Configuring SIMOTION D HMI Tag Addressing in WinCC Flexible Runtime

SIMOTION D controllers (D425, D435, D445, D455) integrate a SIMOTION runtime with a SINAMICS S120 drive control unit on a common hardware platform. Integrating these controllers with an HMI such as the MP277 8" Touch using WinCC Flexible requires a different tag-addressing philosophy than a SIMATIC S7 PLC. The most common integration error is treating SIMOTION D the same as a SINAMICS CU320 and trying to reach drive parameters through absolute DB offsets such as DB35 DBD 4096. That pattern applies to a free-standing SINAMICS S120 with a CU320, not to a SIMOTION D425, where the SINAMICS subsystem is addressed symbolically through the SIMOTION connection driver.

This reference explains the correct path: building the HMI connection, exposing SIMOTION variables symbolically, displaying technological and Alarm_S messages, and verifying runtime data exchange between the controller and the panel.

1. SIMOTION D HMI Integration Architecture

SIMOTION D controllers support HMI integration through three primary communication paths:

• PROFINET – typical for newer D4x5-2 variants using the integrated PROFINET interface or a CBE30 communication board.
• PROFIBUS DP – used on legacy D4x5-1 hardware and on installations that retain a PROFIBUS-only HMI fleet.
• S7 routing / Ethernet – used when the HMI must reach the SIMOTION D through a SIMATIC router or through the S7-300 backplane bus of the D4x5.

WinCC Flexible 2008 SP3 and later ship a dedicated SIMOTION connection driver. This driver uses the SIMOTION OPC-XML or the SIMOTION S7 communication protocol depending on the panel's firmware and the configured interface. With this driver in place, all SIMOTION device-level tags, user-defined variables, and I/O variables are exposed in the WinCC Flexible tag editor as symbolic names. Absolute DB addressing is not used and is not the correct path for SIMOTION D.

Per the official Siemens documentation, the HMI device must explicitly support SIMOTION CPUs in its connection list, and both the SIMOTION device and the HMI must exist as devices in the TIA Portal or SIMOTION SCOUT hardware configuration before a connection can be created. See the SIMOTION SCOUT TIA HMI connection entry for the prerequisite list.

2. Prerequisites

Before starting tag configuration, confirm the following:

1. SIMOTION SCOUT version – V4.4 SP1 or later for the D4x5-2 DP/PN variants. SCOUT V4.3 HF1 or later supports the older D4x5-1 hardware.
2. WinCC Flexible – 2008 SP3 or later for the MP277 8" Touch (order number 6AV6 643-0CD01-1AX1 or successor). WinCC Flexible 2007 supports basic variable exchange but not Alarm_S subscriptions.
3. Connection license – The MP277 must be configured for at least 16 SIMOTION connections if Alarm_S and technological alarms are required.
4. Hardware configuration – Both the SIMOTION D4x5 and the HMI panel must be inserted as devices in the SCOUT project navigator. The HMI is added through Insert > HMI device, and the SIMOTION D is added through Insert > SIMOTION device.
5. Network configuration – IP addresses, subnet masks, and device names (PROFINET) or PROFIBUS node addresses must be assigned and match across both devices.
6. Firmware – SIMOTION D firmware V4.3 or later, and CBE30 firmware V2.6 or later when used for PROFINET.

3. Building the SIMOTION Connection in WinCC Flexible

The connection between the HMI panel and the SIMOTION D is the foundation of all tag and alarm exchange. Configure it in this order.

3.1 Insert the connection

1. Open the WinCC Flexible project in the project tree.
2. Right-click Connections under the HMI device and select New connection.
3. In the connection wizard, choose SIMOTION as the communication driver. Do not choose SIMATIC S7 300/400; that driver uses absolute DB addressing and is the source of most SIMOTION integration errors.
4. Assign a connection name (e.g., HMI_SIMOTION_D445).
5. Select the interface:

3.2 Configure the SIMOTION partner

1. Open the connection properties and select the SIMOTION tab.
2. Enter the IP address of the SIMOTION D PROFINET interface (or PROFIBUS node number for DP).
3. Set the rack and slot to match the SIMOTION D slot in HWCN. For D4x5 the slot is typically 0; for D4x5-2 with CBE30 it is 0 or 2 depending on how the CBE30 is mapped.
4. For PROFINET, enter the PROFINET device name exactly as configured in SCOUT. Mismatched device names prevent connection establishment.

