Resolving S7-300 to KTP600 HMI Communication via IBH Link S7++

Problem Overview

Engineers integrating legacy SIMATIC S7-300 (CPU 314) controllers with modern SIMATIC KTP600 Basic mono PN HMIs frequently hit a wall when they bolt an IBH Link S7++ gateway into the segment. The PC-to-PLC channel (engineering station ↔ IBH Link ↔ S7-300 MPI) works perfectly, but the HMI on the PROFINET side stays blind. Tags show quality code "Bad", the connection status reads "Disconnected", and the panel does not poll.

This is not a hardware fault. The IBH Link S7++ is a fully functional MPI/PPI/Profibus-to-Ethernet converter, but the way TIA Portal or WinCC flexible establishes the S7 connection to a Siemens HMI is fundamentally different from the way the engineering tool talks to the PLC through the same converter. Getting the topology right is the entire job.

Architecture and Topology

The deployment requires two logically separate communication paths that share one physical gateway:

1. Engineering path: TIA Portal / STEP 7 ↔ Ethernet ↔ IBH Link S7++ ↔ MPI bus ↔ S7-300 CPU 314. Used for download, online diagnostics, and program trace.
2. HMI runtime path: KTP600 Basic mono PN ↔ PROFINET / Ethernet ↔ same physical LAN ↔ IBH Link S7++ ↔ MPI bus ↔ S7-300 CPU 314. Used for cyclic tag polling and alarm acquisition.

The IBH Link S7++ sits on both networks simultaneously: it terminates the MPI/Profibus side as a master class 1/2 device and presents an Ethernet-side S7-communication endpoint. The trick is that the HMI must be configured to point at the IBH Link's IP address as if it were an S7 PLC rack, and the gateway in turn forwards the S7 frames onto MPI toward the CPU 314.

Inline topology diagram:

Hardware and Firmware Reference

Build the part list around confirmed Siemens catalog data, not generic equivalents:

Confirm the CPU 314 firmware supports S7 communication as a server (it does from FW V2.0 onward). The KTP600 Basic mono PN must run a TIA Portal image or a WinCC Flexible image that matches the panel generation — the older KTP600 Basic mono DP variant is not PROFINET-capable and is sometimes mistakenly ordered.

Root Cause of the Communication Failure

There are four root-cause classes that engineers hit in this exact scenario. Work through them in order.

1. HMI is configured to talk to the S7-300, not the IBH Link

This is the single most common fault. In the HMI connection editor, the "Partner" or "PLC address" is set to the S7-300's IP — but the S7-300 has no Ethernet interface on a CPU 314. The HMI must be configured with:

• Connection type: S7 communication (not S7-200 PPI, not Modbus)
• Partner IP address: the IBH Link S7++ IP (e.g., 192.168.0.100)
• Partner rack/slot: 0 / 2 (the rack/slot the IBH Link routes to on the MPI side)
• Connection name: any free string

2. IBH Link is not in MPI-to-Ethernet gateway mode

The IBH Link S7++ ships with multiple operating modes. The default "S7-Net" mode works for engineering tools. For HMI runtime on a PROFINET panel, the mode must be "S7-MPI/PPI/DP Gateway" (sometimes labeled "S7 Routing" or "S7-Pass-Through"). The mode is selected in the IBH Link's web interface at http://192.168.0.100 (default IP) under Configuration → Protocol.

3. Subnet mismatch or VLAN segmentation

If the HMI and the IBH Link are on different subnets, ARP will fail silently. Confirm all three devices (HMI, IBH Link, engineering PC) are on the same /24 subnet. The IBH Link's web UI shows the active IP at boot.

4. MPI baud rate mismatch

The CPU 314 default MPI baud rate is 187.5 kbps. The IBH Link must be set to the same rate. If the link is left at the factory default of 19.2 kbps or 1.5 Mbps, the S7 connection establishes at the Ethernet layer (TCP port 102) but no data is exchanged on the MPI side — the symptom looks identical to a total failure.

Step-by-Step Configuration

Prerequisites

• Administrator rights on the engineering PC
• IBHsoftec IBH Net driver installed (provides the S7-over-Ethernet OPC/DLL interface for TIA)
• Latest IBH Link S7++ firmware (≥ V2.20 recommended, downloadable from IBHsoftec)
• Wiring: standard Cat5e/Cat6 between HMI, PC, and IBH Link Ethernet port
• Siemens PROFIBUS connector or MPI cable between IBH Link MPI port and CPU 314 MPI port

Step 1 — Configure the IBH Link S7++

1. Connect the engineering PC to the IBH Link's Ethernet port directly or via switch.
2. Open the browser and navigate to http://192.168.0.100 (factory IP). Log in with the default credentials (admin / admin, change on first login).
3. Under Network, set the IP, subnet mask, and gateway. Save and reboot.
4. Under Protocol → MPI/PPI/DP, set baud rate to 187.5 kbps, bus profile to MPI, and the local MPI address to 0 (master).
5. Under Protocol → S7, confirm the operating mode is S7 Gateway and not just S7-Net client.
6. Click Apply and wait for the link to reboot (~30 s).

