Troubleshooting Siemens KTP 600 HMI Communication with S7-1200 PLC

When a Siemens SIMATIC KTP 600 Basic Mono PN panel displays a fully compiled project, a green connection indicator in the status bar, and a project name in the runtime, yet no live tags update, no alarms appear, and no button press affects the S7-1200 program, the root cause is rarely a cable or a subnet fault. It is almost always a tag-binding fault between the HMI tag database and the S7-1200 symbol table. The simulation on the engineering PC runs against a local copy of the symbol table, so it shows the expected behaviour, but the real panel must rebuild its own tag database from the transferred project. When the symbolic path does not propagate, the panel requests symbols the S7-1200 does not recognise, the connection stays green, and the data fields stay empty.

This reference documents the full diagnostic sequence that resolves the fault on TIA Portal V13 SP1 and V15 projects, the configuration checks that prevent the recurrence, and the field commissioning procedure that verifies the fix. The single corrective action confirmed in the source case was switching the HMI tag references from symbolic PLC tags to absolute addresses (%I0.0, %Q0.0, %MW10, %DB1.DBX0.0). The procedure below documents that fix, the surrounding configuration that must accompany it, and the verification that proves the runtime is healthy.

1. Symptom Summary

The fault presents all of the following characteristics simultaneously:

• TIA Portal HMI simulation runs correctly. Tags update, buttons toggle, alarms trigger as designed.
• The project compiles without errors and downloads to the KTP 600 Basic Mono PN panel without errors.
• The TIA Portal project transfers to the panel; the project name appears in the panel's project list.
• At runtime, the connection icon in the HMI status bar is not red (no explicit connection-fault indicator).
• No PLC data is shown on any screen. Output fields, bar graphs, and indicators are stuck at 0 or display '####'.
• Buttons, when pressed, do not toggle the corresponding bits in the S7-1200 PLC.
• The HMI time-synchronisation mode 'Slave' succeeds (it reads the PLC clock), proving the panel is on the network and the S7-1200 is responding to read requests.
• The HMI time-synchronisation mode 'None' freezes the panel clock at 01/01/2004 (default behaviour of the panel's battery-backed RTC epoch when no time master is configured).

2. Affected Hardware and Software

3. Network Reachability Verification

Before opening the tag editor, eliminate the network as a variable. The standard approach is to install a temporary third node and run ping checks from a host that sits on the same subnet as the panel and PLC.

1. Assign a third IP address to your engineering PC, for example 192.168.0.3, with the same subnet mask (255.255.255.0) as the PLC and panel.
2. Open a Windows command prompt and run ping 192.168.0.1 -n 10 to test the S7-1200.
3. Run ping 192.168.0.2 -n 10 to test the KTP 600 Basic.
4. Confirm 0% packet loss and round-trip times below 1 ms on a direct cable, or below 5 ms on a small switch.
5. From TIA Portal, open Online > Accessible Nodes and confirm both devices appear with their configured IP and PROFINET name.

If the ping to the PLC fails:

• Confirm the S7-1200 PROFINET port is the one connected. The bottom RJ45 on CPUs with two ports is the default PROFINET interface; the top port on 1215C and 1217C is also PROFINET-ready.
• Open Online & Diagnostics > Online Access and verify the PLC's IP address matches the configuration.
• Disable the Windows firewall briefly to rule out ICMP blocking on the host side.

If the ping to the panel fails:

• Open the panel's Control Panel > Network & Dial-up Connections (accessible from the 'Settings' gear icon on the KTP 600 Basic) and verify the static IP and subnet mask match the project.
• Confirm that the HMI's 'Transfer' mode is enabled in the panel control panel, the channel is set to 'PN/IE', and the access point is 'S7ONLINE'.

4. Root Cause: Symbolic Tag Binding Failure on Basic Panels

The KTP 600 Basic Mono PN and its KTP 600 Basic Color PN sibling are implemented on the WinCC Basic runtime that ships inside TIA Portal. The Basic runtime does not consume the same enriched symbolic information that Comfort, Advanced, or Unified panels do. When the HMI tag points to a symbolic PLC tag, TIA Portal must compile the symbolic path into the HMI's offline tag database. On cross-version projects — a V13 SP1 project opened in V15, or a project last saved by a different TIA Portal build — the symbolic table occasionally fails to refresh on the HMI side after transfer.

The symptoms are subtle: the connection status remains green, the panel polls the S7-1200, and the PLC responds with valid S7 frames, but every read returns a quality code of 'Initial value' or 'Address not available' because the HMI sent a request for a symbol the PLC does not recognise. The panel's internal diagnostic buffer records these events as 'Tag binding error' entries.

