Device Proxy TIA Portal: V14 HMI with V11 S7-300 PLC

This technical reference documents a field-proven method for coupling a replacement SIMATIC TP1500 Comfort panel (6AV2 124-0QC02-0AX0), engineered in WinCC Comfort/Advanced V14, with an existing SIMATIC S7-300 controller whose STEP 7 program resides in a TIA Portal V11 SP2 project. Because the two engineering projects cannot be merged across major TIA Portal versions, the only viable approach is to exchange the controller's interface data through an Inter-Project Engineering (IPE) device proxy, configure the HMI connection with absolute addressing, and validate the runtime behavior on physical hardware rather than on PLCSIM.

1. Problem Statement and Constraints

The user's installed base presents four independent constraints that must be addressed before the wiring, HMI, and PLC will communicate as a single coordinated system:

1. CPU program in TIA Portal V11 SP2. The STEP 7 program for the S7-300 cannot be moved to a newer TIA Portal without a full project migration, which carries the risk of breaking HMI tag references that point to the original TP1500 Comfort that has now failed. The PLC project must remain in V11.
2. Replacement TP1500 Comfort panel ships with a newer operating system. WinCC Comfort/Advanced V11 SP2 rejects the panel and reports "Incorrect version of operating system is installed on the HMI device. Update operating system?" Because the original panel could not be backed up, an OS update is not possible. The new panel must therefore be configured with a newer WinCC version that recognizes the panel's firmware.
3. Two engineering workstations, two software versions. The CPU's STEP 7 V11 and the HMI's WinCC V14 are installed on different physical machines. The two TIA Portal instances must remain decoupled; only the controller's interface data is shared.
4. No backup of the original panel image. A full panel restore is therefore impossible. The HMI project must be rebuilt from documentation, or re-issued from the same source from which the original project was built.

Combined, these constraints rule out a single-project, single-version solution. The Siemens-blessed approach for this case is the device proxy, also referred to as Inter-Project Engineering (IPE).

2. Understanding the Device Proxy Mechanism

The device proxy is a placeholder for a real device inside a TIA Portal project. It carries the interface description (Profibus/PN IO device, slot, submodule I/O addresses, and diagnostic configuration) of a controller that lives in a different TIA Portal project or in a different version of the same project. The HMI project only needs the proxy to know the shape of the PLC's process image so that tags, alarms, and screens can be bound to addresses; it never compiles or downloads the PLC program.

Two exchange formats are commonly encountered in Siemens documentation:

• IPE file (*.ipe) — the binary or compressed description of one controller's interface, generated by the source project and consumed by the target project. The IPE is the unit of exchange for the device proxy.
• CAx data (*.xml / *.aml) — an AutomationML variant used for higher-level engineering data exchange. It is not the unit consumed by the standard device proxy import; it is mentioned here only to prevent confusion in field discussions.

The official Siemens notes on IPE are documented in the TIA Portal Help: Notes on IPE and the Siemens Industry Online Support portal under the WinCC Comfort/Advanced manual "Combined configuration with WinCC (TIA Portal) and STEP 7 (TIA Portal) in separate projects".

3. Prerequisites

Before opening either TIA Portal instance, verify the following items are available on the corresponding workstation. Missing any of them will surface as a confusing error during the proxy import or first download.

4. Step-by-Step Procedure

4.1 Export the IPE File from TIA Portal V11

1. Open the STEP 7 V11 project that contains the S7-300 CPU on the PLC workstation.
2. Confirm the project compiles cleanly: Project → Compile → All (rebuild all blocks). A project that fails to compile will produce an IPE that the importer cannot interpret.
3. In the project tree, expand the S7-300 station and locate the CPU object.
4. Select the Device proxy data folder. In V11 SP2 it appears as a sibling of Program blocks, PLC tags, PLC data types, and Watch and force tables. If the folder is not visible, right-click the CPU and select Add new proxy device data.
5. Right-click the proxy entry and choose Export → Device proxy data to IPE file. Specify a short path such as C:\ipe\S7300_Proxy.ipe on a network share accessible to the HMI workstation.
6. Confirm the IPE file size is in the range of 200–800 KB. An IPE of a few kilobytes indicates that the proxy was exported empty (a common symptom of selecting the wrong folder or of the project never having been compiled).

4.2 Import the IPE File as a Device Proxy in TIA Portal V14

1. Open the WinCC V14 project that contains the new TP1500 Comfort panel on the HMI workstation.
2. In the project tree, double-click Devices & networks to open the network editor.
3. Drag a PLC object from the hardware catalog into the network view. The catalog filter must be set to "SIMATIC S7-300"; for a CPU 315-2 PN/DP select the matching order number (for example 6ES7 315-2EH14-0AB0) or, for a 31x-2 DP, the Profibus variant.
4. On the dropped PLC, choose Import device proxy → IPE file and select the .ipe exported in step 4.1.
5. The PLC device in the HMI project is now a proxy. Its rack and module list reflect the original S7-300, but the slots are locked and the proxy cannot be edited. Only the IP address and the Profibus/PN parameters that the HMI uses to reach the proxy are editable.
6. If the import dialog reports "No CPUs or defined device proxy data were found", the source IPE is empty or the wrong folder was exported. Re-export from the V11 project, ensuring the export is launched from the proxy folder and not from the project root.

