Overview of S7-1200 Web Server and AWP
The SIMATIC S7-1200 CPU family (firmware V4.0 and later, including the 1214 DC/DC/DC variant covered by catalog number 6ES7214-1AG40-0XB0) ships with an integrated web server that exposes a subset of the CPU's process data to any HTTP-capable client on the same network. AWP (Automation Web Programming) is the Siemens markup language that the web server uses to inject live tag values, hyperlinks, and form fields into user-authored HTML pages. When a client submits an HTTP GET or POST request, the S7-1200 parses the embedded AWP commands, writes the values into the configured PLC tags, and returns the updated page.
This approach is suitable for low-rate, human-driven or supervisory HMI tasks: dashboard toggles, service-mode overrides, lab equipment, and prototyping. It is not a substitute for a structured fieldbus such as PROFINET, Modbus TCP, or OPC UA when deterministic control, authentication, or high-frequency polling is required. For projects that need REST-style JSON APIs on a different platform, AutomationDirect documents a comparable read-only HTTP interface for the BRX Do-More series in their product video library, which can serve as a cross-reference for teams evaluating both families.
For the original S7-1200 1214 DC/DC/DC task, the goal is to:
- Toggle output
Q0.0from a browser GET request. - Start a TON (on-delay) timer the moment the output is energized.
- Automatically de-energize
Q0.0when the timer expires.
Prerequisites and Hardware
Before commissioning the web server interface, confirm the following:
| Item | Requirement |
|---|---|
| CPU | SIMATIC S7-1200, firmware V4.2 or later (V4.5+ recommended for security fixes) |
| Catalog number (example) | 6ES7214-1AG40-0XB0 (1214 DC/DC/DC) |
| Engineering software | STEP 7 / TIA Portal V16 or later |
| Network | Ethernet connectivity between CPU and client; static IP or DHCP reservation recommended |
| Browser | Any modern browser; JavaScript optional |
| User access level | At least one protected user with the "Web server" permission configured in the CPU security settings |
Reference: SIMATIC S7-1200 Programmable Controller System Manual.
Enabling and Configuring the Web Server in TIA Portal
- In the TIA Portal project tree, select the S7-1200 CPU and open Properties → Web server (Webserver).
- Tick Activate web server on this module. The CPU opens TCP/80 (HTTP) and, if a certificate is loaded, TCP/443 (HTTPS) by default.
- Under User management, add at least one user and grant the Web server permission. Note: starting with firmware V4.2, anonymous read access is disabled by default, so a user is required even for GET-based control.
- Under Automatic update / Update interval, leave the default of 10 s, or shorten to 2 s for tighter feedback. Note that lower values increase CPU scan-time overhead.
- Add the application HTML page (default name
Control.html, AWP-named file) to the Webserver node of the CPU. Pages can be created on the configuration PC and uploaded during download.
AWP Command Syntax Reference
AWP commands are HTML-style comments parsed by the S7-1200 web server. The most relevant commands for GET-based control are:
| AWP command | Function | Example |
|---|---|---|
:="<tag>": |
Read tag value into the HTML output |
<!-- AWP_Out_Variable Name='Q0_0' --> with :="Q0_0":
|
:=<tag>: |
Write tag value from URL/POST parameter into the PLC |
:=Start: when the URL contains ?Start=1
|
<!-- AWP_In_Variable Name='...' --> |
Declare the tag as an input (writable via AWP) | Listed in the page header before := writes |
<!-- AWP_Out_Variable Name='...' --> |
Declare the tag as an output (readable) | Used with :="...":
|
<!-- AWP_Enum_Def ... --> |
Optional enum mapping for HMI-style displays | Restricts valid input strings |
According to the Siemens S7-1200 Web Server Function Manual, a tag must be declared with AWP_In_Variable in the HTML head before it can be written via an HTTP parameter. Tags not declared as input are read-only, even if the GET request contains the parameter.
Reference: SIMATIC S7-1200 Web Server Function Manual.
