[Answer] How to Implement Control Between Siemens PLC and Touch Screen

In order to maintain the differentiation between its high-end touch panels and PLCs, Siemens officially does not support connecting SMART LINE economy touch panels with S7-1500 / S7-1200 / S7-300 PN series PLCs.
A workaround is to use the multifunction switch from Dalian Dejia as a relay.

1. Main functions of the multifunction switch

• Can connect an S7-1500 PLC with a Siemens SMART LINE “Jingcai” series touch panel
• Can connect an S7-1200 PLC with a Siemens SMART LINE “Jingcai” series touch panel
• Can connect an S7-300 PN PLC with a Siemens SMART LINE “Jingcai” series touch panel
• Can connect an S7-1500 PLC directly to Siemens WinCC (using the S7-300 TCP/IP protocol) without needing OPC as a middle layer
• Can connect an S7-1200 PLC directly to Siemens WinCC (using the S7-300 TCP/IP protocol) without needing OPC as a middle layer
• Can connect an S7-200 SMART directly to Siemens WinCC (using the S7-300 TCP/IP protocol) without needing OPC as a middle layer

2. Notes on using the multifunction switch

• When connecting an S7-1200/1500/300 PN to a Siemens SMART LINE “Jingcai” series touch panel, set the last octet of the touch panel’s IP address to 200 or above, e.g. 192.168.1.200. For the PLC IP address configured in the touch panel, you must enter the internal IP address of the switch, not the actual IP address of the PLC.
• When connecting an S7-1200/1500 to a Siemens SMART LINE “Jingcai” series touch panel, you must enable the following in TIA Portal:
  Device configuration → Properties → Protection & Security → Connection mechanisms → tick “Allow PUT/GET communication from remote partners”.
• When connecting an S7-200 SMART directly to Siemens WinCC (or to KingSCADA, etc.), make sure to set the “Switch” value in the multifunction switch to 0.
• Number of PLCs and HMIs (SMART LINE touch panels or WinCC SCADA stations) that can be connected: Each multifunction switch can connect up to 2 PLCs simultaneously (S7-300 PN / S7-1200 / S7-1500 / S7-200 SMART) and up to 3 upper-level systems simultaneously.

3. Additional notes on using the multifunction switch

The multifunction switch internally uses 3 consecutive IP addresses, and each of these internal IP addresses is bound to a PLC IP address. In other words, each internal IP corresponds to one PLC (IP address). For example, when a SMART LINE panel accesses one of the switch’s internal IPs, it is effectively accessing the PLC IP that is bound to that internal IP.

The multifunction switch has a backdoor IP address of xxx.xxx.xxx.222
(for example 192.168.1.222, 192.168.0.222).
Connect the computer and switch with a network cable, then enter this backdoor IP address in Internet Explorer on the PC to open the main menu of the multifunction switch. You can also enter the actual internal starting IP address directly.

Note: Because the switch firmware is relatively old, it can only be accessed via Internet Explorer, or Edge using IE mode. It cannot be accessed using Chrome, Firefox, etc.

The internal starting IP address (used by the switch’s internal processor) can be modified by the user. It will occupy 3 consecutive IP addresses starting from that address. For example, if the starting IP is 192.168.1.10, then 192.168.1.10, 192.168.1.11, and 192.168.1.12 will all be used by the switch’s internal processor.

Binding between the switch’s internal IP addresses and PLC IP addresses:
Each internal IP address (in the switch) corresponds to one PLC (IP address). There are 3 internal IP addresses (in the switch) that can be bound to up to 2 different PLCs.

If one of the internal IP addresses does not need to be bound to any PLC, simply fill in 255.255.255.255 in the corresponding PLC IP field.

When connecting to PLCs with firmware V4.0 or above, you need to enable the following in TIA Portal V13:
Device configuration → Properties → Protection → Connection mechanisms → tick “Allow communication via PUT/GET from remote partner (PLC, HMI, OPC, …)”.

In TIA Portal V15 or higher this is:
Device configuration → Properties → Protection & Security → Connection mechanisms → tick “Allow PUT/GET communication from remote partners”.

4. Memory area mapping

The [E, I, Q, M, V] areas of the Siemens SMART LINE touch panels correspond to the [E, I, Q, M, DB] areas of S7-1500/1200/300 PLCs.
Except for the V area, whose mapping to DB blocks is determined by the SWITCH setting, all other areas are mapped one-to-one.

Mapping between SMART LINE touch panel and S7-1500 / S7-1200 / S7-300 PLC:

• Q area (0–32767) → Q area (0–32767)
• I area (0–32767) → I area (0–32767)
• M area (0–32767) → M area (0–32767)
• V area (0–32767) → DB1 block …

Mapping of V area to DB blocks is selected by SWITCH: [0–5]
Selection switch for mapping between the V area of the Siemens SMART LINE touch panel and the DB blocks of the S7-1500/S7-1200/S7-300 PLC:

When SWITCH = 0:
V0 – V32767 → DB1.DBX0 – DB1.DBX32767

When SWITCH = 1:
V100 – V199 → DB1.DBX0 – DB1.DBX99 (length 99)
V200 – V299 → DB2.DBX0 – DB2.DBX99
V300 – V399 → DB3.DBX0 – DB3.DBX99
V32600 – V32699 → DB326.DBX0 – DB326.DBX99

When SWITCH = 2:
V0 – V999 → DB100.DBX0 – DB100.DBX999 (length 999)
V1000 – V1999 → DB101.DBX0 – DB101.DBX999
V2000 – V2999 → DB102.DBX0 – DB102.DBX999
V3000 – V3999 → DB103.DBX0 – DB103.DBX999
V16000 – V16999 → DB116.DBX0 – DB116.DBX999