TP177B Screen Mirroring via Sm@rtServer: VNC Configuration Guide

Overview: TP177B Screen Mirroring Use Case

The SIMATIC TP177B is a 6-inch HMI panel from the SIMATIC HMI Compact family, commonly paired with S7-200 CPUs in compact machine applications. A frequent field requirement is to mirror the panel’s active runtime screen onto a larger industrial monitor so supervisors and remote viewers can observe operator actions without interfering with local touch interaction. The TP177B has no integrated VGA, DVI, HDMI, or DisplayPort output. Direct video output from the panel to a monitor is therefore impossible; the screen data must be transported over the network.

Siemens addresses this requirement through the Sm@rtServer runtime option, which embeds a standards-compliant VNC server (RFB protocol) inside the TP177B firmware. Any standards-compliant VNC client running on a PC, industrial thin client, or panel PC can then render the live screen onto its own video output to drive the larger display. This reference documents the hardware variants, firmware prerequisites, licensing rules, network topology, configuration steps in WinCC flexible 2008 and TIA Portal, read-only enforcement, commissioning verification, and a troubleshooting matrix for the complete deployment.

TP177B Hardware Variants and Connectivity

Sm@rtServer uses the panel’s Ethernet interface to publish the VNC stream, so only the PN/DP variants are usable. The DP-only variants ship without Ethernet and cannot host a VNC server. Always verify the order number on the rating plate before purchasing spares or replacement units, and check the firmware image version when commissioning existing panels.

Common electrical and physical data for the PN/DP variants:

• Supply: 24 V DC (range 20.4 to 28.8 V), typical power 10 W, max 14 W.
• Ethernet: 10/100 Mbps, RJ45, integrated switch with one external port.
• PROFIBUS DP: up to 12 Mbps (for S7-200/300/400 and non-Siemens masters).
• Display: 5.7-inch STN LCD, 320 × 240 pixels, LED backlight.
• Memory: 1 MB configuration memory, 4 MB flash.
• Operating temperature: 0 to +50 °C horizontal mounting, 0 to +40 °C vertical.

The TP177B PN/DP integrates a single-port Ethernet switch. When the panel needs to sit on a larger PROFINET network or share Ethernet with multiple devices (PC for VNC viewing, additional HMI), an external industrial switch (e.g. SCALANCE XC-100, XB-100, or equivalent unmanaged switch) is required.

Sm@rtServer Architecture: VNC-Based Screen Mirroring

Sm@rtServer is a runtime option that turns the TP177B into an RFB (Remote Framebuffer) server. The panel publishes the current runtime screen as a VNC stream that any compliant client can render. Three related options exist in the Siemens WinCC option family:

• Sm@rtServer: server component running on the panel; the surface this document deploys.
• Sm@rtAccess: client component used by the engineering station or another HMI to view remote panels.
• Sm@rtService: extends Sm@rtAccess with web-based remote maintenance and HTML5 inbox.

The VNC stream is unidirectional pixel data plus bidirectional keyboard/touch events when remote operation is enabled. For monitoring-only mirror use cases, remote input is disabled, leaving the operator’s touch on the TP177B as the only input path.

The architecture is summarized in the diagram below. The S7-200 CPU communicates with the TP177B via PPI/MPI for process data, while Sm@rtServer publishes the rendered screen to a VNC client over Ethernet.

Licensing, Firmware, and Software Prerequisites

Sm@rtServer is a licensed runtime option. Without a license the panel enters a 60-minute grace period after each restart during which Sm@rtServer functions fully, but production deployments require a permanent license to keep the option active after the timer expires. The license is installed on the TP177B itself (not on the VNC client PC) and is transferred via ProSave or the engineering software.

License ordering information varies by region and software version; consult the Siemens Industry Online Support catalog under SIMATIC HMI software > WinCC flexible > Options for the current Sm@rtServer article number when procuring. License files are delivered as a license key (Certificate of License, CoL) that ProSave installs into the panel’s license memory.

Network Topology and Address Planning

The TP177B PN/DP variant carries only one external Ethernet port, so a typical screen-mirroring topology places the panel and the monitoring PC on the same subnet through an external switch. For machine-level isolation the subnet should be separate from the corporate network; remote viewing from outside the machine cell requires a VPN or router-level port forwarding with strict access control.

Required firewall rules and ports:

• TCP 5900 (or configured VNC port) inbound on TP177B: allow from viewer PC only.
• TCP 102 (PROFINET IO) if used: allow only between controller and panel.
• TCP 80/443 (Sm@rtService web): block in production unless remote maintenance is contracted.
• Block all other inbound traffic at the switch or firewall.

WinCC flexible 2008 Configuration Procedure

The TP177B predates TIA Portal’s first release. Most existing projects are still maintained in WinCC flexible 2008. The following steps assume a project already exists for the TP177B; if starting fresh, select TP177B PN/DP in the WinCC flexible project wizard and configure the S7-200 connection first.