3.3 Verify the connection

Compile the project and transfer it to the panel. On the panel, open Start > Settings > WinCC Flexible Internet Settings > Connection status (or use the Connection indicator on a configured screen). A green status confirms that the SIMOTION driver has negotiated a live symbolic connection. A red status typically indicates a wrong IP, wrong device name, or a firewall blocking UDP port 34964 (PROFINET discovery) and TCP port 102 (S7 communication).

4. Symbolic vs. Absolute Tag Addressing

This is the single most important concept in SIMOTION HMI integration, and it is the source of the original question in the support thread.

4.1 Why absolute DB offsets do not work for SIMOTION D

The address pattern DB35 DBD 4096 is the SINAMICS S120 parameter access scheme. In a free-standing S120, parameter r35 of drive object 1 is mapped to a fixed data block offset in the CU320 memory image. The mapping is documented in the SINAMICS S120 List Manual and is consistent across projects because the CU320 firmware controls the layout.

SIMOTION D425, D435, D445, and D455 integrate the SIMOTION runtime and the SINAMICS drive control on a single piece of hardware. The SIMOTION runtime owns the memory map, and the SINAMICS subsystem is exposed to user code as a configured axis, not as a free-standing CU320. The memory layout in the SIMOTION D image is not the same as the CU320 image, and DB35 DBD 4096 does not point at parameter r35 of the integrated drive. This is why the pattern "works" in the field engineer narrative for free CU320s but fails when applied verbatim to a SIMOTION D.

4.2 Symbolic selection in WinCC Flexible

The correct method is to expose SIMOTION variables symbolically. Two routes exist:

1. Unit variables – declared in the SIMOTION program as VAR_GLOBAL with optional VAR_GLOBAL RETAIN for retained values. These are visible to the HMI by name.
2. I/O variables – linked to drive parameters through the technology object configuration (TO axis, TO external encoder, etc.) and exposed via the SIMOTION variable model.

In the WinCC Flexible tag editor:

1. Open Tags > Add tag.
2. In the connection field, select the SIMOTION connection created in Section 3.
3. Click the Symbol column header to display the Symbol field.
4. Click Browse (the ... button). The SIMOTION connection driver queries the SCOUT project and returns a tree of all globally exposed SIMOTION variables, including motor.temperature, axis1.actualVelocity, and any custom unit variable.
5. Select the desired variable. WinCC Flexible automatically populates the data type, length, and access method.

Because the variable is selected by name, no DB or byte offset is required. If the SIMOTION program is renamed or re-tasked, the HMI tag follows the new name automatically on the next compile.

5. Exposing Drive Parameters to the HMI

To read or write a drive parameter from the HMI on a SIMOTION D, route it through a SIMOTION variable rather than a direct DB offset. The recommended pattern is:

1. In the SIMOTION program, declare a unit variable, e.g., VAR_GLOBAL motor_temp : REAL; END_VAR.
2. Read the drive parameter in a SIMOTION task (typically IPO2 or a cyclic background task) using the system function _getDriveParameter() or by reading the axis system variable.
3. Assign the read value to motor_temp each cycle.
4. In WinCC Flexible, symbolically select motor_temp as a tag and bind it to an I/O field on a screen.

For bi-directional parameters (setpoints, control words), assign the HMI tag to a unit variable and write the value to the drive parameter in the SIMOTION program. Direct binding of an HMI tag to a drive parameter through the SIMOTION driver is not part of the public API and is not supported across firmware revisions.

5.1 Common drive parameters frequently exposed to the HMI

Refer to the SIMOTION Motion Control Communication manual for the full list of system functions for drive parameter exchange.

6. Alarm_S and Technological Alarm Configuration

SIMOTION generates three alarm classes that can be displayed on WinCC Flexible:

• Technological alarms – from the technology objects (axis, path, cam).
• Alarm_S messages – from the SIMOTION runtime, mapped to the S7 Alarm_S protocol.
• User-defined alarms – generated through _alarm() system calls in the SIMOTION program.

