Reading and Changing the WinCC Screen Number from a PLC

Overview

Every Siemens SIMATIC HMI runtime - whether SIMATIC WinCC V7 on a Panel PC 670/677/870, WinCC Runtime Professional in the TIA Portal, or WinCC Unified - keeps a numeric identifier for the screen currently displayed. That identifier is exposed to the controller as a cyclical area pointer so a SIMATIC S7-300/400/1200/1500 can read which picture is on the operator's screen, and a second area pointer or job mailbox lets the PLC force a new picture without operator input. This is the canonical mechanism for screen-coupled logic (recipe view selection, alarm-triggered page jumps, mode-dependent menus, remote maintenance views) and it is configured, not programmed, on the HMI side.

This reference covers the two area pointers used to read and change the active picture, the data layout each one uses, the configuration steps in the WinCC Explorer (V6/V7) and in the TIA Portal (WinCC RT Professional / Unified), and the recommended verification procedure on the PLC side. It applies to the original question (Panel PC 670 + WinCC V6.0) and to current TIA Portal V17/V18/V19 projects on Unified Comfort Panels and WinCC Runtime Professional.

Area Pointer Model and Data Direction

An area pointer is a fixed-size data block in the PLC's memory that the HMI runtime polls cyclically over the underlying protocol (MPI/PROFIBUS for legacy S7-300, PROFINET for S7-1200/1500). The runtime either reads the block (PLC → HMI direction, e.g. job mailbox) or writes the block (HMI → PLC direction, e.g. screen number) at the configured update cycle. The active connections screen in WinCC Explorer and the HMI device editor in TIA Portal are the only places where these pointers are enabled and bound to a PLC tag area.

The Siemens Knowledge Base entry ID 109794203 states explicitly: "The screen number is always transferred to the PLC when a new screen is activated or when the focus within a screen changes from one screen object to another." This means the screen number is event-driven on screen entry, and also updates when the user navigates focus between objects inside the same picture - a useful detail when you want to detect operator sub-states.

Reading the Active Screen in the PLC

Classic WinCC V6 / V7 (Panel PC 670, WinCC Explorer)

1. In the WinCC Explorer, right-click Tag Management → SIMATIC S7 PROTOCOL SUITE → [your connection, e.g. TCP/IP] and open Connection Properties.
2. Switch to the Area Pointers tab.
3. Enable Screen Number and assign it a PLC address. The classic default is DB 100, DW 0 (data word 0 in data block 100). The required DB must exist in the S7 program and be at least 1 WORD long with sufficient free length to coexist with other area pointers.
4. Click OK and rebuild the runtime. The HMI will now write the current picture's numeric identifier into DB100.DBW0 every time the picture changes or the focus moves between screen objects.

The identifier written is the picture number assigned in the Graphics Designer: open the picture, choose Properties → Miscellaneous → Picture Number. By default pictures are numbered in the order they are created; the value is editable and is what the PLC actually receives. Re-numbering pictures is therefore a refactoring risk and should be locked down via naming conventions or a generated export.

TIA Portal - WinCC Runtime Professional

1. In the project tree, select the HMI device and open Device Configuration.
2. In the inspector open Connections, select the HMI ↔ PLC connection, and switch to Area Pointers.
3. Enable Screen number and assign a PLC tag - either an absolute address (%DB100.DBW0) or a symbolic tag from the S7 program.
4. Compile and download to the HMI runtime.

TIA Portal - WinCC Unified (Unified Comfort Panels, Unified PC)

For Unified, the screen number area pointer is documented in the TIA Portal Cloud DocV001 - Area pointer screen number. The same principle applies: the pointer is configured in the HMI connection editor and binds to a PLC tag. The HMI cyclically writes the index of the currently active screen object into that tag.

Consuming the value in the S7 program

The word the HMI writes is a plain unsigned 16-bit integer. Typical consumption patterns:

• SCL (S7-1500/1200): IF "HMI_ActiveScreen" = 10 THEN // picture 10 is in focus ... END_IF;
• Ladder (S7-300, classic STEP 7): use a comparator ==I on DB100.DBW0 against a constant or against a known picture number constant block.
• Edge detection: latch the previous screen number and compare - rising edges indicate a screen change, useful for one-shot logic on picture entry.

Changing the Active Screen from the PLC

There are three production-grade methods. Pick one per project; mixing them complicates lifecycle management.

