Fix HMI 190011/190020 Errors with S7-1200 FW 4.7 in TIA V13

Fix HMI Communication Errors 190011 and 190020 with S7-1214C FW 4.7 and TIA Portal V13

Symptom: WinCC Runtime on a KTP1000 Basic Color PN (firmware V12) raises alarms 190011 and 190020 after a new S7-1214C CPU with firmware 4.7 is integrated into an existing TIA Portal V13 project that originally targeted an S7-1215C FW 4.1. Existing tags keep working; newly added tags, screens, and functions trigger the errors continuously. This article documents the root cause, walks through a diagnostic sequence, and lists three field-proven resolution paths with their trade-offs.

1. Affected System Configuration

2. Root Cause: TIA Portal V13 Cannot Natively Model FW 4.7

When a TIA Portal V13 device library encounters an S7-1200 CPU whose firmware exceeds the bundled firmware version list, the engineering tool performs an implicit "device downgrade" and writes the project as if the CPU were the latest supported firmware (FW 4.1 at the time of V13 GA, FW 4.2 after V13 SP1/HSP updates). The following consequences apply:

1. Loss of FW 4.7 functional scope. New system blocks, the additional protected DB types, expanded Recipe and Trace capabilities, and security improvements from firmware 4.4+ onward are removed from the project image at compile time.
2. Asymmetric compile output. The S7-1214C online in the cabinet still runs the real FW 4.7 system blocks; the HMI project compiled in TIA V13 assumes FW 4.1 block semantics. Tag requests the Basic Panel issues are answered differently than expected by the runtime.
3. Connection-handshake timeout on the first request after screen change. The HMI tries to read a tag whose slot or slot-region was not present in the FW 4.1 image (for example, an optimized-access DB or a new instance DB of a FW 4.4+ block). The CPU responds with an S7 negative acknowledgement that WinCC RT surfaces as alarm 190020; the connection itself drops and is re-raised as 190011 on the next cycle.
4. PLC access protection default in FW 4.4+. Beginning with firmware 4.4, Siemens changed the default CPU access level so that read/write from HMI partners is denied unless an explicit PUT/GET permission is granted under Properties → Protection & Security → Connection mechanisms. TIA V13 cannot place this toggle in the device configuration because it does not know the property exists; the compiled image therefore omits the bit, and the runtime applies the FW 4.7 default (denied).

3. WinCC Runtime Error Codes 190011 and 190020

These are system alarms generated by WinCC Runtime on the panel. They are not PLC-side diagnostic buffer entries, so they will not appear in the S7-1200 diagnostic buffer. To confirm the channel state on the PLC side, open Online & Diagnostics → Diagnostics buffer in TIA Portal or via the web server of the CPU (default port 80) and look for events with ID 0x02 / 0x03 ("Communication error") around the time the alarm was raised.

4. TIA Portal and S7-1200 Firmware Compatibility Matrix

Selecting the engineering tool version is the single most important decision for fixing the alarm pair. The matrix below is derived from the published SIMATIC S7-1200 Programmable Controller System Manual edition 06/2021 and the TIA Portal release notes.

The key data point: only TIA Portal V16 (and the matching TIA Portal V16 Update 1 for full feature parity) creates a project image that matches a real FW 4.7 CPU. TIA V15.1 can compile a project against a FW 4.6 image, which already contains the protection/optimized-DB semantics the CPU expects, so alarms drop in many cases even with V15.1.

5. KTP1000 Basic Color PN Constraints

The KTP1000 Basic Color PN (MLFB 6AV6647-0AE11-3AX0) is a low-end panel introduced with the original S7-1200 generation. It has hard runtime limits that interact with the upgrade question:

• Maximum number of tags: 1 024 PowerTags total in the project.
• Maximum number of connections: 4 simultaneous S7 connections.
• Maximum number of screens: 100 in the project file.
• Runtime image version: WinCC RT Advanced V12.0.0.0 (build 12.00.00.00_07.20). Higher TIA Portal versions can compile to that image only if the Compiling to WinCC RT Advanced V12 option is selected under Runtime settings → General.
• Scripting: No VB-style scripting; only the small footprint of "planned actions" and the limited set of system functions available on Basic Panels.

