Resolving Siemens S7-1200 to KTP600 HMI Communication Failures

Problem Description

A S7-1214 DC/DC/DC controller, a SIMATIC KTP600 Basic HMI, and a SCALANCE X005 switch are wired into a PROFINET segment, but the HMI button no longer drives the indicator color on the panel. Pressing or releasing the button produces no change in the lamp's background color, and the PLC tag that is supposed to toggle does not change state when monitored in OB1. This is a classic S7-1200 / KTP600 commissioning failure caused either by an unestablished HMI-PLC PROFINET relationship, by using the wrong connection method in TIA Portal (Topology view instead of Devices & Networks), or by a momentary button configured where a toggle is required.

The S7-1214 DC/DC/DC family (catalog number 6ES7214-1AG40-0XB0 for the current firmware-4.x generation, 6ES7214-1AE30-0XB0 for the firmware 3.x generation) exposes a single PROFINET interface (PN/IE_1) on the bottom RJ45 jack. The KTP600 Basic PN (6AV2 123-2MA03-0AX0) is also a single-port PROFINET device. The SCALANCE X005 (6GK5005-0BA00-1AB2) is an unmanaged 5-port 10/100 switch; it forwards PROFINET frames but does not assign IP addresses or do topology discovery. Configuration is therefore entirely a TIA Portal responsibility, not a switch responsibility.

Root Cause Analysis

Three root causes account for the majority of S7-1200 ↔ KTP600 no-response symptoms in TIA Portal V15..V18 (and the current V19):

1. No HMI-PLC connection was created. The PROFINET devices appear in the project tree and the topology editor shows green links, but the HMI has no "HMI connection" object pointing at the S7-1200. Without this object, tag subscriptions return 0 regardless of button events.
2. Topology view was used instead of Devices & Networks. Topology view only draws the physical cable map. The S7-1200 to HMI logical connection (HMI connection) is created only in the Devices & Networks editor by drag-and-drop from one device port to the other.
3. Button is configured Momentary instead of Toggle. A momentary button writes 1 while pressed and 0 on release. If the HMI is wired to SET/RESET M0.1 and the lamp animation is driven by the release edge, the lamp appears to do nothing. Use the "Switch" (toggle) button mode or invert the logic.

Prerequisites

Verify firmware on the CPU with Online > Accessible nodes or by reading the diagnostic buffer (Diagnostics > Device Information). The KTP600 PN only supports firmware 16.x and newer with TIA Portal V17/V18; older panels require the matching TIA Portal version per the SIMATIC HMI Panels Compatibility Tool.

Step-by-Step Solution

1. Verify the IP and PROFINET device names

Both devices must have unique IP addresses and unique PROFINET device names on the same subnet. Open Devices & Networks in TIA Portal, select the S7-1200, then Properties > PROFINET interface [X1] > Ethernet addresses and set:

• IP address: 192.168.0.1
• Subnet mask: 255.255.255.0
• PROFINET device name: plc1200

Select the KTP600, then Properties > PROFINET interface > Ethernet addresses and set:

• IP address: 192.168.0.2
• Subnet mask: 255.255.255.0
• PROFINET device name: ktp600

2. Create the HMI connection in Devices & Networks

This is the single most common cause of the symptom. From the toolbar, click Connections, choose HMI connection, then drag from the HMI port to the PLC port. The connection object is created automatically with the PLC's PN/IE_1 interface as the partner. Confirm the connection path is shown with a green check mark in the inspector window.

3. Build the toggle in the PLC

In OB1, implement an edge-triggered toggle on M0.1 so a single button press flips the bit. Recommended pattern in ladder (FBD/ST equivalents below):

Network 1: Toggle M0.1 on rising edge of HMI bit
      HMI_Button (Bool)    M0.1_temp (Bool)
---| |---[ <edge> ]---(S)--- M0.1

Network 2: Reset M0.1 on falling edge of HMI bit
      HMI_Button (Bool)    M0.1_temp (Bool)
---|\|---[ <edge> ]---(R)--- M0.1

The HMI_Button tag is the bit the panel writes; M0.1 is the tag the lamp animation reads. The Q0.0 output (lamp coil) should be driven by M0.1, not the raw HMI bit, so the PLC owns the state.

4. Configure the HMI button as a Switch

Open the screen containing the button. Select the button, then in the inspector:

1. Properties > General > Mode: select Switch (not "Button"). A switch button toggles between ON and OFF on each press.
2. Properties > Events > Press: add action SetBit on tag HMI_Button.
3. Properties > Events > Release: add action ResetBit on tag HMI_Button.
4. Properties > Appearance > Appearance: enable "Use design with state" so the lamp can have two color states.