Method 1 - Job mailbox with job 51 (Select Picture By Number)

This is the standard mechanism in classic WinCC and is also supported in WinCC RT Professional. The job mailbox is a 4-WORD block in the PLC that the HMI polls. To trigger a screen change, the PLC writes a structured job into the mailbox and the HMI acknowledges it by setting the same word 0 back to 0 once executed.

Configuration in WinCC V7: Connection Properties → Area Pointers → Job Mailbox. Default address is DB 100, DW 2 - it must not overlap the screen number area pointer. In TIA Portal: HMI device → Connections → Area Pointers → Job mailbox.

ST code (S7-1500/1200) to request picture 12:

// Trigger job mailbox once on a rising edge of bRequest
IF "bScreenRequest" AND NOT "bScreenRequestOld" THEN
    "JobMailbox".JobNo := 51;          // SelectPictureByNumber
    "JobMailbox".Param1 := 12;         // picture number
    "JobMailbox".Param2 := 0;
    "JobMailbox".Param3 := 0;
END_IF;
"bScreenRequestOld" := "bScreenRequest";

// Acknowledge: the HMI writes 0 back into JobNo
IF "JobMailbox".JobNo = 0 THEN
    // mailbox is free, next request is allowed
    "bJobBusy" := FALSE;
END_IF;

Method 2 - Tag-triggered OpenPicture (WinCC V6/V7)

This is the mechanism referenced in the original support answer. It is the simplest in terms of code footprint but requires the picture name as a string.

1. In the Graphics Designer, select the picture that should be the navigation source (for example, picture 1).
2. Open Properties → Events → Open Picture (or the Open event on a button, depending on the use case).
3. Configure the action as C-Action on a tag change and select an external WinCC tag (typically a string tag bound to a PLC DBW area).
4. From the PLC, write the target picture name into the tag (e.g. 'Overview.Pdl') and the HMI opens that picture on the next cycle.

This method has the advantage of allowing the PLC to specify the picture by name rather than by brittle integer, but the string length is bounded by the tag definition and the picture file name must exist in the project. It is not the preferred method for high-reliability industrial applications because the picture file can be renamed during a project upgrade.

Method 3 - Direct picture change via a configured trigger tag (Unified)

WinCC Unified exposes the ChangeScreen system function which can be wired to a PLC tag change. The tag is configured on the screen's Loaded or a button's Click event, with the value carrying either a screen name (string) or a screen ID (integer). The runtime evaluates the trigger tag on the configured acquisition cycle and switches the active screen.

Configuration Walkthrough - End to End

The following procedure is the minimum viable setup for a Panel PC 670 running WinCC V7 against an S7-315-2 PN/DP. The same structure applies to a Unified Comfort Panel against an S7-1516.

Prerequisites

• STEP 7 (classic) or TIA Portal with the S7 program compiled and downloaded.
• WinCC Explorer with the project open and the HMI runtime licensed.
• An S7 connection that has already been verified (green status in WinCC Explorer or Online → Connections in TIA Portal).
• At least two pictures in the Graphics Designer with non-zero picture numbers assigned.

Allocate the area pointer DB on the PLC

Create a global DB (e.g. DB100) with the following minimum layout for both the screen number and the job mailbox. Leave spare words for future area pointers (date/time, coordination, etc.).

Bind the area pointers in WinCC

1. Open the S7 connection properties → Area Pointers.
2. Enable Screen number, point to DB 100 DBB 0, length 1 word.
3. Enable Job mailbox, point to DB 100 DBB 2, length 4 words.
4. Rebuild and start the runtime.

Trigger a screen change from the S7 program

With the job mailbox armed, writing a new picture is two DBW writes plus an edge check on the acknowledge. The block below is a self-contained FB that can be called from OB1 with the desired picture number.

FUNCTION_BLOCK FB_ScreenJump
VAR
    bTriggerOld : BOOL;
    bBusy       : BOOL;
END_VAR

IF bTrigger AND NOT bTriggerOld THEN
    IF NOT bBusy THEN
        "DB100".Job_JobNo  := 51;       // SelectPictureByNumber
        "DB100".Job_Param1 := iPicNo;   // picture number from input
        bBusy := TRUE;
    END_IF;
END_IF;
bTriggerOld := bTrigger;

// HMI clears JobNo to 0 when the request has been processed
IF bBusy AND "DB100".Job_JobNo = 0 THEN
    bBusy := FALSE;
END_IF;
END_FUNCTION_BLOCK