6. Diagnostic Procedure

Run the sequence below before changing hardware. It isolates whether the failure is configuration or compatibility.

6.1 Verify network reachability from the panel

1. On the KTP1000, open Control Panel → Network and Dial-up Connections → PN_X1.
2. Confirm the IP address, subnet mask, and PROFINET device name match the PLC partner.
3. Use Start → Programs → Command Prompt (if available on the panel build) and run ping <PLC_IP>. A successful reply rules out Layer-1/Layer-2 issues.

6.2 Verify S7 connection state from the engineering station

1. In TIA Portal V13, open Online → Accessible devices.
2. The S7-1214C FW 4.7 should be listed with type "S7-1200", firmware "V4.1.0" (the downgraded view) – this is normal.
3. Right-click → Online & Diagnostics → Protection. Confirm Full access (no protection) is shown or that the HMI's PG/PC role is granted.
4. Open the CPU's Properties → Protection & Security → Connection mechanisms. If the toggle Permit access with PUT/GET communication from remote partner (PLC, HMI, OPC, …) is off, the HMI cannot write tags and read-only tags will work inconsistently. This is the FW 4.4+ default behaviour and is the most common cause of the exact "original tags work, new tags fail" pattern reported.

6.3 Capture WinCC Runtime system alarms

1. In the running HMI project, navigate to the screen that uses the new tags.
2. Wait for the alarm line at the bottom of the screen to populate.
3. Trigger System → Alarm Log (or open the configured alarm view) and export the last 100 alarms with timestamp.
4. Sort by alarm number; if 190011 and 190020 cluster within 200 ms of one another, the channel is dropping because of the handshake failure described in section 2.

6.4 Cross-check tag addresses

1. Mark the failing HMI tag in TIA Portal, right-click → Go to → Tag in PLC.
2. The online tag in the FW 4.7 CPU must exist. If the tag points to an optimized-access DB created in the FW 4.7 image but the TIA V13 project compiled it as a standard DB, the address arithmetic will be off by the slot prefix and every request will return "Address out of range".

7. Resolution Path A: Upgrade TIA Portal to V16 (Recommended)

This is the sustainable fix for the machine's lifecycle and removes the firmware/TIA mismatch permanently.

1. Take a backup of the existing TIA V13 project: Project → Archive.
2. Install TIA Portal V16 on a separate engineering station (do not uninstall V13 – both versions can coexist on the same PC and V13 is still required for the existing KTP1000 V12 image until step 6).
3. Open the project in V16 and let the migration assistant convert the project file. Choose "Retain KTP1000 image version V12" on the migration dialog.
4. Replace the S7-1214C device in the project tree: right-click → Change device → S7-1214C DC/DC/DC, FW 4.7. Accept the auto-updated device version.
5. Re-open the HMI connection editor and verify the partner is the new device, not the legacy FW 4.1 entry.
6. Recompile the HMI program. In Runtime settings → General → Image version, switch from V13 image to V16 image; the panel firmware is also upgraded in this step (see step 7).
7. Use ProSave or a TIA Portal V16 download to load the panel image version 16.0.0.0 onto the KTP1000. The load takes roughly 8–12 minutes over Ethernet and preserves all existing recipes and alarms.
8. Download the new PLC hardware configuration and software to the S7-1214C FW 4.7.
9. Confirm PUT/GET permission is now enabled by default on the migrated project.

Verification: trigger the screens that previously raised 190020; alarms should clear within 5 update cycles. Open Online → Accessible devices and confirm the CPU now reports as FW 4.7.0.

8. Resolution Path B: Downgrade the S7-1200 Firmware to 4.2

Acceptable when the customer cannot change TIA Portal due to a long-running multi-machine fleet standardisation. The last S7-1200 firmware version fully compatible with TIA Portal V13 is FW 4.2 (HSP 0013).

