Siemens s7-1200 and KTP700

[careythibodeau]

Long story short.....
Customer : We want you to replace this hmi with a direct replacement. We don't have the original hmi program.

Me: OK, I get a backup image on a USB thumbstick and load it to a brand new direct replacement hmi in my home office.

Me: Go back to location, customer states, oh by the way we nuked the HMI trying to change the ip address.

I install the new hmi and power up the replacement, update the ip address. Start the runtime to see all the place holders are starred out for all values. (no comms to plc)

What are my options gentlemen? Is there an easy way to link this new hmi to the existing unchanged plc in Tia portal? Or do I need to start from scratch?

Interesting note: the original plc program network view does not show any comms link to any devices. How did this ever work before?

 

[JesperMP]

The backup image is from the KTP700 before it was 'nuked' ? If so, you should be able to load it onto an identical KTP700 and be good to go. If that doesnt work something else is going on..

You also seem to have the PLC program, i.e. a TIA project.
Does this include the KTP700 ?

I am suspicious of what has been going on. Has the PLC and/or HMI program been changed ?
Is the TIA backup not uptodate ?
Why was the customer messing with the IP addresses ?

To do:
1. Use the online - reachable nodes to see if you can find the PLC at the IP address same as it is configured in the offline TIA program.
2. Go online with the PLC, check if there are no differences offline/online.
3. If the TIA project includes the KTP700, and the PLC offline/online compare finds no differences, then load the KTP700 from TIA instead of the backed up image.

Interesting note: the original plc program network view does not show any comms link to any devices. How did this ever work before?

You will only see an HMI connection in the TIA project if the KTP700 is integrated in the same TIA project as the PLC.
If PLC and HMI are in the same project, in the device view select connections. The HMI connection should be highlighted.

Also please post versions of TIA and the firmwares.

 

[careythibodeau]

Jesper,

Thanks for the response sir.



The backup image is from the KTP700 before it was 'nuked' ?

Correct, but someone changed the IP of the PLC and HMI before I could get back and replace the HMI.


You also seem to have the PLC program, i.e. a TIA project.
Does this include the KTP700 ?
I have the TIA project for the PLC, its version 15 TIA, this does not include the KTP700, I am unsure why the HMI was not able to be captured. I believe its locked down.


I am suspicious of what has been going on. Has the PLC and/or HMI program been changed ?
As previously mentioned, while i was waiting for the replacement HMI in the mail, the customer accidentally nuked the existing HMI program while messing with IP Addresses.


Is the TIA backup not uptodate ?
The TIA backup only seems to show the PLC project, not the HMI project.



Why was the customer messing with the IP addresses ?
They were changing a bunch of their SCADA network mapping and structure, wanted to change local IPs from x to y.


You will only see an HMI connection in the TIA project if the KTP700 is integrated in the same TIA project as the PLC.
I understand and agree, however, while online, there was no visible connection before. And there still isn't now. Does this mean they are communicating even though on different projects?



1. Use the online - reachable nodes to see if you can find the PLC at the IP address same as it is configured in the offline TIA program.
I can see the new PLC IP Address as well as the HMI PLC address under the find dialog box. They are both reading what they should be. (I corrected the new replacement HMI IP address in the main network settings from the screen)



2. Go online with the PLC, check if there are no differences offline/online.
What kind of differences would you recommend i look for?



3. If the TIA project includes the KTP700, and the PLC offline/online compare finds no differences, then load the KTP700 from TIA instead of the backed up image.
The TIA project does not include the KTP700.


PLC firmware = V4.2.3
PLC hardware = 16
TIA Project = V15


HMI Firmware = Unsure, only have backup at the moment
HMI TIA Project = Assuming it is V15? Wouldnt it need to be in order to link to a V15 PLC?

 

[JesperMP]

Since you dont have the original HMI project, the only way is to revert to the old IP address on the PLC.
The HMI program tries to connect to the PLC via the old IP address and there is nothing you can do about that.


To allow the customer access to the PLC, you can add a router between the PLC and the customers network. You can add the routers IP to the IP address setup of both PLC and HMI, and they will still work as long as the devices own IP addresses remain unchanged.

 

[Lare]

Isn't it possible to change panel own IP and coms settings from panels settings page?

 

[mk42]

Isn't it possible to change panel own IP and coms settings from panels settings page?

The panel's, yes. But the IP that the HMI is expecting the PLC to be at is baked into the project that they don't have and can't change.

 

[sigmadelta]

Use TIA Portal to detect the PLC IP address by browsing for accessible nodes to get the IP address of the PLC. Then you have 253 guesses to what the IP is - if it's baked in to the project as you say. If the PLC address is a.b.c.d, then all you have to do is try the changing the HMI IP address with d = 1 to 254 (excluding the value of d in the PLC address of course).

But... if they did factory reset the HMI and blew it away... then you need to redevelop the project or beg the OEM to supply the project.

 

[sigmadelta]

PS: was a file with the extension .BRF supplied? This is a backup file that can be restored to the HMI using Prosave software.

 

[Rob...]

Would Wireshark be able to find the IP address the HMI was trying to connect to?

I've never tried looking into it.

 

[JesperMP]

It is not the HMI IP that is the problem, the problem is how to change the IP that the HMI tries to connect to, i.e. the IP of the PLC.

I want to moderate what I wrote previously, that it is not possible without changing the HMI program.
Actually there is a way: How do you change the connection from the operator panel to the controller?
Before you get excited, beware that there are a no of caveats. One is:

<Absolute access> must be set as type of access for the HMI tags. In this way the addresses of the tags are read/written directly in the controller and can continue to be used when the connection is changed.

So if the tags in the HMI project uses symbolic access, then you are still stuck.

So I think the solution is still, set the PLC IP to what it was before, then the HMI will probably work again.

 

[sigmadelta]

Would Wireshark be able to find the IP address the HMI was trying to connect to?

TIA Portal can find the IP address of the PLC.

 

[Rob...]

TIA Portal can find the IP address of the PLC.

Yes I know this.

The OP has had the customer changing the IP address of everything though.

So If the HMI is looking for example a CPU at address 10.0.0.1, but the CPU is now been changed to 10.1.1.1 knowing the CPU address is useless.

As has been already stated, there isn't a way of changing the target of the HMI without having the project. At least knowing what the target of the HMI is, the CPU can be changed to suit.

 

[sigmadelta]

So If the HMI is looking for example a CPU at address 10.0.0.1, but the CPU is now been changed to 10.1.1.1 knowing the CPU address is useless.

Ahh, ok, I thought only the HMI address was changed, I didn't pick up that the CPU address was changed as well.

I have used Wireshark to pickup which IP an HMI is trying to talk to. It's easier if the Wireshark PC is connected only with the HMI so you don't get all the other traffic showing up.