If you must keep a momentary button, drive the toggle from a rising-edge evaluation in the PLC and ignore the release event.

5. Map the lamp animation to the PLC tag

For the lamp (or any element whose color changes), select the object and in Properties > Animations > Appearance:

• Variable: PLC > PLC_1 > PLC tags > M0.1 (do not type the address; browse the tag table)
• Trigger: Change of variable, acquisition cycle 100 ms
• Range 0 → background color red; Range 1 → background color green

6. Compile, download, and assign the PROFINET name

Right-click each device → Compile > Hardware (rebuild all). Then download to the PLC first, then to the HMI. On first download the panel will prompt for the PROFINET device name. The SCALANCE X005 will not interfere because it is unmanaged; PROFINET DCP (discovery and configuration protocol) frames pass through transparently.

Verification

1. Go online with the PLC. Add HMI_Button and M0.1 to a watch table. Press the HMI button. HMI_Button should pulse high then low. M0.1 should latch on the first press and unlatch on the second.
2. Confirm the lamp's animation acquisition cycle is fast enough. WinCC Basic defaults to 1 s, which makes a 100 ms pulse look like "nothing happened." Reduce to 100 ms in HMI tag > Acquisition cycle for diagnostic work.
3. Run Online > Accessible nodes from the project tree. Both the PLC and HMI must appear with their PROFINET device names. If the HMI shows MAC-only, the device name was never assigned — repeat step 6.
4. Open the HMI's Diagnostics > Connections view on the panel itself. Status should read "Connected". A red status indicates a wrong IP, wrong PROFINET name, or a firewall on the engineering PC.

Diagnostic Reference Table

Communication Timeout Errors (PLC-001 Class)

When the HMI is configured but the link is broken, the KTP600 raises a connection-status banner and the engineering tools may log an event equivalent to "PLC-001: PLC Communication Timeout." This is a class of errors generated by the HMI runtime, not the PLC, and indicates one of four conditions:

1. IP mismatch — the HMI is configured for 192.168.0.2 but the PLC is at 192.168.0.10.
2. PROFINET device name missing on the panel — DCP name assignment never completed.
3. Subnet mask inconsistency — e.g. 255.255.255.0 on the HMI and 255.255.0.0 on the PLC.
4. Switch or cable problem — only one link LED is lit, or the SCALANCE X005 has a bad port (try a different port; the X005 has no management interface to diagnose).

Eliminate these in order: ping the PLC from a laptop on the same subnet, then from the HMI's service menu (Settings > Network > Ping, available on KTP600 firmware 16.0+). If the ping succeeds, the issue is the HMI connection object, not the network.

Hardware and Firmware Reference

For the official S7-1200 system manual and PROFINET configuration guide, refer to the SIMATIC S7-1200 Programmable Controller System Manual. For KTP600 configuration details, see the SIMATIC HMI KTP600 Basic Operating Instructions. SCALANCE X005 is documented in the SCALANCE X-000 Industrial Ethernet Switches Operating Instructions.

Common Field Pitfalls

• Using Topology view to "connect" devices. Topology view only documents the physical cabling. The S7-1200 ↔ HMI HMI connection is logical and must be drawn in the Network view of Devices & Networks.
• Leaving M0.1 writable from two places. If the PLC logic sets M0.1 in OB1 and the HMI also writes M0.1 directly, the result depends on scan order. Make the HMI write a separate "request" tag and let the PLC own M0.1.
• Forgetting the PROFINET device name. The KTP600 ships without a name. DCP must assign ktp600 before any HMI connection is established, regardless of whether the IP is correct.
• Simulating with mismatched TIA Portal versions. PLCSIM V18 will refuse to start if the active project contains an HMI compiled with V17. Re-compile the HMI against the same portal version you intend to simulate with.
• Confusing 192.168.0.0/24 with 192.168.1.0/24. Out-of-the-box the S7-1214 DC/DC/DC has IP 0.0.0.0; TIA Portal will assign its default 192.168.0.1 on first download only if the PG/PC interface is on the same subnet.

Quick Commissioning Checklist

1. Confirm both devices appear in Online > Accessible nodes with their PROFINET device names.
2. Confirm a green HMI connection line in Devices & Networks > Network view.
3. Compile the HMI without errors.
4. Watch HMI_Button and M0.1 in a PLC watch table while pressing the panel button.
5. Reduce the lamp's HMI acquisition cycle to 100 ms during commissioning.
6. Restore the acquisition cycle to 500 ms or 1 s for production to reduce panel CPU load.