Configuring Bulk Tag Updates in WinCC from S7-300 Symbols

1. The Bulk-Tag Bottleneck in WinCC / S7-300 Projects

In a typical S7-300 / WinCC HMI project, every PLC address the operator station must read, write, or display has to exist as a WinCC tag. Each tag carries a name, an S7 address (DBX, DBW, DBD, I, Q, M, T, C, PEW, PAW), a data type, a scaling factor, and one or more update-related attributes. With 300+ tags, editing each entry by hand through WinCC Explorer or the WinCC Configuration Studio becomes the dominant commissioning cost.

The manual workflow that drives engineers to look for shortcuts is:

1. Open WinCC Explorer (or Configuration Studio in V7.3+).
2. Right-click Tag Management → Add new tag.
3. Pick the connection, the address (e.g., DB100.DBW0), and the data type (INT, WORD, BOOL, REAL, STRING).
4. Define limits, substitution, linear scaling, start value, and any logging/archiving flags.
5. Save and repeat.

At 300 tags this represents between 5 and 20 minutes per tag once type-selection, address parsing, and limit definition are accounted for — roughly 25 to 100 engineering hours of pure data-entry. The methods below collapse that work to minutes.

2. WinCC Tag Architecture: Structure, Address Types, and Update Path

WinCC stores its runtime database in a Microsoft SQL Server instance (WinCC V7.0+) or a Sybase instance (legacy V6.x). The structure table dbo.MS_TAG_CONFIG holds one row per tag. Each row maps to a memory location in the PLC through a channel DLL — for S7-300 the S7 channel DLL is s7otbxdx.dll.

Bulk-editing these rows is the only way to make a 300-tag update a one-step task. WinCC exposes three bulk-update mechanisms: the S7 Symbol Server, the OS-transfer function, and direct database/scripting import.

3. Enabling the S7 Symbol Server (WinCC V7.x)

The S7 Symbol Server is a Windows service shipped with WinCC V7.0 SP3 and later that exposes STEP 7 symbol tables to WinCC over the S7 protocol on TCP/102. When enabled, STEP 7 names, data types, and addresses are visible to WinCC without manual re-typing.

Prerequisites:

• WinCC V7.0 SP3 or later (V7.4 / V7.5 SP1 current at GA cutoff).
• STEP 7 V5.5 / V5.6 with the same project used for the AS.
• A working TCP/IP route from the WinCC station to the S7-300 CPU.
• Administrator rights on both engineering station and runtime station.

Step-by-step enabling:

1. On the engineering station, open SIMATIC Manager → Options → Symbol Server. (For TIA Portal users the equivalent is the "Support for S7 Symbol Server" add-on enabled from the TIA Portal installation under "TIA Portal Options".)
2. Right-click the S7-300 station → Properties → "Operator monitoring and control" tab → tick "Enable S7 Symbol Server".
3. Compile the symbol data; SIMATIC Manager generates a .sdf file in the project path \s7prog\<CPU>\SYMBOLS.
4. On the WinCC station, start the service SIMATIC S7 Symbol Server (start type: automatic) via services.msc.
5. In WinCC Explorer → Tag Management → right-click the S7-TCP/IP channel → "S7 Symbol Server" → "Connect". A dialog lists all S7 programs with the symbol server enabled on reachable CPUs.

After connection, the dialog shows every DB, I, Q, M, T, C tag with its STEP 7 name and S7 address. Selecting rows and clicking "Add to WinCC" pushes them into the WinCC tag database in one operation — the fastest official path when STEP 7 and WinCC live on the same engineering station.

4. The S7_m_c Attribute and OS Transfer Mechanism

In PCS 7 (and in WinCC with the PCS 7 option installed), every tag the operator can change requires two extra attributes beyond the basic S7 configuration:

• S7_m_c (Make Checkable): Boolean. When TRUE the tag is subject to operator-control authorization. When FALSE the tag is read-only from the operator's perspective but can still be written from the AS program or a higher-level SCADA.
• Authorization: Operator right level (1..9 in PCS 7 V8.x; 1..999 in V9.x). The OS user must be a member of the role configured with this level to write the tag.

S7_m_c is stored as a column in dbo.MS_TAG_CONFIG and is not editable from the WinCC Configuration Studio in plain V7.x — it is visible only in PCS 7 OS projects. The reason it matters for a 300-tag update is operator-control bulk setting.

OS transfer is the function in PCS 7 / WinCC that copies AS-side symbol and attribute configuration (including S7_m_c) to the OS-side tag database. Triggered from PCS 7 ES:

1. PCS 7 ES → Component view → AS station → OS → right-click → "Transfer to OS" (or "Transfer AS-OS Engineering data").
2. PCS 7 generates a delta file listing changed attributes and pushes them to the target WinCC OS project via the project-internal network or via an import file.

