Configuring Two HMI Panels on a Single S7-300 PLC over PROFINET

Application Overview and Architecture Decision

When two physical processes (skids) require identical control logic but independent operator stations, three architectural options are commonly evaluated:

1. Two PLCs with peer-to-peer link - duplicate programs, separate I/O, communication via S7 connection or GlobalData.
2. Two PLCs with shared PROFINET I/O - distributed I/O with iDevice sharing.
3. One PLC with two HMI stations - single program, single I/O, two independent operator panels.

This guide covers the third option. It eliminates program duplication, simplifies interlocking through one shared tag database, and reduces hardware cost. The single-PLC approach is justified when:

• Both skids run the same recipe or sequence with only output-device differences
• I/O count fits within one CPU's address area
• Maintenance cost of two programs outweighs operator-coordination overhead

The trade-off is operator authority: when two HMIs can write the same PLC tags, two operators can issue conflicting commands. Both the technical configuration and the operator-authority mechanism are covered here.

Hardware Prerequisites and CPU Selection

For a low-I/O dual-skid application, the recommended CPU is the SIMATIC S7-314C-2 PN/DP (order number 6ES7314-6EH04-0AB0). The "-2 PN/DP" suffix denotes an integrated PROFINET interface and a PROFIBUS DP master interface.

Alternative configurations to evaluate:

• IM 151-8 PN/DP + ET 200S - when I/O is physically remote from the CPU
• S7-315-2 PN/DP - upgrade path when program exceeds 192 KB work memory
• ET 200SP CPU (CPU 1510SP) - for new installations that prefer the latest platform

Full datasheets and firmware notes are published on the Siemens Industry Online Support portal (search for "6ES7314-6EH04-0AB0").

S7-314C-2 PN/DP Detailed Specifications

Network Topology Design with PROFINET

PROFINET (IEC 61784-2) is the recommended industrial Ethernet protocol for new S7-300 installations. For a 2-HMI / 1-PLC topology, three physical layouts are valid.

Option A - Daisy-chain via CPU integrated switch

[HMI Panel 1] ---- [CPU 314C-2 PN/DP] ---- [HMI Panel 2]
                   (built-in 2-port switch)

The S7-314C-2 PN/DP has an integrated managed switch. Both HMI devices can connect directly to the CPU's two RJ45 ports. Lowest cost, but:

• No spare port for engineering
• A single cable break disconnects the second HMI
• Power loss on CPU disconnects both HMIs simultaneously

Option B - Star topology with external switch

                 [SCALANCE XB-008 / XC-208]
                   /         |         \
            [HMI 1]    [CPU 314C]    [HMI 2]
                          |
                     [Engineering PG]

Recommended for production cells. The Siemens SCALANCE XB-008 (unmanaged, 6GK5008-0BA00-1AC2) is sufficient if no PROFINET diagnostics are required. The SCALANCE XC-208 (managed, 6GK5208-0BA00-2AC2) provides LLDP topology discovery and port statistics visible inside TIA Portal.

Option C - Ring with MRP

For high-availability cells, configure Media Redundancy Protocol (MRP) with SCALANCE XM/XR-500 ring switches. MRP recovers a single cable break within 200 ms. Not normally required for skid-level equipment but supported by the CPU's PROFINET stack.

IP Addressing and PROFINET Naming

Static IP addresses are mandatory for production HMIs. Reserve a dedicated subnet (typically 192.168.0.0/24 or 10.10.10.0/24) for the cell. Avoid overlap with office networks to prevent routing loops when an engineering laptop is plugged in.

PROFINET device names are mandatory and are used by the controller to identify devices during connection establishment regardless of the IP. Name assignment is done via TIA Portal "Online → Assign PROFINET device name" or with the free PRONETA tool.

