Fixing TIA Portal V13 TP1500 Comfort Simulation Communication with a Real S7-1500 PLC

When commissioning an HMI application in TIA Portal V13 SP1 against a physically connected S7-1500 CPU 1516, engineers frequently reach for the integrated HMI simulator to validate screens before the real TP1500 Comfort arrives on the bench. In the majority of cases the HMI runtime boots, the project loads, and the developer is left watching a frozen faceplate: tags defined in the PLC tag table do not animate, and the simulated TP behaves as if no PLC were attached. This article documents the layered root cause, the exact configuration that resolves it, and the verification procedure that proves the link is healthy.

1. Problem Description

The reported symptom pattern is consistent across the entire Comfort line:

• PG/PC shows a working online connection to the S7-1500 (watch table animates, online diagnostics open without error).
• The HMI simulator (RT) starts, displays the configured start screen, and accepts inputs on local HMI tags.
• PLC tags, HMI tags mapped to PLC variables, and any animation driven by PLC values remain at their initial value.
• No connection error popup is raised by the runtime, but the Connections node in the HMI device diagnostics shows the integrated connection is not established.

The same configuration works on the physical TP1500 once it is connected to the same subnet, confirming the project itself is correct. The fault therefore lies in the path between WinCC Runtime on the PC and the S7-1500's PROFINET interface.

2. Root Cause Analysis

Three independent misconfigurations have been observed in the field, and they all manifest with the same frozen-tag symptom. Resolving the issue requires verifying all three, not just the first one the engineer happens to find.

The most common of these — and the one that consumed the most bench time in the source case — is item 1. Engineers frequently set the access point to S7ONLINE → TCPIP.Auto.1 while debugging an issue with another tool (e.g., a CP card, a virtual adapter, or a remote routing path), and then forget to revert. The Auto entry is a wildcard that picks the first available interface at boot; if a Hyper-V, VPN, or virtual Ethernet adapter enumerates before the physical NIC, every S7 packet is sent into the void.

3. PG/PC Interface Configuration (Primary Fix)

3.1 Required State

The S7ONLINE access point must be bound to the physical Ethernet adapter that is plugged into the S7-1500's PROFINET port. Open Windows Control Panel → Set PG/PC Interface and confirm the following:

• Access Point of the application: S7ONLINE (NOT S7ONLINE(STEP7) or any renamed copy)
• Interface Parameter Assignment Used: <YourNetworkCard>.TCPIP.1
• The physical NIC entry shows a green indicator and the correct IP is bound

3.2 Procedure

1. Close TIA Portal and any running WinCC Runtime.
2. Open Control Panel → Set PG/PC Interface.
3. In Access Point, select S7ONLINE.
4. In Interface Parameter Assignment, expand the TCP/IP branch and select the entry that matches the NIC physically connected to the PLC (e.g., Intel I219-V TCPIP.1). Do not select any Auto entry.
5. Click OK and confirm the prompt to set this as the default.
6. Restart TIA Portal.

3.3 Verification

From a command prompt on the engineering PC:

ping <S7-1500 IP address>
arp -a | findstr <S7-1500 IP address>

The ping must succeed, and the ARP entry must show the MAC of the S7-1500's PROFINET port (printed on the CPU front plate and visible in Online → Accessible Nodes in TIA Portal). If the ARP entry is missing, the packet is being sent to the wrong interface — the PG/PC setting is still wrong.

4. HMI Connection Access Path

The TIA Portal HMI editor can be configured independently of the Windows-level PG/PC interface. Even with the system set correctly, the integrated HMI connection may still resolve to a stale access path.

4.1 Required State

Open HMI device → Connections → [Connection name] → Properties → Access Path and confirm the access point is the unversioned S7ONLINE, not S7ONLINE1 or S7ONLINE(STEP7).

4.2 Correction Procedure

1. Select the TP1500 Comfort in the project tree.
2. Open Connections in the device editor.
3. Select the integrated S7 connection (the one pointing to PLC_1).
4. In Properties → Access Path, change the access point to S7ONLINE.
5. In the same panel, change the Interface used in subnet to the explicit Ethernet NIC (matching the PG/PC setting from Section 3).
6. Compile the HMI device (right-click → Compile → Software (rebuild all)).

5. PLC Protection and PUT/GET Access

Since STEP 7 V13 the S7-1500 enforces an integrated protection model. If the CPU has been moved from one project to another, or if the security configuration was set during pre-commissioning, the HMI runtime can be denied access even when the network path is correct.

5.1 Required State

• Protection & Security → Access level: at minimum Full access or Read/write access with HMI access for the project in question.
• Connection mechanisms → Permit access with PUT/GET communication from remote partners: enabled.

5.2 Procedure

1. Select the S7-1516 in the project tree.
2. Open Properties → Protection & Security.
3. Set the protection level to Full access (no protection) for development, or to HMI access with a project password.
4. Check Permit access with PUT/GET communication from remote partners.
5. Compile the PLC and download to the CPU.

6. Network and IP Configuration

The TP1500's IP address configured in the project is irrelevant for HMI simulation; the runtime uses the engineering PC's network stack. What does matter is that the PC and the S7-1500 share a routable subnet.