4.3 Configure the HMI Connection with Absolute Addressing

Because the HMI project does not contain the S7-300's program blocks, the HMI connection must be bound by absolute addressing rather than by symbolic references. Configure as follows:

1. Open Devices & networks in the HMI project and select the network view.
2. Click the green HMI connection handle on the TP1500 Comfort and drag the connection line to the proxy PLC. A new HMI_Connection_1 is created.
3. Open the connection's properties (double-click) and set the following:

4. In the Connections editor, ensure that the Online column is checked for the connection. The HMI will only attempt the connection handshake when the Online column is set.
5. Compile the HMI project (Project → Compile → Software (rebuild all)). Resolve any tag-address mismatches that surface, since the HMI is binding to absolute addresses (%DB123.DBW0) that the V11 PLC program must actually contain.

4.4 Bus Parameter Configuration

The bus parameters for Profibus or PROFINET are owned by the PLC, not the HMI. On the HMI side, only the station address of the HMI itself can be set:

• Profibus: TP1500 Comfort → Properties → Profibus interface → Address. Default is 1; change to the address the V11 project reserves for the panel. The Profibus baud rate, Tslot, Ttr, and min slave interval are read from the master and cannot be edited on the HMI.
• PROFINET: TP1500 Comfort → Properties → PROFINET interface → IP address → Subnet → Router. Use the address range configured in the V11 project's PN subnet. The device name must be the same as the IO device name expected by the controller; this is configured in the V14 project on the HMI side because the proxy carries only the controller side of the PROFINET relationship.

Setting bus parameters on the HMI side is therefore a common stumbling block. If the V14 project refuses to accept the desired baud rate, this is by design: the HMI inherits the bus profile from the controller. Push the bus profile to the controller (or accept the controller's profile) and only adapt the HMI's station address.

4.5 Download to the Physical TP1500 Comfort

1. Connect the HMI workstation's Ethernet port to the TP1500 Comfort's PN/IE port (X1). Set the workstation's IP to the same subnet as the panel's service IP (default 192.168.1.1 with the panel at 192.168.1.2 on transfer mode).
2. On the panel, open Control Panel → Transfer → Set transfer mode and enable PN/IE as the transfer channel.
3. From the V14 project, right-click the TP1500 Comfort and select Download to device → Software (all). TIA Portal will transfer the runtime, the project, and (if requested) the panel OS image.
4. Watch the panel's transfer dialog for the message Transfer complete → Restart. The panel reboots into runtime.
5. Verify the connection status icon in the system bar of the runtime; it must show a connected state. A red icon means the panel cannot reach the CPU — typically because the Online column in the HMI connection is not activated, or the controller's IP is on a different subnet.

5. PLCSIM Limitations Across Mixed TIA Versions

PLCSIM is the right tool for early commissioning, but with mixed TIA versions it produces misleading results. The user's experience (PLC and HMI both simulated, yet the HMI does not react to tag changes) is reproducible and is a documented constraint:

• When the S7-300 is simulated in V11 and the TP1500 Comfort is simulated in V14 on the same workstation, only one TIA Portal instance can hold the local S7ONLINE interface at a time. TIA Portal reports "Starting simulation will disable all other online interfaces". The HMI simulation in V14 cannot see the PLC simulated in V11 because V11 has captured the local interface.
• The mitigation is to migrate the PLC's STEP 7 program to V14 temporarily, simulate both PLC and HMI in V14 to verify the screens, then roll the PLC project back to V11 for download. The tag and address layout does not change between V11 and V14 for an S7-300, but the project must be re-archived and a V11 SP2-compatible save performed before returning to production.
• An alternative is to use the physical S7-300 and the physical TP1500 Comfort for verification; PLCSIM is dropped from the loop and the cross-version problem disappears.

6. Versioning Rules for the Device Proxy

The device proxy can be used across TIA Portal versions, but the rule documented in Siemens I/O is that the consumer (target) of the IPE must run in the same or a higher TIA Portal version than the producer (source). The combinations relevant to this article are:

For the V11 → V14 path used here, the V11 project exports and the V14 project imports. The V14 project can never push a device proxy back into the V11 project; the V11 project has no UI affordance to import a V14 IPE.

