PCS 7 CFC: Triggered REAL Move Between DBs with WinCC Override

Overview

In SIMATIC PCS 7, an automation engineer very often needs to load a process default into a data word that the operator can subsequently edit from the OS. A typical pattern is: a maintenance pushbutton on the AS pushes a calibrated setpoint into the faceplate field, the operator tweaks it for the running batch, and the change stays valid until the next maintenance event. The naive implementation — a CFC MOVE block gated by a digital input — breaks the operator write path because MOVE rewrites the destination on every scan while the trigger is TRUE. The OP_A operator/display block (FB 45 in the PCS 7 V7.0 master data library) is purpose-built for this case: it has a LINK_U / LINK_ON pair that performs a one-shot forced write of LINK_U into the U IN_OUT, and then releases U for free WinCC read/write.

The single project-local configuration change that makes this work is flipping the S7_link attribute on the U parameter of the protected OP_A block from false to true. With that attribute set, U is mapped as a process tag back to the data block address, which is exactly the binding the operator's I/O field needs to land its write in the destination DB.

Prerequisites

• SIMATIC PCS 7 V7.0 with the master data library installed (so OP_A is available as FB 45 in the project block folder).
• STEP 7 / CFC editor licensed and online to the AS.
• An S7-400 AS (standard PCS 7 controller) with the CFC runtime loaded in OB 35 (1 s cyclic interrupt) or another configured runtime OB.
• A source data block (example: DB10) with the default REAL stored in DBD0.
• A destination data block (example: DB20) with DBD14 exposed to WinCC as a process tag.
• A digital input bit (example: I3.5) wired to a confirmed pushbutton or maintenance selector.
• Local project edit rights so that the type-protected OP_A block attributes can be opened and modified.

Why a Plain CFC MOVE Block Will Not Work

A CFC MOVE block performs a bitwise copy on every scan in which its EN input is TRUE. Connect I3.5 to EN and the destination DB20.DBD14 is overwritten with DB10.DBD0 on every OB 35 tick for as long as I3.5 is high. The operator's manual change is destroyed the next cycle after it is written, because the trigger has not yet dropped. If you try to debounce this by making the trigger a one-shot (custom FB with edge detection, SET/RESET coil, or a TP/IEC timer pulse), you now own a custom code block in a process-critical path and the operator variable lives in an indirection DB — the original DB20.DBD14 is effectively read-only from the HMI's point of view, which makes faceplate messages and archives misbehave.

OP_A avoids both pitfalls. The PCS 7 library already implements the conditional move plus the operator write-back inside the protected body of FB 45. All that is needed is to make the U pin bidirectional with the data block, which is controlled by the S7_link attribute.

OP_A Block Architecture (FB 45)

OP_A is the PCS 7 standard block for analog value operator control and display. Its I/O contract, as documented in the CFC Elementary Blocks reference manual:

For the trigger-and-override use case, only three pins are wired in the CFC chart:

• U ↔ DB20.DBD14 (bidirectional IN_OUT to the operator-visible target)
• LINK_U ← DB10.DBD0 (the default source value)
• LINK_ON ← I3.5 (the trigger)

The S7_link attribute on U controls whether the value is mapped as a process tag (read/write back to the absolute DB address) or as a local CFC variable (read-only at the block I/O; the value lives only in the chart's working DB). Out of the box the block is shipped with S7_link = false, so the value sits only in the CFC chart and never propagates to DB20.DBD14 — the operator's WinCC write has nothing to land on, and the trigger-driven LINK_U value disappears with the next CFC pass. The attribute must be flipped to true so that U becomes an alias of DB20.DBD14 in the process image.

The S7_link Attribute: The Key to Bidirectional Binding

S7_link is an S7 block attribute that, when true, causes the parameter to be bound directly to the process image / data block address of whatever symbol is wired to it in the CFC chart. When false, the parameter is bound to a local variable inside the instance DB and the value is never written back to the absolute address.