How to identify and convert symbolic tags to absolute:

1. In TIA Portal, expand the HMI device folder in the project tree.
2. Open HMI Tags > Default tag table (or the named tag table you created).
3. Click the Connection column header to sort by connection. All tags whose Connection is 'PLC_1' are candidates.
4. For each tag, change the Address field from the symbolic form (for example, 'Data_block_1'.Motor_Start) to an absolute address from the table below.
5. Recompile the HMI: right-click the HMI device > Compile > Software (rebuild all).
6. Download the rebuilt project to the panel.

If your project uses many tags, the fastest path is to create a new tag table, mark it absolute, and bulk-edit the addresses via the CSV import function in TIA Portal (Tag table > Export/Import). The import format is a plain CSV with columns: Name, Path, Connection, DataType, Length, Address, AccessMode, HMI_TagType.

5. TIA Portal Project Configuration Checks

Before assuming the symbol-binding issue, validate the surrounding configuration so that a re-download fixes the problem and not a stale project state.

5.1 Project Compatibility

TIA Portal V13 SP1 and V15 do not share a native project file. To move a project between them, open the V15 project and choose Project > Save as, then select the V13 SP1 compatibility level. TIA Portal will then refuse to add features unsupported by V13 SP1. As a simpler alternative, keep the project in V15 only and recompile the S7-1200 station with V15. Cross-compilation between major versions without rebuilding the station is the most common cause of stale tag tables on the HMI side.

5.2 HMI-to-PLC Connection Definition

Open Devices & Networks > Connections and select the HMI-PLC line. Confirm:

• The Connection type is 'HMI connection'.
• The PLC endpoint is the correct S7-1200 station.
• The Address details show the PLC's IP (192.168.0.1) and the HMI's IP (192.168.0.2), not 0.0.0.0.
• The 'S7 subnet ID' matches on both endpoints. Mismatched subnet IDs cause the connection to compile but never bind at runtime.

5.3 PLC Protection and Access Level

If the S7-1200 has access protection set to 'Read/Write' or 'Complete protection' in Device Configuration > Properties > Access Protection, the HMI's write attempts are silently rejected. The panel's connection icon may stay green because the GET requests still succeed, but PUT requests fail. Drop the access level to 'Full access (no protection)' for the first download, then re-tighten after commissioning.

5.4 Put/Get Permission on the CPU

S7-1200 firmware 4.x and later requires the 'Permit access with PUT/GET communication from remote partner (PLC, HMI, OPC, ...)' checkbox to be enabled on the CPU's protection screen. If the box is unchecked, any Comfort/Basic panel and any third-party OPC client can read but cannot write. Buttons that attempt to set a bit silently fail. This is the second most common cause of 'reads work, writes don't' on KTP 600 Basic panels.

6. HMI Panel Configuration (KTP 600 Basic)

6.1 Transfer Channel

On the panel, navigate to Settings > Transfer:

• Channel: PN/IE
• Enable 'Auto-transfer at startup' if you want plug-and-play commissioning.
• Access point: S7ONLINE

6.2 IP Configuration

On the panel, navigate to Settings > Network & Dial-up Connections > PN/IE:

• IP address: 192.168.0.2 (must match project)
• Subnet mask: 255.255.255.0
• Do not enable DHCP unless your DHCP server hands out the right lease. Static addressing is preferred for HMI panels.

6.3 Time Synchronisation

The reported panel was set to Time synchronisation = Slave and successfully read the PLC clock. This is a useful smoke test: if the panel reads the time, the S7-1200 is reachable on PROFINET and the S7COMM session is alive. The '1/1/2004' reading seen when switching to 'None' is the panel's default epoch displayed when no time master is available; it is not a fault indicator.

7. PLC Connection Configuration (S7-1200)

On the S7-1200, in Device Configuration > PROFINET Interface > Ethernet Addresses:

• IP address: 192.168.0.1
• Subnet mask: 255.255.255.0
• Use router: unchecked for small networks
• PROFINET device name: must be a unique, valid PROFINET name (e.g., s71200-cpu1)

In the CPU's Properties > Protection & Security:

• Access level: Full access (no protection) for commissioning
• 'Permit access with PUT/GET communication from remote partner' must be checked

8. Compilation and Download Sequence

Use this order to avoid stale binaries:

1. Right-click the S7-1200 station > Compile > Hardware and Software (rebuild all).
2. Right-click the S7-1200 station > Download to device > Hardware and Software. Confirm the wizard shows the correct target IP (192.168.0.1).
3. Right-click the HMI device > Compile > Software (rebuild all).
4. Right-click the HMI device > Download to device > Software (rebuild all). Confirm the wizard shows the correct target IP (192.168.0.2).
5. On the panel, accept the transfer if prompted.
6. Wait for the panel to restart the runtime. The new project name appears in the project list.