TIA Portal Project Structure

In TIA Portal V18 or later, create a single project containing one PLC and two HMI devices:

Project
├── PLC_1 (S7-300 / CPU 314C-2 PN/DP)
│   ├── Device configuration
│   ├── Program blocks (OB1, FB, DB, ...)
│   ├── PLC tags (default tag table)
│   └── PROFINET interface
├── HMI_1 (Comfort Panel, e.g. KTP1200 - Skid A)
│   ├── Connections
│   ├── HMI tags
│   ├── Screens
│   └── Recipes / Alarms (optional)
└── HMI_2 (Comfort Panel, KTP1200 - Skid B)
    ├── Connections
    ├── HMI tags
    ├── Screens
    └── Recipes / Alarms (optional)

Both HMI devices reference the same PLC_1 tag database. TIA Portal maintains a single point of definition - any rename in the PLC tag table propagates to both HMI tag tables if the "PLC tag" connection mode is used.

HMI Connection Configuration

Each HMI device requires its own HMI connection to PLC_1. Procedure:

1. Open HMI_1 in the project tree.
2. Expand "Connections" and double-click to open the editor.
3. Right-click → "Add new connection".
4. Select PLC_1 as the partner.
5. Configure the connection parameters.

Repeat for HMI_2 with Connection resource = 2.

The S7-314C supports up to 16 PG/OP/S7 communication relationships. Two HMI connections plus one engineering PG occupy three of these resources, leaving 13 free for further OP panels, route connections, or S7 peer links.

Tag Database and Connection Routing

Tags can be defined at three levels in TIA Portal:

1. PLC tags (in PLC_1) - source of truth, used by the PLC program.
2. HMI tags pointing at PLC tags - one-to-one reference; TIA Portal maintains the link.
3. HMI tags with absolute address - direct DB/bit reference, no PLC tag required.

For a dual-HMI installation, define all data points as PLC tags in PLC_1 and reference them from both HMIs. This guarantees that a tag rename in the PLC propagates to both HMI devices without manual fix-up.

To assign a PLC tag to a specific HMI's connection:

1. Open the HMI tag editor for HMI_1.
2. Select the tag, open properties.
3. Set "Connection" to HMI1_to_PLC.
4. In "PLC tag", browse and select the shared PLC tag.
5. Repeat for HMI_2 with connection HMI2_to_PLC.

Both HMI devices read and write the same memory locations in the CPU. The PLC program is responsible for separating skid-A logic from skid-B logic; the HMI only displays and controls what it is given access to.

Operator Authority and Screen Locking

When two HMIs share write access to the same PLC memory, operator authority must be implemented to prevent conflicting commands. Three patterns are common.

Pattern 1 - Skid-specific tag groups (recommended)

Structure the PLC data block so each skid owns its own command bits:

DB20 "SkidControl"
  SkidA: STRUCT
    Start     : BOOL;
    Stop      : BOOL;
    Reset     : BOOL;
    Mode_Auto : BOOL;
    Mode_Man  : BOOL;
  END_STRUCT;
  SkidB: STRUCT
    Start     : BOOL;
    Stop      : BOOL;
    Reset     : BOOL;
    Mode_Auto : BOOL;
    Mode_Man  : BOOL;
  END_STRUCT;

HMI_1 displays only DB20.SkidA.* tags; HMI_2 displays only DB20.SkidB.* tags. Each operator sees and controls only their skid. No cross-talk is possible because the tag sets never overlap.

Pattern 2 - User concept on the HMI

Siemens Comfort Panels and WinCC Runtime Advanced support user administration with permission levels. Configure:

• User group "Operator_SkidA" with write permission to Skid A tags
• User group "Operator_SkidB" with write permission to Skid B tags

When an operator logs in on the wrong panel, they cannot write to Skid A or B tags because their permission set is empty. This is configured in TIA Portal under HMI device → User Administration.

