Overview: Two Engineering Models for SIMATIC HMI Panels
SIMATIC Manager — the engineering environment for STEP 7 V5.x on S7-300 and S7-400 controllers — supports two distinct approaches to commissioning a WinCC Flexible operator panel alongside a controller. The decision to embed the panel as an HMI station inside the STEP 7 project, or to keep the panel as a standalone project in WinCC Flexible, governs which runtime features are available: ALARM_S subscriptions, S7 routing through the panel, and symbol-table tag browsing are all gated on the integrated model.
Choosing the wrong model is one of the most common configuration errors in S7-300/400 retrofits. The panel compiles and downloads cleanly, the screens render, the connection test passes — yet alarms never reach the operator, the engineering station cannot route through the panel to the subnet behind it, and the tag editor forces manual address entry for every variable. This reference defines when the integrated connection in HWConfig and NetPro is required, when a standalone connection is sufficient, and how to verify the configuration before commissioning.
Prerequisites
- STEP 7 V5.5 with the latest Service Pack and Hotfix set installed (HF3 or later for full CP 343-1 Lean / CP 443-1 Advanced integration).
- WinCC Flexible 2008 SP5 (SP3 + Hotfix 7 or later for MP 277 / MP 377 and for ALARM_S with S7-400H).
- S7-300 (CPU 31x, CPU 31xC, CPU 31xT/TF) or S7-400 (CPU 41x, CPU 41xH) with a PROFINET or PROFIBUS interface, or a separate CP module such as CP 343-1, CP 343-1 Lean, CP 443-1, or CP 443-1 Advanced.
- Operator panel with Ethernet or PROFIBUS interface: OP 73, OP 77A, OP 77B, TP 177A, TP 177B, OP 177B, TP 277, OP 277, MP 177, MP 277, or MP 377. Comfort Panels (TP700 / TP900 / TP1200 Comfort) are TIA Portal only and are out of scope for SIMATIC Manager.
- For PROFIBUS panels that are not in the HWConfig catalog, the panel GSD file is required.
- IP address plan and PROFIBUS station addresses consistent across the STEP 7 project and the panel project.
Engineering Model 1: Integrated HMI Station in STEP 7
In the integrated model, the panel is inserted into the STEP 7 project as a second station. The panel's CP or integrated interface is configured in HWConfig, a S7 connection is created in NetPro pointing to the PLC station, and the WinCC Flexible project is launched from inside the HMI station so that the tag editor can read the S7 symbol table directly.
Because the HMI station is a sibling of the PLC station under the same project, NetPro knows both ends of the connection, the S7 routing tables are populated automatically, and the WinCC Flexible compiler can resolve symbolic tag references against the S7 symbol table. The integrated model is the only model that exposes the runtime features listed in the next section.
Engineering Model 2: Standalone Panel Project in WinCC Flexible
In the standalone model, the WinCC Flexible project is created and compiled independently. The S7 connection is configured manually inside WinCC Flexible using the panel's connection editor; the engineer types the PLC's IP address (or PROFIBUS address), slot, and rack, and tags are entered with absolute addresses such as DB101.DBD0 or MW20.
The standalone model is faster to set up for small machines with a handful of tags and no alarm or routing requirements, but it is the wrong choice once any of the integrated-only features are required. The two projects do not share a symbol table, do not share a routing configuration, and do not share a STEP 7 alarm server.
When the Integrated Connection is Mandatory
The four features that strictly require the panel to live inside the STEP 7 project are summarized below.
| Feature | Integrated Model | Standalone Model | Consequence of using standalone |
|---|---|---|---|
| PLC keys mapped to I/O address space | Yes — area pointer is configured in HWConfig | No | Key-press bits in the PLC are never updated |
| ALARM_S / ALARM_8 / ALARM_8P subscriptions | Yes | No | S7 alarms never reach the panel; only locally configured bit / analog alarms work |
| S7 routing through the panel | Yes — NetPro populates the panel's routing table | No | PG/PC cannot reach a station behind the panel |
| Tag symbol browsing from the S7 symbol table | Yes — drag-and-drop from the S7 symbols editor | No | Engineer must type every absolute address |
| Symbolic I/O field linked to DB element | Yes | No (only address form) | Refactoring a DB offsets every panel tag |
If the project requires any row above, the panel must be inserted in HWConfig. If the panel is a pure point-to-point display with a small number of absolute-address tags, no alarms, and no routing, the standalone model is sufficient.
ALARM_S Subscription Requirements
ALARM_S (SFB 31 / SFB 33 / SFB 34 / SFB 35) is the alarm system used on S7-300 and S7-400. Message texts and associated values are configured in STEP 7 using PCS 7 or the optional Alarm_S package, then the panel subscribes to the alarm stream through a dedicated S7 connection. The subscription is set up automatically only when the HMI station is integrated in NetPro: WinCC Flexible writes the alarm-server connection parameters (e.g., ALARM_S_ack, ALARM_S_status, ALARM_S_msg_lock, ALARM_S_archive) into the connection's area pointer list.