For 300 tags whose S7_m_c flag must be flipped from FALSE to TRUE (or vice versa), the practical sequence is:

1. Open STEP 7 symbol table or CFC/SFC chart attributes.
2. Set S7_m_c = TRUE for each tag (bulk via Excel + Symbol Editor import, or via the Symbol Editor "Find/Replace" function).
3. Save and compile the AS program.
4. In PCS 7 ES trigger "Transfer AS-OS Engineering data" — the OS picks up the new S7_m_c flags for all 300 tags without manual WinCC edits.

5. PCS 7 AS-OS Engineering Workflow for Mass Tag Import

PCS 7 has a dedicated workflow called AS-OS Engineering designed exactly for this case. It binds every WinCC tag to a STEP 7 symbol or a CFC chart I/O so changes to the AS propagate to the OS automatically. For the engineer with 300+ tags, the sequence is:

1. Create or open the STEP 7 / PCS 7 project containing the S7-300 AS.
2. Declare all 300 tags as STEP 7 symbols (in the Symbol Editor) or as CFC chart I/Os.
3. From PCS 7 ES run "Compile OS" (or "Compile and Download OS"). This performs a bulk merge of all STEP 7 symbols into the WinCC tag database. New symbols become tags; existing tags have their addresses refreshed; deleted symbols are flagged.
4. Review the merge log — PCS 7 lists every added, changed, or skipped tag and the reason. Address conflicts, type mismatches, and duplicate names are reported with line numbers.

Merge log location: %ProgramFiles%\Siemens\Automation\PCS7\OS_Log\<OS-Name>_<timestamp>.log.

Key columns in the merge log: Action (Added, Changed, Deleted, Skipped), Tag Name, Old Address, New Address, Old DataType, New DataType, Reason.

If the engineer is not using PCS 7 but only WinCC V7.x, the equivalent merge is the S7 Symbol Server step in §3 followed by a manual tag import through the WinCC Configuration Studio (right-click structure tag → Import → STEP 7 Symbol Table).

6. Bulk Tag Update via Import/Export and VBScripting

For installations where neither the S7 Symbol Server nor PCS 7 AS-OS is in scope, the same 300-tag update can be performed through the WinCC Configuration Studio's import/export functions combined with a small VBScript.

Method A — Configuration Studio Import

1. Export existing tag structure: WinCC Explorer → Tag Management → right-click → Export → saves a .csv file (separator configurable: tab, semicolon, comma).
2. Edit the CSV in Excel: change addresses, data types, scaling. Keep the columns Tag and Address exact match for updates; new rows with unique tag names become inserts.
3. Import back: Tag Management → Import → pick the .csv → preview → confirm.

Method B — Direct VBScript against the WinCC Tag Database

The runtime API exposes HMIRuntime.Tags for read/write but for bulk structural changes the Configuration API is needed:

' VBScript to bulk-re-address 300 tags in WinCC Configuration Studio
Dim proj, tagColl, tag, i
Set proj = HMICfg.Open("C:\Projects\MyHMI\MyHMI.mcp")
Set tagColl = proj.TagGroups.Item("MyGroup").Tags
For i = 1 To tagColl.Count
  Set tag = tagColl.Item(i)
  If Left(tag.Name, 4) = "MOT_" Then
    tag.Address = Replace(tag.Address, "DB100", "DB200")
    tag.DataType = 4     ' INT
    tag.LimitEnable = True
    tag.LimitHigh = 100
    tag.LimitLow = 0
  End If
Next
proj.Save
proj.Close

Run from the Configuration Studio macro editor (Tools → Macros → Edit → Run) or from an external script launched with cscript.exe.

Method C — Direct SQL against the WinCC database (V7.0+ only, runtime stopped)

UPDATE dbo.MS_TAG_CONFIG
SET Address = REPLACE(Address, 'DB100', 'DB200'),
    DataType = 4,
    LimitEnable = 1,
    LimitHigh = 100,
    LimitLow = 0
WHERE Tag LIKE 'MOT_%';

UPDATE dbo.MS_TAG_CONFIG
SET S7_m_c = 1
WHERE Tag LIKE 'VAL_%' AND Connection = 'S7_Connection_1';

After SQL edits, restart WinCC Runtime. SQL edits are not officially supported by Siemens and may break licensing checks if the runtime DB is moved or restructured — always keep a backup of the .mcp file before any SQL manipulation.

7. Alternative Connection: Symbolic Access over Named S7 Connections

WinCC V7.0+ supports symbolic tag binding through named S7 connections (NetPro). With a named connection, the tag address can reference a STEP 7 symbol by name rather than by absolute DB address. Once configured at project level, all 300 tags can be re-pointed to a new DB layout by changing the symbol mapping file — no per-tag address edits required.

