1. Overview
Operator data input in WinCC allows an authorized operator to write setpoints, recipe parameters, time values, and binary commands into the S7 PLC's working memory through a runtime screen. The written value is then available to the STEP 7 user program for further processing – for example, as the setpoint of a closed-loop controller, the time base of an ON-delay, or a recipe selection byte.
The most common implementation is an I/O Field smart object on a WinCC picture bound to a process tag whose address points into a STEP 7 data block (DB). The tag can be any of the elementary STEP 7 data types – BOOL, INT, DINT, REAL, WORD, DWORD, or S5TIME – and the WinCC I/O field automatically formats the value for the operator.
This reference applies to:
- WinCC V7.0 / V7.4 / V7.5 SP3 (HMI RT and PC RT)
- SIMATIC S7-300 (CPU 31x, CPU 319), S7-400 (CPU 41x/41xH), and S7-1200/1500 via S7-1500 software controller or separate Ethernet CP
- STEP 7 V5.5 / V5.6 and TIA Portal V15.1 / V16 / V17
- Drivers:
S7ONLINE(SOFTNET S7 / IE),SIMATIC S7 Protocol Suitechannels MPI / PROFIBUS / TCP/IP
2. Prerequisites
- WinCC 7 installed with appropriate WinCC V7.5 system manual license (RT 128 / RT 256 / RT 2k / RT 8k / RT 16k depending on number of tags).
- STEP 7 or TIA Portal project with a compiled S7 program downloaded to the PLC. The DBs used as input targets must be available in the offline program and not optimized (S7-300/400) or marked as accessible from HMI (S7-1200/1500 in TIA Portal).
- Configured WinCC ↔ PLC channel in the WinCC Explorer → Tag Management → SIMATIC S7 PROTOCOL SUITE with at least one logical connection (MPI, PROFIBUS, or TCP/IP). For TCP/IP the partner (PLC) must be reachable at rack/slot 0/0 (S7-300/400) or with the TIA "PLC_1" connection configured as an S7 connection (S7-1200/1500).
- Operator authorization configured in User Administrator. By default the change of an input field is restricted to the Authorization level Operator (level 5 in WinCC default). The level can be tightened (e.g. level 4 Supervisor) by raising the Authorization attribute of the I/O field.
3. Architecture and Communication Path
The operator data input follows a fixed path:
- Operator enters a value in the WinCC I/O field and presses Enter or tabs out.
- WinCC Runtime triggers a write job against the configured tag.
- The tag is mapped via the SIMATIC S7 Protocol Suite channel to an absolute address in the STEP 7 PLC (e.g.
DB10.DBD0for a REAL value in DB 10 byte offset 0..3). - The channel sends a PUT/PG function (S7 communication) or a write request (S7 protocol) to the CPU over MPI / PROFIBUS / ISO-on-TCP / TCP.
- The CPU writes the value into the working DB. The user program reads the new value on the next OB1 cycle.
4. Configuring the S7 Data Block (STEP 7 V5.x)
Create a global DB that contains the operator input variables. Example for a temperature setpoint (REAL), a time value (S5TIME), and a recipe selection (INT):
DATA_BLOCK DB10
STRUCT
SpTemp : REAL; // 4 bytes (DBD0)
SpRampTime : S5TIME; // 2 bytes (DBW4)
RecipeSelect : INT; // 2 bytes (DBW6)
EnableBit : BOOL; // 1 bit (DBX8.0)
END_STRUCT
BEGIN
SpTemp := 0.000;
SpRampTime := S5T#0MS;
RecipeSelect := 0;
EnableBit := FALSE;
END_DATA_BLOCKREAL occupies 4 bytes and must start at a multiple of 4 (DBD0, DBD4, DBD8...). INT/WORD/S5TIME must start at an even byte (DBW0, DBW2, DBW4...). A BOOL inside a DB occupies 1 bit of the next free byte. If you insert a REAL after a BOOL, STEP 7 inserts a reserved byte to restore alignment. Inspect the "Address" column in the DB declaration to see the absolute offset.4.1 Configuring the S7 Data Block (TIA Portal / S7-1500)
In TIA Portal the same structure is created, but the default for new DBs is Optimized. For WinCC V7 the DB must be set to Standard (compatible with S7-300/400) or have the HMI attributes enabled:
- Right-click the DB → Properties → Attributes.
