S7-1500 to Third-Party HMI: OPC UA, S7 Protocol, and Watchdog Setup

This reference covers the engineering tasks required to attach a non-Siemens HMI (most commonly a Beijer Electronics panel programmed in iX Developer, or a Weintek, Red Lion, Pro-face, or Maple Systems panel) to a Siemens SIMATIC S7-1500 CPU, modify existing logic, and implement the spec line: "The PLC must detect any HMI that is connected and indicated ready; loss of any HMI after indicating ready shall result in an HMI Error. If the HMI is re-established, the error shall clear."

The two engineering decisions are independent: (1) which transport protocol the HMI uses to talk to the S7-1500, and (2) how connection loss is detected. Both are addressed below with parameter tables, SCL code, and iX Developer tag-binding examples.

1. Prerequisites

• S7-1500 CPU with firmware that supports the chosen protocol. OPC UA Server requires Firmware 2.0 or later on most S7-1500 CPUs (S7-1500 V2.0+). Check the firmware entry under Online > Diagnostics > CPU Information in TIA Portal.
• TIA Portal V15.1 or later for OPC UA server configuration. Earlier versions (V13/V14) support only S7 communication and Modbus TCP via a CM/CP.
• HMI vendor IDE: iX Developer 2.40+ for Beijer, EBPro for Weintek, Crimson 3 for Red Lion, GP-Pro EX for Pro-face.
• Ethernet infrastructure: managed switch recommended. The S7-1500 PROFINET port and the HMI must share an IP subnet. Default CPU IP is 192.168.0.1; default Beijer panel IP range is 192.168.1.x; either side must be changed to match.
• Project file from the previous engineer (TIA Portal .ap15_1 or later) plus the HMI project backup if any exists.
• PG/PC Ethernet cable for downloading to the CPU, and a separate cable or switch port for the HMI.

2. Protocol Selection for S7-1500 ↔ Third-Party HMI

Three protocols are practical for an S7-1500 talking to a non-Siemens HMI. The right choice depends on firmware, licensing, and what the HMI driver library supports.

3. Enabling the OPC UA Server on the S7-1500

1. In the TIA Portal project tree, right-click the S7-1500 CPU → Properties → OPC UA → Server.
2. Check Activate OPC UA Server.
3. Set Port = 4840 (default).
4. Choose a Security Policy: None for bench testing, Basic128Rsa15 or Basic256Sha256 for production. The S7-1500 generates a self-signed server certificate automatically; export it to a USB stick and import it into the HMI's trusted-certificate store on first connection.
5. Under OPC UA → Server → User Authentication, leave Disable for an internal machine network, or enable Enable username/password and create a dedicated HMI service account. Do not reuse the CPU's protection-level password as the OPC UA user.
6. Compile and download the hardware configuration to the CPU.

By default, all DBs marked as accessible from HMI/OPC UA are exposed. In each DB's properties, set Optimized block access = checked and Accessible from HMI/OPC UA = checked, or untick Optimized and use absolute addresses if the OPC UA client cannot browse optimized symbols.

4. Enabling S7 PUT/GET on the S7-1500

1. Right-click the CPU → Properties → Protection & Security → Connection mechanisms.
2. Check Permit access with PUT/GET communication from remote partner.
3. Under Protection, set the access level to Full access (no protection) for the HMI service account, or create a separate user with HMI access rights. Avoid "No access (complete protection)" for the HMI account.
4. Compile and download.

PUT/GET lets the HMI read/write DB bytes using the standard Siemens S7 protocol. Block-optimized DBs are still readable through the S7 driver, but writes must use the same data type layout declared in the DB. A real tag binding looks like:

5. Modbus TCP via CM 1542-1 (Fallback Option)

When neither OPC UA nor S7 is available, install a CM 1542-1 in the S7-1500 rack and add a Modbus TCP server connection. The HMI then polls holding registers in a designated DB. Register mapping example:

6. Programming the Beijer (or Other B-Brand) HMI

The "B brand" referenced in the original question is almost always Beijer Electronics (iX Developer / X2 series panels). The integration workflow is:

1. Open iX Developer, open or import the existing .ixproj file.
2. In the Project → Tags node, the existing tags should already point to a Siemens driver. Confirm the driver is Siemens S7-1500 (ISO-on-TCP). The default connection uses 192.168.0.1, rack 0, slot 1.
3. If the project is empty, add a new Controller: right-click Tags → Add → Siemens S7-1500. Configure:
   • IP: 192.168.0.1 (or the CPU's actual IP)
   • Rack: 0, Slot: 1
   • Connection type: ISO-on-TCP (port 102)
   • Polling rate: 100 ms (default 1000 ms is too slow for a heartbeat)
4. Add tags pointing to the DB100 offsets listed in §4.
5. Build the project (F7) and deploy to the panel over Ethernet or USB.

For Weintek panels, the equivalent is EasyBuilder Pro → System Parameters → Device → Siemens S7-1500 (ISO-on-TCP). For Red Lion, the driver is Siemens S7 MPI/TCP in Crimson 3. The tag-mapping rules are identical: bind display elements to PLC addresses, set the polling rate to 100 ms or faster.

7. Detecting HMI Connection Loss Without a Watchdog Toggle on the HMI

Siemens HMIs use a feature called "Area Pointer / Coordination" where a single bit is set by the HMI runtime as long as the connection is alive. Most third-party HMIs do not implement that exact mechanism, so the practical solution is a bidirectional heartbeat:

• PLC toggles a bit every 200 ms (use a clock memory bit or an FB timer).
• HMI reads the bit, inverts it, writes it back to a different PLC address within one poll cycle.
• PLC monitors the echo bit: if it does not change state for > 500 ms, the HMI is considered lost and HMI_Error is set.
• When the echo resumes toggling, the error clears automatically — satisfying the spec line "If the HMI is re-established the error shall clear."