For a true operator write-back path you need the symbol address to be the canonical storage location. The default OP_A setting (S7_link = false) was chosen by Siemens so that multiple OP_A instances could be daisy-chained through shared CFC working DBs without trampling each other. For the one-tag-per-block pattern used by the trigger-and-override scheme, that protection works against the engineer, so it has to be reversed.

Step-by-Step Implementation

1. Open the OP_A Block in Edit Mode

In SIMATIC Manager, expand the project tree:

Project
 └─ S7 Program
     └─ Blocks
         └─ OP_A    (FB 45)
         └─ OP_A_DB (instance DB, auto-generated)

Double-click OP_A. The editor warns that the block is type-protected/locked. Click OK. The block opens; the algorithm body is read-only, but the I/O interface declaration at the top of the window is fully accessible.

2. Modify the S7_link Attribute

Scroll to the IN_OUT section. Select the U parameter row. Open Properties (right-click → Object Properties, or menu Edit → Properties). Switch to the Attributes tab. Locate S7_link. The shipped value is false. Change it to true. Confirm with OK. The editor will pop a dialog stating the block interface has been modified — this is expected.

3. Save and Re-Import the Block

Save the modified block back to the project (File → Save, or Ctrl+S). Then in every CFC chart that uses OP_A, right-click the chart background and select Block Type → Update. This re-compiles all instances of OP_A in the project and re-binds the U parameter to the new S7_link = true contract. Recompile the chart and download the program to the AS.

4. Wire the Pins in the CFC Chart

Drag the OP_A instance into the CFC chart and wire as follows:

  I3.5       ------> OP_A.LINK_ON
  DB10.DBD0  ------> OP_A.LINK_U
  DB20.DBD14 <-----> OP_A.U        (IN_OUT, bidirectional)
  OP_A.Q_LINK -----> DB20.DBX16.0  (optional, status mirror)

Compile the chart. Download to the AS. The program is now ready for OS-side configuration.

Signal Flow and Timing

The state machine inside OP_A behaves as follows on each CFC cycle:

1. LINK_ON is sampled at the start of the block call.
2. If LINK_ON = 1 on a rising edge (previous cycle was 0), the block writes LINK_U into the internal U buffer, which — because S7_link = true — propagates the value into DB20.DBD14 within the same cycle. Q_LINK is set to 1 for one cycle.
3. If LINK_ON remains level-stable at 1, no further write occurs; Q_LINK returns to 0. This is what protects the operator write path: a stuck or bouncy input does not continuously clobber the value.
4. If LINK_ON = 0, the block reads the data block value at U and presents it to the CFC chart. WinCC operator writes arriving on the next HMI job cycle are accepted into DB20.DBD14 and visible to OP_A on the subsequent OB 35 tick.

The recommended CFC task placement is OB 35 (1 s cyclic interrupt). This keeps the operator write-back latency inside the standard WinCC polling window (typically 1–2 s) so that the operator never sees a "value not accepted" condition. If the trigger I3.5 is a momentary pushbutton, debounce it with a standard IEC on-delay timer in a separate chart before wiring to LINK_ON, or use the PCS 7 I_FLASH / edge block. Recommended debounce time: 200–500 ms.

Type Conversion for REAL Values

A common error is to wire DB10.DBD0 directly into LINK_U when the source word is stored as a raw bit pattern (for example, the result of an unconverted peripheral read or a pre-conversion DINT). The CFC MOVE block — and OP_A's internal copy — only forwards the bit string; it does not change the data type. The CFC Elementary Blocks manual specifies the required chain:

• DW_DI — convert DWORD to DINT (re-interprets the bit pattern as a signed 32-bit integer).
• DI_R — convert DINT to REAL (numeric conversion to IEEE 754 single-precision float).

DB10.DBD0 ----> DW_DI ----> DI_R ----> OP_A.LINK_U

For libraries that ship the newer IEC-conformant conversion blocks, DI_R can be replaced with DINT_TO_REAL or DWORD_TO_REAL (SCL) with identical IEEE 754 result. If the source is already a true REAL, the chain is unnecessary and a direct wire is correct.

