Resolving Siemens HMI TOP B1 Tag Acquisition Error: S7-1200 Guide

Overview of the TOP B1 Indication on Siemens HMI Panels

The "TOP B1" string reported on SIMATIC Basic Panels (KTP, TP and Comfort-series operator panels) is most commonly observed as a stuck alarm-bar indicator in the WinCC TIA Portal runtime. Field reports describe the panel refusing to refresh process tags, showing a static "TOP B1" (or "TOP! B1") banner while the connected S7-1200 or S7-1500 CPU continues running. The message is not a single defined diagnostic event; the "TOP" element indicates the highest-priority active alarm class on the panel and the "B1" code is a per-project message class label that the integrator configured in HMI alarms > Alarm classes. The banner only clears when the runtime can successfully poll-tag the CPU. When it cannot, the panel keeps the last known alarm text frozen on screen.

This symptom is almost always caused by a broken communication path between the engineering station, the HMI panel, and the CPU. The capture of tag values in TIA Portal (Watch tables, Traces, Tag tables, Online & diagnostics) is performed by the PC-side software, not by the panel. If the PC cannot see the CPU over PROFINET or Ethernet, all tag-acquisition activity will fail and the panel will display the highest-priority alarm it has buffered — typically labelled TOP B1 if that is what was active when the link dropped.

Hardware and Software Identification

Before changing any configuration, capture the exact model numbers and firmware levels of every device on the network. Many reported TOP B1 errors are actually the result of an unsupported firmware combination between a CPU, a Comfort/Basic Panel, and TIA Portal.

Refer to the Siemens TIA Portal Compatibility Tool entry for each device. If the project was built in V16 and the panel firmware is on V14, TIA Portal will refuse to download and the panel will retain its last alarm text — which is how a TOP B1 message appears frozen.

Root Cause Analysis

Three conditions, alone or in combination, produce the TOP B1 sticky-banner symptom:

1. IP subnet mismatch between the engineering PC and the target CPU. The PC must use an IP address in the same subnet as the PLC's PROFINET interface for TIA Portal to perform online tag acquisition over the S7 protocol.
2. PLC protection level set to "Read access" or "No access" with a password configured. This blocks remote PUT/GET communication from any partner, including the HMI panel and the engineering station.
3. The "Permit access via PUT/GET communication from remote partner" checkbox is not enabled. Without this flag the S7-1200/1500 rejects all partner-initiated read/write requests that are not part of an HMI connection defined in TIA Portal, even when the protection level is "Full access".

Pre-Diagnosis Checklist

Run through this list before opening any configuration. Each item takes less than 30 seconds:

1. Verify the PC Ethernet adapter is enabled and the link light is solid on the switch port used for the PLC.
2. Confirm that the engineering PC and the CPU are physically connected through the same PROFINET switch (or directly with a crossover/Ethernet cable for a 1:1 engineering link).
3. Read the CPU IP address from the display (if present) or from the project > Device properties > Ethernet addresses > IP address.
4. Open a Windows Command Prompt and execute ping <CPU IP>. A reply confirms Layer 3 reachability.
5. Open Start > Control Panel > Set PG/PC interface and confirm the access point S7ONLINE (STEP7) is bound to the correct Ethernet adapter.
6. In TIA Portal, select Online > Accessible nodes. The CPU should appear with its IP and PROFINET device name.

Network Subnet and IP Range Validation

PC and CPU must share the same subnet mask. The most common cause of the TOP B1 panel symptom is that the PC was previously connected to a corporate LAN with a /16 mask and the CPU sits on a /24 industrial subnet, so traffic never reaches the CPU's PROFINET port.

Set the PC adapter with ncpa.cpl > right-click the Ethernet adapter > Properties > Internet Protocol Version 4 (TCP/IPv4). Use either a static address in the CPU's subnet or enable DHCP with a reservation in the SCADA-managed switch.

Configuring PLC Protection Levels in TIA Portal

The S7-1200 and S7-1500 PLCs expose three protection levels in the device configuration. From most permissive to most restrictive:

Navigate in TIA Portal: select the CPU in the project tree > Properties > General > Protection & Security. The dropdown Access level defines the HMI/PG access tier. For unrestricted engineering access choose Full access (no password) while commissioning, then re-enable a password once tag acquisition has been verified.

1. In the project tree, double-click the CPU device (e.g., PLC_1 [CPU 1214C DC/DC/DC]).
2. In the inspector window select the Properties tab.
3. Expand General > Protection & Security.
4. Set Access level to Full access. Leave the password fields empty for the commissioning phase.
5. Click the checkbox Permit access with PUT/GET from remote partner (PLC, HMI, OPC, ...).
6. Compile and download to the CPU.

Enabling PUT/GET Access for Remote Partners

PUT/GET is a SIMATIC-specific S7 service used by older HMIs, WinCC flexible runtime, OPC DA servers, and most third-party SCADA packages. Modern TIA Portal projects that configure an HMI connection inside the project do not require PUT/GET because they use the configured S7 connection instead. However, any tag capture performed outside the configured HMI connection — including Online > Watch table from a remote engineering station over a routed network — depends on PUT/GET.

To enable the flag:

1. Project tree > right-click the CPU > Properties.
2. Protection & Security > Connection mechanisms.
3. Tick Permit access with PUT/GET from remote partner (PLC, HMI, OPC, ...).
4. Confirm with OK, recompile (Project tree > CPU > right-click > Compile > Hardware (rebuild all)), and download.