6.1 SCOUT configuration

1. Open the SIMOTION device configuration and select the HMI connection.
2. Enable Send alarm messages to HMI on the connection properties.
3. For Alarm_S, ensure that the message configuration in SCOUT is compiled and downloaded to the SIMOTION D. SCOUT generates an S7-compatible message DB automatically when the Generate Alarm_S option is enabled.
4. For technological alarms, the technology objects must be configured with at least one alarm that has a user-defined category. The default categories are Information, Warning, and Fault.

6.2 WinCC Flexible alarm configuration

1. In the project tree, open Alarms > Alarm settings.
2. Confirm that the Alarm_S bit number is mapped to a SIMOTION alarm class. The default mapping works for most projects.
3. Enable Acknowledgeable for any alarm that requires operator acknowledgement.
4. Configure the alarm view on a screen and bind it to the Alarm_S buffer.

When a SIMOTION technological alarm fires, the message appears in the WinCC Flexible alarm view within the configured update cycle (typically 500 ms for PROFINET, 1 s for PROFIBUS at 12 Mbit/s).

7. Communication to WinCC Flexible Runtime on a PC

When the HMI is WinCC Flexible Runtime on a PC rather than a panel, the configuration is identical except for the interface binding. The PC must be equipped with a CP5611 (PROFIBUS) or a standard Ethernet adapter (PROFINET). The IP address in the SIMOTION connection on the PC side is the address of the SIMOTION D, not the PC.

For routed scenarios where the PC reaches the SIMOTION D through a SIMATIC router, configure the SIMOTION connection in WinCC Flexible with the S7 routing option and define the route in the PG/PC interface. The CBE30 on the D4x5 supports S7 routing only on firmware V2.6.6 and later; verify before commissioning.

8. Verification Procedure

After configuration, verify the system with the following steps:

1. Connection test – From the panel, open Start > Settings > Transfer > Connection status and confirm that the SIMOTION connection is green.
2. Tag value test – Add a temporary I/O field bound to a known SIMOTION variable, such as a counter incremented once per second in the SIMOTION program. Verify the value updates on the HMI every cycle.
3. Bidirectional test – Bind a button to a write tag (e.g., cmd_start : BOOL). Toggle the bit from the HMI and confirm the SIMOTION program sees the change in the next IPO cycle.
4. Alarm test – Trigger a SIMOTION technological alarm by issuing an axis stop with an active follow-up error. Confirm the message appears on the HMI with the correct timestamp and category.
5. Diagnostic buffer – Open SCOUT > Target system > Diagnostics and confirm that the HMI is listed in the active connections.

9. Troubleshooting Matrix

10. Common Pitfalls and Field-Proven Notes

• Do not assume the memory layout of a SIMOTION D matches a free-standing CU320. Even though both run SINAMICS firmware, the host platform (SIMOTION runtime vs. S7 CPU) controls the memory map.
• Symbolic selection in WinCC Flexible requires the SCOUT project to be the active offline project. If the panel is connected to a different SIMOTION project than the one open in SCOUT, the browse dialog may show stale or empty variable lists.
• When migrating from WinCC Flexible to TIA Portal WinCC, recreate the connections through the TIA Portal HMI wizard. Symbolic selection works identically in both, but the connection driver identifier changes from SIMOTION (WinCC Flexible) to SIMOTION device (TIA Portal).
• For D4x5-2 DP/PN variants, the CBE30 PROFINET interface and the integrated PROFINET interface are separate network devices. The SIMOTION connection to the HMI must bind to one of them explicitly; the default in SCOUT is the integrated interface.
• Retain variables are accessible symbolically but require that the Retain option is enabled on the SIMOTON project properties. Without it, the variable resets on every controller restart and the HMI reads the initial value.

11. Standards and Reference Documents

The following official Siemens documents and resources support the procedures described in this article:

• SIMOTION SCOUT TIA – Creating an HMI connection (ID 109476550)
• SIMOTION Motion Control Communication manual (PDF)
• Overview of HMI connection – TIA Portal documentation