Resolving SIMATIC MTP1900 to CompactLogix EtherNet/IP Faults

Problem Overview

A SIMATIC WinCC Unified Comfort Panel MTP1900 (19 in. multi-touch) runs an HMI project that polls 11 individual Allen-Bradley 5069-L306ERS2 CompactLogix 5380 controllers over EtherNet/IP. The same project executes without errors in TIA Portal simulation mode on the engineering workstation, but after the project is downloaded to the panel runtime, every screen symbol shows a yellow warning triangle and actual values do not update. The simulation success proves the HMI tags, screen logic, and connection definitions are valid; the failure mode is therefore tied to runtime networking, runtime services, and driver limits that the simulator does not exercise.

This article documents the layered root cause: (1) disjoint IP subnets between the engineering PC and the panel runtime, (2) a reserved 172.17.0.0/16 Docker bridge used internally by the SIMATIC Edge service on the Unified Comfort Panel, and (3) the documented system-test limit of four programmable controllers per Allen-Bradley EtherNet/IP or DF1 multi-point connection in WinCC Unified. The verification procedure, the exact Control Panel sequence to reclaim the 172.17.0.0/16 subnet, and the supported alternatives for connecting 11 controllers are all covered below.

Affected Components and Versions

Architecture and IP Addressing Baseline

The MTP1900 ships with two physical Ethernet interfaces that can be configured as one PROFINET interface pair or as a PROFINET interface plus an independent "PROFINET/separate" interface. Connecting a third-party EtherNet/IP network to a Unified Comfort panel is normally done on the independent interface so that PROFINET machine traffic remains isolated.

The 11 CompactLogix controllers in the field are assumed to be on a single EtherNet/IP subnet. The engineering PC used for the TIA Portal simulation is typically plugged into the same switch as the panel, but is configured with an IP and subnet mask that differ from the panel's runtime IP. When TIA Portal simulates the project, the runtime is the engineering PC's IP stack, so the connections are validated against the PC's view of the network. The downloaded runtime executes inside the panel, on the panel's interfaces, and uses the panel's IP configuration. This asymmetry is the source of the discrepancy.

Root Cause Analysis

1. Subnet Mismatch Between PC and Panel

The engineering PC sees the 11 controllers across one or two subnets (for example 172.16.0.0/16 and 172.18.0.0/16). The MTP1900 may boot with a different default subnet mask, often 255.255.0.0 on a separate IP, or the panel X2 interface may be left on the factory subnet 192.168.0.0/24. With a single subnet mask of 255.255.0.0, the panel can reach 172.16.0.0/16 but not 172.18.0.0/16; with 255.255.255.0 it can reach neither. The classic symptom is that some symbols update and others stay grey, or that all symbols show the yellow warning triangle.

Two remedies exist:

• Add a router in TIA Portal. Configure the panel's PROFINET/separate interface with a router address and assign every PLC connection the correct router. This is the preferred approach when the plant network is intentionally split across multiple subnets.
• Widen the subnet mask to a supernet. To reach both 172.16.0.0/16 and 172.18.0.0/16 without a router, the panel needs a /14 mask, i.e. 255.252.0.0. This covers the address range 172.16.0.0–172.19.255.255.

2. SIMATIC Edge Reserved Subnet 172.17.0.0/16

The WinCC Unified Comfort Panel includes a SIMATIC Edge runtime that uses Docker for containerized applications. The default Docker bridge network on the panel is 172.17.0.0/16. This address range is therefore reserved internally and cannot be assigned to a host interface while Edge is enabled. When a supernet of 255.252.0.0 is configured to span the plant's 172.16.x.x and 172.18.x.x networks, the Linux network stack on the panel will reject or collide with the 172.17.x.x range that the Edge Docker daemon has already claimed.

Two paths forward:

1. Reconfigure the Docker bridge to a non-conflicting range. The Edge Management web UI exposes a setting for the Docker network; change it to a private range that does not overlap with the plant network, e.g. 172.20.0.0/16 or 10.200.0.0/16. After the change, the panel can claim 172.17.0.0/16 for the supernet. SIMATIC Edge can be disabled afterward if no container workloads are needed.
2. Disable SIMATIC Edge entirely. If no Edge applications are used, the Edge service can be stopped and the Docker bridge released. The 172.17.0.0/16 range then becomes free for host networking.