Designing the HTML Control Page
Create a new file named Control.html in the project. The page contains two button hyperlinks, one for ON, one for OFF, plus a read-only display of Q0.0 and the running timer. The complete file is shown below:
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<title>S7-1200 Output Control</title>
<!-- AWP_In_Variable Name='Start' -->
<!-- AWP_In_Variable Name='Stop' -->
</head>
<body>
<h1>S7-1200 1214 Output Control</h1>
<p>Q0.0 state: <!-- AWP_Out_Variable Name='Q0_0' --><span>:="Q0_0":</span></p>
<p>Timer running (s): :="Timer_ET":</p>
<a href="/awp/Control.html?Start=1"><button>ON (start 5 s pulse)</button></a>
<a href="/awp/Control.html?Stop=1"><button>OFF (immediate release)</button></a>
</body>
</html>Key points:
- The
StartandStoptags are declared as input variables, which is mandatory for write access from HTTP parameters. - Buttons are ordinary
<a>hyperlinks that issue an HTTP GET to the same page with a query string. - Output readouts use the
:="Q0_0":notation; theQ0_0tag must be declared withAWP_Out_Variablefor the server to substitute its value. - Tag names in AWP must use valid identifier characters; the period in
Q0.0is replaced by an underscore (Q0_0) inside the URL parameter, and the AWP engine maps the two automatically when the underlying tag is selected by symbolic name in the PLC tag table.
PLC Program: Output Latch with TON Auto-Off
The HTML page only writes the Start and Stop tags. The PLC program is responsible for latching the output, running the timer, and clearing the output on completion. The following networks are written in TIA Portal's LAD/FBD editor and assume standard tag names.
Tag table
| Symbolic name | Data type | Address | Scope |
|---|---|---|---|
| Start | Bool | M10.0 | AWP input, set by GET request |
| Stop | Bool | M10.1 | AWP input, set by GET request |
| Q0_0 | Bool | Q0.0 | Physical output (read by AWP for display) |
| Run | Bool | M11.0 | Internal run flag (latch) |
| PulseTimer | TON | DB1 | IEC timer instance |
| PulseTime | Time | DB2.DBD0 | Pulse duration, default T#5s |
| Timer_ET | Time | DB2.DBD4 | Elapsed time, exposed to AWP |
Network 1 — Latch run flag on Start, clear on Stop or timer done
| Start | --| Run |--( )--|
| Run | --| | |
| <Stop OR PulseTimer.Q> |--|/| Run |Implementation in ladder: set coil of Run on rising edge of Start with Run as a parallel contact (OR); reset Run on either Stop or the timer's Q (done) output.
Network 2 — Drive Q0.0 from run flag
--| Run |--( Q0_0 )--
Network 3 — Run the TON timer only while output is active
--| Q0_0 |--[TON PulseTimer, PT := PulseTime]--
The TON instruction is enabled by Q0_0 so timing starts the instant the output is energized and resets the moment the output drops. The timer's ET (elapsed time) is copied into Timer_ET in Network 4 for the AWP display.
Network 4 — Mirror elapsed time to AWP-visible tag
--[ MOVE PulseTimer.ET -> Timer_ET ]--
Alternative compact STL/FBD form is acceptable. The functional intent is identical: latch on Start, run timer while output is on, break the latch when the timer reaches PT.
Start is a one-shot edge in the latching network. If continuous retrigger is desired, replace the Start edge with a level check | Start | and let the timer itself govern the off-time.Uploading HTML Pages to the CPU
- Right-click the CPU in the project tree and select Download to device → Hardware and software (only). The web pages in the Webserver node are transferred as part of the standard download.
- Alternatively, after the project is loaded, open Webserver → User-defined pages, right-click and select Generate HTML files, then drag the resulting ZIP into the Webserver page node. The file name must be the same as the one referenced in the AWP command (in this example,
Control.html). - Confirm upload in the TIA Portal diagnostics view: the Web server entry should report the page count and last-modified timestamp.
Verification and Testing
- Open a browser and navigate to
http://<plc-ip>/awp/Control.html. Log in with the user defined in step 1 of the configuration. - Verify the page renders with
Q0.0 state: 0initially. - Click the ON button. The page reloads, the GET request sets
Start = 1, and the PLC latchesRun.Q0.0reads1in the table within one scan. - Observe the displayed
Timer running (s)value advancing from0stoward5s. - When the timer reaches
T#5s,PulseTimer.Qrises, the latch breaks, andQ0.0returns to0automatically. - Click the OFF button. The latch breaks immediately regardless of timer state.
Browser DevTools can capture the GET request to confirm the wire format:
GET /awp/Control.html?Start=1 HTTP/1.1
Host: 192.168.0.10
Authorization: Basic <base64 credentials>
User-Agent: Mozilla/5.0 ...The PLC responds with HTTP 200 and the rendered HTML body containing the substituted tag values.
