S7-1211C Start-Stop Programming in TIA Portal with Web Server

David Krause14 min read
S7-1200SiemensTutorial / How-to
Licensed PE Working through this on a live machine? A Maine-licensed engineer can take it from here — included with IMD hardware, by the hour for everything else. Book an engineer

Application Overview

This reference implements a classic two-wire (Start/Stop with seal-in) ON/OFF control routine on a SIMATIC S7-1211C CPU and exposes three PLC tags — Start, Stop, and Motor_Run — to a user-defined web page served by the S7-1200 web server. The end user can press Start and Stop from any modern browser on the same subnet without an HMI panel or additional HMI runtime license.

The ladder network follows IEC 61131-3 conventions: a normally-open Start pushbutton sets a bit that latches through a parallel auxiliary contact; a normally-closed Stop pushbutton (wired or simulated) breaks the seal-in path. The same logic is duplicated using the SR (Set-Dominant Set/Reset) flip-flop to give engineers a choice between the classic contact-and-coil method and the bit-instruction method.

The HTML page is generated as a fragment with AWP (Automation Web Programming) commands. TIA Portal injects the page into the PLC file system at compile time, and the S7-1200 web server streams it on HTTP GET to a browser, replacing the default Siemens intro page.

Hardware: SIMATIC S7-1211C CPU

The S7-1211C is the entry-level CPU in the S7-1200 family. The DC/DC/DC variant (6ES7211-1AE40-0XB0, firmware V4.x) is the most common choice for this kind of discrete control because it provides:

Parameter Value
Order number (DC/DC/DC) 6ES7211-1AE40-0XB0
Order number (DC/DC/RLY) 6ES7211-1HE40-0XB0
Order number (AC/DC/RLY) 6ES7211-1BE40-0XB0
Digital inputs (24 V DC) 6 (4 HSC-capable)
Digital outputs 4 (DC sourcing or relay)
Process image (I/Q) 1024 bytes in / 1024 bytes out
Bit memory 4096 bytes
Work memory 50 KB program / 75 KB data
Load memory 2 MB internal, expandable with SIMATIC memory card
Web server Yes (HTML5 since firmware V4.2)
User-defined web pages Yes (HTML + AWP commands)
Real-time clock Yes (battery-backed)
PROFINET 1 x RJ45, 10/100 Mbit/s
Note on variants: For the start/stop application described here any 1211C variant works because only the I/O count and not the CPU core is exercised. If you wire physical pushbuttons, choose the DC/DC/RLY variant so the inputs accept 24 V sourcing signals and the outputs drive relay coils directly.

Verify the firmware in TIA Portal under Online > Accessible Devices or read SD card file SIMATIC.S7S in the PLC /System directory. User-defined web pages and the HTML5 web server require firmware V4.0 or higher. The HTML5 visual redesign is delivered starting with V4.2.

Software Prerequisites

  • TIA Portal V15.1 or higher (V17 / V18 recommended for current firmware support)
  • SIMATIC S7-1200 CPU device package matching the firmware of the target PLC
  • Web browser supporting HTML5 and JavaScript (Edge, Chrome, Firefox)
  • Network connection between engineering station and CPU PROFINET port (cross-over cable or switch)

Install the S7-1200 HSP (Hardware Support Package) from the Siemens support site if your TIA Portal version does not list the 1211C in the device catalog. The HSP adds the device description including firmware V4.6 / V4.7 currently shipping on 1211C CPUs.

TIA Portal Project and Tag Configuration

  1. Open TIA Portal and choose Create new project. Name it e.g. StartStop_Web.
  2. From Portal view > Devices & networks click Add new device > SIMATIC S7-1200 > CPU > CPU 1211C DC/DC/DC > 6ES7211-1AE40-0XB0 with firmware V4.6. The slot configuration opens.
  3. In Device view confirm the integrated DI6/DQ4 module. No signal board or signal module is required for this application.
  4. In Properties > Ethernet addresses set the PROFINET IP to a fixed address (e.g. 192.168.0.10 / 255.255.255.0). Static IP is mandatory for the web server URL.
  5. Under Properties > Web server check Activate web server on this module. The CPU then starts serving the standard pages immediately. User-defined pages are added in a later step.

Create a tag table named tags_HMI and declare the following tags. The exact names appear in the AWP source as :="tag name": placeholders.

