Connecting an HMI Operator Panel to ET 200S CPU 6ES7151-7AA20-0AB

Connecting an HMI Operator Panel to the ET 200S CPU 6ES7151-7AA20-0AB0

This reference documents how to select, wire, configure, and commission a Siemens SIMATIC operator panel (HMI) against the ET 200S CPU module with order number 6ES7 151-7AA20-0AB0. The same workflow applies to variants of the IM151-7 (6ES7151-7AA21-0AB0, 6ES7151-7AB00-0AB0, 6ES7151-7AB01-0AB0) and to the IM151-8 PN/DP (6ES7151-8AB00-0AB0) when its PROFIBUS interface is used. The objective is threefold: (1) read and acknowledge process faults, (2) monitor the online status of digital and analog inputs/outputs, and (3) display the live value of a position encoder connected to the ET 200S I/O.

1. CPU Interface and Communication Capabilities

The integrated X1 interface of the 6ES7151-7AA20-0AB0 supports the following modes, selectable in HW Config:

• MPI – default after factory reset; up to 32 nodes, default baud rate 187.5 kbit/s, max 12 Mbit/s on the 6ES7151-7AA20-0AB0 with firmware V3.x.
• PROFIBUS DP master – up to 125 slaves; 9.6 kbit/s to 12 Mbit/s.
• PROFIBUS DP slave – to a higher-level DP master (typical for PCS 7 AS stations).

Default MPI address out of the box is 2. HMI panels and the programming PG/PC must occupy addresses on the same bus segment; the CPU reserves addresses 0 (PG), 1 (PG/OP reserved), and 2 (CPU) by Siemens convention. Free usable addresses for HMI: 3 through 31 (and higher when bus repeaters are added).

The CPU operator panel referenced in TIA Portal online & diagnostic tools is a software view of the online CPU's mode, error state, and value-forcing status. It is not a physical HMI. The HMI selection and wiring discussed below are independent of that software feature.

2. Communication Protocol Decision Matrix

Recommendation: for a single operator panel that reads faults, I/O state, and a position encoder, MPI at 187.5 kbit/s is sufficient and avoids the need for GSD files or DP master configuration. Switch to PROFIBUS DP only if a second HMI, an ET 200 remote station, or a drive is also on the bus.

3. Compatible Operator Panel Catalog

Selection must satisfy three constraints simultaneously: (a) MPI or PROFIBUS physical interface on the panel, (b) WinCC Flexible / TIA Portal configuration project must be available for that panel, and (c) the panel must not be in the "Product Cancellation" phase if long-term spare-part availability matters.

Verdict for the 6ES7151-7AA20-0AB0: the TP177B 4" or 6" or the TP177A 6" remain the most widely available MPI/PROFIBUS panels that work directly with this CPU. A Comfort Panel (TP700/TP1200) with the optional PROFIBUS plug-in card (6GK1162-1AA01) is the long-term-repair / lifecycle-stable choice.

4. Hardware Wiring

Both MPI and PROFIBUS DP share the same 9-pin D-sub pinout on the CPU. Terminating resistors must be enabled at the two physical ends of the bus segment only.

Use the pre-assembled PROFIBUS cable with 9-pin D-sub and integrated terminating resistor (6XV1830-0EH10 plus connector 6ES7972-0BA12-0XA0). Insert the connector with the terminating switch in the ON position at the CPU and at the panel end only; the middle nodes must have it OFF. Maximum segment length at 187.5 kbit/s is 1000 m; at 1.5 Mbit/s 200 m; at 12 Mbit/s 100 m.

5. STEP 7 / TIA Portal CPU Side Configuration

1. Open the SIMATIC Manager project that contains the ET 200S station; right-click IM151-7 CPU → Object Properties → tab Interface.
2. Set Interface: MPI or PROFIBUS DP. Set MPI address = 2 (CPU default) and Highest MPI address: = 31. Transmission rate 187.5 kbit/s is the safe default for a single HMI.
3. If DP is used, add the HMI as a DP slave with the panel's GSD file: Options → Install GSD File. Siemens panels ship with their GSD pre-installed in the HW catalog under PROFIBUS DP → HMI → Siemens AG.
4. Download the HW Config to the CPU. The MPI/DP LED on the CPU should change from steady to flashing (active token passing).
5. Compile and download the S7 program; ensure OB1, OB82 (diagnostic interrupt), OB100 (restart), and OB122 (I/O access error) are present to prevent the CPU from going STOP on first error.

6. HMI Configuration in WinCC Flexible / TIA Portal

1. Create a WinCC Flexible project for the chosen TP/MP panel. In TIA Portal, add a new device → HMI → select the MLFB of the panel.
2. On the panel's Connections editor, add an S7-300/400 connection. Set Interface: MPI or PROFIBUS, address = 3 (or any free address 3–31), Slot: 2 (CPU), Rack: 0. Leave the default rack/slot; the IM151-7 occupies slot 2 of its virtual rack.
3. Set the same baud rate on the HMI side as on the CPU side (187.5 kbit/s for MPI; matched DP rate for PROFIBUS).
4. For PROFIBUS DP panels, set the panel's PROFIBUS address to a unique value 3–31. The Highest station address on the bus must be ≥ the highest assigned address.
5. Compile the HMI project. Transfer the runtime over Ethernet (TP Ethernet port) or via MPI/PROFIBUS using the "Transfer" mode on the panel (hold the Transfer button or set Settings → Transfer → enable MPI/DP transfer).