Step 2 — Confirm MPI connectivity from the IBH Link

From the IBH Link web UI, use the diagnostic page to broadcast an MPI status request. The CPU 314 should appear in the discovered stations list with its MPI address (2 by default). If it does not, the bus is physically or parametrically broken — fix that first before touching the HMI.

Step 3 — Configure the KTP600 in TIA Portal

1. Open the TIA Portal project that contains the HMI device.
2. In the project tree, expand KTP600 Basic mono PN → Connections.
3. Double-click the connection (or add a new one with type S7 connection).
4. Configure the partner:

5. Map the HMI tags to PLC addresses (DB1.DBD0, MW10, etc.) as you would for a direct Ethernet-attached S7-300 PN/PN.
6. Compile the HMI project and download to the KTP600.

Step 4 — For WinCC Flexible / older TIA versions

If the panel was originally configured in WinCC Flexible 2008 SP3 or earlier, the connection path uses a different selector. In the connection editor:

• Communication driver: SIMATIC S7 300/400
• Station address: IP of the IBH Link
• Rack / Slot: 0 / 2
• Cycle time: 1000 ms (slower is more forgiving on MPI bottlenecks)

Step 5 — Optional: Add the Engineering PC to the S7 connection path

If you need the engineering station and the HMI to share one gateway without IP gymnastics, add the IBH Link as a "PG/PC interface" in the TIA project under Online & Diagnostics → PG/PC Interface → IBH Net (S7-LAN). This is purely for STEP 7; the HMI uses the IP-based connection above.

Verification

1. From the engineering PC, ping 192.168.0.100 — should respond in < 1 ms on a switched LAN.
2. Open TIA Portal online, scan the IBH Link's subnet, and confirm the S7-300 appears with the correct MPI address.
3. On the KTP600, navigate to System → Network → Connection (or Diagnostics on older firmware) and confirm the connection status reads "Connected" with the configured partner IP.
4. Force a tag in the PLC (e.g., set M0.0 in VAT table) and watch the corresponding HMI tag change in the runtime. Round-trip latency on a 1 s cycle should be 1.0–1.2 s end-to-end.
5. Trigger an alarm from the PLC and confirm it appears on the HMI message buffer within two polling cycles.

OPC Server Fallback

If the direct S7 connection from the HMI refuses to come up, or if the panel is actually a PC runtime (WinCC Runtime Advanced / Professional) rather than a physical Siemens panel, the supported path is the IBH OPC server:

1. Install IBH OPC (license-protected — requires a valid serial number; request from IBHsoftec or an authorized distributor).
2. Install IBH-NET driver (free download from the same site).
3. Configure an OPC DA server pointing at the IBH Link IP and the target S7-300.
4. Bind WinCC Runtime tags to the OPC DA items.

Kepware's Siemens TCP/IP Ethernet (MPI) driver is a well-known third-party alternative that also works against the IBH Link S7++ and avoids the IBH OPC license fee, but it requires the same IP-and-rack/slot configuration described above.

Performance and Sizing Notes

Expect the following practical limits on this topology:

Three-phase / power calculations are not relevant to this topology, but the standard PROFIBUS copper distance and repeater rules apply: each 187.5 kbps segment is limited to 1,000 m with three repeaters in series. Place the IBH Link within 50 m of the CPU 314 for noise margin.

Troubleshooting Matrix

Related Standards and References

For verifying behavior against published specs, consult:

• Siemens Industry Online Support — search for 6ES7314-1AG14-0AB0 and 6AV6647-0AB11-3AX0 for the official manuals, firmware lists, and operating instructions.
• PROFINET installation guidelines — for cable and topology rules on the Ethernet side.
• IEC 61158 — fieldbus standard that defines the underlying MPI/Profibus layer the IBH Link bridges.
• IBHsoftec — official firmware downloads, IBH OPC serial-number request, and direct support contact (Turmstr. 77, 64753 Beerfelden, Germany; Tel. +49 6068 3001).

Field-Commissioning Checklist

1. □ IBH Link S7++ firmware version recorded (read from web UI status page).
2. □ IBH Link IP, subnet mask, gateway recorded.
3. □ IBH Link MPI baud rate = 187.5 kbps, local address = 0.
4. □ CPU 314 MPI address = 2 (or as configured), baud rate = 187.5 kbps.
5. □ MPI bus terminated at both ends.
6. □ KTP600 PN image matches panel MLFB (mono PN, not mono DP).
7. □ HMI connection type = S7, partner IP = IBH Link, rack/slot = 0/2.
8. □ Tag test: force a known bit, observe on HMI.
9. □ Alarm test: trigger a programmed alarm, confirm in HMI buffer.
10. □ Cycle time ≥ 1 s, document in project notes.