Resolving S7 Routing Failures Between STEP 7 V5.x and TIA Portal

Problem Overview: S7 Routing Failure Between STEP 7 V5.x and TIA Portal V14

Cross-project S7 routing is required when an engineering station (ES) must download an HMI configuration that was created in SIMATIC WinCC (TIA Portal) V14 to a Comfort/Basic panel, while the underlying PLCs continue to be programmed in STEP 7 V5.5 / V5.6 (classic). In this topology, the HMI download is not a direct point-to-point transfer: TIA Portal pushes the HMI image through a multi-hop S7 route that traverses the Engineering Station's Ethernet interface, one or more S7-300/S7-400 CPU or CP modules, and finally the Profibus (DP) or Profinet (PN) segment to which the panel is attached.

The failure mode reported in the field is asymmetric:

• Test rig (works): CPU 317-2PN/DP on a desk, ES on the integrated PN interface, KTP700-DP on the integrated DP interface of the same CPU. HMI download completes over S7 routing in TIA Portal V14. The same panel also accepts the download with firmware downgraded to V13.0.x.
• Plant (fails): CPU 413-3PN/DP, ES attached to an add-on CP 443-1 on Industrial Ethernet, Profibus network with the KTP700-DP attached through an IF 964-DP interface submodule (used because the plant Profibus segment already exceeds 32 slaves on the CPU's integrated DP interface). HMI compile succeeds in TIA Portal, proxy import from the STEP 7 V5.x project succeeds, but the HMI download times out or reports a routing error.

The combination of a 2007-era S7-400 station (CPU 414-3 DP at firmware V4.1.0) plus a CP 443-1 plus an IF 964-DP is the classic configuration that breaks cross-project S7 routing. The same configuration works flawlessly for STEP 7 V5.x-only HMI downloads because classic WinCC flexible did not depend on TIA Portal's HMI routing pipeline.

Root Cause Analysis: Why Routing Works on S7-300 but Fails on S7-400

The S7 routing path is established by combining routing entries in three places: the ES's PG/PC interface assignment, the routing table of every S7 station along the path, and the TIA Portal device configuration. A failure on any single hop aborts the download. The four most common root causes in this exact topology are:

1. CP 443-1 not configured as a router. A CP 443-1 is a passive Ethernet node by default. S7 routing must be explicitly enabled in the CP properties, and the CP must be assigned the same S7 subnet ID as the CPU's integrated PN interface so that TIA Portal can resolve the S7 route through the CP rather than through the CPU.
2. IF 964-DP not declared in the S7 routing table. Because the Profibus segment is connected to an interface submodule, the S7-400 CPU does not automatically know about that subnet for routing purposes. The IF 964-DP must be configured as a Profibus master in HW Config (STEP 7 V5.x) with a unique PROFIBUS address, and the CPU's routing table must contain an entry from the CP 443-1's Ethernet subnet to the IF 964-DP's Profibus subnet.
3. Firmware version of the S7-400 CPU is below the TIA Portal V14 minimum. Cross-project S7 routing to TIA Portal HMI targets requires S7-400 CPU firmware V5.1 or higher for full support of TIA Portal V14. The user's CPU 414-3 DP at firmware V4.1.0 was released for STEP 7 V5.4 SP5 and predates several routing-related firmware extensions. While the basic S7 routing protocol is technically present, the TIA Portal HMI loader relies on extended routing diagnostics (SZL 0x0131 / 0x0132) that were stabilized on S7-400 firmware V5.1.x and later.
4. PG/PC interface uses "S7ONLINE" pointing to the wrong adapter. When the ES is connected to the CP 443-1 (not the integrated PN), the PG/PC interface must be set to TCP/IP -> CP 443-1 ISO or to the corresponding S7ONLINE access point. If the PG/PC interface is set to the integrated PN interface, the ES opens a connection that is not on the routing path, and TIA Portal cannot reach the panel even though STEP 7 V5.x online functions work.

