Overview
When a Siemens S7-1500 automation cell and a fleet of SIMATIC HMI panels are engineered by different teams, it is often impractical to keep both the PLC program and the HMI screens inside a single TIA Portal project. Source compilation time, library contention, and Siemens license limits all push large projects toward a multi-project workflow. Siemens addresses this with the Device Proxy Data mechanism, which lets one TIA project publish a snapshot of an S7-1500 CPU (its symbols, data blocks, and connection parameters) so that a second TIA project can bind a SIMATIC HMI to that CPU without ever opening the original PLC program.
This article documents the exact export and import procedure for Device Proxy Data, explains why TIA Portal V15 Update 3 raises the 0036:000001 error when a user attempts to initialize a proxy CPU, and provides a multi-panel topology for 50 KTP700 units that maintains a single source of truth for the PLC tag database.
When Device Proxy Is the Right Tool
Device Proxy Data is a TIA Portal feature designed for one specific scenario: an HMI engineer in TIA needs the symbol interface of a PLC that lives in another project (frequently a Classic STEP 7 / SIMATIC Manager project) and cannot be opened from TIA. The published SIMATIC HMI at a glance with TIA Portal manual confirms that the proxy is generated as a stand-in CPU and that initialization of the proxy only succeeds if valid Device Proxy Data is selected on disk.
Typical situations where the workflow applies:
- Multiple developers must edit PLC and HMI code in parallel on independent TIA installations.
- The PLC project is on a controlled-release branch and should not be branched per HMI change.
- You are scaling from a small number of panels (1-2) to dozens of identical panels (e.g., 50 KTP700 Basic DP or Comfort units) without copying the PLC source code into every HMI project.
- OEM machine builders deliver a sealed PLC binary plus a published proxy to system integrators.
Prerequisites
Verify the following before beginning the export:
| Item | Requirement | Notes |
|---|---|---|
| TIA Portal version | V15, V15.1, V15 Update 3 or later (V16/V17/V18 also supported) | Device Proxy Data folder is present in every TIA version from V14 SP1 onward. |
| PLC project | S7-1500 CPU compiled without errors (e.g., 6ES7517-3AP00-0AB0 / 1517-3 PN/DP) | Compile must finish with 0 errors; warnings are tolerated. |
| HMI project | TIA Portal with HMI option installed and a KTP700 / KTP700 Basic / Comfort panel added | Panel must be created before importing the proxy. |
| Licenses | STEP 7 Professional, WinCC Professional/Comfort (panel class) | Device Proxy export does not consume an additional license; runtime HMI licenses are unaffected. |
| File share | Read access to the folder holding the exported *.zip / *.pnml proxy file | Network share or local path; permission errors here will surface as 0036:000001. |
Error 0036:000001 Root Cause
The HMI engineer creates a new SIMATIC S7-1500 device inside the HMI project and tries to mark it as a proxy by selecting Initialize device proxy. TIA Portal then prompts for a data source. Two outcomes are possible:
- The selection dialog points to a valid Device Proxy Data file generated from the source PLC project. TIA loads symbols, FB/FC/DB interfaces, and the connection configuration. No error appears.
- The selection points to a file that does not contain proxy data, or the dialog is cancelled. TIA then raises
Error 0036:000001: No CPU, no proxy data found. Do you want to try to open another source of data?
The error string is generated by the HMI device configurator when its import parser cannot locate a <Cpu> element in the supplied XML / TIA-XML payload. The most common user-side cause is that the export step in the PLC project was skipped or the wrong file (a normal project archive .zap15 rather than the Device Proxy export) was selected.
Step-by-Step: Exporting Device Proxy Data from the PLC Project
- Open the TIA Portal project that contains the S7-1500 CPU (here: 6ES7517-3AP00-0AB0 in a project named
Cell_A_PLC). - Select the CPU device in the project tree.
- Open the Device Proxy Data folder below the CPU. If the folder is not visible, right-click the CPU and confirm the option Show all Device Proxy Data is enabled (this option appears after TIA V14 SP1).
- Right-click the Device Proxy Data folder and choose Add new Device Proxy Data.
- In the dialog, name the proxy (e.g.,
Cell_A_HMI_Proxy_v003) and choose the visibility scope:- Public — all tags, blocks, and data types; required for an HMI engineer who needs the full symbol set.
- Read-only — for documentation tools or third-party systems.
- Confirm with OK. TIA compiles the CPU and produces a proxy object below the folder.
