Configuring Dynamic WinCC Recipes for S7-300 PLCs

Overview: Why Dynamic Recipes in WinCC for S7-300

Recipe handling in SIMATIC WinCC is the standard mechanism for transferring batch data between the SCADA layer and the automation layer. In a fixed-sequence implementation, the PLC program contains hard-coded step logic, and the SCADA only delivers setpoint values. The dynamic recipe approach is different: the complete sequence definition (step list, transition conditions, ramp values, dwell times) lives in the WinCC recipe database and is downloaded to the S7-300 before each batch run.

This pattern is required when:

• Product variants are introduced frequently and re-programming the PLC is not acceptable.
• Operators must be able to edit the sequence without engaging the PLC engineer.
• Validation and GMP environments require that the "master recipe" be stored in the SCADA/ERP layer.
• The number of steps per product is variable (1 to N), and the PLC holds a generic executor.

The article builds the configuration end-to-end for an S7-300 CPU (e.g., 315-2 PN/DP, 317-2 PN/DP, 319-3 PN/DP) controlled by WinCC V7.x, with the TIA Portal / WinCC RT Professional path called out where relevant. The official Siemens entry point for recipe examples is the TIA Portal example: Creating recipes (RT Professional) and the historical WinCC V7 demo project at Siemens Support Entry 35102867.

System Architecture and Data Flow

The recipe lives in the WinCC Recipe Editor and is persisted to a relational database (Microsoft Access for WinCC V7 base installations, Microsoft SQL Server for larger configurations or RT Professional). When the operator triggers "Download to PLC", WinCC writes the recipe data into a dedicated data block (DB) on the S7-300. The PLC then executes the steps using a generic executor block that interprets the data rather than relying on hard-coded logic.

Prerequisites and Software Requirements

PLC Data Block Structure for Recipes

The S7-300 needs a clearly defined interface DB. The example below uses DB500 as the recipe interface. All offsets are byte-based and align with what the WinCC Recipe Editor will target.

Total DB size: 10 + 50 * 16 = 810 bytes. Keep the DB length above the last used byte.

WinCC Communication Channel Configuration

1. Open the WinCC Explorer and add the SIMATIC S7 Protocol Suite channel if not already present.
2. Right-click TCP/IP → New Driver Connection. Name it e.g. S7_300_Recipe.
3. Set the connection parameters:
   IP Address = 192.168.0.10 (CPU PN interface)
   Rack = 0
Slot = 2 (CPU 315-2 PN/DP)
4. Test the connection using the channel diagnostics (right-click → Connection Status). Expected: green "Connected" indicator within 2 s.
5. In the tag management, create the WinCC tags listed in the table above. Use Data Block addressing and set DB number = 500, Offset = 0, etc.

Defining Recipes in WinCC Explorer

1. In WinCC Explorer, open the Recipe Editor.
2. Create a new recipe MASTER_RECIPE.
3. Add the recipe elements matching the PLC structure. Each element name must be unique and is what the operator sees in the selection list.
4. Set the storage path. The default in WinCC V7.0.2 is the project path; for a centralized database use a shared *.mdf on the WinCC server.
5. Create the data records. Each record corresponds to one product variant. A field-proven rule is to limit step count to 50, because the PLC interface DB above is sized for 50.

The TIA Portal example for RT Professional shows the equivalent workflow in the newer toolchain, where the recipe elements are configured per HMI tag and the storage backend is always SQL Server.

Implementing Dynamic Auto-Sequences

Native WinCC V7 recipes do not have an "auto-sequence" entity; the dynamic behavior is built with scripts attached to the Recipe View control. The typical pattern uses the C or VBS action interface and the Recipe View's event "Status Change".

VBS example — Build the sequence dynamically before download

' WinCC V7 VBS action attached to "Download" button
Sub OnClick(ByVal Item)
    Dim rcs, rec, elem, val
    Set rcs = HMIRuntime.ActiveProject.RecipeSystem
    Set rec = rcs.Recipe("MASTER_RECIPE").DataRecord(RecipeListBox.Text)

    rec.Read

    ' Map PLC bits into step_1..step_N by pulling operator input
    Dim stepCount
    stepCount = CInt(OperatorInputStepsField.Text)
    rec.Element("Step_Count").Value = stepCount

    Dim i
    For i = 1 To stepCount
        ' Pull values from dynamic HMI fields generated by the operator panel
        rec.Element("Step_" & i & "_Type").Value  = _
            CInt(Me.GetSibling("S" & i & "_TYPE").OutputValue)
        rec.Element("Step_" & i & "_Value").Value = _
            CSng(Me.GetSibling("S" & i & "_VALUE").OutputValue)
        rec.Element("Step_" & i & "_Dwell").Value = _
            CLng(Me.GetSibling("S" & i & "_DWELL").OutputValue)
    Next

    rec.Write

    ' Trigger the PLC download command
    HMIRuntime.Tags("REC_DL_CMD").Write 1
    HMIRuntime.Tags("REC_DL_CMD").Write 0   ' pulse
End Sub

