Resolving TP700 Comfort HMI Download Failure in TIA Portal

1. Problem Description

A brand new SIMATIC TP700 Comfort panel (article number 6AV2 124-1GC01-0AX0 and the -0AX1 / -0AX2 variants) is reachable from TIA Portal — it appears in the Online → Accessible devices view with the correct IP address — yet every project transfer to the HMI aborts with the error "Failed to establish a connection to the device". TIA Portal typically reports an HMI transfer error code around 0x0310 in the logfile at %LOCALAPPDATA%\Siemens\Automation\Logfiles\. The transfer bar stalls at 5–10 %, the dialog closes, and the panel never enters the downloaded runtime. This article documents the field-verified cause chain and the exact commissioning sequence that resolves it on a new panel.

2. Environment and Prerequisites

A new TP700 ships with no IP address, no PROFINET device name, and transfer disabled. Confirm the panel is powered, the green link LED on the PROFINET port is lit, and the patch cable is in the panel's PROFINET (PN / X1) port — not the optional RS422/485 port and not the service USB.

3. Root Cause Analysis

From the symptom (visible but unreachable) the failure is almost never the HMI's PROFINET stack itself. The handshake between TIA Portal and the HMI runs over a dedicated channel inside PROFINET IO, and any of the following breaks the handshake:

1. PROFINET device name not actually written. A Set device name call that returns success in the dialog can still fail silently if the panel rejects the name (length > 240 chars, illegal characters such as spaces or hyphens in some firmware revisions, or a duplicate on the network).
2. PG/PC interface bound to the wrong NIC. TIA Portal uses whatever access point S7ONLINE (STEP 7) points to. On a multi-NIC laptop (Wi-Fi + Ethernet + VPN + Hyper-V virtual switch), the wrong adapter is selected more often than not.
3. Windows Defender Firewall or corporate EDR drops the transfer UDP/TCP ports. The S7 communication channel used for HMI transfer is TCP 102 plus a dynamic UDP range — both can be blocked silently.
4. Transfer not enabled on the panel. The HMI's Settings → Transfer toggle must be on, and the panel must be in transfer mode (automatic or manual).
5. HMI image / TIA Portal version mismatch. A panel shipped with a newer HMI image than the TIA Portal version that compiled the project refuses the download. The reverse is also true: an old image on a new project fails identically with a different error code.
6. Subnet mismatch in the PG. TIA Portal will not warn if the engineering station is on a different subnet; it simply cannot open a TCP session to the HMI.
7. PROFINET topology not online. If the panel was configured as a PROFINET IO device of a CPU in the same project, the CPU must be online and the IO device must be reachable — otherwise the HMI transfer may also fail in mixed topologies.

4. Diagnostic Workflow

Run the following checks in order. Each check produces a binary pass/fail result and a remediation step in Section 5.

4.1 Layer-1 / Layer-2 reachability

From a Windows command prompt with administrator rights, ping the panel IP with a small payload to avoid fragmentation:

ping -l 64 -n 4 192.168.0.10

Then verify MAC visibility with arp -a. If ping fails, fix the IP / subnet first — every later step is meaningless without a Layer-3 path.

4.2 PROFINET device name verification

Open Online → Accessible devices in TIA Portal. The panel appears by IP, and the right-hand pane shows the current PROFINET name. If the field is empty, or if the name shown does not match the project exactly (the device matches case-insensitively, but the project is case-sensitive), the transfer will fail.

4.3 Transfer mode state on the HMI

On the panel, navigate to Control Panel → Transfer. The transfer channel must be enabled and the panel must report Transfer mode when triggered. If the panel sits in normal runtime and Transfer is off, the handshake is closed at the HMI's end.

4.4 TIA Portal logfile analysis

After a failed download, TIA Portal writes a log under %LOCALAPPDATA%\Siemens\Automation\Logfiles\. The relevant section contains a hex error code; the most common for this symptom is 0x0310 (HMI transfer: connection could not be established). A second common code is 0x80072EFD (The connection with the server was terminated abnormally), which usually points at a firewall.

5. Step-by-Step Resolution

5.1 Connect the PG directly to the panel

Use a CAT5e or better straight-through cable (modern NICs auto-MDIX) from the engineering PC's Ethernet port to the TP700's PROFINET (PN / X1) port. Disable Wi-Fi and any VPN adapters on the PC to keep the PG's route table simple. Siemens' official transfer FAQ (entry ID 88633853) recommends exactly this direct topology as the first attempt.

5.2 Configure the PG with a static IP in the same subnet

Set the PC NIC to a static address on the same /24 subnet as the panel — for example:

• Panel: 192.168.0.10 / mask 255.255.255.0
• PC: 192.168.0.1 / mask 255.255.255.0 / gateway 0.0.0.0

The PG must not rely on a DHCP server while commissioning a brand new panel, because the panel itself has no DHCP client at delivery.

5.3 Set the panel's IP and PROFINET name from the HMI

On the TP700, open Settings → Network and enter:

• IP address: 192.168.0.10
• Subnet mask: 255.255.255.0
• PROFINET device name: tp700-comfort (must match the project name in the TIA Portal device configuration exactly)

Save and reboot the panel. After the reboot, re-verify with the ping test from 4.1.

5.4 Configure the PG/PC interface in TIA Portal

Open Options → Set PG/PC interface. Under Access point of applications, select S7ONLINE (STEP 7) -> <your Ethernet NIC>. The wrong adapter is the single most common cause of device visible but transfer fails. Confirm the MAC address of the selected NIC matches the one shown in ncpa.cpl.