6.1 Common Network Defects

• Windows firewall blocks outbound TCP/UDP on ports 102 (S7 communication) and 34962–34964 (PROFINET discovery).
• Spanning tree on a managed switch has the PLC port in a non-edge state, delaying link-up past the simulator's connection timeout.
• VPN client has added a default route to the wrong interface, hijacking the S7-1500 traffic.

7. Real PLC vs PLCSIM — Why the Fix Differs

Engineers searching for this issue will find the Siemens FAQ 88193789, which describes a separate problem class: S7-PLCSIM V13 uses a different access point than legacy S7-PLCSIM for the S7-300/400. If you are working with a real PLC, the FAQ does not apply — but the symptoms look identical (tags do not animate in the HMI simulator), which is why so many engineers chase the wrong fix.

8. Step-by-Step Resolution Procedure

Execute these steps in order; verify the link after each step before moving to the next.

Step 1 — Pre-checks

• Confirm the S7-1500 is reachable: ping <PLC IP> succeeds.
• Confirm TIA can go online with the PLC: Online → Accessible Nodes shows the CPU.
• Close TIA Portal before changing the PG/PC interface.

Step 2 — Fix PG/PC Interface

1. Open Set PG/PC Interface.
2. Set S7ONLINE → explicit <NIC>.TCPIP.1.
3. Click OK.

Step 3 — Fix HMI Access Path

1. Open the TP1500 device editor in TIA.
2. Open Connections.
3. Set the integrated connection's access point to S7ONLINE and the subnet to the explicit NIC.
4. Compile the HMI software (rebuild all).

Step 4 — Fix PLC Protection

1. Open PLC device properties → Protection & Security.
2. Set protection to Full access.
3. Enable Permit access with PUT/GET communication from remote partners.
4. Compile and download to the PLC.

Step 5 — Start the Simulator

1. In the TIA Portal project tree, right-click the TP1500 → Start Simulation.
2. WinCC Runtime opens, downloads the compiled RT image, and attempts to connect.
3. The status bar of the runtime should transition to Connected within 5–10 seconds.

9. Verification Procedure

A working link is proven by the following checks, all of which must pass:

1. Runtime status: HMI → Diagnostics → Connection shows the integrated connection as Established with the correct PLC IP.
2. Tag animation: a tag of type Bool in the PLC tag table is forced via the watch table to TRUE; the corresponding indicator on the simulated TP must change state within 250 ms (default WinCC Comfort update cycle).
3. Bidirectional write: an input field on the simulated TP writes back to the PLC tag, and the watch table reflects the new value within 250 ms.
4. Connection diagnostics: Online → Online & Diagnostics → PROFINET interface on the S7-1500 shows an active PROFINET connection with the engineering PC's MAC.
5. Event log clean: no S7 connection aborted entries appear in the PLC's diagnostic buffer during the test.

10. Troubleshooting Matrix

11. Field-Proven Caveats and Edge Cases

11.1 The "Auto" trap

Engineers who switch to TCPIP.Auto.1 for a one-off task (e.g., connecting to a remote PLC over VPN) often forget to revert. The HMI simulator then silently picks the wrong adapter. The cost of an explicit binding is zero — there is no reason to use Auto in development.

11.2 Virtual adapters

Hyper-V, WSL, Docker Desktop, VMware Workstation, and the Windows Wi-Fi Direct Virtual Adapter all create virtual Ethernet interfaces that may enumerate before the wired NIC. If Auto is selected, the simulator may bind to any of them. Use Get-NetAdapter | Sort-Object ifIndex in PowerShell to confirm the wired NIC's ifIndex is the lowest, or simply bind the explicit adapter.

11.3 Multi-PLC projects

If the project contains more than one S7-1500, each HMI connection may have its own access point. Ensure the integrated connection for PLC_1 is the one with the corrected access path.

11.4 TIA Portal version

This fix is specific to V13 SP1 and later. In V13 (no SP), the access point dialog behaves the same but the simulator requires an additional PC runtime license in the WinCC Runtime Professional line. In V14 and later, the same fix applies; in V15, the runtime is called WinCC Runtime Unified only for Unified panels, but the Comfort line still uses the Comfort runtime, so the procedure is identical.

11.5 Why no popup

The WinCC Comfort runtime does not raise a dialog when a connection cannot be established — it simply holds the tags at their initial values. This is by design (you do not want an alarm dialog blocking an HMI on a shop floor), but it is unhelpful for development. Enable Tools → Runtime settings → Alarm logging → Connection events to surface these in the event log during commissioning.

12. Summary

For a real S7-1500 + simulated TP Comfort in TIA Portal V13 SP1, the three-step checklist that resolves 95% of "tags do not animate" issues is:

1. PG/PC interface: S7ONLINE bound to the explicit wired NIC's TCPIP.1.
2. HMI connection: access point S7ONLINE, subnet bound to the same explicit NIC.
3. PLC protection: Full access and Permit access with PUT/GET enabled.

Once all three are aligned, the HMI simulator connects to the real CPU within seconds and the developer can continue building screens without the physical panel on the bench.

Frequently Asked Questions