Step 7 V11 on Windows XP Mode VM: Network and HMI Setup

Overview

Siemens STEP 7 V11 (the original TIA Portal release) is a 32-bit engineering environment that predates full 64-bit Windows support. On a 64-bit Windows 7 host, V11 will frequently refuse to install or will crash during online operations unless the installer DVD is the V11 SP2 image. When the only installer available is the V11 RTM DVD, the proven path is to host the engineering tool inside a Windows XP virtual machine: either Microsoft Windows Virtual PC + XP Mode on Windows 7 Professional/Ultimate/Enterprise, or VMware Workstation with a Windows XP guest. Once the VM is in place, the next engineering problem is the network path between the guest, the host, and the S7-1200/S7-300 PROFINET interface on the shop-floor PLC.

This reference covers three integration tasks in one workflow:

1. Building a Windows Virtual PC / XP Mode environment that will install TIA Portal V11 cleanly on a 64-bit host.
2. Bridging the virtual NIC to the host so PROFINET/TCP discovery reaches the S7-1200.
3. Wiring the KTP600 Basic PN HMI into the same STEP 7 V11 project and animating a tank level from an IEC timer accumulator.

Why Virtual XP Is Required for STEP 7 V11

STEP 7 V11 (TIA Portal) is built on a 32-bit process model. The V11 RTM installer explicitly checks for 32-bit Windows and aborts on x64 hosts. V11 SP2 added x64 install compatibility for Windows 7, but stability on x64 was still poor - SP2 will crash far less often than RTM but is not a hardened x64 build. If your support contract only provides the V11 RTM media, the supported workaround is to install on Windows XP (32-bit) inside a virtual machine.

Per the Siemens Industry Online Support entry on the TIA Portal V11 SP2 install, the install DVD can be applied directly to Windows 7 64-bit once the SP2 image is available, but if the original V11 RTM DVD is the only artefact you own, the only officially supported path is a 32-bit Windows host - the cleanest being Windows XP Mode from Microsoft. See the Siemens support thread Step 7 1200 for 64 Bit machines for the official statement.

Prerequisites

Installing Windows Virtual PC and XP Mode on Windows 7

1. Download and install the Windows Virtual PC update and the Windows XP Mode package from the official Microsoft download center. XP Mode is a free add-on for Windows 7 Professional, Enterprise, and Ultimate.
2. Verify virtualization is enabled in BIOS (Intel VT-x / AMD-V). If disabled, Windows Virtual PC will refuse to start the VM.
3. Launch Windows Virtual PC from the Start menu. The default VM Windows XP Mode.vhd is created in your user profile. According to Microsoft Learn, the VHD is stored under a path such as C:\Users\<User>\Virtual Machines\Windows XP Mode.vhd or, on Windows 7, under %LOCALAPPDATA%\Microsoft\Windows Virtual PC\Virtual Machines\. See the Microsoft Q&A reference Where does Win7 store the Windows Virtual PC > XP Mode VHD for the exact location by build.
4. Boot the VM, complete Windows XP Mini-Setup, and install Virtual PC Integration Components from the VM menu (Tools → Install Integration Components). This enables shared folders, clipboard, and the dynamic display driver.
5. Inside the XP guest, install STEP 7 V11 from the DVD. The 32-bit install proceeds without error. Apply V11 SP1/SP2 inside the guest before commissioning online operations.

Network Configuration: Bridging the VM to the PLC

STEP 7 V11 inside the guest must see the S7-1200 PROFINET interface as a reachable node on TCP/IP. The default Shared Networking (NAT) mode of Windows Virtual PC hides the guest behind a NAT, which breaks PG/PC broadcast discovery and is the most common cause of "cannot go online to the PLC." Replace it with a bridged connection that exposes the physical NIC of the host to the guest.

Path A: Windows Virtual PC (XP Mode) - Bind the Virtual NIC to a Physical Adapter

1. Close the XP Mode VM and exit Windows Virtual PC.
2. Open Virtual Networks from the Windows Virtual PC control panel.
3. Create a new virtual network, set it to External, and bind it to the physical Ethernet NIC that is wired to the S7-1200 / PROFINET switch.
4. Open Settings for the XP Mode VM and assign the new virtual network adapter to Adapter 1. Remove or disable any NAT-based adapter.
5. Boot the VM. In Windows XP, assign a static IPv4 address to the LAN adapter. Example: 192.168.0.10 / 255.255.255.0 if the S7-1200 is on 192.168.0.1 / 24.