Affected Hardware and Minimum Firmware Requirements

The S7-400 firmware V5.1 boundary is documented in the Siemens FAQ "How do you enable cross-project S7 Routing in the TIA Portal and in STEP 7 V5.x?" and is the cleanest single reference for the cross-project topology. The full S7 routing function matrix per module is published in the entry "Which modules support the S7 Routing function?" in the Siemens Industry Online Support knowledge base.

Prerequisites for Cross-Project S7 Routing

Before the first HMI download attempt, validate the following items. If any of them are not satisfied, fix the STEP 7 V5.x project first; do not try to compensate in TIA Portal.

1. STEP 7 V5.5 SP4 (or V5.6) is installed on the ES, with the latest Hotfixes applied. TIA Portal V14 SP1 Update 6 (or later) is installed in parallel.
2. The PLC project is opened at least once on the ES, the S7 program is consistent (Save + Compile, no SZL timeouts), and the S7-400 station passes PLC > Diagnostics/Settings > Module Information with no SF / BF errors.
3. The CP 443-1 has an IP address that is reachable from the ES's PG/PC interface without any NAT. The CP's MAC address is bound to the IP in the ES's ARP cache (or a static ARP entry is used).
4. The IF 964-DP Profibus master is configured in HW Config with a unique PROFIBUS address (typically 2 on a plant segment). The bus profile is set to "DP" not "Universal".
5. The KTP700-DP's Profibus address is unique on the IF 964-DP segment and matches the address configured in the TIA Portal HMI device.
6. The TIA Portal project uses the HMI proxy import path described in "Combined configuration with WinCC (TIA Portal) and STEP 7 V5.x" to expose STEP 7 V5.x tags to the HMI tags. The HMI device must be linked to the proxy DB, not to a local copy of the tag table.
7. The PG/PC interface of the ES is set to TCP/IP (Auto) -> Intel/Realtek NIC pointing to the physical network where the CP 443-1 is reachable, and the Access Point of the Application is S7ONLINE.

Configuring S7 Routing in STEP 7 V5.x

The routing table is built in HW Config. Open the S7-400 station, right-click the CPU 414-3 PN/DP, and select Object Properties > Interfaces > Profibus / PROFINET > Routing.... The dialog contains two columns representing the local subnets and remote subnets that the CPU is allowed to bridge.

1. Add the CP 443-1 Ethernet subnet (the one carrying the ES) to the Available subnets list.
2. Add the IF 964-DP Profibus subnet (the one carrying the KTP700-DP) to the same list.
3. Set the CP 443-1 as the default router for the Ethernet subnet and verify that "Use router" is checked for the IF 964-DP subnet.
4. Save and compile the station. STEP 7 will write a routing table into the offline project. The table is downloaded to the CPU with the next overall reset / parameter download; for hot changes, an PLC > Download to Target System > Routing Tables option is also available in HW Config.

If a CP 443-1 is in the rack, it must be configured with a router entry that delegates S7 connection requests from the ES subnet to the CPU's integrated PN interface. This is done in CP 443-1 Properties > Options > S7 Routing with "S7 routing enabled" = active.

Configuring S7 Routing in TIA Portal V14

Open the TIA Portal project, navigate to Devices & Networks > Networks view, and place the HMI panel on the same Profibus subnet that was declared in the STEP 7 V5.x project. TIA Portal will automatically build an S7 route from the ES through any matching S7 station that has routing enabled.

1. In Devices & Networks, select the HMI panel and open Properties > PROFINET / PROFIBUS interface > S7 Routing. Set "Use router for S7 connection" = active and pick the CP 443-1 from the drop-down.
2. If the panel is on a Profibus subnet attached to the IF 964-DP, ensure the IF 964-DP appears in the network view as a Profibus master; otherwise right-click the S7-400 station and choose Add submodule > IF 964-DP.
3. Compile the HMI project (Compile > Software (rebuild all)) and resolve any warnings about missing proxies.

For projects that mix STEP 7 V5.x and TIA Portal stations, the cross-project settings are described in detail in the FAQ "How do you configure and enable S7 Routing in STEP 7 (TIA Portal)?"

Enabling the PG/PC Routing Entry and S7 Subnet Gateway

The ES must announce itself as a node on the same Industrial Ethernet subnet that the CP 443-1 is using. If the ES sits on a different subnet, a Layer-3 gateway must be configured. Use the Set PG/PC Interface control panel to assign the S7ONLINE access point to the NIC that is on the same subnet as the CP 443-1.