7. Notes on IPE: System Diagnostics and PLC Alarms

When the HMI is bound to the PLC through a device proxy, the HMI can still display system diagnostics views and PLC alarms originating from the real controller. The official Siemens guidance, summarized in the TIA Portal Help: Notes on IPE, states:

• Insert the System diagnostics view in the HMI project and bind it to the proxy PLC. The view resolves diagnostic buffers only when the panel is online with the real CPU.
• For PLC alarms to be visible in the HMI's alarm view, the alarms must be inserted as a content of the device proxy (right-click the proxy → Add new proxy device data → PLC alarms). The alarm text and class are taken from the original S7-300's PLC alarm configuration, which is exported as part of the IPE.
• The proxy cannot be edited in the HMI project. If a new alarm is added to the V11 PLC, the IPE must be re-exported and re-imported in the V14 project. The HMI does not auto-refresh alarms from the live CPU.

8. Wiring and Electrical Verification

Before relying on the proxy connection, physically verify the wiring according to the original cabinet drawings. The TP1500 Comfort supports both Profibus and PROFINET on the same unit, but the connector assignments differ:

Verify the Profibus termination at the panel and at the PLC: measure approximately 220 Ω between pins 3 and 8 with the cable disconnected from any active device. For PROFINET, verify the link LEDs on X1 of both the panel and the S7-300 PN port.

9. Verification Procedure

After download and before handing the machine back to production, run the following verifications. The list is ordered from cheapest to most expensive (in terms of risk to running equipment):

1. Connection handshake. Open the runtime on the TP1500 Comfort. Look for the connection icon in the system bar; it must show a connected state. If it is red, the Online column on the HMI connection is not activated, or the controller's IP is unreachable.
2. Tag round-trip. Create a temporary screen with two I/O fields: one tied to an input word (for example %IW0 from the proxy), one tied to an output word (for example %QW0). Force a value from the STEP 7 V11 watch table and confirm that the I/O field updates within 200 ms (the default WinCC acquisition cycle).
3. Alarm round-trip. Trigger a known PLC alarm (for example a high-temperature alarm on a configured tag) from the V11 program. Confirm that the alarm appears in the HMI alarm view with the correct text and class. If the alarm does not appear, the PLC alarms have not been added to the device proxy — re-export and re-import the IPE.
4. Screen switching. Navigate to every configured screen. Confirm that no field shows a "???" or "invalid address" placeholder. Replace any address that does not exist in the V11 program.
5. Recipe and audit trail. If the original machine used recipes or user administration, validate the recipe transfer and the login flow on the new panel. Recipes created in V11 and used by an S7-300 in TIA Portal are forward-compatible with V14, but the recipe structure in the HMI project must match the data block layout exactly.
6. Restart and cold start. Power-cycle the panel and the CPU. Confirm that the connection re-establishes automatically within the configured timeout. The default WinCC connection timeout is 30 s; the panel will report "connection to PLC ... interrupted" for that interval until the handshake completes.

10. Troubleshooting Matrix

11. Migration Alternative and When to Choose It

If the V11 PLC project has no HMI references left (because the original panel is dead and will not be replaced), or if the user is willing to absorb a one-time migration cost, the alternative is to migrate the PLC project to TIA Portal V14, keep a single project, and configure the HMI in the same project. Migration gains:

• A single engineering environment for PLC and HMI.
• PLCSIM works in one version — V14 — for both controller and panel.
• Direct symbolic tag binding from the HMI to the PLC; the device proxy is no longer needed.
• Shared cross-references, automatic tag consistency check, and unified documentation.

Migration cost:

• STEP 7 blocks must be re-compiled in V14. A small set of S7-300 libraries (notably F-library blocks and older GRAPH sequencers) need to be re-imported in V14 form.
• Hardware catalog entries for modules that were added with older HSPs may need a newer HSP.
• The S7-300 program must be re-downloaded to the controller (CPU goes into STOP during download). Plan the migration during a planned downtime window.

For greenfield machines or machines that are already in for major service, migration is the cleaner path. For a field repair where downtime must be measured in hours, the device-proxy path documented above is the right choice.

12. Summary Procedure Checklist

1. On the V11 workstation: compile the S7-300 project; export the IPE from the Device proxy data folder of the CPU.
2. On the V14 workstation: open the HMI project; drag a CPU of matching type into the network view; import the IPE as a device proxy.
3. Connect the TP1500 Comfort to the proxy PLC; activate the Online column; set the absolute IP and rack/slot.
4. Bind HMI tags to absolute addresses (%DBx.DBWy, %IWz, %QWz) that exist in the V11 PLC program.
5. Add PLC alarms to the device proxy and re-export/re-import if any alarm is added on the PLC side later.
6. Compile and download to the physical panel. Verify the connection, tag round-trip, alarm round-trip, and screen switching.
7. For PLCSIM verification, migrate the PLC project to V14 temporarily or use physical hardware.