Locking WinCC Flexible Operator Controls via PLC Mode Logic

1. Problem Statement: Disabling Operator Controls Across Multiple Machines

Engineers commissioning SIMATIC HMI projects in WinCC Flexible 2008 SP5 (or its successors WinCC Comfort/Advanced inside TIA Portal, WinCC RT Professional, or WinCC Unified) repeatedly encounter a single recurring requirement: an operator button must be locked from the panel while the underlying process is in a state that forbids the commanded action. Canonical examples include (a) forbidding manual motor start while a cascade is still running in automatic, (b) disabling a stop command while a downstream super-step is mid-transition, (c) preventing two operators from driving a shared actuator at once, (d) preventing mode change while a safety-relevant sub-sequence has not yet completed, and (e) ensuring that a transition request from Auto to Manual cannot actuate any motor until the cascade stop has reached its terminal step. The most common pitfall is to implement the interlock inside the HMI runtime through screen scripts, animation logic, or one-shot events on the panel side. That approach introduces three classes of failure: first, a momentary loss of the PROFIBUS or PROFINET link between panel and PLC leaves latched command bits indeterminate across the reconnect; second, the HMI project becomes a safety-relevant controller, which the relevant harmonised standards (IEC 61508, ISO 13849-1) do not permit and which the SIMATIC manual explicitly warns against; and third, commissioning engineers must read panel-side scripts in addition to the PLC program, which doubles the diagnostic burden when an actuator behaves unexpectedly. This reference describes a single-vendor, PLC-centric architecture that uses a structured commands DB, edge detection, and S7-Graph cascade sequencing to drive a robust Operation property in WinCC Flexible while the actual interlock lives exclusively in the S7 CPU program. The same pattern survives the migration path to TIA Portal V20 and WinCC Unified without modification of the CPU program; only the property names change.

2. Architectural Principles: PLC Owns the Truth, HMI Owns the Reflection

Siemens documents the recommended separation of concerns across the SIMATIC manual set: HMI devices are operator interfaces, not safety controllers. The S7-300/400 and S7-1500 CPUs run the application logic, and the panel reflects that logic. Any operator request must therefore be modelled as a request bit emitted from the panel, evaluated by an edge detector in the CPU, and acted upon only when the application-level preconditions are satisfied. Three practical benefits of this division underpin every recommendation in this reference.

1. Deterministic scan-time behaviour. OB1 always sees the same number of inputs and the same set of enable conditions. The HMI acquisition cycle — 100 ms by default for WinCC Comfort, configurable to 50 ms or below for WinCC RT Professional — never directly writes to actuator memory.
2. Fail-safe HMI outage behaviour. If the panel loses connection to the PLC while an operator is pressing a manual start, the request bit stays at its last value. The PLC evaluates the request bit, fires its rising edge, drives the actuator, and resets the request bit in the same scan. A subsequent panel reboot cannot re-actuate any motors because the request bits are not latched and the last processed state resides in the actuator DB.
3. Single source for safety audit. When the project is reviewed against the machinery directive 2006/42/EC, only the PLC program needs to be presented. The HMI project is excluded from the safety discussion entirely, which simplifies compliance documentation.

3. WinCC Flexible Event Function Taxonomy

WinCC Flexible exposes a discrete set of event functions on a button’s Press, Release, and Click events that interact with PLC tags. Engineers who work with the SetBit and SetBitWhilePressed functions frequently report inconsistent behaviour at HMI disconnect, and the cause is invariably confusion about how the function treats the boolean tag when the panel cyclically re-acquires it after a reconnect.

Use SetBit only when a separate network in the PLC clears the bit in the same scan; otherwise the latched command survives an HMI restart and can drive an actuator on reconnect. Use SetBitWhilePressed for jog commands in which the operator physically keeps the button pressed; never use it as a substitute for an edge detector in the PLC. Avoid InvertBit and BitLatch for any safety-relevant command. The pairing convention used throughout this reference is: every command the HMI sets is reset by the PLC within the next OB1 cycle; this guarantees that the panel never holds unintended state. The same convention is also strongly preferred for TIA Portal projects using the Press/Release event model.