3. Allen-Bradley Multi-Point Connection Limit (4 PLCs)

Siemens system-tests the Allen-Bradley EtherNet/IP and Allen-Bradley DF1 drivers in WinCC Unified with a maximum of four programmable controllers per driver instance. The driver is not strictly limited to four at runtime — it is a tested boundary. For a configuration with 11 controllers, this puts the installation outside the verified envelope. Siemens support may decline service requests, and field behaviour becomes unpredictable. The same project works in TIA Portal simulation because the simulator exercises a single CIP session per connection; the panel's runtime may exhaust sockets, CIP connections, or internal request queues sooner than a workstation does.

The two engineering solutions are:

• Distribute the 11 PLCs across three driver instances in TIA Portal, each with four (or fewer) connections. Verify that the panel's available sockets and CPU load support three concurrent driver instances.
• Use an OPC UA aggregation layer. Deploy a Rockwell FactoryTalk Linx OPC UA server (or Kepware / third-party) on a separate industrial PC, expose the 11 controllers as OPC UA tags, and consume them in WinCC Unified through the OPC UA driver. This bypasses the multi-point test limit on the native Allen-Bradley driver.

Diagnostic Procedure

1. Reproduce the failure deterministically. Power the panel, complete a clean download of the project from TIA Portal, and let the runtime start. Note the exact symbols that show the yellow warning triangle and the connections they reference.
2. Open the system alarm view. Add an alarm control to any screen (WinCC Unified HMI > Controls > Alarm control). The default alarm source delivers runtime system alarms with the WinCC Unified alarm classes "System" and "Diagnosis". Read the alarm number, the alarm text, and the connection name referenced in the alarm.
3. Map the alarm to a cause. Cross-check the alarm text against the official Siemens list of causes of a faulty connection (RT Unified). The most common alarm IDs for connection faults in Unified Runtime are in the range 0x8000xxxx and reference connection state machine transitions such as Connect failed, No route to host, or Session timeout.
4. Read the panel's runtime IP configuration. On the MTP1900, open Control Panel > Network and Dial-up Connections and inspect the IP address, subnet mask, and default gateway of the X1 and X2 interfaces. Compare to the engineering PC's view of the same networks.
5. Verify the SIMATIC Edge status. Open Control Panel > Apps > SIMATIC Apps and note whether SIMATIC Edge is running. If running, open the Edge Management web UI from a browser on the engineering PC at https://<panel-IP>:9443 and read the Docker Network setting.
6. Count active connections in TIA Portal. In the project tree, open Devices & Networks > HMI > Connections and tally the Allen-Bradley EtherNet/IP driver instances and the PLC endpoints per instance.

Step-by-Step Resolution

Step A — Fix the Subnet Mask on the Panel Interface

1. In TIA Portal, open Devices & Networks and select the MTP1900.
2. Open the panel's PROFINET/separate interface (X2) and set the IPv4 address to a value inside the plant range used by the CompactLogix controllers. Set the subnet mask to 255.252.0.0 (a /14 supernet) if the controllers span 172.16.0.0/16 and 172.18.0.0/16.
3. Compile the project and download it to the panel.
4. On the panel, verify in Control Panel > Network and Dial-up Connections that the runtime IP and mask are now correct.

Step B — Reclaim 172.17.0.0/16 from the SIMATIC Edge Docker Bridge

1. On the panel, open Control Panel > Apps > SIMATIC Apps and confirm that SIMATIC Edge is enabled.
2. From the engineering PC, open a browser and navigate to the Edge Management UI: https://<panel-IP>:9443. Accept the security/SSL warning for the self-signed certificate.
3. Log in with the configured Edge user.
4. Open Settings > Docker Network. Change the bridge subnet to a non-conflicting private range, for example 172.20.0.0/16 with gateway 172.20.0.1.
5. Click Apply and let Edge restart the Docker daemon.
6. Return to Control Panel > Apps > SIMATIC Apps and disable SIMATIC Edge if no container workloads are required. This releases any residual bridge interfaces and frees the 172.17.0.0/16 range for host networking.
7. Reboot the panel to ensure the network stack re-initialises with the new Docker bridge range.