Path B: VMware Workstation - VMnet Bridged Adapters

For hosts where Windows Virtual PC is unavailable (Windows 8/10 hosts, no VT-x, or multiple NICs), VMware Workstation offers finer control.

1. Open Edit → Virtual Network Editor. The dialog requires elevated rights; click Change Settings.
2. Map each physical NIC to a VMnet: bind the wired shop-floor NIC to VMnet0 (bridged) and the wireless/WAN NIC to VMnet8 (NAT, for internet-only traffic).
3. In the VM Settings panel, add two virtual adapters: assign VMnet0 to Network Adapter 1 (Bridged, Replicate physical network connection state) and VMnet8 to Network Adapter 2 (NAT).
4. Inside the XP guest, configure only the bridged adapter with a static IP on the PLC subnet. Leave the NAT adapter as DHCP for Windows Update access.

IP Subnet Planning for S7-1200 PROFINET Access

The S7-1200 PROFINET interface accepts a single IPv4 address with a /24 (255.255.255.0) netmask for most engineering scenarios. The PG/PC inside the VM must be on the same subnet. Use the following planning table before any configuration.

Verify the path before opening TIA Portal:

ping 192.168.0.1

arp -a  <-- should show the MAC of the S7-1200

Set PG/PC interface:  S7ONLINE  →  TCP/IP (your bridged NIC)

Using NetSetMan for Network Profile Switching

Engineers routinely move between office (DHCP), home (DHCP), and shop-floor (static 192.168.0.x) networks. Re-typing IPs each time is error-prone. NetSetMan is a freeware network profile switcher that stores a complete set of NIC parameters (IP, mask, gateway, DNS, Wins, Wi-Fi SSID) per preset and applies it with a single click or scheduled trigger.

1. Install NetSetMan inside the XP guest.
2. Create a profile named Shopfloor with the static IPs above and a second profile Office set to DHCP.
3. Save the profiles inside the VM's project folder. TIA Portal does not care about the host IP, but a stable naming convention makes project hand-over predictable.
4. Optional: Use the command-line nsm.exe /use "Shopfloor" to script profile switching from a batch file. This pairs well with a TIA Portal project file shortcut.

Resolving the Project-Save Failure in XP Mode

Symptom: closing the TIA project and reopening it shows only the project name; the S7-1200 station, the HMI, the program blocks, and the HMI screens are all gone.

Root causes in order of frequency:

1. Project file saved on a network share that is offline at reopen. Save to a local path on the XP VHD or to a host-shared folder that is permanently mapped.
2. UAC-protected host folder accessed via Virtual PC shared folders. Windows 7 UAC filters writes from a service-style account. Save the TIA project to C:\Users\<User>\Documents\TIA\<ProjectName> inside the XP guest, not to \tsclient\C\Users\....
3. Antivirus inside the XP guest quarantines the .ap11 archive. Add the TIA project directory to the AV exclusion list.
4. Auto-recovery interval is longer than the crash window. Enable Project → Save automatically every 1 minute in TIA Portal options.
5. Project size exceeds the VHD dynamic limit. The default XP Mode VHD is 96 GB dynamic. A TIA V11 project rarely approaches 100 MB, but version-controlled copies plus symbol libraries can grow; VHD compact the image after each major project close.

Integrating the KTP600 Basic HMI

The SIMATIC KTP600 Basic is a 6-inch touch HMI with PROFINET interface. In TIA Portal V11 it is added under Add new device → HMI → SIMATIC Basic Panel → KTP600 Basic mono PN or color PN. The configuration environment is WinCC Basic, which is part of the TIA Portal install.

Connecting the HMI to the S7-1200

1. In the HMI device configuration, set the PROFINET interface IP to 192.168.0.2 / 24.
2. In Connections, create an HMI connection to the S7-1200 with the integrated PROFINET interface as the endpoint.
3. Set the connection mode to PG/PC and HMI share the same subnet if both are on 192.168.0.x.

Displaying an Accumulator Timer Value as a Tank Level

The objective is to display a tank fill percentage based on the running accumulator of an IEC timer. The cleanest implementation in TIA Portal V11 uses an IEC_TON timer block in the S7-1200 program whose ET (elapsed time) output is exposed as a tag, then mapped to a bar/percentage display on the KTP600.