4. The Three-Block Data Architecture: DB100, DB110, DB120

The canonical data layout for a PLC-driven HMI panel has three global data blocks that separate raw HMI events, processed commands, and mode-related permissives.

• DB100 “HMI_Cmd”: request bits from the panel. Each button writes one bit here. These bits are never wired directly to any actuator; they are momentary demands that the CPU interprets.
• DB110 “HMI_State”: state bits the panel reads. Computed from the application, never mirrored from DB100.
• DB120 “Mode_Perm”: permission flags that the panel’s Enable property reads. Each button has a paired permission bit; the button is enabled only when its permission bit is TRUE.

DB100 is the only block the panel writes to; DB110 and DB120 are read-only from the panel’s perspective. The block layout maps cleanly to TIA Portal “control DBs” and to WinCC Unified connection namespaces.

A minimal struct definition for DB100 in STEP 7 V5.5:

DATA_BLOCK DB100
TITLE = 'HMI Commands'
STRUCT
  M1_Start_Request : BOOL;
  M1_Stop_Request  : BOOL;
  M2_Start_Request : BOOL;
  M2_Stop_Request  : BOOL;
  M3_Start_Request : BOOL;
  M3_Stop_Request  : BOOL;
  Mode_M1_Auto_Req : BOOL;
  Mode_M1_Manu_Req : BOOL;
  Mode_M2_Auto_Req : BOOL;
  Mode_M2_Manu_Req : BOOL;
  Mode_M3_Auto_Req : BOOL;
  Mode_M3_Manu_Req : BOOL;
END_STRUCT;
END_DATA_BLOCK

DB120 mirrors the structure for permissives:

DATA_BLOCK DB120
TITLE = 'Mode Permissives'
STRUCT
  Permission : STRUCT
    M1_Manual_OK : BOOL;
    M2_Manual_OK : BOOL;
    M3_Manual_OK : BOOL;
  END_STRUCT;
  Mode : STRUCT
    M1_Manual : BOOL;
    M2_Manual : BOOL;
    M3_Manual : BOOL;
    AtLeastOneManual : BOOL;
  END_STRUCT;
END_STRUCT;
END_DATA_BLOCK

OB1 Network 1 implements the discipline that makes the architecture robust:

// Network 1: Reset transient HMI requests
      A     "HMI_Cmd".M1_Start_Request
      AN    "Permission".M1_Manual_OK
      R     "HMI_Cmd".M1_Start_Request

      A     "HMI_Cmd".M1_Stop_Request
      R     "HMI_Cmd".M1_Stop_Request

      CALL  FC 100                     // generic bulk reset of DB100

// Network 2: Edge-detect surviving requests
      A     "HMI_Cmd".M1_Start_Request
      FP    "HMI_Edge".M1_Start
      S     "HMI_Latch".M1_Start

      A     "HMI_Cmd".M1_Stop_Request
      FP    "HMI_Edge".M1_Stop
      S     "HMI_Latch".M1_Stop

// Network 3: Apply mode-gated toggle
      A     "HMI_Latch".M1_Start
      A     "Permission".M1_Manual_OK
      S     "Output".M1_Motor
      R     "HMI_Latch".M1_Start           // self-clearing one-shot

The first network guarantees that any request that fails its permission test is dropped within one PLC scan; the second raises an edge only on a fresh activation; the third applies the toggle logic gated by the mode flag and self-clears the one-shot. This pattern is the minimum viable scaffold recommended for any WinCC Flexible / WinCC Comfort project with manual-override requirements.

