Troubleshooting TP1500 HMI Ethernet Communication on S7-1500

1. Problem Overview

A SIMATIC S7-1518-4 PN/DP CPU (6ES7518-4AP00-0AB0 family) is connected to a SIMATIC TP1500 Comfort HMI (6AV2 124-1MC01-0AX0 or current 6AV2 124-1 series) configured in TIA Portal. When the operator presses a button on the HMI screen, the corresponding PLC tag should toggle via an HMI event (SetBit, ResetBit, InvertBit, or a function call). In the failing scenario, the PLC tags stay in FALSE regardless of how many times the button is actuated. The HMI runtime is alive, the project compiles, and there are no syntax errors.

This class of failure is one of the most common complaints raised by engineers who are new to TIA Portal. The fault is almost never a hardware defect — it is a configuration or address-planning issue. The four usual suspects are:

1. PLC IP address / subnet mask does not match the HMI IP address / subnet mask on the same PROFINET segment.
2. The HMI connection in TIA Portal points to the wrong PLC interface or wrong rack/slot.
3. The HMI tag is not bound to a PLC tag, or its acquisition cycle is set incorrectly.
4. S7-PLCSIM is being used as the controller and the HMI is targeting a physical adapter rather than the PLCSIM virtual interface (or vice versa).

The resolution path below walks through each layer in the order TIA Portal builds it, from the Ethernet interface up to the event on the button. Reference documentation is the Siemens Industry Online Support portal and the SIMATIC S7-1500 product page.

2. Root Cause Matrix and Symptoms

The table below maps the visible symptom to the most likely configuration error. Use it as a triage guide before opening TIA Portal.

3. S7-1500 and TP1500 Comfort Hardware Reference

The CPU 1518-4 PN/DP provides three PROFINET-capable Ethernet interfaces:

• X1: PROFINET interface 1 (default PN IO controller, 2-port switch)
• X2: PROFINET interface 2 (independent IP, can be used as second PN IO controller or separate subnet)
• X3: PROFINET interface 3 (gigabit, often used for IT/management traffic; cannot act as PN IO controller on older FW)

The TP1500 Comfort is a 15" widescreen panel with an X1 (PROFINET) and X2 (PROFINET) interface. For a basic HMI/PLC link, the panel's X1 is connected to the CPU's X1, X2, or X3 directly using a patch cable or via a switch. There is no need for a router when both devices are on the same subnet.

For the TP1500 Comfort operating instructions and the SIMATIC S7-1500 system manual, consult Siemens Industry Online Support under entry IDs 109755224 (TP1500 Comfort) and 109751728 (CPU 1518-4 PN/DP).

4. Subnet Mask and IP Address Fundamentals

The complaint sub-net mask 255.255.255.0 (= /24) provides 254 usable host addresses inside the address range 192.168.3.0–192.168.3.255. As long as both endpoints sit inside this same block, communication is allowed without a router. The CPU's X1 (192.168.3.1) and the HMI's X1 (192.168.3.2) therefore satisfy the requirement if the HMI is actually configured with that exact address.

Wider subnet masks widen the broadcast domain:

One community suggestion was to widen the mask to 255.255.252.0 (/22) so that the PLC's three interfaces (192.168.1.0/24, 192.168.2.0/24, 192.168.3.0/24) collapse into a single routed segment. That workaround is not recommended. Bridging subnets with a wider mask introduces broadcast noise into the wrong segments, breaks any PN IO controller assignment, and does not address the actual root cause, which is mismatched interfaces. Keep each physical interface in its own /24 and connect the HMI to the specific interface you intend to use.

5. Configuring IP Addresses in TIA Portal

The TIA Portal configuration path for IP settings is:

1. Open the project and switch to Project view.
2. In the project tree, double-click Devices & Networks.
3. Select the CPU device. The Device view shows the CPU with ports X1, X2, X3.
4. Click each port in turn. In the inspector window under Properties > General > Ethernet addresses, set:
   • Subnet: create or assign the same subnet the HMI uses.
   • IP address: 192.168.3.1 for the HMI-facing interface.
   • Subnet mask: 255.255.255.0.
   • Use router: unchecked (unless a gateway is required).
5. Repeat for the HMI device. The HMI's X1 must be on the same subnet as the CPU interface you will use. A typical assignment for the failing project: HMI X1 → 192.168.3.2 / 255.255.255.0.

Verify the addresses by selecting Online → Accessible Nodes from the menu. The PLC should appear by name and IP after the download.

6. Configuring the HMI Connection

The IP layer being correct does not guarantee application-layer communication. TIA Portal still requires an explicit HMI connection object that binds the panel to a specific PLC with rack/slot.

1. In the project tree under the HMI device, open Connections.
2. Double-click the existing connection (default name: HMI_Connection_1) or add a new one with type S7 connection.
3. In the inspector window set:
   • Endpoint: PLC device
   • Interface: the correct PROFINET interface of the PLC (X1, X2, or X3)
   • IP address: must match the IP set on that interface (192.168.3.1)
   • Rack / Slot: 0 / 1 for an S7-1500 CPU
   • Connection resource: automatic (S7-1500 supports 1–32 S7 connections per CPU)
4. Compile the HMI, download, and confirm no error triangle appears on the connection object.

