Resolving KTP1000 PN Transfer Mode: Cable and Boot Configuration

Problem Statement

On a fresh Siemens KTP1000 Basic PN panel (catalog group 6AV6647), commissioning a project via WinCC Flexible 2008 SP3 stalls at the very first hurdle: the panel boots straight into a "General Settings" or "This device has no project – go to Control Panel for more details" screen, and the Transfer / Start / Control Panel Start Center dialog never appears. Toggling power, attempting ProSave backup/restore, and forcing a TIA Portal transfer all fail to establish an Ethernet connection. The root cause in the majority of field cases is a PROFINET cable polarity mismatch between the engineering PC and the panel's PN port, compounded by a missing or non-default transfer target IP on the panel.

Other observable symptoms in this state:

• Panel boots to a static settings page; touch input is accepted but no menu structure is present.
• After several power cycles, the screen freezes on a "no runtime / no project" message.
• ProSave reports "Cannot establish a connection" or "Device not found" when scanning.
• TIA Portal's Online > Accessible nodes does not list the panel.
• Link LED on the panel's PROFINET port is OFF (no physical link) when connected to a PC NIC.

Affected Hardware and Firmware

Any first-generation Siemens KTP1000 Basic PN device in the 6AV6647-0Axxx-3AX0 family running firmware from the V11.x through V13.x (HMI image) is susceptible. Devices shipped with firmware V14.0.0.0 and later include Auto-MDIX in the PROFINET PHY, which largely masks the cable polarity problem. The fault therefore appears predominantly on:

Always confirm the exact catalog number on the rating plate against the Siemens SIMATIC HMI manual library before troubleshooting.

Root Cause Analysis

The PROFINET standard (IEC 61784-2 / IEC 61158) defines 100 Mbit/s Ethernet on two pairs (pins 1-2 and 3-6 of the RJ45). It mandates straight-through cabling when connecting devices to switches. The standard does not require Auto-MDIX on the device port. Older KTP1000 Basic PN hardware uses a Micrel KSZ8041 PHY that has no Auto-MDIX capability; the port is fixed MDI.

When a panel with a fixed-MDI PROFINET port is connected directly to a PC NIC (also typically fixed-MDI on older motherboards, or MDI-X on newer ones), the TX pair on one side can land on the RX pair of the other — yielding no link. The HMI image then has no LAN connectivity, the Start Center cannot fetch the transfer prompt, and the panel presents the user with a static settings screen rather than the expected Transfer / Start / Control Panel dialog.

Secondary causes that produce the same end-state must be ruled out:

1. PROFINET node IP address is 0.0.0.0 or outside the PC's subnet.
2. The PC firewall blocks UDP/TCP ports 102 (S7 / PNIO), 161 (SNMP), and 34964 (PNIO RT).
3. Transfer mode in the project is set to Manual with the wrong Target address.
4. Corrupt internal flash from an interrupted prior transfer (requires factory reset).

Prerequisites for Recovery

• 24 VDC / 1.5 A regulated supply with M12 or screw-type connector.
• Engineering PC with WinCC Flexible 2008 SP3 (or TIA Portal V13 SP1 / V14 SP1 with WinCC Comfort/Advanced).
• ProSave V13 (matches panel firmware; bundled with TIA Portal on the installation media).
• Ethernet cable: 1 × crossover (MDI-X) for direct PC ↔ panel; or a small unmanaged PROFINET switch plus a straight cable.
• Project source: a *.hmi file (WinCC Flexible) or a compiled *.tia / *.ap14 with a panel image.
• USB or Ethernet access to the SIMATIC HMI Manuals and Operating Instructions for cross-reference.

Hardware: Cable Selection and Pinout

The decisive step is selecting the right physical medium. Use the matrix below:

RJ45 crossover pinout (TIA-568A on one end, TIA-568B on the other):

End A (T568A)            End B (T568B)
1  White/Green  ──── 1  White/Orange
2  Green        ──── 2  Orange
3  White/Orange ──── 3  White/Green
4  Blue         ──── 4  Blue
5  White/Blue   ──── 5  White/Blue
6  Orange       ──── 6  Green
7  White/Brown  ──── 7  White/Brown
8  Brown        ──── 8  Brown

Verify on the panel: the left LED on the RJ45 jack must illuminate solid green within 3 seconds of the PC link coming up. A dark or amber-only LED is a hard fault — check the cable and the port pins for bent contacts.