5. Edge-Detected Toggle Logic in S7 STL and SCL

The button-to-output toggle pattern — sometimes called the “Wipp-SR” in German references — is canonical for SIMATIC S7-300 and S7-400. Its expansion for a single motor in machine M1 with separate Start and Stop operators reads:

// Network 10: HMI Start request gated by manual permission
      A     "HMI_Cmd".M1_Start_Request
      FP    "HMI_EdgeM1".Start
      A     "Permission".M1_Manual_OK    // manual + cascade stopped
      S     "Cmd".M1_Motor

// Network 11: HMI Stop and auto cascade stop
      A     "HMI_Cmd".M1_Stop_Request
      FP    "HMI_EdgeM1".Stop
      O     "AutoStop".M1_Active        // S7-Graph cascade stop
      R     "Cmd".M1_Motor

// Network 12: Cyclic reset of DB100 bits
      CALL  FC 100                      // see Section 4

FC 100 implements a single-pass reset of all DB100 request bits. Its body in STL is straightforward, looping over a UDT that mirrors the request structure:

FUNCTION FC 100 : VOID
TITLE  = 'Bulk reset of HMI command bits'
BEGIN
      LAR1  P#DB100.DBX0.0
      L     12                          // number of request bytes
Next:  L     0
      T     DBW [AR1,P#0.0]
      +AR1  P#2.0
      L     0
      LOOP  Next
END_FUNCTION

The semantic guarantee is that no request bit survives more than one OB1 cycle unless it is reasserted by a new operator action; latched operator intent therefore lives exclusively in Cmd, never in HMI_Cmd. SCL equivalents for S7-1500 in TIA Portal are written as:

// SCL form for TIA Portal S7-1500
FOR i := 0 TO 11 BY 2 DO
  "HMI_Cmd".Requests[i] := FALSE;
END_FOR;

IF "HMI_EdgeM1_Start_Rising" AND "Permission".M1_Manual_OK THEN
  "Cmd".M1_Motor := TRUE;
END_IF;

IF "HMI_EdgeM1_Stop_Rising" OR "AutoStop".M1_Active THEN
  "Cmd".M1_Motor := FALSE;
END_IF;

Edge memory bits in S7-300/400 are placed in a dedicated flag area (e.g. MW 1000–MW 1099) and initialised in OB100 (restart) and OB102 (cold restart). For S7-1500 with TIA Portal, edge memory bits are placed in global DBs and initialised via the Start values column.

6. S7-Graph Cascade Sequencing with OpZero and OpZeroed

The challenge unique to multi-mode machines is that toggling a hardware switch from Auto to Manual requires a controlled transition: the cascade stop sequence must run to completion before manual permissions are granted, and the cascade start sequence must complete before automatic permissions are granted. S7-Graph 5 (for S7-300/400 inside STEP 7 V5.5) and S7-Graph 7 (inside TIA Portal V20 for S7-1500) handle this directly through super-steps, transition conditions, and the OpZero / OpZeroed operand pair.

A representative chain for one machine M1 in a cascade of three:

Step S10 is the steady-state automatic run. The transition S10 → S50 fires on Mode_Req.M1_Manual. Step S50 executes a cascade stop super-step that systematically resets each downstream motor one at a time with configurable dwell times between stages. The transition S50 → S80 fires on All_Motors_Stopped, which itself is a Boolean reduction (AN Output.M1_Motor; AN Output.M1_Downstream_M2; AN Output.M1_Downstream_M3) over the actuator DB. Step S80 is the manual-ready state and the only state in which Permission.M1_Manual_OK is asserted. Once Mode_Req.M1_Auto rises, the chain re-enters S10 through the cascade restart super-step.

The OpZero and OpZeroed operands from S7-Graph are zero-condition pairs used inside permanent operations of a step. They are the Graph-native way to ensure that the actuator bits are reset at the conclusion of the stop super-step without conflicting with the manual loop that follows. Configure both operands on each motor output: OpZero := All_Motors_Stopped ensures that as soon as all motors are off, the Graph stops driving them, allowing manual writes to take effect immediately. OpZeroed is the return flag confirming the zeroing happened, readable as a step transition guard.