Pattern 3 - Active station token

A byte tag in the PLC, DB30.ActiveStation, holds 1 (Skid A) or 2 (Skid B). Each HMI writes only if it owns the token:

// PLC logic, in OB1 or a cyclic FB
IF "DB30".ActiveStation = 1 AND "HMI1_Request_Token" THEN
  "DB30".ActiveStation := 1;          // HMI1 keeps authority
ELSIF "DB30".ActiveStation = 2 AND "HMI2_Request_Token" THEN
  "DB30".ActiveStation := 2;          // HMI2 keeps authority
END_IF;

The HMIs monitor DB30.ActiveStation and grey out control buttons when not active. The PLC blocks any write attempt via a global "write enable" bit set only for the active station.

Step-by-Step Commissioning Procedure

1. Wire PROFINET cables between the CPU and both HMI devices using shielded CAT 5e (or better) industrial cable.
2. Insert the MMC into the CPU before powering on. The MMC is required for the CPU to retain firmware and project.
3. Power up the CPU; wait for the RUN/STOP LED to go solid green. The SF (system fault) LED may briefly flash during startup.
4. Configure the CPU's IP address and PROFINET device name via TIA Portal: PLC_1 → Online & Diagnostics → "Assign IP address" and "Assign PROFINET device name". Use the values from the addressing table above.
5. Power up both HMI devices. On each panel, open Control Panel → Network and set the IP address, subnet mask, and PROFINET device name.
6. On the engineering PC, open TIA Portal and select "Online → Accessible devices". All three nodes (PLC, HMI_1, HMI_2) should appear with their assigned PROFINET names.
7. Download the PLC_1 project to the CPU. Verify the CPU stays in RUN.
8. Download the HMI_1 project, then the HMI_2 project. Each HMI reboots after download.
9. From HMI_1, verify read access: open a screen that displays a known PLC tag value and confirm it updates when the input is forced.
10. From HMI_2, repeat the same test.
11. Test write access: from HMI_1, toggle a skid-A control bit; verify the PLC tag changes and any output module LED responds. Repeat from HMI_2 on a skid-B bit.
12. Test the authority mechanism (if Pattern 2 or 3 is used): log in as a user without permission and confirm that write controls are disabled.

Diagnostics and Verification

TIA Portal online diagnostics

• Online → Diagnostics → PROFINET topology - shows physical cable paths and port connections
• Online → Diagnostics → Device information - per-device state, firmware version, IP, name
• PLC → Online & Diagnostics → PROFINET interface → Port statistics - discarded frames, CRC errors, link-down events

CPU web server

Enable in PLC properties → Web server. Access from any browser:

http://192.168.0.1

The web server provides:

• Diagnostic buffer (last 200 entries)
• Variable monitoring (read-only; read/write via "User-defined pages")
• Module information
• Identification & maintenance (I&M) data

HMI diagnostic screen

Add a dedicated "Diagnostics" screen on each HMI showing:

• Connection state bit (Area Pointer "Coordination" byte 0, bit 0)
• Partner IP and PROFINET name (read from the PLC tag table)
• Last update timestamp
• Active station ID (if Pattern 3 is implemented)

PROFINET cable diagnostics

If a port link is unstable, use the SCALANCE switch's WebUI or TIA Portal's port statistics. PROFINET alarms trigger if the link goes down more than three times within a configurable window.

Troubleshooting Matrix

HMI Device Selection Guidance

For a skid-level HMI, the Siemens Comfort Panel line is the current recommendation. Common choices:

All Comfort Panels include a single PROFINET port and require a separate switch for star topology. They support the WinCC Comfort / Advanced engineering environment, which is the same TIA Portal HMI tool used to configure the panels in this guide. Configuration manuals are available on the Siemens Industry Online Support portal under "SIMATIC HMI" → "Comfort Panels".

For applications where the HMI is the only operator interface for the skid (no SCADA), Comfort Panel + WinCC Comfort is the recommended minimum stack. For plants with a higher-level SCADA, use WinCC Runtime Professional on an IPC and reduce the local HMI to a thin-client type (KTP or Mobile Panel).