This setting survives a CPU restart and is part of the project, so it must be re-applied every time the security configuration is changed. See the Siemens FAQ 77440336 on PUT/GET for S7-1200/1500.

Verifying HMI-to-PLC Connection Configuration

If the HMI and the PC are both unable to read tags, the panel connection itself must be audited. Open the HMI device configuration:

1. Select the HMI device (e.g., HMI_1 [TP700 Comfort]) in the project tree.
2. Open Devices & networks.
3. Inspect the Connections table at the bottom. A single S7-1200/1500 connection must be present and bound to the HMI's PROFINET interface.
4. Double-click the connection and confirm the address is the actual IP of the CPU, not the default project placeholder.
5. Check that the connection's Operating mode is set to Activate connection, not "Passive".

Once the TIA Portal project compiles cleanly (no yellow warnings under Info > Compile), download the HMI project to the panel via Online > HMI device maintenance > Download to device. On the Comfort/Basic Panel the transfer dialog uses either Ethernet (Mode 2 — Remote) or USB (Mode 1 — Manual). If the panel ever displays a connection-error icon overlay on the alarm bar (typically a yellow triangle) the connection configuration is wrong even if the project compiles; this is the most frequent cause of the persistent TOP B1 banner.

Tag Acquisition Path: PC vs. Panel

Many integrators assume the HMI panel itself handles the tag logging and display buffering. In a Siemens TIA Portal project, however, the engineering PC performs tag capture separately from the panel runtime. The two acquisition paths are independent:

When the engineering station runs out of the same subnet as the CPU and uses the TIA Portal Online > Accessible nodes function, it opens a transient S7 session on TCP 102. If the PC later drops the link (e.g., IP change, switch reboot, VPN tunnel reset), the panel will start the next polling cycle against a non-responsive CPU. The panel's last good message text remains on screen until the OPC/HMI connection recovers, which is why the user sees TOP B1 stuck even though the underlying error was a transient link drop on the PC side.

Port and Firewall Considerations

The default S7-1200/1500 port is TCP 102 for ISO-on-TCP (RFC 1006) S7 communication. OPC UA, increasingly deployed on S7-1500 firmware V2.6 and later, listens on TCP 4840 by default and on TCP 4841 for binary encoded traffic.

Add an inbound rule in Windows Defender Firewall with advanced security for the TIA Portal executable ("Siemens.TiaPortal.exe") or, more simply, an inbound rule for TCP 102 with scope limited to the engineering subnet 192.168.0.0/24. Industrial firewalls (e.g., SCALANCE S615) default to denying inbound ISO-on-TCP; enable the appropriate filter rule for the engineering PC.

Verification Procedure

Run the following checks in order to confirm that the TOP B1 indication has cleared and tag acquisition is stable:

1. Online accessible nodes: in TIA Portal select Online > Accessible nodes. The CPU must appear with its PROFINET name and IP. If multiple nodes appear, double-check the direct-attached PC rather than a bridged LAN.
2. Online & diagnostics: select the CPU > Online & diagnostics > Status. The protection-level field should report Full access and the PUT/GET checkbox should be Enabled.
3. Watch table read: open a Watch table and trigger Monitor (all). Tags must refresh at the configured update rate without #REF! placeholders. Errors of type SFR 0x0004 in the diagnostics buffer indicate PUT/GET is still rejected.
4. Online tag table on the panel: on a Comfort/Basic Panel, enter the service menu (usually tap the system bar four times during the start screen). Under Diagnostics > Connection the configured connection should show Connected with non-zero throughput values.
5. Buffer the alarm: cycle power on the panel. The TOP B1 banner should clear within three polling cycles (typically < 5 s on a Comfort panel with a 1 s update rate).

Extended Diagnostics and Recovery

If the panel still shows the TOP B1 banner after all of the above, escalate to deeper diagnostics:

• CPU diagnostics buffer: select CPU > Online & diagnostics > Diagnostics buffer. Look for entries "Security: CPU protection level changed" and "Communication: Connection rejected (PUT/GET disabled)". Each rejected partner request writes one entry per minute; the source IP and partner type identify which device is misconfigured.
• Wireshark packet capture: filter on tcp.port == 102. The TIA Portal GoOnline sequence opens a CR (Connection Request) TPDU from the PC. If the CPU responds with RJ (Refusal), the rejection reason octet returns 0x01 (Resource not available) or 0x03 (Invalid parameter). Code 0x03 confirms a PUT/GET protection mismatch.
• Firmware mismatch: if the panel refuses the project download, compare the firmware of the panel (read from HMI > System > System information) with the TIA Portal version. A panel on V13 firmware cannot load a V15+ project.
• Topology verification: if the HMI is on a routable subnet behind a SCALANCE or NAT router, confirm the route is bidirectional. The PROFINET DCP multicast is non-routable by default; configure LLDP or use fixed ARP.

Preventive Maintenance Recommendations

• Always keep at least one dedicated Ethernet port on the engineering station for direct CPU access, configured with a static IP in the standard PROFINET range 192.168.0.0/16 (any free address).
• Document the PUT/GET setting per CPU in the project handover pack. Add the toggle to the standard commissioning checklist so a password change never silently disables tag acquisition.
• Use WinCC Comfort V18 or later so the panel can fall back to OPC UA on TCP 4840 when the S7 connection is unavailable; this dramatically reduces frozen-banner incidents.
• For sites where the HMI and the engineering PC both speak to the same CPU, prefer an HMI-tag table inside the TIA Portal project over PUT/GET, so the panel can manage its own polling and reports a clear connection-error indicator instead of freezing on TOP B1.