For S7-400 with H-CPUs, ALARM_8 / ALARM_8P (SFB 35 / SFB 36 / SFB 37) is used instead. The same integration requirement applies.
S7 Routing Through the Operator Panel
S7 routing lets a programming device (PG/PC) reach a station on a different subnet by using an intermediate S7 station as a router. Many WinCC Flexible panels include an Ethernet or PROFIBUS CP that can act as a router — for example, the OP 177B with an integrated Ethernet interface, the MP 277 / MP 377 with two Ethernet interfaces, and any panel paired with a separate CP module.
Routing configuration is built up in NetPro from the project-wide view. The HMI station must be inserted in HWConfig with its CP configured, and the Use router checkbox must be set in the CP properties. Once this is done, a station on subnet B (e.g., a drive on PROFIBUS behind the panel) becomes reachable from the PG on subnet A through the panel's CP, with no additional programming on the PLC.
Tag Symbol Browsing and the S7 Symbol Table
When the HMI station is integrated, the WinCC Flexible tag editor offers an S7 symbols view. Symbols declared in the S7 symbol table (e.g., Motor1_Speed typed as REAL in DB101.DBD0) can be dragged into the tag editor. WinCC Flexible stores the symbolic reference, not the absolute address; if the DB number, offset, or data type is changed in STEP 7, the panel picks up the new layout on the next project compile and download.
In the standalone model, the symbol-table view is not populated, and the engineer must type DB 101 DBD 0 REAL for every tag. When the DB layout is refactored, every affected tag must be re-entered by hand. For projects with hundreds of tags this is the single largest source of commissioning delay and is the most common reason to migrate a panel into HWConfig late in the project.
Area Pointers and the Job Mailbox
Area pointers are 16-byte (or larger) data blocks in the PLC that the panel reads or writes to coordinate state with the controller. The standard area pointers are:
| Area pointer | Direction | Purpose |
|---|---|---|
| Coordination | PLC → HMI | 8 bits; bit 0 = operating mode, bit 4 = life-bit for connection diagnostics |
| Date / Time | PLC → HMI | 8-byte pointer; panel reads the PLC clock and propagates to internal clock |
| Project ID | PLC → HMI | 1 word; HMI verifies the connected project matches the expected project |
| Screen number | HMI → PLC | 1 word; PLC can read the currently active screen for coordination logic |
| Job mailbox | PLC → HMI | 4 words; PLC triggers screen changes, sets the user, executes recipes, etc. |
| Data record | Bidirectional | Used for recipe transfer between PLC and panel |
Area pointers are configured on the S7 connection in WinCC Flexible. With an integrated connection, the pointer DB number is offered as a drop-down so the engineer picks an existing DB; with a standalone connection, the DB number and offset must be typed manually and the DB must exist in the PLC at that exact location at runtime.
Step-by-Step: Inserting an HMI Station in HWConfig
- In SIMATIC Manager, right-click the project and choose Insert New Object → SIMATIC HMI Station. Select the panel type from the catalog (e.g., MP 277 10" Touch). A new HMI station node appears in the project tree.
- Double-click the HMI station to open its HWConfig. The panel appears in the rack with its integrated interface(s) auto-populated. For PROFIBUS panels without an integrated interface, drag a CP module (e.g., CP 5611 for PROFIBUS-master panels) into the rack and configure its station address.
- Configure the panel's IP address (PROFINET) or PROFIBUS address on the integrated interface properties. Match the address to the physical panel and the project's IP plan.
- Save and compile the HMI station. Open NetPro from the SIMATIC Manager toolbar or from HWConfig via Options → NetPro.
- In NetPro, drag a connection from the HMI station's CP onto the PLC's CP / integrated interface. The Insert S7 Connection dialog opens. Confirm the connection partner (the PLC station) and the connection ID (default is 1).
- Set the Operating mode of the connection to Both active only if the panel must initiate S7 functions (e.g., writing tags). For most operator panels, HMI / OPC server / routing mode is the correct setting.
- Save and compile NetPro. The connection is now in the S7 project's connection table; the panel's WinCC Flexible project will read it.
- Double-click the HMI station in SIMATIC Manager to launch WinCC Flexible. The project is created automatically. Open the tag editor, switch to the S7 symbols view, and drag symbols from the S7 symbol table onto tags.
- Open Connections → Area pointers in WinCC Flexible. Tick Coordination, Date / Time, Project ID, and Job mailbox. The default DB number (e.g., DB 100) is proposed; create that DB in the PLC with the recommended size and the connection is live.
- Compile the WinCC Flexible project, transfer it to the panel over Ethernet or PROFIBUS, and verify with the procedure below.
Verification Procedure
After download, perform the following four checks. Any failure indicates that the integrated connection has not been built up correctly.