- Right-click the new proxy object and choose Export Device Proxy Data. Select a folder, accept the default
.ziparchive, and confirm. - Send the resulting
*.zipto the HMI engineer over a controlled file share. Do not distribute the original TIA project archive (*.zap15); it does not contain the proxy schema TIA expects on import.
What the exported archive contains
| File | Purpose |
|---|---|
DeviceProxy.aml |
AutomationML description of the CPU, including name, type, and IP address hints. |
symbols.xml |
All exported PLC tags, DB members, and I/O symbols in TIA-XML form. |
blocks.xml |
Block interface descriptions (FB/FC/OB parameter list) without compiled code. |
connections.xml |
S7 connection parameters (TSAPs, port, rack/slot) for the HMI ↔ PLC link. |
Step-by-Step: Importing Proxy Data into the HMI Project
- Open the HMI-only TIA project (e.g.,
Cell_A_HMI_50Panels). - In the project tree, add a new device: Add new device → SIMATIC S7-1500 → CPU 1517-3 PN/DP (or the exact model used in the source project; matching the model avoids HMI tag-check warnings).
- Right-click the new CPU and choose Initialize device proxy.
- Browse to the exported
*.zipfrom the previous section, select it, and confirm. - TIA populates the proxy CPU with the published tags and data blocks. The Devices & Networks editor will show a configured S7 connection referencing the proxy's TSAPs.
- Save the project. The proxy CPU is now a stand-in the HMI can compile against.
Configuring the HMI Connection to the Live PLC
The proxy is a development-only artifact. At runtime, every HMI must talk to the real CPU over PROFINET. Edit the HMI connections in the HMI project:
- Open Devices & Networks.
- Select the S7 connection from the proxy CPU to the HMI.
- Change the Partner (PLC) IP address from the proxy placeholder to the real CPU's PROFINET IP, e.g.,
192.168.0.10. - Set the access point to S7ONLINE and the connection resource to the same TSAPs the proxy exported (default for CPU 1517:
03.01for slot 1, rack 0). - Repeat for every KTP700 — but use the panel's own IP, not the proxy IP, on the HMI side.
For a fleet of 50 panels, a single project can still drive the proxy as long as the panels are configured individually under the same HMI project root. Each panel then has its own HMI connection pointing to the real PLC IP.
Multi-Panel Topology with 50 KTP700 Units
The reference layout for a 50-KTP700 cell driven by an S7-1517:
-
PLC rack: one CPU 1517-3 PN/DP at
192.168.0.10, PN interface X1 connected to the cell switch. - Cell switch: managed PROFINET switch, e.g., SCALANCE XC208, with all panels on the same VLAN.
-
KTP700 panels: addresses
192.168.0.101through192.168.0.150; mask255.255.255.0; gateway192.168.0.1. - HMI ↔ PLC update rate: 250 ms acquisition cycle for status, 1 s for non-critical diagnostics — tune in the HMI tag properties.
Symbolic vs Absolute Addressing
Device Proxy Data preserves symbolic names. Continue to program HMI tags symbolically — do not switch to absolute addressing simply because the PLC is hidden. Symbolic tags survive PLC re-import, while absolute addresses (e.g., %DB101.DBX0.0) become stale the moment the PLC engineer reorganises data blocks.
| Approach | Behavior across proxy re-imports | Recommended? |
|---|---|---|
Symbolic (e.g., Cell.Motor1.Speed) |
Tags rebind automatically; name changes flagged at compile. | Yes |
Absolute (e.g., %DB101.DBD4) |
Tags break silently if DB layout changes. | No |
| Mixed | Compile warnings, occasional runtime Address not available alarms. | Avoid |
Performance and Network Considerations
An S7-1517 can service many S7 connections in parallel, but each KTP700 connection is an S7-connection (HMI ↔ PLC) that uses one CPU connection resource. Keep these numbers in mind:
- The CPU 1517-3 PN/DP supports up to 128 active S7 communication connections (subject to the active connection resource count, configurable in the CPU properties → Communication). 50 panels fit comfortably.
- Each S7 connection is set up using the S7ONLINE access point; the HMI runtime is started on the panel, not the PLC.
- Avoid running every panel at the default 100 ms acquisition cycle. Group high-priority tags at 100 ms, status tags at 250-500 ms, and pure diagnostics at 1-2 s to keep the PROFINET load under 30% on the cell switch.