GlobalData and S7 Communication - Brief Note

If the design later moves to two PLCs (e.g., scaling to additional skids), GlobalData was historically used for cyclic data exchange between S7-300 CPUs over MPI or PROFIBUS. GlobalData is deprecated in current TIA Portal versions; S7 connections with PUT/GET or BSEND/BRCV blocks are the supported mechanism.

If S7-300-to-S7-300 communication is required:

• Each S7 connection consumes one connection resource on both CPUs
• Maximum data per PUT/GET call: 160 bytes (older CPUs) or up to 462 bytes (newer)
• Configuration in TIA Portal: PLC_1 → "Connections" → "S7 connection" → set partner IP, rack, slot
• Use PUT for write, GET for read, BSEND/BRCV for large or variable-length data

For new designs, follow the S7 connection approach. Older legacy systems using GlobalData should be migrated during the next major upgrade.

Memory Card and Project Handling

The S7-314C-2 PN/DP does not have internal load memory; the MMC is mandatory. Recommendations:

• Use a Siemens-branded MMC of the correct size for the project (typically 2 MB for skid-sized logic).
• Always write the project back to the MMC after commissioning ("PLC → Memory Card → Write to Memory Card"). This ensures the project survives a CPU-to-CPU swap.
• When replacing a CPU, transfer the MMC from the old unit to the new unit and power on - the new CPU loads the project automatically.
• Do not store the same MMC across multiple CPUs simultaneously. The MMC binds to one CPU after a programming operation.

Firmware Update Procedure

1. Download the correct firmware file (matching order number 6ES7314-6EH04-0AB0) from the Siemens support portal.
2. Insert an empty MMC into a card reader and copy the firmware files to the root directory.
3. Insert the MMC into the powered-off CPU and turn on power.
4. The CPU performs the firmware update automatically. The SF LED flashes during the update; wait for the CPU to go to STOP with a solid SF LED.
5. Remove the MMC, re-insert the project MMC, and power-cycle.
6. Verify firmware version in TIA Portal: PLC → Online & Diagnostics → Module information.

Safety Considerations

A dual-skid installation with one PLC and two HMIs shares a single point of failure. Consider:

• E-Stop hardware - wire the E-Stop loop through safety-rated hardware (e.g., Sirius 3SK1 or 3SK2 safety relay, or a fail-safe CPU such as the CPU 315F-2 PN/DP). The E-Stop must act independently of the HMI software.
• Power supply redundancy - use a Siemens SITOP PSU100N or SITOP UPS1600 with a battery module. Loss of 24 V DC must not black out both HMIs simultaneously without a controlled shutdown.
• Network redundancy - if both skids are critical, use SCALANCE XC-200 with MRP ring. PROFINET MRP recovers a single cable break within 200 ms.
• Watchdog timer - implement a CPU cycle-time watchdog that puts outputs in a safe state if the cycle time exceeds the configured limit. The S7-300 OB80 (time error) handles this natively.

These are application-level decisions and should be reviewed against ISO 13849-1 (functional safety) and IEC 61508 / IEC 61511 (process safety) requirements where applicable.

Field-Commissioning Tips

1. Document the PROFINET names in a printed label attached to each device. TIA Portal shows the name, not the IP, in topology view.
2. Use a separate subnet for each cell. Subnet overlap between cells causes confusion when laptops move between them.
3. Disable PG mode on the HMI once commissioning is complete. PG mode allows the panel to be used as a remote engineering terminal and is a security risk in production.
4. Set the PROFINET update time for HMI connections to 100 ms or higher. Faster updates consume CPU resources with no visual benefit.
5. Test failover: with both HMIs operating, pull the cable on one. The PLC should continue running the unaffected skid; the affected HMI should show a clear "Connection lost" banner.
6. Take a TIA Portal project backup to a versioned location (e.g., Git, SVN, or a corporate PLM system). The .ap18 file contains the entire project and is small enough to commit regularly.
7. Verify the MMC label matches the project version before swapping a CPU. Mixing MMCs from different projects is a common commissioning error.

FAQ