Verify the assignment with the following ping from a command prompt on the ES:

ping -n 4 <CP 443-1 IP address>
ping -n 4 <CPU integrated PN IP address>

If the CP 443-1 replies but the integrated PN interface does not, the S7 route through the CP is not registered in the CPU's routing table. Re-open the CPU's Routing... dialog in STEP 7 V5.x and confirm the entry for the CP 443-1's subnet has the integrated PN as the local interface.

Downloading the HMI Project Through the S7 Route

1. Right-click the HMI panel in the TIA Portal project tree.
2. Choose Download to Device > Software (all).
3. In the download dialog, select the S7ONLINE access point and the NIC pointing at the CP 443-1.
4. In the Connection field, choose "Connect to target over router" and select the CPU 414-3 PN/DP from the list. TIA Portal resolves the S7 route as: ES → CP 443-1 → CPU 414-3 PN/DP → IF 964-DP → KTP700-DP.
5. Click Load. The first download takes 3-8 minutes on a 2007-era S7-400 station because the panel's operating system is re-flashed if the firmware version does not match the TIA Portal image.

For a deeper walkthrough of the HMI download path, see the Siemens knowledge base entry "In WinCC (TIA Portal), how do you transfer a project to an HMI panel using S7 routing?"

Verification Steps and Diagnostic Indicators

After the download completes, perform the following checks before declaring the routing pipeline healthy:

1. Open Online & Diagnostics on the KTP700-DP and confirm the panel reports "Connection to PLC established" with the configured DB / tag.
2. Run a tag test from the panel's Settings > Transfer > Channel Diagnostics to confirm round-trip latency is below 800 ms. Values above 2 s indicate the route is bouncing through an extra hop (typically the CPU integrated DP is still being used because the IF 964-DP is not in the routing table).
3. Force a controlled shutdown of the ES NIC after a successful download and re-download. If the download still completes with the NIC down, the cache is being used and the routing table is stale; rebuild the station in HW Config and re-download.
4. From STEP 7 V5.x, run PLC > Diagnostics/Settings > Module Information > Diagnostic Buffer on the CPU. Look for SZL 0x0131 entries (routing table) and 0x0132 entries (routing statistics). A 0x0132 entry with status 0x001A indicates an S7 routing attempt to a subnet the CPU does not know; that is the signature of the IF 964-DP not being declared.

Workarounds When the S7-400 Path Fails

If the CPU 414-3 cannot be firmware-upgraded above V4.1.0 (for example, the customer's plant does not permit FW updates on a validated system), the following field-proven workarounds keep the TIA Portal HMI download path alive:

• Use the CPU integrated DP interface as the panel's Profibus master for the panel subnet only, by moving the panel to a small standalone Profibus segment on the integrated DP. This restores the S7 route ES → CP 443-1 → CPU 414-3 integrated PN → integrated DP → KTP700-DP and matches the topology that the S7-300 test rig proved works. The remaining 32+ Profibus slaves can stay on the IF 964-DP.
• Run the HMI download from a local TIA Portal instance on the panel. Open the TIA Portal project on a laptop that is directly attached to the panel's Profibus via a CP 5711 or PC-Adapter USB, and download locally. This bypasses S7 routing entirely and is the only path that works when the CPU firmware blocks the S7 route. The drawback is loss of the single-ES configuration the user originally wanted.
• Add a CP 443-1 Advanced (6GK7443-1GX30-0XE0) with a separate IP subnet and connect the ES directly to it. The CP 443-1 Advanced supports routing from its own Ethernet segment to the CPU's PN/DP segments even on older S7-400 CPUs, because the routing logic lives in the CP firmware (V3.2.7 or higher) rather than in the CPU firmware.
• Upgrade the CPU to a current 414-3 PN/DP (6ES7414-3EM07-0AB0) with firmware V5.3.x. The replacement is hardware-compatible with the existing rack and provides a clean S7-400 routing path for TIA Portal V14/V15/V16.

Troubleshooting Matrix