The S7-Graph program in TIA Portal V20 exports as an FB (typically FB 900 onwards) with an instance DB per machine. Inside the FB the actions are written as IEC 61131-3 actions with qualifiers (N, S, R, L, D). For example, step S50 contains the action:

// S7-Graph FB 901 (M1 instance), Step S50 cascade stop:
Action "Stop_M1_Motor" : S5
  S Output.M1_Motor := FALSE   // hard off
  R Output.M1_Valve := FALSE
  R Cmd.M1_Motor     := FALSE   // ensures manual loop cannot preempt
Action "Stop_M1_Wait" : L8s      // 8 second dwell
  N Output.M1_Dwell_Timer

The action qualifier S5 drives the assignment for 5 seconds, a common SIMATIC pattern for staged cascade shutdown; the dwell step L8s holds the Graph in the wait sub-step for 8 seconds. Both qualify with the OpZero condition so that the stop sequence self-terminates when the downstream motors are also off.

7. Per-Button Enable, Visibility Animation, and Screen Navigation

WinCC Flexible supports per-button Enable through a connected PLC tag. The cleanest visual filter is to bind each button’s Enable property to a permission bit in DB120. For example, the M1 Start button has:

• Tag (Enable property): DB120.Permission.M1_Manual_OK
• Appearance “Disabled”: grey foreground, no press feedback
• Acquisition cycle: 100 ms (default) or reduced to 50 ms for fast response

Beyond per-button enablement, the screen navigation itself must be mode-aware. Use area pointers or scheduled tasks to change the start screen based on a global mode variable. The recommended approach for WinCC Flexible 2008 SP5 is:

1. Read DB120.Mode.M1_Manual, DB120.Mode.M2_Manual, DB120.Mode.M3_Manual into three internal HMI tags.
2. Configure a scheduled task in WinCC Flexible that runs every 500 ms and sets the start screen based on the OR of the three bits.
3. Place a global “Return to Auto” button on the manual screen that requests mode change back to auto. The PLC decides when the cascade restart can begin.

For WinCC Comfort/Advanced inside TIA Portal, the equivalent configuration path is Properties > Animations > Operator-Control Enable. For WinCC RT Professional, the lock is the security property documented in the TIA Portal V20 manual set:

Properties for locking and unlocking operator controls under TIA Portal V20 with RT Professional are documented in the official help set: Locking and unlocking operator controls (RT Professional). The same documentation page covers the two-hand operation lock for safety-relevant panels and shows the visibility property filter list applied across operator controls.

8. Multi-Mode Switch Architecture: Per-Machine Permissives

A typical packaging line has three machines (M1, M2, M3) each with its own Auto/Manual key-switch wired to a digital input module such as the SM 321 (6ES7321-1BL00-0AA0) on S7-300 or the DI 16x24VDC module on S7-1500. The three switches must not be combined into a single mode byte because the operator needs to service one machine while the other two keep running in auto. The PLC processes each switch independently through its own FC.

// FC 200: Per-machine Auto/Manual handling
      A     "DI".M1_Manual_Switch           // debounced in OB1 via DI
      FP    "EdgeM1".Manual_Switch
      S     "Mode_Req".M1_Manual

      A     "DI".M1_Manual_Switch
      AN    "Mode".M1_Manual
      FP    "EdgeM1".Auto_Switch
      S     "Mode_Req".M1_Auto

// FC 201: Per-machine mode transition
      A     "Mode_Req".M1_Auto
      A     "Mode".M1_Manual
      A     "S7_Graph".M1_Manual_Ready      // step S80 active
      S     "Mode".M1_Manual               // retain manual flag
      R     "Mode".M1_Manual                // clear manual
      R     "Mode_Req".M1_Auto

      A     "Mode_Req".M1_Manual
      A     "Mode".M1_Manual
      A     "S7_Graph".M1_Auto_Run         // step S10 active
      S     "Mode".M1_Manual
      R     "Mode".M1_Manual                // retrigger auto
      R     "Mode_Req".M1_Manual

Each machine has its own Graph chain (M1_Graph, M2_Graph, M3_Graph, typically FB 901–FB 903) and its own permission bit. Cascade restart only triggers when all three auto requests are satisfied, allowing individual machines to come back online before the others. The HMI screen shows a consolidated mode panel with the three current modes highlighted by colour: green for auto, amber for manual, and grey for the transition state. A consolidated AtLeastOneManual bit in DB120 drives the start-screen navigation in WinCC Flexible.