This scheme works equally well with OPC UA, S7, or Modbus TCP. The heartbeat is independent of the protocol choice.

8. SCL Implementation on the S7-1500

Create a new function block FB_HMI_Heartbeat in TIA Portal with the following code. Drop it into a cyclic OB (OB1) and call it once per cycle.

FUNCTION_BLOCK "FB_HMI_Heartbeat"
VAR
    ToggleBit  : BOOL;   // output to HMI: 0,1,0,1,...
    EchoPrev   : BOOL;   // echo state from previous cycle
    EchoStable : DINT;   // ms since echo last changed
    LastChange : DINT;   // last time the echo changed (ms clock)
    HMI_Error  : BOOL;   // latched connection-loss flag
    TimeoutMs  : DINT := 500;
END_VAR
BEGIN
    // 1) Toggle the heartbeat bit every PLC cycle (OB1 ≈ 5–20 ms)
    //    For a stable 100 ms period, derive ToggleBit from a clock memory bit
    //    (System & Clock Memory in CPU properties) e.g. Clock_100ms XOR'ed with 1.
    //    Here we use the cycle counter approach:
    "ToggleBit" := NOT "ToggleBit";

    // 2) Read the HMI's echo
    //    The HMI reads ToggleBit and writes it back inverted into "EchoIn".
    //    If the HMI is alive, EchoIn toggles every cycle.
    //    If the HMI is gone, EchoIn freezes at its last value.

    // 3) Track time since last change
    IF "EchoIn" <> "EchoPrev" THEN
        "LastChange" := "Clock_ms";          // Clock_ms is a DINT clock, e.g. from IEC_TIMER or time-of-day ms
        "EchoPrev"   := "EchoIn";
    END_IF;

    "EchoStable" := "Clock_ms" - "LastChange";

    // 4) Set/clear HMI_Error
    IF "EchoStable" > "TimeoutMs" THEN
        "HMI_Error" := TRUE;
    ELSIF "EchoStable" < ("TimeoutMs" / 2) THEN
        "HMI_Error" := FALSE;                 // auto-clear when echo returns
    END_IF;
END_FUNCTION_BLOCK

Clock Memory Setup

Enable System and clock memory in the CPU's properties. Configure a 100 ms clock bit (default byte 0). Wire it to ToggleBit directly if you prefer not to roll your own toggle in SCL.

9. Heartbeat Implementation on the Beijer iX HMI

In iX Developer, add two tags to the Siemens S7-1500 driver:

• PLC_Heartbeat → DB100.DBX0.1 (Bool)
• HMI_Echo → DB100.DBX0.2 (Bool)

Use a screen Action (or a periodic tag action) that runs every 100 ms:

// Pseudocode for iX Developer Action
IF PLC_Heartbeat == TRUE THEN
    HMI_Echo := FALSE;
else
    HMI_Echo := TRUE;
END_IF;

The action runs on a 100 ms timer built into iX. Set the timer under Project → Global → Actions → Add → Timer Event. Polling cycle on the tag group must be ≤ 100 ms to match the toggle rate.

10. Verification and Commissioning

1. Watch the toggle in TIA Portal. Open Online → Watch table, force DB100.DBX0.1 = 1, refresh, force = 0, refresh. Verify the bit physically toggles every PLC cycle.
2. Watch the echo. With the HMI online, observe DB100.DBX0.2 in the same watch table. It must invert every cycle. If it does not: the iX action is not running, the polling rate is too slow, or the tag offset is wrong.
3. Force a loss. Pull the Ethernet cable from the HMI. Within 1 second DB100.DBX0.3 (HMI_Error) must go TRUE.
4. Reconnect. Plug the cable back in. The echo resumes toggling; HMI_Error must auto-clear within one timeout window.
5. OPC UA security check. If using OPC UA with Basic256Sha256, confirm the HMI's trust store contains the S7-1500's exported certificate. A handshake failure shows up in the CPU's diagnostic buffer as event ID 0x0404 with "Rejected by server".
6. S7 driver error counter. iX Developer logs connection errors under System → Status → Drivers. The "Comm Error" counter increments on every failed poll; verify it stays at 0 during normal operation.

11. Troubleshooting Matrix

12. Field-Proven Notes

• For a 1-second response to a real cable pull, the TimeoutMs constant in §8 should be set to 1000–1500 ms. Going below 500 ms causes nuisance trips on momentary switch overshoot.
• If the application requires multiple HMIs (e.g. local + remote), instantiate FB_HMI_Heartbeat once per HMI with a unique DB100 slot per instance, and OR the resulting HMI_Error bits into a single Any_HMI_Error tag for alarming.
• Keep the heartbeat tags in a dedicated DB (e.g. DB100). Avoid scattering them inside the process DB; the HMI project becomes brittle when addresses shift.
• Document the S7-1500 firmware version in the HMI project's comments panel. OPC UA Server behavior changed between FW 2.0, 2.6, and 2.9 (e.g. max session count, certificate handling).
• When a Beijer panel replaces a Siemens Comfort Panel that already uses Area Coordination, the existing PLC code that monitors that coordination bit will not work. Re-map it to the new heartbeat tags and update the alarm text.

FAQ