Troubleshooting KTP Basic HMI to ET 200SP CPU 1510SP-1 PN

1. Problem Overview

This troubleshooting reference addresses a recurring integration fault on SIMATIC ET 200SP stations built around the CPU 1510SP-1 PN (order number 6ES7510-1DJ01-0AB0 / current revision 6ES7510-1DK03-0AB0) when a KTP Basic Panel (KTP400 Basic, KTP700 Basic, KTP900 Basic, KTP1200 Basic, or KTP1200 Basic DP) is attached over PROFINET. The classic symptom set is:

• The KTP Basic boots, displays the start screen, but tag values remain frozen at initial value (0 / empty string).
• No diagnostic buffer entry, no SF / BF LED on the HMI, no PROFINET channel-diagnostic alarm in TIA Portal.
• Pressing buttons on the HMI does not toggle the corresponding tags in the PLC tag table.
• The PLC tag table shows "Access" column populated, but HMI shows nothing.
• Security settings in the HMI project are greyed out ("HMI access" only, no operator/admin distinction available).
• Image version on the KTP is outdated (pre-V17 Update 6 panels frequently exhibit this failure mode).

The CPU 1510SP-1 PN is a PROFINET IO controller with 100 KB program memory and 750 KB data memory. It supports up to 64 IO devices within one PROFINET IO system as documented in the official CPU 1510SP-1 PN manual. The KTP Basic panels use the WinCC RT image structure that is sensitive to firmware mismatch with the TIA Portal engineering version.

2. Root Cause Analysis

Five interacting root causes account for the vast majority of "HMI shows no values, no error reported" cases on this topology:

1. Firmware / Image version mismatch. KTP Basic panels shipped before WinCC Panel Images V17 Update 6 have a known PROFINET connection-loss issue to S7-1500 / ET 200SP CPUs. The HMI silently drops the AR (Application Relationship) and retries without raising an operator-visible alarm. The official fix is to update the panel image to WinCC Panel Images V17 Update 6 or later (V18 / V19 are preferred for new projects).
2. Time-zone drift between PLC and HMI. WinCC tags that use scheduled acquisition or time-stamping evaluate the onboard clock. When the CPU 1510SP-1 PN is set to local time (e.g., UTC+1 with summer/winter switching) and the KTP is set to UTC+0, or vice-versa, tag freshness comparisons fail and values are not committed to the screen. Both devices must run on the same time base — typically UTC (no offset, no daylight saving).
3. PLC tag access right not granted to the HMI connection. In the PLC's tag properties the access right "HMI access" must be explicitly enabled. When the HMI connection is created from the HMI device's "Connections" editor, the wizard can leave "Accessible from HMI" unchecked. The tag then compiles fine and is visible in the project tree but the runtime AR will not expose it.
4. PROFINET device name mismatch / unassigned name. The KTP Basic PROFINET device must have a PROFINET device name that matches the configured partner in TIA Portal. When the topology is loaded to the CPU but the device name has not been assigned to the panel (assign PROFINET device name), the AR remains in "Name not assigned" state with no operator alarm — only a BF flash on the panel port.
5. Security level locked to "HMI access" only. When the user administration in the HMI project is configured with the legacy role scheme (rather than the newer User Management / UMAC scheme in TIA V17+), the role dropdown is greyed out. This indicates the panel image is too old to support the new scheme, again pointing to the panel image update.

3. Prerequisites

• TIA Portal V17 Update 6 or later (V18 / V19 recommended for ET 200SP firmware >= V3.1).
• KTP Basic panel image V17 Update 6 or later — verify in the panel under Settings > System > Image Version.
• ET 200SP CPU 1510SP-1 PN firmware V2.9 or later (V3.0 / V3.1 for full TIA V18 feature set).
• PROFINET cable (Cat 5e or higher, copper, max 100 m segment) between CPU PROFINET port X1 and KTP PROFINET port.
• Configured IP subnet matching both devices (default 192.168.0.x / 255.255.255.0 is acceptable for bench tests).

4. Image Version & Firmware Verification

Image version is the single largest contributor to silent connection drops. Confirm as follows.

1. On the KTP Basic, navigate Control Panel > System > About > Image Version. Note the build string.
2. Compare with the Siemens WinCC Panel Images release notes for your TIA Portal version. V17 Update 6 and newer contain the connection-stability fix referenced in the Siemens support entry "No connection to PLC after WinCC Panel Images V17 Update 6".
3. If the build is older, download the matching WinCC Panel Images update from the Siemens Industry Online Support portal. Use ProSave to perform the image update; do not flash a different major version than your TIA Portal project compiles against.
4. On the CPU 1510SP-1 PN, open Online & Diagnostics > Diagnostics > CPU in TIA Portal and confirm firmware version. For ET 200SP CPUs with order code 6ES7510-1DK03-0AB0, the current firmware is V3.1.x — see the CPU 1510SP-1 PN ID-Link reference for the device-specific manual collection.