Security Considerations
- Authentication: Firmware V4.2+ rejects anonymous access. Always configure at least one user with a strong password and the principle of least privilege.
- HTTPS: If the link traverses untrusted networks, load a CA-signed certificate (TIA Portal → Web server → Security) and switch to TCP/443.
- Command injection: AWP strictly types parameters as Bool, Int, Real, or String. Avoid accepting raw String writes for control; keep all writable tags as Bool or numeric.
- Network segmentation: Place the PLC in a control VLAN and use a stateful firewall to limit sources to known HMI/workstation IPs.
- Audit: Web server access is logged in the CPU diagnostic buffer; integrate with a syslog server if the network requires forensic records.
Troubleshooting Matrix
| Symptom | Likely cause | Corrective action |
|---|---|---|
| HTTP 401 on every request | User not configured, or anonymous access disabled (default V4.2+) | Add a user under Web server → User management and assign Web server permission |
| HTTP 404 on /awp/Control.html | HTML file not in the Webserver node or filename mismatch | Re-add the page in TIA Portal → Webserver → User-defined pages; ensure filename matches the URL |
| Tag value not updating | Tag not declared as AWP_In_Variable / AWP_Out_Variable | Add the appropriate AWP declaration in the page <head> |
| Q0.0 turns on but never off | TON instance not enabled by Q0.0, or reset wiring missing | Verify the TON enable input is wired to Q0.0 and the timer's Q output is in the latch-reset path |
| Page returns but Q0.0 is shown as 0 even when LED is on | Symbolic name mismatch (e.g., reading Q0_0 while tag is named Output_Q0_0) |
Confirm the symbolic name in the PLC tag table and in the AWP command are identical |
| Each click toggles only briefly | Start is being read as a level, not an edge, and is reset by the next scan | Convert the input detection to a rising-edge contact (P) in Network 1 |
| Browser caches old value | Browser is caching the rendered page | Append a unique query parameter per click, or set HTTP cache headers via a meta tag |
Alternative Approaches and Cross-Platform Notes
For projects that need a richer REST/JSON API than AWP provides, several alternatives exist. The S7-1200 supports a Modbus TCP server (MB_SERVER) instruction set out of the box, which allows external clients to read/write the same tags using standard Modbus function codes. OPC UA is available on CPU firmware V4.4 and later via the OPC UA server option, providing structured data and method calls.
For controllers from other vendors, comparable HTTP control exists but with different semantics. AutomationDirect's BRX Do-More series exposes a read-only REST-style interface over a dedicated TCP port documented in their product video library; writes are rejected by default. Siemens users who need write capability should rely on the AWP mechanisms described in this article, or migrate to a controller with a dedicated REST server such as the S7-1500 with OPC UA methods.
Field Commissioning Checklist
- Static IP set on CPU; backup of project file stored offsite.
- At least two CPU users defined: one operator (write access to Start/Stop only), one engineer (full).
- Ton duration configured via HMI tag, not hard-coded, for easier maintenance.
- HTML page tested from a second subnet to confirm firewall rules.
- Diagnostic buffer cleared before handover so future events are easier to correlate.
Can the S7-1200 web server replace a full HMI?
No. The web server is intended for diagnostics, low-rate control, and remote visibility. A full HMI (e.g., SIMATIC Comfort Panel) provides multitouch, alarm logging, and certified operator screens. Use the web server as a supplementary interface, not a primary operator panel.
Does the GET request need authentication?
Yes. From firmware V4.2 onward, all web server access requires HTTP Basic authentication with a configured user. Plan to send credentials in the client (browser, curl, or script) and prefer HTTPS for any non-local network.
How do I make the pulse duration user-configurable?
Expose a second AWP In_Variable (e.g., PulseSeconds, type Int) and write it to the PT input of the TON instance. The HTML page can include a numeric input that submits the value via GET on form change.
Why does the timer not retrigger on a second click?
Because the latch is broken the moment the timer reaches PT. If retrigger on each click is required, modify Network 1 so the latch is broken only by Stop, and add a parallel network that copies PulseTimer.Q to the timer's reset coil to clear ET when the output drops.
What is the maximum number of AWP pages the CPU supports?
The S7-1200 web server allows up to 1 MB of HTML in the user-defined pages area. In practice, keep total page weight below 200 KB to avoid noticeable load delays on slow links.