Name Data type Address Direction Comment
Start_Button Bool %I0.0 Input NO pushbutton, wired to DI a
Stop_Button Bool %I0.1 Input NC pushbutton, wired to DI b
Motor_Run Bool %Q0.0 Output Contactor coil, driven via DQ.0
HMI_Start Bool %M10.0 In/Out Start flag from web page
HMI_Stop Bool %M10.1 In/Out Stop flag from web page
Run_State Bool %M20.0 Internal Sealed-in run flag
Web_Output Bool %M20.1 Internal Mirror of Motor_Run for AWP read
Wiring convention: Inputs are sinking (type 1 per IEC 61131-2) on the 1211C. Wire the NO Start button between 24 V DC source and the input terminal. The NC Stop button should be wired so that opening the contact (button pressed) drives the input FALSE, because the ladder treats the input as TRUE in the idle state.

Ladder Logic Implementation

Drop a new ladder network inside Main [OB1]. Use the LAD editor in TIA Portal. Two networks cover the two implementation styles: the classic contact-and-coil seal-in (Network 1) and the SR flip-flop (Network 2). Pick the one that matches your company coding standard — both produce identical end-to-end behavior when wired correctly.

Network 1 — Two-wire start/stop with seal-in:


Network 1: Two-wire start/stop control (seal-in)
|----[ Start_Button ]--+----[/ Stop_Button ]----( Run_State )----|
|                      |                                           |
|                      +----[ Run_State ]---------------------------|
|                                                                   |
|----[ Run_State ]-----------------------------------( Motor_Run )---|
|                                                                   |
|----[ Run_State ]-----------------------------------( Web_Output )--|

The first rung sets the seal-in flag Run_State when Start_Button is pressed and the stop contact is closed (TRUE). The second rung drives the physical output Motor_Run and mirrors it to Web_Output for the AWP page. Because the seal-in auxiliary contact is wired in parallel with the Start input, releasing the button does not drop the output; pressing the NC Stop button opens the rung and clears the flag.

To make the logic robust against stuck contacts, add an additional NC contact of Motor_Run in series with the stop branch if external wiring provides feedback. This is a common motor contactor interlock practice.

Network 2 — Set/Reset flip-flop (Set dominant):


Network 2: SR flip-flop control (Set dominant)
|----[ Start_Button ]--+----[/ Stop_Button ]--+---( SR )---|
|                       |                       | S1         Q|
|                       |                       | R          |
|                       +----[ HMI_Start ]------+            |
|                                                              |
|----[ HMI_Stop ]--------------------------------------( R )---|
|                                                              |
|----[ SR.Q ]------------------------------------( Motor_Run )--|
|                                                              |
|----[ SR.Q ]------------------------------------( Web_Output )-|

The SR block has a single-instance DB (created automatically). Input Set1 is the start OR, input Reset is the stop. The Set is dominant by default: if both Set1 and Reset are TRUE simultaneously, the output remains TRUE. Engineers who require a reset-dominant behavior should use the RS (Reset-Dominant Set/Reset) block instead.

Why two networks? In a real machine the start/stop logic usually lives inside a function block (FB) with instance DB. Showing both contact-and-coil and bit-instruction implementations side by side makes it easier to migrate between the two styles depending on company coding standard.

Web Server and User-Defined Page Activation

After the basic CPU is online, the S7-1200 web server is reachable at http://192.168.0.10. The default page offers diagnostics, tag status, watch tables, and firmware information. To overlay a custom page that controls the application, follow the steps below.

  1. In the TIA Portal project tree, right-click the CPU and choose Add new user-defined web page. The wizard creates a folder under CPU_1 > Web pages and inserts a default index.html.
  2. The wizard adds two files to the project:
    • index.html — the HTML body visible to the browser.
    • script.js — optional JavaScript helpers for AWP polling.
  3. Mark the user-defined web page as the start page under Properties > Web page > HTML directory > Default page if you want the browser to load your page instead of the Siemens intro.
  4. Compile the project. TIA Portal packages the HTML, AWP substitutions, and the generated fragments into the SDB and writes them to the PLC on download.

To activate the user-defined pages at runtime, the CPU must have Activate web server enabled (set in step 5 of project creation) and the user must have at least the Read access level configured under Properties > Protection & Security > Access levels. Write or HMI access is required to toggle outputs from the page. See the SIMATIC S7-1200 Programmable Controller System Manual chapter 11 for full web server configuration details.