5. PROFINET Topology & Device Name Assignment

The PROFINET AR between the CPU 1510SP-1 PN and the KTP Basic is established only after the panel's PROFINET device name is assigned and matches the TIA Portal configuration. The CPU will not raise an operator alarm if the name is wrong — only a slow BF blink on the HMI port.

1. In TIA Portal Devices & Networks, drag the KTP Basic PN device into the PROFINET subnet of the CPU 1510SP-1 PN.
2. Assign a unique PROFINET device name (e.g., ktp700-basic-1) in the device properties.
3. Compile and download the hardware configuration to the CPU.
4. Right-click the KTP device in Devices & Networks > Assign PROFINET device name. In the dialog, select the target MAC address of the panel and the configured name. Confirm.
5. The panel BF LED should extinguish within 5 seconds. The CPU 1510SP-1 PN should report the device as accessible in Online & Diagnostics > PROFINET IO > IO Devices.

6. Time Synchronization (UTC Handling)

Clock drift between PLC and HMI is a documented cause of "no value updates" without any visible alarm. The fix is to force both devices onto a common time base.

1. In the CPU 1510SP-1 PN properties > Time of day, set the time source to None for bench testing or to an NTP server for production. Disable "Time zone" daylight-saving compensation; the time transmitted over PROFINET should be UTC.
2. On the KTP Basic Control Panel > System > Date/Time, set the time zone to UTC+0 (London, Lisbon) and disable automatic DST switching.
3. Verify by triggering a time-of-day read from the PLC using RD_SYS_T (read system time) and writing it to a tag the HMI displays. If the value matches the panel's Date/Time screen within one second, the time base is correct.

7. HMI Connection Configuration

Configure the S7 connection inside the HMI project explicitly. Do not rely on automatic connection detection.

1. In the KTP Basic device > Connections, add a new connection of type S7ONLINE / S7 1500.
2. Set the partner (PLC) IP address to the CPU 1510SP-1 PN's PROFINET interface address (default 192.168.0.1).
3. Set the access point to S7ONLINE and the slot/rack to 0 / 1 (CPU 1510SP-1 PN default).
4. Confirm that the connection's "Establish connection" is set to "On project startup".
5. Compile the HMI project and transfer the runtime to the panel.

Refer to the Siemens Knowledge Base article "Configuration of an HMI connection to S7-1500 / S7-1200 CPUs" for the canonical step-by-step with screenshots.

8. PLC Tag Access & Security Settings

Tag access must be granted to the HMI at two layers: the project-wide HMI connection ACL and the per-tag "Accessible from HMI" attribute.

1. In the CPU 1510SP-1 PN > Properties > Connection resources, verify that the HMI connection type is permitted (S7 HMI connection is enabled by default).
2. In the PLC tag properties (default tag table or user-defined tag table), open each tag used by the HMI and verify the Accessible from HMI column. This must be ticked.
3. If the column is greyed out, the tag resides inside an optimized block and the access is via the symbolic name only. Switch the tag's "Accessibility" to "Accessible from HMI" in the block's properties.
4. Under PLC properties > Protection & Security, ensure the access level "Full access (no protection)" is selected for bench testing. Production deployments should use a HMI password (level 2) at minimum.

When the HMI security dropdown shows "HMI access" only and is greyed out, the panel image is too old to interpret the newer user-administration schema. Updating the panel image to V17 Update 6+ restores the full role list (Operator, Supervisor, Administrator).

9. Hardware Wiring & Port Diagnostics

PROFINET requires 100 Mbit/s full-duplex with auto-negotiation disabled on managed switches; for direct CPU-to-HMI connections use a crossover or straight Cat 5e cable — the PHY on PROFINET devices auto-MDIXes, so either works.

• Link LED: must be solid green on both ends within 3 s of power-up.
• RX/TX activity: must blink on the HMI port during AR establishment.
• CPU X1 LED: link/activity green; no BF. A solid BF indicates physical layer or device-name problem.
• Panel port LED: green link, no BF.

Confirm PROFINET cable conformance: two pairs, 100 Ω characteristic impedance, ≤ 100 m per segment. Industrial PROFINET cable (e.g., 6XV1840-2AH10) is recommended for noisy plant environments.

10. Verification Procedures

1. In TIA Portal, open the CPU's Online & Diagnostics. The PROFINET IO system should list the KTP Basic as Accessible, No faults.
2. Open the PLC tag table Monitor / Modify. Force a tag (e.g., "Start_Button") to TRUE. The HMI screen should reflect the value within the configured update cycle (default 1 s).
3. On the HMI, press a configured button. The corresponding tag in the PLC tag monitor should toggle.
4. Power-cycle the HMI. The connection should re-establish in < 15 s without operator intervention.
5. Run a 10-minute soak test. No BF events, no AR aborts, no greyed screens.

11. Troubleshooting Matrix

12. Frequently Asked Questions