IP Address and Transfer Target Configuration

The panel must have a valid transfer target address matching the PC's subnet. If the panel is reachable via the Start Center > Control Panel > Transfer menu, set the following:

On the PC, set a static IP in the same subnet (e.g. 192.168.0.1 / 255.255.255.0) and disable the firewall profile for the wired adapter, or open inbound UDP 102, 161, 34964, 49152-65535. Confirm reachability:

ping 192.168.0.10

# SNMP probe (Siemens SYCON-style)
snmpwalk -v2c -c public 192.168.0.10 1.3.6.1.4.1.4329.6.3.2

If the Start Center is unreachable because the panel is frozen on the static screen, jump to the Factory Reset via ProSave procedure below and re-establish the link before attempting to change the IP from the touch UI.

WinCC Flexible 2008 SP3 Transfer Procedure

1. Open the project (*.hmi) in WinCC Flexible 2008 SP3.
2. Select Project > Transfer > Transfer Settings. Set:
   • Mode: Ethernet (TCP/IP)
   • Target address: 192.168.0.10 (must match panel IP)
   • Password: leave blank unless a project password is set
3. Click Transfer. WinCC Flexible compiles the runtime and pushes it via port 102/TCP.
4. Watch the panel: the Start Center should briefly show Transfer, then the project boots within 30-60 s.
5. If the dialog "Transfer / Start / Control Panel" still does not appear, hold the upper-left corner of the touch for 3 s during power-up — this is the panel's Service Menu shortcut, equivalent to the Start Center on KTP Basic.

For projects compiled with TIA Portal (V13 SP1+), use Online > HMI Device Maintenance > Download to device. TIA Portal calls ProSave in the background and writes the same image format.

ProSave Service Tool Procedure (Factory Reset Path)

Use ProSave when the panel is bricked at boot and the touch UI is unresponsive. ProSave can rebuild the flash image without needing a working Start Center.

1. Connect the crossover cable. Power the panel. Confirm the link LED.
2. Launch ProSave from C:\Program Files\Siemens\Automation\Portal V14\Data\Hmi\ProSave.exe (or the WinCC Flexible install path).
3. Select Device type: KTP1000 Basic PN, Connection: Ethernet, enter the target IP 192.168.0.10.
4. Click Connect. ProSave will request the panel's version and the S7 password (blank by default).
5. Open the Operating system update tab. Choose the matching KTP1000 Basic PN.img from the WinCC Flexible / TIA install media.
6. Tick Reset to factory settings and click Update OS. Allow 4-6 minutes — the panel will reboot twice.
7. After the second reboot, the Start Center reappears with the Transfer / Start / Control Panel dialog active.

TIA Portal Commissioning Path

Modern TIA Portal versions (V14 SP1 through V18) can deploy to the same panel as long as the project is compiled against the correct HMI image:

1. In the project tree, double-click Devices & Networks > HMI_1 [KTP1000 Basic PN].
2. Properties > PROFINET interface [X1] > Ethernet addresses > set IP to 192.168.0.10, subnet 255.255.255.0.
3. Properties > Operating mode > tick Support device replacement without exchangeable medium.
4. Right-click the device > Compile > Software (rebuild all).
5. Right-click > Download to device > All. Accept the certificate prompt.
6. Choose PN/IE as the type, enter the target IP, click Search. The panel should appear with MAC label 00-0E-8C-xx-xx-xx.
7. Click Download. The transfer window shows file count and ETA; the panel reboots and runs the new project.

For a complete TIA workflow, refer to the SIMATIC WinCC Engineering V14 - Programming and Operating Manual.

Verification Checklist

Troubleshooting Matrix

Field-Engineer Notes

The Transfer / Start / Control Panel dialog is gated by two independent conditions: physical Ethernet reachability and a valid runtime image on flash. A field engineer should always confirm link status before assuming the panel is faulty — 80% of "bricked" KTP1000 reports in the field trace to a cable that simply does not cross the pairs correctly. For spare-parts staging, pre-build a labelled crossover cable and tape it to the engineering laptop; this single change has resolved the most stubborn commissioning delays on panels with non-Auto-MDIX PROFINET PHYs.

When the panel boots into "this device has no project" and freezes, treat this as a firmware/flash issue rather than a configuration problem. Force the recovery path via ProSave — do not waste cycles pressing touch areas attempting to reach a control panel that the runtime is not ready to render.

For long-term reliability, upgrade to the latest HMI image (V14.0.0.0 or later) when the catalog number supports it; Auto-MDIX eliminates the cable polarity concern for direct connections, simplifying future commissioning.