- Connection status in the panel. Open Project → Transfer → Status on the panel, or trigger the Status Force screen. The S7 connection should show Online. A value of Offline or a red status icon indicates that the partner address, rack, or slot is wrong.
- Life-bit toggle. The Coordination area pointer bit 4 toggles every second while the connection is healthy. Monitor it in STEP 7 with a VAT or via the online view; a stuck value indicates the area pointer DB does not exist or the connection is not downloading the panel configuration.
-
ALARM_S test alarm. In STEP 7, trigger a sample ALARM_S message using
SFB 31with the message number 1 of the configured message text. The message should appear in the panel's Alarm view within 1 to 2 seconds. - Routing test (if used). From the PG on subnet A, open Accessible Nodes in STEP 7. The station on subnet B (behind the panel) should appear with the panel listed as the gateway. A timeout indicates the panel's CP does not have routing enabled or the NetPro build was not transferred to the panel.
Troubleshooting Matrix
| Symptom | Likely cause | Resolution |
|---|---|---|
| Panel shows "No connection to PLC" | Standalone connection with wrong IP / PROFIBUS address, rack, or slot | Open Connections in WinCC Flexible, verify IP address = PLC address, Rack = 0, Slot = 2 (or 3 for S7-400). If the panel is integrated, regenerate the connection in NetPro and re-download. |
| S7 alarms never appear | ALARM_S area pointer not configured, or panel is standalone | Open the connection's Area pointers in WinCC Flexible; tick ALARM_S. Confirm the alarm DB exists in the PLC and that the message texts are loaded with HWConfig download. |
| PG cannot route through the panel | Panel CP routing not enabled in NetPro | Open the panel station in HWConfig, double-click the CP, open the Properties dialog, and enable Use router. Re-compile and re-download. |
| Tag editor does not show S7 symbols | Panel is not in the STEP 7 project, or WinCC Flexible is opened outside SIMATIC Manager | Confirm the panel is a station under the STEP 7 project. Open WinCC Flexible by double-clicking the HMI station; the S7 symbols view only populates from this entry point. |
| Key-press bits in the PLC are always 0 | Area pointer for keys not configured, or the PLC-key DB is the wrong DB number | Enable the Keys area pointer in WinCC Flexible. The default pointer DB is the same DB as the area pointer used for the panel; verify in the PLC's VAT that the bits toggle when keys are pressed. |
| Compile error "Symbol not found" in WinCC Flexible | S7 symbol was renamed or deleted in STEP 7 | Right-click the panel project, choose Rebuild All. Resolve any unresolved symbols; WinCC Flexible falls back to the absolute address but flags the discrepancy. |
Choosing the Model for a New Project
As a rule of thumb, default to the integrated model for any project with more than 30 tags, any S7 alarm, or any network where the panel sits between two subnets. The cost of inserting the panel in HWConfig is roughly 15 minutes of engineering; the cost of doing it late in the project — after a refactor of DB offsets, after the plant is wired, or after a commissioning trip is scheduled — is typically a full day. The standalone model should be reserved for very small, single-PLC, single-subnet, tag-light machines where no symbolic or alarm features are required.
Do I have to insert my HMI panel in HWConfig?
Insert the panel in HWConfig if the project uses ALARM_S / ALARM_8 messages, requires S7 routing through the panel, or needs symbolic tag picking from the S7 symbol table. A standalone WinCC Flexible project is sufficient for small, point-to-point, alarm-free machines with a handful of absolute-address tags.
Why are my S7 alarms not appearing on the panel?
The most common cause is a standalone panel project: the ALARM_S area pointer is not assigned on the S7 connection, so the panel never subscribes to the PLC's alarm server. Re-insert the panel as an HMI station in HWConfig, rebuild the S7 connection in NetPro, enable the ALARM_S area pointer in WinCC Flexible, and verify with a sample SFB 31 trigger.
Can I route through a WinCC Flexible panel?
Yes, for S7 routing on PROFIBUS and PROFINET, provided the panel is inserted in HWConfig and its CP has Use router enabled in the CP properties. The routing table is built up by NetPro; PROFINET IO device access through a panel router is not supported on WinCC Flexible panels.
What is the difference between integrated and standalone connection in WinCC Flexible?
An integrated connection is created by dragging between the HMI station and the PLC station in NetPro, and it pulls its parameters from the STEP 7 project. A standalone connection is created inside WinCC Flexible's connection editor, with the PLC address, rack, and slot typed in manually. Integrated connections enable symbolic tag browsing, ALARM_S, and routing; standalone connections do not.
How do I enable tag symbol picking in WinCC Flexible?
Open the panel project by double-clicking the HMI station inside SIMATIC Manager — do not launch WinCC Flexible independently. In the tag editor, switch to the S7 symbols view. Drag any symbol from the STEP 7 symbol table onto the tag list. Tags created this way reference the symbol by name and survive DB refactors.