7. Configuring HMI Tags and Button Events

An HMI tag must be tied to a PLC tag through the connection. Without the binding, the panel reads and writes to a local buffer that no PLC monitors.

Procedure:

1. Project tree → HMI device → HMI Tags → open or create the tag table.
2. For each tag, set:
   • Connection: HMI_Connection_1
   • PLC tag: select or manually enter the absolute address (for example %DB5.DBX0.0 or symbolic "MyDB".MyBit)
   • Acquisition mode: Cyclic in operation (default) for visibility, or Cyclic continuous for high-speed diagnostics
   • Acquisition cycle: default 1 s; lower to 100 ms for fast displays
3. Open the screen that contains the button. In the button's inspector under Properties > Events > Press, configure the action:
   • Set bit: tag = HMI tag, value = 1
   • or InvertBit in DB to toggle
   • or call an FB that performs the action
4. Compile and download both the PLC and the HMI.

If the HMI tag is not tied to a connection, a small red disconnect icon appears next to the tag in the tag table. If the absolute PLC address is wrong, the tag will read 0 regardless of button presses.

8. S7-PLCSIM Simulation-Specific Settings

When neither a physical CPU nor a physical TP1500 Comfort exists, both sides must be emulated. This is the scenario the original question described: the engineer had a PLCSIM instance and an HMI simulation running on the same engineering station. Two interfaces exist in the runtime:

• PLCSIM (local) — a soft PLC that binds only to the engineering host's loopback. Communicates with the same engineering instance of TIA Portal.
• PLCSIM (Ethernet / PLCSIM Advanced) — a soft PLC that presents itself on a real TCP/IP interface. Multiple TIA Portal instances and HMI simulations can connect to it across the network.

If the HMI simulation points at the loopback address (127.0.0.1) but the PLC instance is on PLCSIM (Ethernet) with 192.168.3.1, the tags will remain FALSE because the HMI cannot see the PLC. Conversely, if both are loopback but the IP set in the HMI connection is 192.168.3.1, the HMI will resolve to a non-existent host and again fail silently.

1. Start PLCSIM. In the toolbar, choose between PLCSIM (local, loopback) and PLCSIM (Ethernet / PLCSIM Advanced). Pick one — do not switch mid-session.
2. Use a fixed virtual Ethernet adapter. PLCSIM Advanced binds to a TAP interface (e.g. 192.168.3.1). Confirm with ipconfig /all.
3. Open the HMI runtime simulation in TIA Portal: Start > Run > HMI Simulation. The runtime will appear in the notification area.
4. Inspect the connection from the runtime: Control Panel → Network and Dial-up Connections → Ethernet → Status. The panel must show a valid IP that matches the configured value.
5. Press a button. The tag should now update on the PLCSIM instance. Add a watch table on the PLC side to confirm.

PLCSIM and the HMI runtime can also be launched with command-line arguments to bind specific adapters. See the S7-PLCSIM function manual at Siemens Industry Online Support.

9. Diagnostic LEDs, Error Codes, and Online Tools

Use the LEDs and online diagnostics to verify each layer before assuming the project is mis-configured.

From TIA Portal:

• Online → Accessible Nodes — confirms whether the HMI sees the PLC at all. If the PLC is missing, the IP layer is broken.
• Online & Diagnostics on the CPU — diagnostic buffer lists S7 connection establishment events, with timestamps and OBs triggered.
• Project Tree → HMI → Diagnostics → Connection — shows live status of each HMI connection, with the number of failed retries.
• Watch table on the PLC — manually set the bit to confirm the rest of the program (and HMI display) responds correctly. If forcing the bit works, the HMI write path is the problem; if forcing does not show on the HMI, the tag binding is wrong.

10. Verification Procedures

1. Confirm physical link: LINK LED on both ports is green.
2. Confirm IP layer: ping 192.168.3.1 from the engineering station succeeds.
3. Confirm HMI can find the PLC: HMI runtime → Control Panel → Network shows PLC IP and reachable status.
4. Confirm PLC accepts the connection: Online → Accessible Nodes shows the HMI's MAC address listed as a partner.
5. Confirm tag binding: in TIA Portal, set the HMI tag to Constant with value 1 temporarily; the PLC tag should follow. If it does, the connection works — restore the proper PLC address.
6. Confirm button event: in the HMI runtime, press the button. The diagnostic counter on the HMI connection (Online & Diagnostics) should increment.
7. Confirm end-to-end: the bit is set in the PLC watch table.

If all seven checks pass and the bit still does not stay set, the PLC program is overwriting the bit elsewhere. Inspect the program for double-coil assignments or restart OBs that clear the bit.

11. Cross-Vendor Reference: AutomationDirect C-more

For engineers who maintain a mixed fleet or who evaluate alternatives, the AutomationDirect C-more HMI family uses a similar Ethernet connection paradigm. The setup procedure for an Ethernet link from the engineering PC to a C-more panel is documented in the C-more Ethernet Connection Setup help. The C-more Ethernet Quick Start video walks through the Browse Network function used when the panel IP is unknown.

The principle generalizes across vendors: confirm the IP and subnet on both endpoints, then create an explicit connection object that points at the correct PLC interface. Siemens calls this an HMI Connection; AutomationDirect calls it a Protocol / Driver selection; Rockwell calls it an EDS / AOP. The configuration detail changes, but the rule does not.

12. Frequently Asked Questions