finish the wizard and modify the connection afterwards.
6. Click through the wizard (next > next > finish).
7. A second device (e.g. Device_2) now appears in the project tree, configured as the PC runtime station.

The wizard creates both the panel device and the PC device under one project, so tag changes propagate to both. This is the foundation of the panel↔PC bridge.

Simatic HMI HTTP Connection Setup

The HTTP connection is configured under the panel device's Communications > Connections node. WinCC Flexible offers a connection editor that pairs the local interface with the remote partner.

1. Navigate to Device_1 (TP177B) > Communications > Connections.
2. Open the connection editor. The default connection to the PLC remains intact; add a second connection with the following parameters:

On the PC-side device (Device_2), the same connection is mirrored. Because the project shares one tag database, WinCC Flexible automatically generates the partner entry when both devices reference the same Connection_1.

Tag Configuration and Address Mapping

Tags declared on Device_1 (TP177B) are visible to Device_2 (PC) through the connection. To reference a panel tag from a screen on the PC runtime, use the symbolic tag name and select Connection_1 as the source.

1. In Device_2's tag editor, create a tag (for example PC_TankLevel) of type Int or Real.
2. Open the tag properties; under Connection select Connection_1.
3. Under Address, do not type a PLC address. Click the address helper button.
4. In the address dialog, navigate to Device_1 (TP177B) > Communication > Tags and select the panel-side tag you want to mirror (for example TankLevel).
5. Confirm. The PC tag now has the symbolic reference Device_1\Communication\Tags\TankLevel instead of a raw PLC address.

PC-side tag (Device_2):
  Name        : PC_TankLevel
  Type        : Real
  Connection  : Connection_1 (Simatic HMI HTTP)
  Address     : Device_1\Communication\Tags\TankLevel
  Update cycle: 1 s (minimum for HTTP polling)

Polling cycle influences CPU and network load on both devices. Typical values are 1 s for slowly-changing process values and 250 ms for alarms or motor states. Below 250 ms the HTTP channel becomes the bottleneck because of TCP overhead on WinCE.

SmartAccess Alternative Path

When the engineering goal is remote service (start/stop/runtime observation of the TP177B from the PC), SmartAccess replaces the Simatic HMI HTTP tag bridge with a service/remote-assistance tunnel. SmartAccess requires:

1. A valid WinCC Flexible Runtime + SmartAccess license on the PC (USB stick or hard-disk license).
2. SmartAccess enabled on the TP177B via WinCC Flexible > Device Settings > SmartAccess tab, or via the Control Panel > WinCC flexible Internet Settings applet on the panel.
3. The PC's IP allowed in the SmartAccess address list of the TP177B.

SmartAccess uses TCP port 5900 (display) and 5901 (input) by default, plus HTTP 80 for control. If only SmartService (read-only service) is licensed, port 5900 is sufficient.

WinCE Panel-Side Internet Settings

Several settings on the TP177B must be active before either the HTTP bridge or SmartAccess work. Open Start > Programs > WinCC flexible Internet Settings on the panel.

After editing, reboot the panel. Internet Settings changes in WinCE are not applied to live sockets until the stack restarts.

Downloading the Project to the TP177B

Before the bridge can carry tags, the compiled project must be on the panel. Two transfer paths are supported over Ethernet.

1. In WinCC Flexible ES, select Project > Transfer > Transfer (or Ctrl+Shift+F7).
2. Choose mode Ethernet (PN/IE).
3. Enter the panel IP 192.168.0.20. Optionally enable Show all accessible stations to let the ES broadcast-probe the subnet.
4. Click Transfer. The first transfer prompts for the panel's administrator password (default 100).

If the broadcast probe fails (common on routed networks or when the engineering PC is on a different VLAN), set the IP manually. Reference the TP177B operating instructions listed in the Siemens Industry Online Support under entry ID 23308794 for the exact Transfer applet paths.

Verification and Commissioning Tests

After transfer and connection configuration, perform the following checks in order. Each step has a pass criterion that can be observed on-screen or in the diagnostic log.

1. Physical link – link LED on the TP177B Ethernet port is steady green. Pass: green LED steady, amber LED dark or blinking on traffic.
2. IP reachability – from the PC run ping 192.168.0.20 -t. Pass: replies < 5 ms on a switched LAN.
3. HTTP probe – from the PC browser open http://192.168.0.20. Pass: WinCC Flexible web top page or login dialog appears.
4. Tag refresh – in WinCC Flexible Runtime on the PC, force a known value on a TP177B tag (for example TankLevel := 50.0 via a button script on the panel) and observe the mirrored PC tag PC_TankLevel. Pass: PC tag updates within one update cycle (typically ≤ 1 s).
5. Bidirectional – write a value from the PC runtime and confirm the panel screen updates. Pass: process screen on TP177B reflects the value within one cycle.
6. Cold reboot – power-cycle the TP177B. Pass: tags reconnect automatically; no manual restart of the PC runtime required.

Troubleshooting Matrix

Performance and Sizing Notes

The TP177B PN variant integrates a 10/100 Mbit Ethernet controller. The HTTP channel used by WinCC Flexible is request/response and is not designed for high-volume streaming. A practical sizing rule, derived from the WinCE image capabilities, is:

• Up to ~200 tags mirrored simultaneously with a 1 s update cycle.
• Up to ~50 tags with a 250 ms update cycle.
• Above those numbers, favor PROFINET direct connection between the PC and the PLC, or use a PLC tag subscription through OPC rather than the HMI HTTP bridge.

Network load for 200 tags at 1 s cycle on a single HTTP connection is on the order of 80–120 kbit/s with default tag sizes (mix of Bool, Int, Real). The TP177B's CPU overhead is dominated by tag-acquisition polling, not by HTTP framing.

Security and Production Hardening

The TP177B default user "Administrator" with password "100" is a well-known engineering backdoor. Before commissioning on a production network:

1. Change the administrator password in the panel's Control Panel > User Administration.
2. Restrict SmartAccess access list to known engineering PC IPs only.
3. If the plant has an IEC 62443 zone model, place the TP177B and engineering PC in the same zone; do not expose port 80 to the office network without a stateful inspection firewall.
4. Disable the Web Server in WinCC flexible Internet Settings when remote access is no longer required.

FAQ