9. Verification Procedure

After the download, validate the fix in this order:

9.1 Connection Status

On the KTP 600 Basic, the connection icon (lower-right status bar) must remain green. A yellow icon means the panel is starting up; red means a hard connection fault (IP, cable, or PUT/GET).

9.2 Tag Read Test

On a screen that has a numeric output field linked to, for example, %DB1.DBW0, force a value in the PLC: open Online & Diagnostics > Force table and set the word. The HMI field should update within the configured polling cycle (default 1 s).

9.3 Tag Write Test

Press a button wired to %M0.0. In the PLC's Monitor & Force Table, the bit should turn true while the button is held (for a momentary) or toggle (for a toggle button). If the bit does not move, the panel is not writing, indicating either PUT/GET is blocked or the tag's access mode is set to 'read only' in the tag table.

9.4 Alarm Test

Trigger a bitmapped alarm in the PLC (raise a tag the HMI's alarm class is monitoring). The alarm must appear in the HMI's alarm view. The source case reported that no alarms were visible even though they were configured; the absolute-address fix also restores alarm visibility because the alarm trigger tag is also re-bound to an absolute address.

10. Diagnostic Tools in TIA Portal

10.1 Online & Diagnostics — HMI

Right-click the HMI device and choose Online & Diagnostic. The diagnostic buffer lists connection state changes, transfer errors, and runtime errors with timestamps. Tags marked 'Bad' or 'Initial' are listed with the absolute address the runtime is requesting, which makes it easy to spot a mismatched address or a typo.

10.2 Online & Diagnostics — PLC

Right-click the S7-1200 and choose Online & Diagnostic > Diagnostic Buffer. Look for S7COMM-related entries. A 'Connection established' / 'Connection terminated' pair is normal. Repeated 'Symbol not found' or 'DB not loaded' entries indicate the panel is requesting a symbol the PLC does not have loaded — a clear sign of a symbolic-binding failure on the HMI side.

10.3 Wireshark Trace (Optional)

Capture the Ethernet traffic between the panel and the PLC on port 102. A successful read returns an S7 PDU with data; a failed symbolic lookup returns an S7 PDU with an error code (typically 0x0A — 'Object does not exist' or 0x05 — 'Address out of range'). Filter: tcp.port == 102.

11. Common Error Code Matrix

12. Compatibility and Version Notes

The KTP 600 Basic Mono PN is supported by TIA Portal V13 SP1 and later, including V15, V15.1, V16, V17, V18, and V19. The minimum S7-1200 CPU firmware required for HMI connectivity via PROFINET is firmware 4.0; firmware 4.2 introduced the PUT/GET permission toggle that is relevant here. When a project compiled under V13 SP1 is opened in V15, the project can be saved in compatibility mode but TIA Portal will not refresh the HMI tag table's symbolic mapping without an explicit 'Compile > Software (rebuild all)' on the HMI device. Always rebuild the HMI after a major-version upgrade.

For new projects on newer TIA Portal versions, the recommendation is to remain on a single TIA Portal version for the project lifetime and to use absolute addressing for the HMI tags where the panel is a Basic series. The Comfort, Unified, and Mobile panels handle symbolic tags more robustly, but the Basic panel's tighter WinCC Basic runtime makes the absolute-address pattern the most reliable across versions and across mixed-version engineering teams.

For project conventions and version-specific behaviour, see the TIA Portal Help (TIA Portal V15: SIMATIC TIA Portal V15 — Documentation) and the SIMATIC S7-1200 Programmable Controller system manual (S7-1200 System Manual). For the KTP 600 Basic Mono PN operating instructions, refer to KTP600 Basic PN — Operating Instructions.

13. Field Commissioning Checklist

1. Static IP set on the PLC (192.168.0.1/24).
2. Static IP set on the panel (192.168.0.2/24).
3. PG/PC interface set to the correct Ethernet adapter, access point S7ONLINE.
4. Ping to both devices successful from the engineering PC.
5. PLC compiled and downloaded first; HMI compiled and downloaded second.
6. PUT/GET permitted on the CPU.
7. Access protection set to 'Full access' for commissioning.
8. All HMI tags use absolute addresses (%I, %Q, %M, %DB).
9. Read test, write test, and alarm test all pass.
10. Re-tighten CPU access protection to the desired final level only after step 9 passes.
11. Document the final IP, PROFINET name, and access level on the cabinet drawing.

14. Frequently Asked Questions