For installations where additional machines share a single S7-Graph instance, the pattern scales by adding transition conditions per machine rather than forking the chain. The S7-Graph editor in TIA Portal V20 supports parallel branches with their own sequencers, allowing the three machines to operate as independent sub-chains that share a single common lock step (S80) for cascade restart.

9. Connection Configuration: MPI, PROFIBUS, PROFINET, OPC UA

Reliable HMI-to-PLC locking requires a deterministic connection with a known acquisition rate. The recommended generations are:

For WinCC Flexible 2008 SP5 on PROFIBUS DP, configure the connection as IF1B with an OP address on the same bus as the PLC, and set the acquisition rate for the Enable property to 100 ms. For TIA Portal Comfort panels on PROFINET, use the device proxy and the PLC’s integrated PROFINET interface (e.g. PROFINET 1 of CPU 1515-2 PN). For WinCC Unified PC and Web, an OPC UA server connection on the S7-1500 CPU publishes the DB120 tags to clients; the publishing rate is configured under OPC UA Server > Publication of DB120.

10. Migration to TIA Portal, WinCC Comfort, RT Professional, Unified

The discipline of PLC-driven commands survives the migration to TIA Portal. What changes is the property syntax of the lock itself. The migration path is incremental: WinCC Flexible projects migrate to WinCC Comfort/Advanced first, then optionally to WinCC RT Professional or Unified. The data architecture (DB100/DB110/DB120) does not change; the connection-mapping step in TIA Portal replaces the area-pointer configuration of WinCC Flexible.

For TIA Portal V20 with WinCC RT Professional, the documented mechanism for locking an operator control is to disable the Allow operator control option under Properties > Properties > Security. The documentation page covers the two-hand operation lock for safety-relevant panels and shows the visibility property filter list. For Comfort Panels (WinCC Comfort/Advanced) the equivalent path is Properties > Animations > Operator-Control Enable, tied to a Boolean HMI tag sourced from DB120. For WinCC Unified PC and Web, the lock is implemented in the screen via the Enabled property of the control.

The TIA Portal V20 RT Professional documentation explicitly recommends enabling operator controls only after the PLC signals the application-level permission, which corresponds directly to the DB120 permission pattern: Locking and unlocking operator controls (RT Professional).

11. Verification and Commissioning Procedure

Commissioning a PLC-driven HMI lock follows a fixed sequence. Skipping any step leaves residual risk:

1. Open the S7 project (STEP 7 V5.5 or TIA Portal V20), recompile HW Config and the program, and download to the CPU. Verify the CPU is in RUN with no SF (system fault) and no BF (bus fault) on the PROFIBUS or PROFINET master.
2. Open WinCC Flexible (or TIA Portal HMI editor) and download the panel project. Verify the connection status indicator is green.
3. In the PLC, force Mode.M1_Manual := TRUE directly in a VAT (Variable Table) and verify that Permission.M1_Manual_OK rises only after the cascade has run to step S80.
4. Toggle the physical Auto/Manual switch on the control cabinet. Verify that the HMI button Enable property follows the PLC bit within one acquisition cycle.
5. Disconnect the MPI/PROFIBUS/PROFINET cable while a manual command is in progress and verify that no actuator moves. Reconnect, verify that the actuator state reflects the PLC truth, not the panel state.
6. Open the VAT and walk DB100, DB110, DB120. Each request bit in DB100 must return to FALSE within one OB1 cycle after FC 100 executes.
7. Force a configuration error by stopping the CPU and verifying that the panel shows the connection error rather than driving any actuator.
8. Switch each of the three Auto/Manual switches independently and verify cascade stop → manual → cascade restart sequence on the others that remain in auto.

A commissioning checklist covering the verification above should be filed with the project’s functional safety documentation for ISO 13849-1 PL d review, even when the panel is not part of the safety chain. The checklist is typically archived in the project’s quality folder under CMM_201_HMI_Lock_v01.docx.