AWP Command Reference

The user-defined web page uses a small set of AWP commands. The following table summarizes the ones needed for this project.

AWP command Syntax Function
Variable read :="Run_State": Substituted with the current value of the tag at request time
Variable write (form) <form>...<input name='"HMI_Start"'>...</form> Submitted via HTTP POST to set the tag
Enum value :=HMI_Start:0 Force the value to a literal constant
Page fragment (write) <!-- AWP_In_Variable Name='"HMI_Start"' --> Declare a tag as a writable input variable
Page fragment (read) <!-- AWP_Out_Variable Name='"Run_State"' --> Declare a tag as a read-only output variable
Set value <input type='hidden' name='"HMI_Start"' value='1' /> Used inside a form to write a constant 1 to HMI_Start

Place the variable declaration block at the top of the HTML file, before <body>:


<!-- AWP_In_Variable Name='"HMI_Start"' -->
<!-- AWP_In_Variable Name='"HMI_Stop"' -->
<!-- AWP_Out_Variable Name='"Run_State"' -->

The single-quote / double-quote nesting follows the Siemens documented convention: outer single quotes for the HTML attribute value, inner double quotes for the AWP variable name string. The HTML editor of TIA Portal validates the syntax when you save the file. A complete list of supported commands is available in the S7-1200 Web Server Application Examples support entry.

HTML Page Build

Below is a minimal but functional HTML page that contains two forms: one for Start, one for Stop, and a status label that reads the current value of Run_State. Save the file in the Web pages folder of the CPU object.


<!DOCTYPE html>
<html lang='en'>
<head>
  <meta charset='UTF-8'>
  <title>S7-1200 Motor Control</title>
  <style>
    body { font-family: sans-serif; margin: 2rem; }
    .btn { padding: 0.6rem 1.2rem; margin: 0.4rem; font-size: 1rem; }
    .run { color: #1a7f37; font-weight: bold; }
  </style>
</head>
<body>
  <h1>Motor Control</h1>
  <p>State: <span class='run'> :="Run_State": </span></p>
  <form method='POST' action=''>
    <input type='hidden' name='"HMI_Start"' value='1' />
    <button class='btn' type='submit'>Start</button>
  </form>
  <form method='POST' action=''>
    <input type='hidden' name='"HMI_Stop"' value='1' />
    <button class='btn' type='submit'>Stop</button>
  </form>
</body>
</html>

When the operator clicks Start, the browser issues an HTTP POST to the same URL with the form data "HMI_Start"=1. The web server interprets this as a write to the AWP_In_Variable HMI_Start. The PLC then sets the bit in OB1 cycle, and the seal-in logic drives Run_State and Motor_Run high. The next page refresh shows the new state.

To refresh the state without a full reload, embed a tiny JavaScript that uses fetch() to poll a second HTML fragment that only contains the :="Run_State": substitution. Siemens ships sample JavaScript for this exact pattern in the help system.

Deployment and Verification

If the CPU is in a different location from the engineering station, copy the user-defined web page to a SIMATIC memory card and insert it into the PLC before power-up. The folder structure on the card must be:


/SIMATIC/S7-1200/WEB/
    index.html
    script.js
    fragments/
        state.html

To export the web pages from TIA Portal, choose CPU > Web pages > Export. TIA Portal creates a zip file that can be unzipped to a memory card. Siemens documentation states that the HTML files must be saved in UTF-8 without BOM — a BOM marker is prepended to the response and corrupts AWP tag substitution.

Commissioning sequence:

  1. Right-click the CPU in the project tree and choose Download to device > Hardware and software. TIA Portal writes the program, the web pages, and the configuration into the CPU.
  2. Open a browser and navigate to http://192.168.0.10. The default Siemens page appears first; click the user-defined page link in the navigation, or load http://192.168.0.10/awp/index.html directly.
  3. From the start page click Start. The browser posts to the CPU, the seal-in flag Run_State goes TRUE, and the Motor_Run output energizes. The state indicator on the page should change to 1 on the next refresh.
  4. Click Stop. The state goes back to 0 and the output drops out.
  5. To verify the physical wiring, open a watch table in TIA Portal (Online > Watch & force tables) and force Start_Button and Stop_Button while monitoring Motor_Run. The behavior must match the network logic exactly.
  6. Power-cycle the PLC to confirm the bit memory configuration. With HMI_Start and Run_State declared non-retentive, both reset to FALSE on restart, preventing a dangerous auto-restart.