- Set Accessible from HMI = true.
- Set Writable from HMI = true (per tag or globally).
- For S7-1200/1500 the Optimized block access option can remain enabled, but the symbolic access from WinCC V7.4 SP3 and later supports symbolic tags with "Access via optimized block access".
5. Configuring WinCC Tags
Open WinCC Explorer → Tag Management → SIMATIC S7 PROTOCOL SUITE → [your connection, e.g. MPI or TCP/IP] and add tags with the following parameters:
| WinCC tag | Data type | STEP 7 address | Length | Update |
|---|---|---|---|---|
OpSpTemp |
Floating-point 32-bit IEEE 754 | DB 10, DBD 0 | 4 bytes | 500 ms |
OpRampTime |
Unsigned 16-bit (S5TIME) | DB 10, DBW 4 | 2 bytes | 1 s |
OpRecipeSel |
Signed 16-bit | DB 10, DBW 6 | 2 bytes | 1 s |
OpEnable |
Binary tag | DB 10, DBX 8.0 | 1 bit | 100 ms |
5000 for 5 s) and the STEP 7 program converts it with FC 33 (S5TI_TIM / IEC time conversion) or directly loads the value into a TIMER coil. See Section 8 for the encoding details.6. Configuring the I/O Field for Operator Data Input
On the desired process picture, drag an I/O Field from the WinCC Graphics Designer toolbox. Configure it as Input/Output field and bind it to the tag created in Section 5.
| Property | Setting | Purpose |
|---|---|---|
| Tag (process tag) | OpSpTemp |
Logical link to the S7 address |
| Data format | 999.999 (or .9 / .9f with decimal count) | Operator visible representation |
| Output/Input value | Operator input enabled | Allow write to PLC |
| Limit values | Min = 0.0, Max = 850.0 (example) | Reject out-of-range entries |
| Authorization | Level 4 (Supervisor) or higher | Restrict who can change the value |
| Apply on | Return / Lost focus / Both | When the value is sent to the PLC |
| Clear on invalid | Yes | Revert to last valid value on type error |
| Hidden input | No (default) | Show entered digits while typing |
7. Reading the Written Value Back (MOVE / L / T)
The value entered by the operator is already at DB10.DBD0. The user program in OB1 / a cyclic FC can move it directly into another working area, a flag word, or the I/O area of a function module. A typical AWL/ST snippet:
// AWL
L DB10.DBD0 // load operator setpoint (REAL)
T MD 100 // copy to flag double word
ITD // not needed for REAL
// or for INT
L DB10.DBW6
T MW 102// SCL
IF DB10.EnableBit THEN
rSetpoint := DB10.SpTemp; // REAL from DB
iRecipe := DB10.RecipeSelect; // INT from DB
END_IF;If the MOVE shows a "different value" than what was typed, validate the following in order:
- Open the tag in WinCC Online tag management (Start → Right-click tag → Online) and confirm the raw value in the PLC. The displayed value is always the source of truth.
- Check address alignment – a REAL declared at DBW2 will not align to DBD2; you must address it as DBD2 only if the offset is 2, otherwise re-declare the variable in the DB to start on a multiple of 4.
- Confirm signed vs unsigned. A negative REAL can look like a large positive value if the destination is treated as DWORD.
8. Timer Data Input (S5TIME / IEC Time)
The STEP 7 S5TIME format is a 16-bit value with BCD-coded time base (bits 12-13) and BCD time value (bits 0-11). To allow an operator to set a timer value, expose the tag as a raw Unsigned 16-bit in WinCC and convert in the PLC using a lookup table or FC 33 (S5TI_TIM):
| Time base (bits 13-12) | Resolution | Range |
|---|---|---|
| 00 | 10 ms | 10 ms to 9 s 990 ms |
| 01 | 100 ms | 100 ms to 1 m 39 s 900 ms |
| 10 | 1 s | 1 s to 16 m 39 s |
| 11 | 10 s | 10 s to 2 h 46 m 30 s |
For a more operator-friendly entry, present a WinCC I/O field in seconds. The PLC then executes L #Time_s; ITD; DTB; T DB10.DBW4 to convert decimal seconds to S5TIME BCD. The DTB instruction selects the smallest possible time base automatically.