- For very large tag counts per panel, consider WinCC's area pointers (e.g., Date/time, Coordination, Project ID) rather than polling equivalent tags.
Limitations and Alternatives
Device Proxy Data has documented limits that often catch teams on large projects:
- Max 5,000 published tags per proxy in TIA V15/V16. TIA V17 raised the limit to 50,000 tags.
- PLC block code is not exported; the HMI engineer can only see FB/FC/DB interfaces, not the SCL/STL source.
- No version control integration. Track the exported
*.zipin the same Git/SVN repo as the PLC project and tag it with the PLC version. - Multi-user TIA server access to the source PLC project is not possible from the HMI project — by design.
Alternatives to consider when Device Proxy Data is not enough:
| Approach | When to use | Trade-off |
|---|---|---|
| Single combined TIA project on multi-user server | Small teams, frequent PLC/HMI co-changes | Server licensing, merge conflicts |
| OPC UA server on the CPU 1517 | Third-party dashboards, SCADA overlay | Extra CPU load, separate tag namespace |
| PUT/GET S7 communication between two TIA projects | Legacy STEP 7 + new TIA project mixed | Manual symbol maintenance |
| Shared global library in TIA | Type/version re-use across cells | Library master must be kept under change control |
Verification and Commissioning
- Compile both projects to zero errors. The HMI compile will surface any tag whose name was renamed in the PLC project since the last proxy import.
-
Download the HMI project to one panel and ping the PLC. Use the panel's Start Center → Settings → Network to verify the IP route to
192.168.0.10. - Open the panel's diagnostic page (Settings → System → Information). Confirm the S7 connection reports Connected and shows the PLC's MAC address and IP.
- Watch the PLC's online connection list. In TIA, open the CPU → Online & Diagnostics → Connections. Each panel shows up with its own S7 connection ID.
- Force a tag from the panel (e.g., a bit in a control DB) and observe the change in the PLC's watch table to confirm end-to-end symbolic binding.
Troubleshooting Matrix
| Symptom | Likely cause | Fix |
|---|---|---|
0036:000001 on proxy initialization |
Wrong file selected (project archive, not proxy export) or TIA version mismatch | Re-export from the PLC project via Device Proxy Data → Export; align TIA versions on both projects |
| HMI compile shows Address not available on tag | Symbol was renamed or DB moved in PLC | Re-import proxy, then run Project → Cleanup → Unused tags |
| Panel shows Connection failure at runtime | Proxy IP not replaced by real CPU IP in HMI connection | Edit the S7 connection in Devices & Networks; set partner IP to the real PLC |
| Random panels lose connection on PROFINET storm | Acquisition cycles too aggressive across 50 panels | Stagger cycles to 250 ms / 500 ms / 1 s per tag class |
| Error Too many connections on the CPU | Number of HMI connection resources exceeded (default limit lower than 128 on older firmware) | Raise active connection resources in CPU properties → Communication; check CPU firmware ≥ V2.6 for full 128 connections |
Frequently Asked Questions
Why does TIA Portal V15 Update 3 raise error 0036:000001 when initializing a device proxy?
The HMI project is being pointed at a file that is not a Device Proxy Data export (for example, a normal .zap15 project archive) or the export was created by a different TIA version. Re-export via the CPU's Device Proxy Data → Export menu in the source PLC project and match TIA versions on both sides.
Can 50 KTP700 panels share a single TIA HMI project that uses a device proxy?
Yes. Add one proxy CPU of type S7-1500, import the proxy data, then add 50 KTP700 devices under the project tree. Each panel gets its own HMI connection to the real PLC IP; the proxy is only a compile-time placeholder.
How many S7 connections can a CPU 1517-3 PN/DP handle for HMIs?
Up to 128 active S7 communication connections, depending on the configured active connection resources in the CPU properties. 50 panels is well within the limit; verify the count in CPU properties → Communication and confirm CPU firmware is V2.6 or later for the full 128.
Does the device proxy export include the compiled S7-1500 program code?
No. Device Proxy Data exports symbols, DB/FB/FC interfaces, and connection parameters only. The HMI engineer sees the same tag namespace as the PLC, but no STL/SCL source or block code.
What acquisition cycle should I set on 50 KTP700 panels to keep PROFINET load low?
Use 100 ms only for high-priority status, 250-500 ms for normal tags, and 1-2 s for diagnostics. Stagger the start times of the panels' acquisition jobs by a few seconds in TIA to avoid synchronized PROFINET bursts across all 50 connections.