Configuration:

1. In NetPro / STEP 7, define an "S7 Connection" between the WinCC station and the AS, named e.g. AS01_HMI.
2. In WinCC Tag Management → right-click the S7 channel → New Connection → pick the named connection from NetPro.
3. When adding tags, the address field accepts both absolute (DB100,DBW0) and symbolic (DB100.Motor_Speed) forms. The runtime resolves symbols against the symbol table stored in the WinCC project.

For the 300-tag update, symbolic addresses let the engineer change the DB number or restructure the PLC program without touching WinCC at all — the symbol name keeps the binding. This is the most robust long-term approach and the recommended practice for green-field projects.

8. Step-by-Step Procedure: Updating 300 Tags in One Pass

This procedure assumes WinCC V7.4+ on the engineering station, STEP 7 V5.5+ project, S7-300 CPU 31x, and TCP/IP connection on the same subnet.

Prerequisites:

• Engineering station with STEP 7 V5.5/5.6 and WinCC V7.4+ installed.
• WinCC and STEP 7 projects open side by side.
• WinCC Runtime not running on the engineering station (close it to release DB locks).
• S7-300 CPU online accessible (ping test: 192.168.0.1 from the engineering station).
• Administrator rights on the engineering station.

Procedure:

1. Open STEP 7 project → Symbol Editor → confirm all 300 tag names are present with correct addresses and data types. If any tag is missing, add it now.
2. SIMATIC Manager → Options → Symbol Server → confirm "Enable" for the target CPU → Compile.
3. On the WinCC station → services.msc → set "SIMATIC S7 Symbol Server" to "Started" and "Startup type" to "Automatic".
4. WinCC Explorer → Tag Management → right-click "S7-TCP/IP" → "S7 Symbol Server" → "Connect" → pick the CPU → "Add all" → confirm. All 300 tags are now added.
5. To set operator-control flags: PCS 7 ES → CFC/SFC or Symbol Editor → select all 300 → Properties → S7_m_c = TRUE → Save.
6. PCS 7 ES → OS → "Transfer AS-OS Engineering Data" → confirm. The OS receives the updated S7_m_c flags for all 300 tags.
7. WinCC Configuration Studio → Structure tag → verify row count = 300 → spot-check three random tags.
8. WinCC Explorer → Activate → runtime starts with new tags loaded.
9. On the HMI, open a faceplate containing one of the 300 tags → confirm value matches the PLC online monitor.

Verification checks:

• Tag Management → count of tags = 300.
• No tag shows status "Address error" in the diagnostics view (Ctrl+F8 → "Tag Status").
• For S7_m_c tags: log in as a user with the required authorization level; try writing the tag from a screen → write succeeds. Log out and retry → write rejected with "No authorization".

9. Verification, Diagnostics, and Quality Checks

After a bulk update, run the following checks before signing off commissioning:

1. Tag count: Tag Management → Properties → count. Compare to expected count.
2. Address syntax: Diagnostic view (Tag Management → right-click → Diagnostics) shows invalid addresses in red.
3. Connection status: Right-click connection → "Status". All channels should show "OK" or "Established".
4. Update time: Right-click tag → Properties → "Acquisition cycle" and "Update cycle". Confirm cycles match the PLC scan time. Typical S7-300 update cycles: 250 ms for HMI-critical, 1 s for trending, 5 s for archiving.
5. Type mismatches: A common failure is INT vs WORD (signed/unsigned). Re-read STEP 7 and WinCC types; WinCC INT is signed 16-bit (DataType=4), WORD is unsigned (DataType=2). Same bits, different interpretation.
6. S7_m_c and authorization: Trigger an operator write from the HMI. The runtime must check Authorization and either accept or reject.
7. Archive integrity: If any of the 300 tags are archived, WinCC Tag Logging will write new archive rows on the next change. Verify by triggering one value change and checking dbo.ARCHIVE.

10. Troubleshooting Matrix

11. Safety and Engineering Notes

• Always close WinCC Runtime before editing the .mcp project file or the SQL DB. Opening a project while the runtime holds it can corrupt the database.
• Back up the project folder before any bulk operation. The .mcp file plus the project subfolder contain the entire configuration.
• SQL edits are not officially supported by Siemens; prefer the Configuration Studio import/export path for production systems.
• The S7 Symbol Server is a one-way bridge from STEP 7 to WinCC. Changes made in WinCC are NOT written back to STEP 7.
• S7_m_c = TRUE forces an authorization check at write time. For S7-300 systems without PCS 7, set this attribute only if PCS 7 OS is in scope; otherwise leave it at its default value.
• For safety-relevant tags, ensure operator writes pass through the standard PCS 7 enable/auth/model chain — never bypass S7_m_c to speed up commissioning.

FAQ