7. Tag, Alarm, and Encoder Value Configuration

7.1 Digital I/O status (online monitoring)

Declare the I/O as Process tags in WinCC Flexible with the same absolute addresses used in the STEP 7 symbol table. Example for byte 0 of the ET 200S digital input module (1st slot of the IM151-7):

Symbol:    DI_byte_0
Datatype:  BYTE  (or USINT for TIA WinCC)
Address:   E 0     (German)  /  I 0     (international)
Acquisition: Cyclic, 1 s

Place a numeric / bit-pattern output field on the screen bound to DI_byte_0 or individual bits E0.0…E0.7 for one-line state. Enable Display Leading Zeros in the panel's screen layout for readability.

7.2 Position encoder value (online monitoring)

For an SSI / incremental encoder wired to an ET 200S 1SSI module (e.g. 6ES7 138-4DB03-0AB0) or a 1Count24V counter module, the encoder value lands in input words IW x and IW x+1. Configure:

Symbol:   EncoderPos
Datatype: DINT  (32-bit signed) or DWORD
Address:  ID  x        (I area, double-word aligned)
Length:   4 bytes
Scaling:  user units per increment / engineering units in the PLC

Use an I/O Field on the panel with display format Decimal and the proper scaling (counts → mm, deg, pulses). For 32-bit encoders, declare a DINT tag; the panel will display signed integer values directly.

7.3 Fault reading and acknowledgement

For bit faults mapped to a word (e.g. MW 100) use WinCC Flexible's Bit messages with acknowledgement. For S7 diagnostic alarms (drive, slave, module faults) generated by the CPU, the operator panel will receive them through the standard S7 diagnostic mechanism if you tick Use S7 diagnostics in the connection settings and define a Message number assignment in the CPU (STEP 7 → CPU properties → Diagnostics). Each diagnostic event creates an entry in the panel's Message view with the Acknowledge button, and the acknowledgement bit is set in the corresponding Acknowledge tag.

For S7 user-defined alarms (SFC17 / SFC18 / SFC107 / SFC108) that you trigger from OB1, declare alarm numbers 1–999 in the CPU's Alarm_S / Alarm_D configuration and the matching message text in WinCC Flexible's Bit messages or Alarm messages. The acknowledgement tag and the Acknowledge HMI button reset the alarm bit in the PLC.

8. Online / Diagnostic Tools (TIA Portal "CPU Operator Panel")

In TIA Portal with the PG connected to the 6ES7151-7AA20-0AB0 over MPI/DP, the Online & Diagnostics → CPU operator panel view reports the operating mode (STOP / RUN / STARTUP / HOLD), the presence of an error, the value-forcing status, and the online/Offline comparison state. This is a software-only view; it does not replace a physical HMI. Use it during commissioning to confirm the bus is alive before fault-tracing the panel connection.

9. Commissioning Verification (Field Procedure)

1. Power up the ET 200S station with the HMI connector unpowered first; measure 24 V at the panel.
2. Power the panel. Enter Transfer mode and download the compiled HMI runtime. Restart the panel.
3. Verify the panel changes from Connection error to Online; the diagnostic LED on the panel turns green.
4. In TIA Portal / STEP 7 Online → Accessible Nodes the panel's MPI/DP address must appear.
5. Toggle a digital input and verify the bit-pattern changes on the HMI screen within 2 s (default acquisition).
6. Move the encoder and verify the I/O field value changes by the expected scaling factor.
7. Trigger a test fault (e.g. force a wire break on an analog input) and confirm the panel raises a message and that the Acknowledge button clears it.

10. Troubleshooting Matrix

11. Migration to Active Components

The OP7, OP17, OP27, OP37, TP170A/B, TP177A/B, TP177micro, and MP177/MP277 are all in Discontinued or Product Cancellation phase. For new installations, choose one of the following to guarantee spares for 10+ years:

• Comfort Panel TP700 / TP900 / TP1200 with the PROFIBUS plug-in module 6GK1162-1AA01 – active product, full TIA Portal support, PROFIBUS DP 12 Mbit/s.
• Basic Panel KTP400 / KTP700 / KTP900 / KTP1200 with PROFINET – requires a IE/PB Link PN IO (6GK1411-5AB10) or a PN/DP coupler between the ET 200S CPU's MPI/DP port and the PROFINET panel.
• For PCS 7 plants, the panel is typically an OS client, see Integration of S7-300 Package Units in SIMATIC PCS 7 for the recommended OS route.

12. Field-Proven Cautions

• Never enable the PROFIBUS terminating resistor on more than two nodes per segment. A common field error is enabling the terminator on the CPU, the panel, and a third ET 200 station that happens to sit at the end of the cable run.
• The IM151-7 CPU's MPI/DP port and the IM151-8 PN/DP's PROFINET port are mutually exclusive for HMI traffic if you only have one cable run. Use a PN/DP coupler (e.g. 6GK1411-5AB10) if the panel is PROFINET-only.
• When the panel is in Transfer mode, it briefly drops its S7 connection. This is normal and does not indicate a fault.
• If a TIA Portal project is compiled against a Comfort Panel using "S7-300/400" as the connection, the bus address on the panel and the slot of the CPU must match exactly. Mismatches cause a non-deterministic connection failure that only shows up after a panel restart.
• Encoder values from a 1SSI module arrive as a right-justified 16- or 32-bit integer in IW; apply bit-shifting and zero-adjustment in the PLC's user program (FC/FB) before exposing the scaled value to the HMI as a DINT tag.