1. Download the FW 4.2 update package from the Siemens Industry Online Support entry SIMATIC S7-1200 CPUs – firmware updates (article ID 109762833).
2. Open the existing FW 4.7 file (S7_1200_CPU_4xx_V04.07.00.upd) and the new FW 4.2 file (S7_1200_CPU_4xx_V04.02.07.upd) side by side.
3. Use a SIMATIC Memory Card (SMC) of at least 4 MB. Copy the FW 4.2 file to \SIMATIC\S7_1200\FW4.2\ on the card.
4. Insert the SMC into the S7-1214C with the CPU in STOP. Power-cycle the CPU; the LED pattern STOP-flash / MAINT-flash indicates the firmware update is in progress.
5. Wait for STOP steady. The CPU is now on FW 4.2.
6. Re-download the hardware configuration from the TIA V13 project. The compiled image now matches.

Verification: the panel raises no further 190011/190020 after a power cycle. Confirm with Online → Accessible devices that the CPU now reports FW 4.2.0 and that Protection → Access level = Full access (no protection) is back in effect.

9. Resolution Path C: Replace the S7-1214C FW 4.7 with an FW 4.1 or FW 4.2 Variant

If the spare-parts inventory allows it, swap the new CPU for one loaded with FW 4.1 (or a CPU that ships with FW 4.1 by default). The S7-1214C DC/DC/DC with firmware 4.1 has the order number 6ES7214-1AG40-0XB0 and was the standard variant through 2016. Used units in this firmware state are sometimes available from the Siemens refurbished stock.

1. Order the matching MLFB with the requested firmware. Siemens Exchange & Repair Services can usually deliver a CPU at any firmware version up to and including the most recent, but a downgrade at the factory must be specified explicitly.
2. Install and connect; download the unchanged TIA V13 project.
3. Verify the alarms disappear.

This is the lowest-risk path with respect to project engineering, but it is the most expensive and ties the machine to an obsolete firmware. Use only when the customer explicitly rejects an engineering-tool upgrade.

10. HMI Connection Configuration Checklist

Regardless of the path chosen, verify the items below once the new firmware/TIA combination is in place:

11. Preventive Measures for Mixed-Firmware Projects

• Maintain a single TIA Portal version per project. Mixed-firmware projects with mixed-firmware HMI panels are the single largest source of alarms in the field. When a new CPU enters the cabinet, upgrade TIA and the panel image in the same change ticket.
• Pin the TIA Portal version in the project name. e.g., Machine_X_TIA16_HWRev3.ap16. The archive contains a self-describing compatibility record.
• Document the firmware/TIA matrix inside the cabinet door. A laminated sheet listing the CPU order number, firmware, HMI order number, and TIA Portal version prevents the next maintenance technician from substituting a newer spare without thinking about the project.
• Always enable PUT/GET on FW 4.4+ CPUs when the project includes any third-party HMI or older WinCC RT panel. The default changed silently between FW 4.3 and FW 4.4 and is the most common field finding in the SIMATIC Knowledge Base.
• Keep at least one engineering station with TIA V13 or V13 SP1 installed until every Basic PN panel in the fleet has been migrated to V14 SP1 or later. Removing the old toolchain too early blocks emergency panel re-loads.

12. Summary

The error pair 190011 / 190020 on a KTP1000 Basic PN paired with an S7-1214C FW 4.7 in a TIA Portal V13 project is the signature of a firmware / engineering-tool mismatch. TIA V13 silently downgrades the FW 4.7 CPU to FW 4.1 in its project model, losing the PUT/GET permission toggle and the optimized-DB address semantics introduced with FW 4.4. The fix is one of three paths: upgrade TIA Portal to V16 (sustainable), downgrade the CPU to FW 4.2 (fleet-conservative), or replace the CPU with a FW 4.1 spare (single-machine workaround). Always verify the S7 connection parameters and the protection settings after the change, and treat any 190011/190020 alarm burst as a firmware-compatibility event until proven otherwise.