Verification

1. Static read test. From the STEP 7 monitor, place the operator panel on picture 5 and observe DB100.DBW0. It must show the value 5. Click through pictures 1, 2, 3 and confirm the value tracks each transition.
2. Focus test. Inside picture 5, click between two IO fields with focus. DB100.DBW0 should update even though the picture did not change - this confirms the focus event path described in Siemens KB 109794203.
3. PLC-driven write test. Force DB100.DBW2 = 51 and DB100.DBW4 = 7 from the STEP 7 monitor. The panel must jump to picture 7 within one acquisition cycle. The HMI will then write 0 back into DBW2. A stuck non-zero value after the panel switches indicates the HMI rejected the request (picture number not assigned, picture disabled, or runtime not fully started).
4. Cyclical stress test. Toggle a PLC bit at 200 ms and route it to the FB above with a fixed picture number. The panel should toggle between two pictures without error word 0xFFFF ever appearing in DBW2.
5. Unified variant test. In the HMI device's online diagnostics, open Connections → Area Pointers and confirm Screen number shows OK. A red status indicates a length or address mismatch, not a wiring fault.

Troubleshooting Matrix

Migration Notes - V6/V7 to TIA Portal / Unified

Projects migrated from WinCC V6/V7 to TIA Portal V17+ retain the screen number concept. The migration tool translates the area pointer bindings, but two field-proven caveats apply:

• DB optimization. S7-1200/1500 programs generated in TIA Portal default DBs to optimized access. Area pointer bindings that use absolute byte offsets (DB100.DBB0) require the DB to be non-optimized. Re-binding the area pointer to a symbolic PLC tag eliminates this constraint and is the recommended approach in new projects.
• Picture number semantics. In WinCC V7 the picture number is a free integer. In WinCC Unified the same area pointer carries the screen object ID, which is assigned automatically by the TIA Portal compiler and is not user-editable. PLC code that switches on a hard-coded integer therefore needs to be re-mapped to the new IDs after migration. Export the screen inventory from the TIA Portal project and update the PLC constants accordingly.
• Job mailbox support. WinCC Unified supports a slimmer set of job mailbox jobs than WinCC V7. Job 51 (Select Picture By Number) is still available, but jobs 49, 51, and 55 (logon, select picture by name, set language) must be verified against the Unified runtime manual for the specific firmware version on the panel.

Performance and Timing

The screen number area pointer update is bound to two events: picture activation and focus change. There is no per-cycle poll, so DB100.DBW0 can be read on every OB1 scan with no performance cost. The job mailbox is polled by the HMI at the configured acquisition cycle, default 1 s for a Panel PC 670, down to 100 ms for PROFINET IRT with a Unified Comfort Panel. For a faster apparent response, lower the acquisition cycle on the HMI side rather than polling the mailbox from the PLC more often - the bottleneck is the HMI scan, not the S7 program.

Security and Access Considerations

Forcing screen changes from the PLC bypasses the HMI's user-management (UMC) visibility controls in some scenarios: a job 51 request opens the named picture regardless of the operator's current authorizations. The picture itself still enforces its own visibility, but the user may land on a screen with a different security context than expected. Production deployments that need strict access control should use the user change job (typically 49 in V7) to set a system-defined user before issuing job 51, or use the tag-triggered OpenPicture configured behind a button event that the operator can also trigger.

Field-Proven Patterns

• Alarm-coupled navigation. Raise a digital alarm in the PLC, write the alarm's associated picture number to a tag, and use the tag change to call OpenPicture. Pair with a sound tag and a flashing indicator for noisy environments.
• Mode-based start screen. On HMI startup, use a startup script to read a PLC tag that contains the desired initial picture. The HMI writes back the resulting active screen to the screen number area pointer, which the PLC then consumes to drive mode-specific interlocks.
• Remote maintenance jump. A service PLC tag forces a jump to a maintenance picture and disables operator buttons via a coordination byte. This is the cleanest pattern for OEM service access without exposing the full picture tree to the customer.

References in Context

Two official Siemens documents are the authoritative source for the area pointer behavior and the Unified equivalent. Siemens Support entry 109794203 describes the event-driven update of the screen number area pointer in WinCC V7, while the TIA Portal Cloud DocV001 page on the area pointer screen number documents the same mechanism for WinCC Unified. Together they cover the full lifecycle from the Panel PC 670 era to current Unified Comfort Panels. Job mailbox details, including job 51, are documented in the WinCC V7 manual under Communication → SIMATIC S7 Protocol → Job Mailbox and in the WinCC Unified system manual under System functions → Jobs; consult the version-specific PDF for the job list and parameter layout of your target runtime.