Resolving S7-1500 Dual-Subnet HMI Simulation Communication

Problem Overview: HMI Simulation Fails Across a Dual-Subnet S7-1500

A typical commissioning pain point on S7-1500 machines is the HMI simulation in TIA Portal: the engineering station can read/write the CPU without issue, but pressing Start Simulation on the Comfort Panel project produces no tag updates, no alarms, and a connection-status icon that never turns green. The reproduction is consistent: a CPU 1515-2 PN with two PROFINET interfaces, a TP1500 Comfort connected to one interface, and the engineering PC connected to the other.

The exact symptom from the field is shown in the table below.

With a /22 mask, the engineering PC can ping both 192.168.148.10 (PLC X1) and 192.168.150.10 (PLC X2). The PLC is online, HMI tags are visible, project download to the HMI works via S7 routing through the PLC. The single failing operation is the HMI Runtime simulation launched from the PC.

Root Cause: HMI Connection Target Is Unreachable From the PC

When a Comfort Panel project is built, the HMI connection stores a fixed partner (PLC) IP address. In this case, that partner is 192.168.148.10 (PLC X1). The HMI Runtime on the panel uses this address to open the S7 connection to the CPU. When you launch RT Simulation on the PC, the simulated Runtime runs on the engineering station and attempts the exact same connection to the same partner IP.

Look at the Layer-3 path the simulation must traverse:

1. WinCC Runtime on the PC opens a socket to 192.168.148.10:102 (ISO-on-TCP / S7 protocol port).
2. Windows checks the routing table. The PC's only interface is 192.168.150.252/22, which covers 192.168.148.0 through 192.168.151.255.
3. The destination 192.168.148.10 is on-link, so Windows sends an ARP for it on the local Ethernet.
4. No device on the PC's physical segment owns 192.168.148.10. The ARP fails, and the S7 connection times out.

Even though the PC and the HMI-target IP share the same /22 subnet in theory, the physical topology is split: the PC and the HMI target are on different broadcast domains separated by the CPU's two PROFINET interfaces. The CPU is acting as a Layer-3 boundary, not a transparent bridge.

This is the key behavior of an S7-1500 with two PROFINET interfaces as documented in the Siemens functional description: Rules for CPUs with several PROFINET interfaces (S7-1500). Each PROFINET interface is a separate IP subnet from a routing perspective, regardless of the configured mask. Two interfaces on the same CPU cannot be configured into the same logical subnet (no IP aliasing); they are always separate Layer-3 networks unless joined by an external router.

Why S7 Routing Helps Project Transfer But Not Simulation

S7 routing is a Siemens-specific mechanism that allows a TIA Portal client (PG) to traverse S7-1500 CPUs as routers to reach downstream stations such as HMIs, drives, or remote I/O. The CPU exposes routing entries that are inserted by TIA Portal during Go online > Accessible nodes. The S7 route allows a TIA Portal download to reach the TP1500 through the CPU at 192.168.150.10, even though the panel sits at 192.168.148.11.

The HMI Runtime connection is not an S7-routed path. The Runtime opens a direct S7 communication (ISO-on-TCP, port 102) from itself to the configured partner. There is no routing hop. So:

Solution Path 1: Add a Router Between the Two Subnets

The cleanest long-term fix is to deploy a Layer-3 router (or Layer-3 switch) between the two PROFINET segments and define explicit routes on the engineering PC. This converts the dual-subnet topology into a routable IP network while keeping the machine's two PROFINET segments logically separate (good for separating plant networks from machine networks).

1. Install a small industrial router (e.g. SCALANCE XC-216, SCALANCE MUM856, or any managed switch with L3 capability) with two interfaces:
   – eth0 → PLC X2 segment, IP 192.168.150.1/22
   – eth1 → HMI/PLC X1 segment, IP 192.168.148.1/22
2. Connect eth0 to the same switch as the PC and PLC X2, and eth1 to the same switch as the HMI and PLC X1 (or direct cable if the topology is point-to-point).
3. On the engineering PC, add a persistent route so the S7 partner IP is reachable:
   route -p ADD 192.168.148.0 MASK 255.255.252.0 192.168.150.1
4. Verify with tracert 192.168.148.10. The first hop should be the router at 192.168.150.1.
5. Restart the TIA Portal HMI Runtime simulation. The connection should establish within a few seconds.

Solution Path 2: Change the HMI Connection Partner IP

If the goal is to keep the engineering topology minimal during development, change the HMI connection in TIA Portal to point to the PROFINET interface that the PC can already reach.

1. Open the HMI device configuration in TIA Portal.
2. Select Connections and open the S7 connection to the CPU.
3. Change the Partner (PLC) IP address from 192.168.148.10 to 192.168.150.10 (the X2 interface that the PC can reach).
4. Compile the HMI project and start RT simulation.

Trade-off: this connection IP is what the real panel will also use once deployed. If the panel is physically wired to X1, the production HMI will fail because it cannot reach 192.168.150.10 from 192.168.148.11. Two patterns are common in industry to handle this:

• Dual-compile workflow: maintain two HMI connection variants in the same TIA project, or use a connection switch in the project properties. Manually swap which connection is active before each simulation session.
• Move the HMI to X2 subnet: rewire or re-IP the panel to 192.168.150.x so the production HMI and the PC share the same subnet, then use a separate switch for the I/O devices on X1. This is the simplest topology for greenfield machines.