8.1 Using IEC Timers (S7-300/400 and S7-1200/1500)
For S7-1200/1500 and the IEC timer library (TON, TOF, TP), input the time as a Time (32-bit DINT in milliseconds). Declare the DB variable as TIME and bind a WinCC I/O field configured as Signed 32-bit with limit values matching the time range. Display the value in ms or s using a WinCC dynamic dialog and the format string 999.999 s (divide by 1000 in the display conversion).
9. Complete Data Type Mapping Reference
| STEP 7 data type | Bit width | WinCC tag type (SIMATIC S7 Protocol Suite) | Typical use |
|---|---|---|---|
| BOOL | 1 | Binary tag | Enable / select bit |
| BYTE | 8 | Unsigned 8-bit | Bit patterns, status |
| WORD | 16 | Unsigned 16-bit | S5TIME raw, hex value |
| INT | 16 | Signed 16-bit | Recipe number, setpoint index |
| DWORD | 32 | Unsigned 32-bit | Bit mask, time tick |
| DINT | 32 | Signed 32-bit | Counter, position |
| REAL | 32 | Floating-point 32-bit IEEE 754 | Temperature, pressure, flow setpoint |
| S5TIME | 16 | Unsigned 16-bit (BCD) | Timer preset (legacy) |
| TIME | 32 | Signed 32-bit | IEC timer preset (ms) |
| CHAR | 8 | Text tag, 8-bit character set | Recipe name (1 char) |
| STRING | n×8 + 16 | Text tag, 8-bit character set, length n+1 | Operator messages |
10. Verification Procedure
- Open the process picture in WinCC Runtime. The I/O field should display the initial value from the DB (e.g.
0.000). - Open WinCC Tag Management → right-click the tag → Properties → Read/Write and confirm "Write enabled" is set.
- In Online view, modify the tag value. The PLC's online view (STEP 7 → Monitor/Modify) should show the new value at the configured address within one update cycle.
- Trigger the value in the user program (e.g. set a breakpoint after the MOVE) and confirm the value flows through.
- Check the WinCC diagnostic window (Tools → Status of Driver Connections) – the channel state must be Connected with no short-time errors.
- Check the CPU diagnostic buffer for communication errors (e.g. I/O access error, Data record error) via STEP 7 → PLC → Diagnostic Buffer.
11. Troubleshooting Matrix
| Symptom | Probable root cause | Corrective action |
|---|---|---|
| I/O field greyed out | Authorization level too high or no user logged in | Log in as Operator or higher; lower the field's authorization level |
| Value reverts to old value after Enter | Tag not "Write enabled" | Open the tag properties and check the Read/Write option |
| SF LED on CPU, "Data record error" in diagnostic buffer | DB not "Accessible from HMI" (S7-1200/1500 optimized block) | Enable the attribute in TIA Portal DB properties |
| MOVE shows a different value than typed | Address misalignment (REAL at odd offset) or endianness | Re-declare the variable on a word/double-word boundary; verify DBD/DWW in DB declaration |
| Channel status "Disconnected" | Wrong PG/PC interface assignment or wrong rack/slot | Set PG/PC interface to the correct CP (S7ONLINE → Properties → TCP/IP → S7-300/400 rack 0 slot 2 / S7-1200/1500 slot 1) |
| Write succeeds in Online test but not from picture | Output/Input value property of the I/O field is set to Output only | Change to Input/Output in the I/O field configuration dialog |
| Value accepted but returns a corrupted number | Signed vs unsigned mismatch in WinCC tag type | Match the tag type to the DB element (e.g. INT → Signed 16-bit) |
| Time value rounds to zero | Time base 00 selected with value < 10 ms | Increase the I/O field min value to ≥ 1 s, or convert to IEC TIME |
12. Performance and Reliability Tips
- Keep the update cycle of operator-input tags between 500 ms and 2 s. Slower updates reduce load on the S7 communication resources, especially with PROFIBUS at 1.5 Mbit/s and many tags.