12. Process Data Archiving and Operator Action Logging

For ISO 13849-1 PL c and PL d machines, every operator action that influences the safety state must be logged. Although the panel itself is excluded from the safety chain, the operator action log provides traceability for incident reconstruction. Configure the S7-300/400 “Audit Trail” function or the TIA Portal V20 “Operator Action Logging” extension to record:

• Tag name: DB120.Mode.M1_Manual, M2_Manual, M3_Manual
• Old value, new value, timestamp (ms resolution from CPU clock)
• Operator name from WinCC logon (via UMC for Comfort/Unified)
• Source: HMI tag, OPC UA, MPI/PROFIBUS/PROFINET direct write

The WinCC Flexible 2008 SP5 audit trail stores records in a circular log file on the panel’s flash storage. In TIA Portal V20, the operator action log is on the HMI Runtime side and writes to a SQL database (SQLite or MS SQL depending on the deployment). Archiving retention is 30 days by default; configure under Runtime Settings > Logging > Audit Trail.

If the audit trail cannot be enabled (e.g., older panel without persistent storage), implement a minimal log in the PLC: a DB200 with 16-byte records written each time Permission.Mx_Manual_OK changes, snapshotted with the OB1 cycle counter and a millisecond timestamp from the CPU clock (SFC 1 READ_CLK). The log can be retrieved by WinCC Comfort in CSV format for any post-incident review.

13. Functional Safety Considerations (ISO 13849-1, IEC 61508)

HMI panels are rated at most EN 61131-2 Cat.1 in functional-safety architectures. The relevant harmonised standards that govern how interlocking logic can be distributed are:

• ISO 13849-1 (PL): defines the performance level for safety functions. Hardware panels reach PL a with single-channel architecture; PL d requires redundant logic in the F-CPU (e.g. S7-1500F with safety module SM 526F).
• IEC 61508 (SIL): defines the safety integrity level. Panel-rated logic is bounded by SIL 1; safety interlocks must live in a SIL 2 or higher subsystem.
• IEC 62061 (SIL): machinery-specific derivation of IEC 61508.

Therefore any “manual override” presented on the HMI is informative; the actual safety interlock must be implemented in either the F-CPU program (via fail-safe DI/DO modules such as SM 526F) or in an external safety relay (Pilz PNOZ multi, Sick FX3-XTIO). The pattern in this reference moves the interlock into the standard CPU, which is acceptable for non-safety mode switching (operator-permitted transitions), but does not replace the safety-rated architecture for actual E-stop and guard-door functions.

14. Diagnostic Tools and Online Monitoring

WinCC Flexible 2008 SP5 and TIA Portal V20 provide complementary diagnostic surfaces for monitoring the lock architecture. The recommended set of tools is:

• VAT (Variable Table) in STEP 7 / TIA Portal: monitor DB100, DB110, DB120, and Edge bits in real time. The VAT supports both incremental and cyclic refresh; use cyclic refresh at 250 ms for accurate perception of edge transitions.
• HMI tag simulation: WinCC Flexible and TIA Portal both support forcing tag values from the HMI editor. This is useful to simulate panel behaviour without touching the PLC but should not be used to override a running machine.
• S7-Graph status view in STEP 7: open the FB during online monitoring to see which step is active, which transitions are met, and which actions are pending. The OpZero conditions are visible in the step’s “Condition” column.
• WinCC ProAgent / F-Trace: for safety-rated versions, an F-Trace capture shows the diagnostic buffer of the F-CPU including passivation and reintegration events.
• Web server on S7-1500: the integrated web server exposes variable states over HTTP and is useful for remote diagnostic of the lock architecture without being on-site.

A diagnostic workflow that catches the most common installation errors in under five minutes is:

1. Open VAT, watch DB120.Mode.M1_Manual. Toggle the physical switch.
2. If the bit does not change, the digital input module is not wired or the input address mismatch.
3. If the bit changes but Permission.M1_Manual_OK does not, the S7-Graph has not reached step S80.
4. If the permission bit updates but the HMI button stays grey, the Enable tag wiring in WinCC is broken.
5. If the HMI button enables but the actuator does not start, DB100 is not receiving the request; check the event function configuration on the button.

15. Troubleshooting Matrix

16. Frequently Asked Questions