Troubleshooting Matrix

Symptom Possible cause Diagnostic step Corrective action
Web page returns 404 Web server not activated or user-defined page not compiled Open default Siemens page first to confirm the server is up Check Activate web server; recompile project
Start button has no effect Access level insufficient or HMI_Start not declared as AWP_In_Variable Inspect the HTML head for the AWP comment Add the declaration, set Write access in protection settings
Page shows literal :="Run_State": AWP comments missing or HTML not recognized as a user-defined page View source in browser; verify the comment block Re-save the file with the AWP_In_Variable / AWP_Out_Variable comments
Output latches on regardless of Stop Stop input wired as NO instead of NC, or wrong tag address Watch table: toggle Stop_Button and confirm the bit goes FALSE Re-wire the pushbutton; correct the tag address
Stop works but Start does not Start tag address overlaps with retentive area or HMI_Start memory is not cleared Force the tag with TIA Portal; check OB1 scan Clear the bit in startup OB or change address
CPU in STOP after download Compile error in HTML triggers PLC startup inhibit on some firmware Check diagnostic buffer for 'User-defined web page: syntax error' Correct the HTML and reload
Page refresh shows stale data Browser cache holding the old AWP substitution Open DevTools and disable cache Force reload (Ctrl+F5) or append a query string
HMI_Start writes 0 and 1 alternately Form submits with no value attribute; browser sends empty View the form in browser; inspect submitted data Add value='1' to the hidden input
Browser shows the Siemens default page only User-defined page not set as default Check HTML directory > Default page in CPU properties Set the user-defined page as default and recompile
Output drops randomly during normal operation OB1 cycle exceeded, scan time too long, or noise on stop input Check CPU scan time in online diagnostics; check wiring Add input debounce in OB1 or use a longer filter time on the DI module

Commissioning Best Practices

  • Browser access through the integrated PROFINET port is sufficient for subnets up to 32 clients. For larger deployments, use a separate router or industrial firewall because the S7-1200 web server has no built-in HTTPS.
  • The user-defined web page is read from the CPU file system on every request. The default OB1 cycle is fast enough to serve dozens of users without noticeable delay, but with HTML5 visualizations the request time can grow beyond 200 ms per page if the fragment is large.
  • When the CPU is in STOP, the user-defined web page is still served but writes are ignored. The browser cannot differentiate between this state and a running CPU, so wire a Run_State indicator (LED or 24 V lamp) on the output to give the operator a physical confirmation.
  • Authorization is performed once per session. If the operator navigates to a different page, the S7-1200 web server keeps the access level in a cookie for the lifetime of the browser session.
  • For multi-language support, the user-defined web page can use the :="My_Tag".Lang syntax to substitute text from a string-tag array. Each language becomes one PLC string tag.
  • Mark the HTML directory as Default page in the CPU properties; otherwise, the browser lands on the Siemens intro and the operator has to drill down to reach the control page.
  • Use Retain only on tags that must survive a power cycle. For this application, Run_State and Web_Output should be non-retentive so the machine never restarts automatically after a power failure.

What TIA Portal version is required for user-defined web pages on the S7-1211C?

TIA Portal V13 SP1 or higher is the baseline for user-defined web pages on the S7-1200. For HTML5 web pages and the modernized look-and-feel, TIA Portal V15.1 with a CPU firmware of V4.2 or higher is recommended.

Do I need a SIMATIC memory card to store the user-defined web page?

No. The compiled user-defined web page is stored in the load memory of the CPU. The memory card is only needed when the source HTML files must travel with the PLC to a different site, or when the load memory is too small to hold the project.

Why does my Start pushbutton need to be a NO contact and the Stop pushbutton a NC contact?

The standard seal-in ladder expects a normally-closed Stop so that a wire break or contact failure de-energizes the motor. A normally-open Start ensures the operator must press the button to start the machine. Both conventions align with IEC 60204-1 emergency stop requirements.

Can the web page write to physical outputs directly?

Yes, the AWP mechanism can target any tag, including %Q0.0. However, the recommended practice is to write to a memory bit and let the PLC program decide whether to energize the output, because the browser is not a safety-rated input device and cannot enforce interlocks.

How do I protect the web page with a password?

Open CPU Properties > Protection & Security > Access levels, set the HMI access level password, and choose HMI access for the user-defined web page. The browser prompts for the password on the first navigation to a protected page.

Back to blog