1. Program side (S7-1200, SCL or LAD/FBD): In a function block, instantiate IEC_TIMER_0_0 (DB static) of type TON_TIME. Use PT := T#30s for a 30-second fill cycle. Expose a tag iFillPercent of type INT computed as REAL_TO_INT( IEC_TON_0_0.ET / IEC_TON_0_0.PT * 100 ) in a continuous FB cycle.
2. Tag side (HMI): In the HMI tag table, add a new tag TankFillPct of type Int, connection = the HMI connection above, PLC tag = iFillPercent. Enable Update cycle: 500 ms to match the timer resolution.
3. Screen side (KTP600): Open the screen in WinCC Basic. Drag a Bar object from the toolbox. In the configuration dialog:
   • Variable: TankFillPct
   • Process value range: 0 to 100
   • Limit high: 90 (red), limit low: 10 (yellow)
   • Direction: Bottom to top (tank fill) or right to left (horizontal pipe)
4. Label: Add a text or output field for "Fill %" next to the bar.
5. Compile and download: Right-click the KTP600 → Compile → Software (rebuild all). Then Download to device → HMI. The S7-1200 program is compiled and downloaded separately.

Sample SCL Snippet for the S7-1200

FUNCTION_BLOCK "FB_TankFill"
VAR
    "tonFill" : TON_TIME;
    "iFillPct" : INT;
END_VAR
BEGIN
    "tonFill".IN := "bStart";
    "tonFill".PT := T#30s;
    TON_TIME(IN := "tonFill".IN,
             PT := "tonFill".PT,
             Q  => "tonFill".Q,
             ET => "tonFill".ET);

    IF "tonFill".PT <> T#0s THEN
        "iFillPct" := REAL_TO_INT(DINT_TO_REAL(TIME_TO_DINT("tonFill".ET)) * 100.0 / DINT_TO_REAL(TIME_TO_DINT("tonFill".PT)));
    ELSE
        "iFillPct" := 0;
    END_IF;
END_FUNCTION_BLOCK

Commissioning Verification Checklist

1. VM layer: Bridged NIC shows 192.168.0.10 / 24. ipconfig /all lists the bridged adapter as the active LAN.
2. Physical layer: Link LED on the S7-1200 X1 port and the switch are solid. Replace any cross-over assumption with a switch - PROFINET negotiates 100 Mbit/s full duplex and most modern NICs are MDI/MDIX auto-sensing, but a damaged cable can hang discovery.
3. Reachability: ping 192.168.0.1 from the XP guest returns <1 ms. arp -a shows the S7-1200 MAC (prefix 00:0E:8C for older, 28:63:36 for newer CPUs).
4. Set PG/PC interface: In TIA Portal, Online → Accessible nodes must list the CPU. If empty, re-check the bridged NIC binding.
5. Go online: Online → Go online with the S7-1200 station. CPU diagnostic buffer should show a "PG online" entry with timestamp.
6. HMI compile & download: HMI → Compile → Software (rebuild all) followed by Download to device → HMI. The KTP600 should reboot into the new project within 60 seconds.
7. Live value test: Set "bStart" := TRUE in the watch table. The bar on the KTP600 should sweep 0 → 100% over 30 s. Set FALSE; the bar should freeze at the last ET snapshot.
8. Project archive: Project → Archive → Save as creates a .zap11 on the host. Test restore on a separate host to confirm integrity.

Troubleshooting Matrix

Field-Proven Caveats

• Windows XP Mode VHDs do not survive a Windows 10/11 host upgrade cleanly. If the host is replaced, migrate by exporting the VM via Virtual PC's Close → Export, then convert with VMware or VirtualBox.
• PROFINET DCP discovery uses Ethernet multicast on MAC 01:0E:CF:00:00:00. A managed switch with IGMP snooping disabled can drop these frames. On Cisco/HP managed switches, enable filter unregistered multicast = disabled on the PLC port.
• When the S7-1200 firmware is V4.5 or higher, TIA V11 will refuse to download. Migrate to TIA V15.1 or later in that case - the XP Mode workflow is no longer sufficient.
• The KTP600 Basic Mono PN (6AV6 647-0AC11-3AX0) supports 16 colors; the Color PN (6AV6 647-0AF11-3AX0) supports 256. Bar gradients behave differently between the two. Choose your part number before designing screens.
• STEP 7 V11 SP2 is the last V11 release; no further service packs were published. Critical bug fixes only landed in V13 SP1 and later.

FAQ