5.5 Allow TIA Portal through Windows Defender Firewall

Open Windows Defender Firewall with Advanced Security and add an inbound rule for the TIA Portal HMI transfer process:

• Program path: %ProgramFiles%\Siemens\Automation\SimaticOam\bin\s7oiehsx64.exe (or s7oiehsx.exe on 32-bit TIA Portal)
• Protocols / ports: TCP 102, UDP 34964 (PROFINET discovery), UDP 34965 (PROFINET LLDP)
• Action: allow on the Domain, Private, and Public profiles

Alternatively, add a programmatic rule for the path above and let Windows manage the dynamic ports. If the engineering PC is corporate-managed, the same exception must be added in Group Policy or pushed via your EDR console.

5.6 Assign the PROFINET device name from TIA Portal (alternative)

If the HMI Control Panel is not available (panel is locked, or commissioning remotely via the network), assign the name from TIA Portal:

1. Online → Accessible devices — the panel appears with its IP and an empty name.
2. Right-click the panel row → Assign PROFINET device name.
3. Type the name exactly as configured in the project (for example tp700-comfort).
4. Click Assign name — the panel reboots its PROFINET stack automatically.

After this, the device is addressable by name, and the HMI download path opens. The TIA Portal's Online → Accessible devices scan uses PROFINET DCP, which by design does not require the name to be set — this is why the panel appears in the list even with an empty name field.

6. TIA Portal and HMI Image Compatibility

A version mismatch between the engineering project and the panel's HMI image produces a transfer failure with a different error code (0x80072EFD / The connection with the server was terminated abnormally), but the visible symptom — device found, transfer fails — overlaps. The shipped image on a new TP700 is usually V16 or V17 depending on the procurement date.

Use ProSave (bundled with TIA Portal under Siemens\Automation\SimaticOam\bin\ProSave.exe) to reflash the HMI image to a matching version before the first download. Without a version match, the transfer is rejected even though the panel is reachable. The panel can be flashed over Ethernet (PN/IE) or via the service USB; PN/IE is preferred because it leaves the firmware routine reachable for the subsequent project transfer.

7. PROFINET vs Ethernet Transfer Channel

The TIA Portal download dialog exposes two channel options that behave differently:

• PN/IE — the default. Talks to the panel as a PROFINET IO device, uses the device name and IP, validates the IO AR.
• Ethernet — a pure TCP/IP transfer that does not require a PROFINET name, only IP reachability.

For a brand new panel where the PROFINET name is suspect, switching the transfer channel to Ethernet is a fast diagnostic: if the Ethernet transfer succeeds, the PROFINET name assignment is the problem; if it still fails, the issue is at the IP / firewall / adapter layer. Siemens entry 88633853 documents the two channels in detail and the conditions under which each is allowed.

8. Transfer Settings on the TP700 Comfort Control Panel

On the panel, the Settings → Transfer menu exposes the parameters shown below. The factory defaults are not always suitable for the first commissioning.

9. PG/PC Interface Selection in Detail

The Set PG/PC interface dialog is a frequent source of confusion. The setting binds an access point (a logical name) to a physical network adapter. For HMI transfer in TIA Portal, the relevant access point is S7ONLINE (STEP 7). The historical distinction between S7ONLINE and S7ONLINE_HMI (used by WinCC flexible) is gone in TIA Portal — TIA Portal always uses S7ONLINE for both PLC and HMI transfer.

To verify the binding from the command line, query the SimaticOam registry hive:

reg query "HKLM\SOFTWARE\Siemens\Automation\SimaticOam\RT\Trans\Set_PGPC" /v "S7ONLINE"

The output's Data field is the GUID of the NIC currently bound. Match this GUID to the network adapter in Device Manager. If it points to a virtual adapter (Hyper-V, VPN, WSL, VMware), the transfer will go nowhere. Use reg add to rebind to the wired Ethernet NIC after a Hyper-V installation, as Hyper-V can hijack the access point.

10. Verification After Resolution

After each fix step, perform the three checks below. Only when all three pass is the transfer considered healthy.

1. Ping test — ping -l 64 -n 4 <HMI_IP> returns < 5 ms with zero loss on a direct link.
2. PROFINET name test — in Online → Accessible devices, the panel row shows the configured name in the Device name column.
3. Test transfer — in the TIA Portal project tree, right-click the HMI → Compile and download to device → Software (all). The transfer bar should reach 100 % and the panel should boot into the new runtime within ~30 s.

If step 3 fails but steps 1 and 2 pass, the HMI image version is the next suspect (Section 6). If step 2 fails, repeat the PROFINET name assignment (Section 5.3 or 5.6). If step 1 fails, the issue is Layer-1/2: cable, NIC, or port.

11. Field-Commissioning Checklist for a New TP700 Comfort

Use this checklist the first time a TP700 Comfort is brought up. Each item is a one-minute check; the full sequence runs in 15–20 minutes.

1. Confirm the PROFINET cable is in the PN/X1 port, not the optional RS422/485 port or the service USB.
2. Set the PG's NIC to a static IP in the same /24 subnet as the planned panel IP.
3. Disable Wi-Fi, VPN, and any virtual NICs on the PG.
4. Power the panel, wait for the loader screen.
5. On the panel, open Settings → Network, enter IP, mask, and PROFINET name. Save and reboot.
6. From the PG, ping the panel. If ping fails, fix the cable / subnet first.
7. In TIA Portal, set the S7ONLINE access point to the wired Ethernet NIC.
8. Allow the SimaticOam process through Windows Defender Firewall (TCP 102, UDP 34964/34965).
9. In TIA Portal, go to Online → Accessible devices and verify the PROFINET name appears.
10. Compile the HMI project and select PN/IE as the transfer channel.
11. On the panel, open Settings → Transfer, press Start transfer now.
12. Confirm the project downloaded and the panel boots into runtime.
13. Change the panel's transfer password and switch automatic transfer off before the panel goes live on the network.

12. Frequently Asked Questions