- Group all operator-input tags under a single connection (channel unit). A second connection for the same PLC doubles the load on the S7 CPU's communication resources.
- Do not bind I/O fields directly to
DB1000.DBD0in projects that use an HMI tag prefix – the prefix must be removed or the address field will fail parsing. - For recipe loads, prefer the WinCC Recipe view to a hand-wired I/O field. The Recipe view uses internal write bursts and reduces the number of separate operator actions.
- Use Limit values on every I/O field. A setpoint entered as
1e308can be written to the PLC as a non-finite REAL and propagate NaN to subsequent math operations, freezing the controlled loop. - Always set Clear on invalid = Yes to prevent the operator from being trapped with a value that the PLC will silently reject.
13. References and Further Reading
- WinCC V7.5 System Manual (Siemens Industry Online Support)
- SIMATIC S7-300 S7-300 Automation System, CPU 31xC and CPU 31x: Installation and Operating Manual
- S7-1500 Automation System System Manual
- STEP 7 V5.6 Programming and Operating Manual
- WinCC V7.5 Communication Manual – SIMATIC S7 Protocol Suite
- Entry ID 81318674 – "Why does the S7-1200/1500 reject writes from WinCC?" (FAQ)
- Entry ID 106474747 – "Data types between STEP 7 and WinCC V7" (FAQ)
Why does my WinCC I/O field show a different value than the MOVE instruction reads in STEP 7?
Three causes account for almost every case. First, the WinCC tag may be reading from a different address than the one being written by your MOVE; confirm the absolute byte offset in the DB declaration matches the WinCC tag address (e.g. DBD0, DBD4, DBD8 for REALs). Second, address misalignment: a REAL must start on a multiple of 4 in the DB; if you declared it at offset 2 you must re-declare the variable, not just change the MOVE address. Third, signed/unsigned mismatch – a negative value entered as REAL displayed as a DWORD will look like a large positive number. Use the WinCC Online tag view and STEP 7 Monitor/Modify to inspect the raw bytes in the DB and confirm both sides read the same bits.
How do I write a TIME value (milliseconds) from WinCC into an S7-1200/1500 IEC timer?
Declare the DB element as TIME (DINT, milliseconds). In WinCC add a tag with data type Signed 32-bit on the corresponding DBW. Display the I/O field in seconds with the dynamic dialog format string 999.999 s by dividing the value by 1000 in the conversion formula. The PLC then passes the DINT directly to the IEC TON/TOF input PT. Do not use S5TIME; S5TIME is BCD-coded and incompatible with the IEC timer family.
Which authorization level do I set on the I/O field to prevent operators from changing a critical setpoint?
By default WinCC has eight authorization levels 0 to 7. Level 0 = No. Authorization, level 4 = Supervisor, level 5 = Operator, level 6 = Maintenance, level 7 = Administrator. To block all operators from changing a setpoint, set the I/O field's Authorization property to level 6 or 7. The higher the level number, the more privileged the access. Users not assigned that level in the User Administrator can still see the field but it will be greyed out for input.
The S7-1500 rejects my write from WinCC with "Data record error". What is wrong?
On S7-1200/1500 with optimized block access, every DB has the attributes Accessible from HMI and Writable from HMI disabled by default. Open the DB in TIA Portal, go to Properties → Attributes, set both attributes to true, recompile, and re-download. If the DB is shared with safety code, the same two attributes must be enabled for each tag, not just the block. After this change the WinCC write will be accepted without the diagnostic buffer entry.
Why does my operator see the I/O field greyed out even after logging in?
The I/O field has its Authorization property set to a level higher than the user's level. Compare the user's level in the User Administrator with the field's level. The default Operator user has level 5; a field with level 6 (Maintenance) or 7 (Administrator) will be greyed out. Also confirm the I/O field is configured as Input/Output, not Output only, in the I/O Field Configuration dialog under Output/Input value.