Step C — Reduce Connections per Allen-Bradley Driver Instance

1. In TIA Portal, right-click the panel and choose Add new connection to create a second (and third) Allen-Bradley EtherNet/IP driver instance.
2. Distribute the 11 controllers across the driver instances with four PLCs per instance, e.g. 4 + 4 + 3.
3. For each connection, set the CPU slot to 0 (Logix Designer tags are exposed on slot 0 over EtherNet/IP), and set the connection path to the controller's CIP path, e.g. 172.16.1.10,1,0.
4. Map the HMI tags to the controller tags by symbolic name, e.g. Program:MainProgram.nSpeed, exactly as the symbolic addressing requires.
5. Compile the project, download to the panel, and observe the system alarm view.

Step D — Optional: Replace the Native Driver with OPC UA

1. Install FactoryTalk Linx (or an equivalent OPC UA server) on an industrial PC with a stable EtherNet/IP connection to the 11 controllers.
2. Configure 11 device shortcuts in FactoryTalk Linx, one per CompactLogix CPU, and verify that each shortcut reads a test tag (e.g. Program:MainProgram.Heartbeat) at a 1 s poll rate.
3. Expose the tags through the OPC UA server endpoint, e.g. opc.tcp://<server>:49320.
4. In TIA Portal, add an OPC UA connection to the panel and import the tag namespace from the server.
5. Re-map the HMI tags to the OPC UA namespace; delete the Allen-Bradley EtherNet/IP driver instances.
6. Download the project and verify the alarm view no longer reports connection faults.

Verification

1. Symbol status. Open each screen and confirm that no symbol shows the yellow warning triangle. The yellow triangle indicates a tag is in the "bad" quality state in OPC UA terminology; the runtime uses the equivalent internal "Quality = Bad / Communication error" flag.
2. System alarm view. Confirm the system alarm view is empty or only shows informational start-up messages.
3. Update rate. Force a value change in Logix Designer and confirm the HMI reflects it within the configured acquisition cycle (typically 500 ms to 2 s for an Allen-Bradley EtherNet/IP driver).
4. Endpoint reachability. From the engineering PC, run a sustained ping or use the panel's Control Panel > Network > Diagnostics to verify that every controller IP is reachable through the panel's runtime interface.
5. Edge isolation. Open Control Panel > Apps > SIMATIC Apps and confirm that the Docker bridge subnet no longer overlaps the plant subnet. The Linux command ip addr show docker0 (if accessible via the panel's remote shell) should show the new range.

Yellow Warning Triangle — Symbol Quality States

Related Limitations and Edge Cases

• Logix slot addressing. CompactLogix 5380 exposes its tags over EtherNet/IP at CPU slot 0. Setting the slot to 1 (a common mistake inherited from ControlLogix projects) results in connection faults that the system alarm view reports as "Path segment error".
• Forward Open size. The Allen-Bradley driver opens a CIP Forward Open per connection. Each CompactLogix 5380 has a finite number of CIP connections; the 5069-L306ERS2 is documented for 16 concurrent CIP connections. With 11 controllers, plan for at least 11 CIP connections plus any RSLinx, HMI, or MSG instructions already in use.
• DLR ring vs star. If the 11 controllers are wired in a Device Level Ring (DLR), confirm that no single ring break leaves a controller on an isolated subnet. The MTP1900 is a ring supervisor only if the topology is configured for it; otherwise it is a ring node.
• Firmware mismatch. Studio 5000 / Logix Designer V36.011 produces firmware V36.001 project files. Running a V36 firmware on V35 hardware is rejected by the controller; confirm the 5069-L306ERS2 hardware revision supports V36 (rev. 20.013 or later is documented in the 5069 product profile).
• Subnet mask /14 trap. A supernet 255.252.0.0 works for the controllers but allows the panel to also ARP for 172.17.x.x — which the Edge Docker bridge may answer with an internal IP, leading to intermittent misrouting. The Step B Edge remediation is mandatory if Step A uses a supernet.
• Symbolic vs direct addressing. The Allen-Bradley EtherNet/IP driver in WinCC Unified reads tags by symbolic name (controller-scope and program-scope). It does not read by legacy SLC-style data table addresses. Verify each tag's full path in Logix Designer, e.g. Program:MainProgram.HMI_Data[0].Speed_SP.

Diagnostic Reference Matrix

Spec Sheet Snapshot — MTP1900 Unified Comfort

Spec Sheet Snapshot — 5069-L306ERS2

FAQ