1. Open the WinCC flexible 2008 project and select the TP177B in the project tree.
2. Open Device Settings from the context menu or via the panel’s properties dialog.
3. Switch to the Services tab (Runtime Services).
4. Tick the Sm@rtServer checkbox to enable the option.
5. Set the TCP port (default 5900). Increase the port if the panel is one of several VNC servers behind the same firewall.
6. Configure the VNC password (1-8 ASCII characters). Record the password in the project’s documentation.
7. Under User Administration, define a user account whose Authorization level is set to View only; do not assign operator rights.
8. Compile the project (Project > Compiler > All).
9. Transfer the project to the TP177B via Ethernet (PN/DP variant) using WinCC flexible’s transfer dialog.
10. On the panel, open the Control Panel > Sm@rtServer and verify the option is marked Running; the taskbar shows a Sm@rtServer icon when active.
11. Test the connection from the engineering station using any VNC viewer: vncviewer 192.168.10.10::5900 or via a graphical client connecting to 192.168.10.10:5900.

WinCC flexible uses two paths for the transfer dialog: Project > Transfer > Transfer Settings sets the channel; Project > Transfer > Transfer to Target Device initiates the actual transfer. For the PN/DP variant, ensure the engineering station is on the same subnet as the panel and that the panel’s transfer mode is enabled in its Control Panel (Settings > Transfer > Remote Control).

TIA Portal Configuration Procedure

When the project is maintained in TIA Portal (V13 SP1 with the TP177B HSP, or V14/V15 with WinCC Comfort/Advanced and the corresponding HSP), the configuration path is parallel but uses the TIA Portal property sheet structure.

1. Open the TIA Portal project and select the TP177B device in the project tree.
2. Open Properties > Runtime settings > Services.
3. Activate Sm@rtServer.
4. Set the TCP port (default 5900) and password (1-8 ASCII chars).
5. Define user accounts under User administration; assign the VNC user a View-only authorization.
6. Compile the project (Compile > Software (rebuild all)).
7. Download to the TP177B (Online > Download to device).
8. On the panel, verify the Sm@rtServer icon in the taskbar and the Control Panel > Sm@rtServer status.
9. Validate from the viewer PC using vncviewer 192.168.10.10:5900 or any compliant client.

For projects being migrated from WinCC flexible, the Sm@rtServer settings do not always port cleanly. Verify the password and port values after migration; do not assume the previous values are preserved. See the TIA Portal documentation for HSP-supported TP177B feature matrices.

Configuring Read-Only Monitoring and Access Rights

The deployment requirement here is monitor-only: the supervisor’s screen must track every navigation and value change the operator makes, but no input from the supervisor should reach the panel. Two complementary mechanisms enforce this:

1. Sm@rtServer view-only mode: when the connected VNC client uses the View-only user account, mouse and keyboard events sent from the viewer are discarded by the panel. The operator’s local touch remains the only authoritative input.
2. RFB view-only flag: standard RFB supports a view-only pointer-event flag. RealVNC, TightVNC, and TigerVNC expose this as a checkbox in the connection profile; the panel honors it as soon as the flag is set, regardless of the user account.

Recommended enforcement procedure:

• Create a dedicated user named sm_viewer in WinCC flexible / TIA Portal user administration.
• Set its Authorization field to View only. Do not add the user to any group that contains operator rights.
• Set the Sm@rtServer password to a value distinct from any operator password.
• On the viewer PC, configure the VNC client profile with the View only flag enabled as a defense-in-depth measure.
• Document the password in the project handover and restrict distribution to authorized maintenance staff.

To verify read-only behavior during commissioning, attempt to change a tag value from the viewer PC; the panel should ignore the input. If the value updates, either the user authorization is incorrect or the RFB view-only flag is not set on the client.

Commissioning Verification Checklist

Run through the following matrix before declaring the mirroring deployment complete. Each row lists a check, the expected result, and the diagnostic action if the result is negative.

Operational Limitations and Constraints

• No native video output on the panel. The TP177B does not provide VGA, DVI, HDMI, or DisplayPort outputs. The TP177B cannot be plugged directly into a monitor with a video cable; a VNC client device is mandatory.
• Sm@rtServer adds runtime load. Continuous screen encoding consumes CPU cycles on the panel. With heavy tag updates or rapid screen changes, expect a 5-15% reduction in panel responsiveness. Reduce concurrent VNC clients if response becomes sluggish.
• Demo mode duration is 60 minutes per restart. Without a license, the Sm@rtServer option stops accepting new connections and refuses existing connections after the timer elapses. Restarting the panel grants another 60 minutes; production deployments require the paid license.
• RFB traffic is unencrypted. Standard RFB does not encrypt the pixel stream or password. Use a private LAN or a VPN tunnel when crossing network boundaries.
• Concurrent clients. While RFB supports multiple viewers, the TP177B’s runtime has limited headroom; 1-2 concurrent clients is the practical maximum before visible lag appears.
• Touch input forwarding. When Sm@rtServer is in operate mode (not view-only), input from the remote client is injected into the panel runtime. To prevent accidental operation, always use the view-only configuration described above.
• S7-200 communications. Sm@rtServer shares the Ethernet port with other traffic (engineering transfers, PROFINET IO). The TP177B’s internal switch handles QoS internally, but heavy PROFINET IO plus multiple VNC clients can saturate the 100 Mbps link. Segment the network with a managed switch if you observe dropped HMI polls.
• Password length cap. RFB passwords are limited to 8 ASCII characters; longer passphrases are not supported. Plan password policy accordingly.

Troubleshooting Matrix

Frequently Asked Questions