Solution Path 3: Add a Second IP Address on the Engineering PC Interface

Windows can bind multiple IP addresses to a single physical interface. Adding 192.168.148.252/22 (or a host IP inside the HMI subnet) to the PC's Ethernet adapter allows the S7 partner IP to be reached directly, even though it lives on a different physical segment. This works only if there is a path – either an additional NIC plugged into the HMI switch, or a routed/L3 path through the CPU. Without one of those, the new IP has no route to the target.

Procedure for the dual-NIC variant (recommended over a single-NIC secondary IP):

1. Install a second Ethernet adapter in the engineering PC or use a USB-Ethernet dongle.
2. Connect it to the same physical switch as the TP1500 Comfort.
3. Assign 192.168.148.252 with mask 255.255.252.0.
4. Verify with ping 192.168.148.10 and ping 192.168.148.11 from the PC.
5. Run the HMI simulation. The S7 partner IP is now on-link for the second NIC and the connection opens.

Solution Path 4: Use S7 Routing for Project Transfer Only

If the priority is to commission the real HMI (not simulate it) and the PC will never need to run the HMI Runtime on the engineering station, the existing S7-routing path is sufficient. TIA Portal will download the HMI project to the TP1500 by routing through the CPU. This is the standard Siemens-recommended approach for plant-side maintenance and is documented in the same TIA Portal functional description linked above.

To deploy:

1. In TIA Portal, right-click the TP1500 device → Download to device → Accessible nodes.
2. Select the route entry that points through the CPU 1515-2 PN at 192.168.150.10 to the panel at 192.168.148.11.
3. Confirm the download. The project is transferred via S7 routing, and the HMI Runtime on the real panel starts talking to the CPU on its own subnet.

Configuring the PG/PC Interface for TIA Portal

A frequent adjacent cause of "simulation sees the PLC but RT does not" is a mis-set PG/PC interface. The PG/PC interface assignment tells TIA Portal which Windows network adapter to use for S7ONLINE access. If the wrong adapter is selected, the project can be downloaded via routing (TIA does its own routing) but the simulated Runtime will follow the S7ONLINE assignment.

1. Open Control Panel → Set PG/PC Interface (the classic applet, not the modern Settings app).
2. Select the entry that lists the network adapter connected to the PLC X2 segment as the S7ONLINE access point.
3. Apply, then close and re-open TIA Portal so the change takes effect.

Verification Checklist

After applying any of the solutions above, run through this matrix to confirm the topology is fully operational.

Best-Practice Topologies for S7-1500 With Two PROFINET Ports

The dual-subnet pattern is common and valid; the failure mode above is a tooling/workflow issue, not a defect. Three topologies are stable in the field.

For new machines where the commissioning team will need frequent HMI simulation, choose the third topology: put the HMI, the engineering PC, and the CPU's X1 interface on a single managed switch with one IP subnet. Use X2 for higher-level plant communication (HMI of an upstream line, MES, or another controller). The CPU's two PROFINET ports make this segmentation natural.

Quick Diagnostic Procedure

Use this sequence to localize the failure in under five minutes.

1. ipconfig /all on the PC – confirm the active adapter has the expected IP 192.168.150.252 and mask 255.255.252.0.
2. arp -a – confirm the PC's ARP table contains 192.168.150.10 (PLC X2). If not, the PLC X2 is unreachable and the entire stack is broken.
3. ping 192.168.150.10 – should reply. If it times out, the local segment is the fault.
4. ping 192.168.148.10 – if this fails and step 3 succeeded, the Layer-3 boundary at the CPU is confirmed. Apply Solution 1, 2, or 3 above.
5. Open the HMI connection in TIA Portal and note the partner IP. Confirm the PC has a Layer-3 path to that exact IP.
6. Open TIA Portal → Online → Accessible nodes → filter by the partner IP. If the partner IP is not listed, the PC cannot reach it directly.
7. Start RT simulation with the TIA Portal diagnostic view open. The connection error message typically reads "Connection interrupted / HMI tag: status: connection failure" for the S7 partner. The fault is Layer-3 reachability, not tag configuration.

Edge Cases and Field Notes

• TP1500 Comfort on a /22 mask. A /22 mask does not change the fact that the two PROFINET ports are separate subnets. The mask only widens what the PC can ARP for on its own physical segment. If the PC is physically attached to X2, ARP for 192.168.148.10 still fails because no device on the X2 switch responds to it.
• CPU 1515-2 PN vs. CPU 1515F-2 PN. The same rules apply; the F-variant adds PROFIsafe on either port, but Layer-3 behavior is identical.
• Firmware differences. The dual-interface routing rules are documented in the TIA Portal functional description for S7-1500 CPUs and are firmware-agnostic. TIA Portal V13, V15, V16, V17, V18, and V20 all implement them the same way. If an older project appears to work in V13 but not V15, the cause is usually a change in the TIA Portal simulation launcher (the HMI simulation was a separate executable in older versions), not a CPU behavior change.
• S7-1200 vs. S7-1500. The same advice applies to S7-1200 with two PROFINET interfaces (CPU 1215C, 1217C). The two PROFINET ports are still separate Layer-3 networks.
• ET 200SP / IM 155 as a router. PROFINET IO devices are Layer-2 only and do not route. A PROFINET device in subnet A cannot be reached from subnet B without a router.

References to Official Documentation

• Siemens TIA Portal functional description: Rules for CPUs with several PROFINET interfaces (S7-1500)
• Siemens SIMATIC S7-1500 CPU 1515-2 PN manual (6ES7515-2AM02-0AB0) – device manual and PROFINET interface specifications.
• SIMATIC HMI TP1500 Comfort device manual (6AV2 124-1QC02) – PROFINET connection, IP configuration, and S7 routing notes.