The C equivalent (ANSI C, WinCC Global Script) is faster for large step counts:

// C action, fired on "Status Change" of the Recipe View
#include "apdefap.h"
void OnClick(char* lpszPictureName, char* lpszObjectName)
{
    CMN_ERROR err;
    int stepCount = GetTagWord(lpszPictureName, "OP_STEPS");
    SetTagWord(lpszPictureName, "REC_STEPS", (WORD)stepCount);
    for (int i = 1; i <= stepCount; ++i)
    {
        char tagType[32], tagVal[32], tagDwell[32];
        sprintf(tagType,  "S%d_TYPE",  i);
        sprintf(tagVal,   "S%d_VALUE", i);
        sprintf(tagDwell, "S%d_DWELL", i);
        SetTagByte(lpszPictureName, tagType,  GetTagByte(lpszPictureName, tagType));
        SetTagFloat(lpszPictureName, tagVal,  GetTagFloat(lpszPictureName, tagVal));
        SetTagDWord(lpszPictureName, tagDwell, GetTagDWord(lpszPictureName, tagDwell));
    }
    SetTagBit(lpszPictureName, "REC_DL_CMD", 1);
    SetTagBit(lpszPictureName, "REC_DL_CMD", 0);
}

PLC-Side Generic Step Executor (STEP 7 SCL)

The S7-300 program needs a generic block that interprets the downloaded steps. Below is an SCL sketch for FB100, called in OB1 with the recipe DB passed as INPUT.

FUNCTION_BLOCK FB100
VAR_INPUT
    RecipeDB : BLOCK_DB;       // DB500 expected
    StepCount : INT;           // From DB500.DBW2
END_VAR
VAR
    i : INT := 1;
    TimerInst : TON;
    StepType : BYTE;
    StepVal  : REAL;
    StepDwell: DINT;
    StepTran : BYTE;
END_VAR
BEGIN
    IF StepCount < 1 OR StepCount > 50 THEN RETURN; END_IF;

    // Read current step header at offset 10 + (cur-1)*16
    StepType := RecipeDB.DBB[10 + (i-1)*16 + 0];
    StepVal  := RecipeDB.DBD[10 + (i-1)*16 + 1];
    StepDwell:= RecipeDB.DBD[10 + (i-1)*16 + 5];
    StepTran := RecipeDB.DBB[10 + (i-1)*16 + 9];

    CASE StepType OF
        0: // Dwell
            TimerInst(IN := TRUE, PT := DINT_TO_TIME(StepDwell));
        1: // Ramp
            RampOutput := StepVal;   // analog output scaling handled elsewhere
        2: // Digital output bitmask
            DigitalOut := WORD_TO_INT(RecipeDB.DBW[10 + (i-1)*16 + 9]);
        3: // Wait for operator "Continue"
            ; // noop
    END_CASE;

    // Transition handling
    IF (StepTran = 0 AND TimerInst.Q) OR
       (StepTran = 1 AND OperatorContinue) OR
       (StepTran = 2 AND ABS(ProcessPV - StepVal) < 0.5) THEN
        i := i + 1;
        IF i > StepCount THEN i := 1; END_IF;
    END_IF;
END_FUNCTION_BLOCK

Recipe Download Procedure

1. Operator opens the Recipe View control on the HMI screen.
2. Operator selects the data record (e.g., PRODUCT_42_REV03) from the list.
3. Operator edits any step values via the dynamic input fields generated by the VBS action.
4. Operator presses Save Record — WinCC persists the record to the Access/SQL database.
5. Operator presses Download to PLC — the VBS action writes the elements to WinCC tags and pulses REC_DL_CMD.
6. S7-300 FB100 latches the data into DB500, sets REC_DL_ACK after validation, and starts execution.
7. WinCC receives REC_DL_ACK and displays a green status indicator in the recipe view.

Verification and Commissioning

Troubleshooting Matrix

Notes on Migration to TIA Portal / RT Professional

For new deployments targeting S7-1500 or for unified engineering, the equivalent setup is described in the RT Professional recipe example. The S7-300 connection remains valid in TIA Portal through the legacy S7-300 add-on, but recipe storage moves from Access to SQL Server and the script interface changes from VBS/C to the unified TIA Portal VBS / C / JavaScript action API. The PLC-side interface DB can be reused as-is, which limits migration effort.