WinCC Operator Configuration

With the AS program loaded and OP_A correctly bound to DB20.DBD14, the WinCC side is straightforward:

1. In WinCC Explorer, open the tag management. Confirm or create a process tag at address DB20, DBD 14 with data type Floating-point 32-bit IEEE 754. The tag name is project-specific (e.g. DB20_DBD14_SP).
2. Open the faceplate or screen that hosts the operator I/O field. Bind the I/O field's tag property to the new process tag.
3. Configure the operator authorization (default: level 5 "Process controlling" or higher per project policy).
4. If the project uses PCS 7 APL (Advanced Process Library) faceplates, the OP_A instance is typically wrapped by a higher-level block (e.g. MOT_SPEED, VLV_ANL) and the same S7_link = true modification may be required on the wrapper's U or SP pin. Verify with the APL manual for the version in use.

No additional WinCC scripting is required; the operator write path goes through WinCC → S7 communication → DB20.DBD14, and OP_A reads it back on the next OB 35 cycle.

Variant: Operator Variable in the OP_A Instance DB

If the process allows the operator variable to live entirely in the OP_A instance DB (no separate DB20), the WinCC tag can be pointed directly at OP_A_INST.U in the instance DB. The trigger wiring remains identical and the S7_link modification is unnecessary — the U value is already the process tag for that instance.

This is the cleanest topology and is preferred for new projects. It does, however, lose the explicit absolute DB address visibility that some archive / audit configurations require, and it couples the WinCC tag to the chart instance name (renaming the chart breaks the tag).

Verification and Commissioning Checklist

1. Trigger write — Force I3.5 = 1 in PLCSIM or on the physical input. Confirm that DB20.DBD14 is overwritten with the value of DB10.DBD0 within one OB 35 cycle. Monitor Q_LINK for a single 0→1 pulse.
2. Operator override — Drop I3.5 to 0. From WinCC runtime, write a new value into the I/O field bound to DB20.DBD14. Confirm the value is retained across at least three OB 35 cycles.
3. Re-trigger — Re-assert I3.5. Confirm that DB20.DBD14 snaps back to DB10.DBD0 and that Q_LINK pulses again.
4. Level-stable trigger — Hold I3.5 = 1 for 10 s. Write a new value from WinCC during that interval. Confirm the value is overwritten (because the trigger is high continuously, the block re-asserts on each cycle) — this is expected behavior, document it for the operator.
5. CFC online cross-check — Open the OP_A instance in CFC online view. The U parameter must show the operator-written value when LINK_ON = 0 and the LINK_U value when LINK_ON = 1.
6. Watchdog / runtime OB check — In the S7 diagnostic buffer, confirm OB 35 is executing on schedule. A missed OB 35 stall halts both the trigger and the operator read-back.

Troubleshooting Matrix

Edge Cases and Field-Proven Caveats

• Negative REAL defaults — The DW_DI → DI_R chain correctly handles negative DINT values. If you skip the chain and use direct bit copy, negative REALs arrive as positive (the sign bit is lost in the operator's downstream float interpretation).
• Denormals and NaN — OP_A does not normalize denormal IEEE 754 values. If your default source is a computed value, clamp it to a finite range upstream to avoid faceplate display artifacts.
• Multiple OP_A on the same DB word — With S7_link = true, two OP_A instances writing the same DB20.DBD14 will fight. Only one OP_A per operator variable is allowed.
• WinCC archive — The archive should be bound to the absolute DB address DB20, DBD 14, not to the OP_A instance DB. Otherwise, the archive will miss the trigger-forced values that occur between OB 35 cycles.
• S7-400H redundant AS — The S7_link = true modification is project-local and is replicated to the standby AS by the standard PCS 7 download mechanism. No special handling is required for redundant controllers.
• Version migration — When migrating from PCS 7 V7.0 to V8.x, the OP_A block number may differ. The I/O contract (U, LINK_U, LINK_ON, Q_LINK) is preserved across all PCS 7 versions that ship OP_A. Re-apply the S7_link modification to the version-specific block in the new master data library.

FAQ