Reading S7-200 VB Bytes in WinCC via PC Access OPC

1. Problem Definition and Architecture

Reading an 8-bit value (a byte, address VB1000) from a Siemens SIMATIC S7-200 CPU into a WinCC HMI/SCADA tag is one of the most common points of failure when the S7-200 is connected to WinCC through the S7-200 PC Access OPC server. The byte arrives correctly inside PC Access (the value 192 shown for VB1000 is verified there) but the WinCC tag either shows a wrong value, an error, or no update at all.

The root cause is almost always a data-type mismatch between the S7-200 memory representation (BYTE / unsigned 8-bit) and the way the WinCC tag manager interprets the OPC item. The fix is to set the correct WinCC data type together with the correct format adaptation rule.

The data path is:

S7-200 CPU (VB1000, BYTE)
        |   PPI/MPI/TCP via CP243-1
        v
S7-200 PC Access (OPC DA 2.0 server, item = VB1000, BYTE)
        |   DCOM / local OPC
        v
WinCC Tag Management (Tag = S7_200_VB1000, configured data type)

The crucial detail: the byte must be exposed by PC Access as an OPC item of type VT_UI1 (unsigned 8-bit) or, when the full register is delivered, VT_I1. The WinCC tag must then consume that item with a matching format adaptation rule.

2. S7-200 Memory Model – What VB1000 Really Is

The V (Variable) memory area of the S7-200 is a byte-addressable RAM region that holds the process image, retentive data, and freely usable scratch bytes. The addressing scheme is:

A VB is always the lowest byte of its containing VW. So VB1000 shares the low byte of VW1000, and VB1001 shares the high byte. When you read VW1000 you are reading two bytes; this is the most common cause of the "I read 192 in PC Access but WinCC shows 65472" symptom.

3. PC Access OPC Item Configuration

Inside S7-200 PC Access (the OPC DA 2.0 server that ships with STEP 7 Micro/WIN), create an item for the byte:

1. Right-click Project > New Item > Symbol.
2. Enter a symbol name, e.g. VB1000_Byte.
3. Set Address to VB1000 (or VB1000:B in some PC Access versions).
4. Set Data Type to Byte (unsigned 8-bit) – this is the default for VB addresses but verify it is not left as Word.
5. Set Memory to V.
6. Click Test. The status bar must read 192 for a byte whose PLC value is 192 (0xC0).

The item is exposed on the OPC DA 2.0 interface as a VT_UI1 value. The canonical Item ID has the form:

S7-200 PC Access.SymbolName   (canonical string)
S7:[S7-200_PCAccess]SymbolName,B (access path syntax in WinCC)

If the OPC test client (e.g. OPC Scout) shows the correct byte, the server side is good and the bug is in WinCC.

4. WinCC Tag Manager – Choosing the Correct Data Type

In WinCC Explorer open Tag Management > [Your driver connection, e.g. OPC > OPC Groups] > New Tag. The tag dialog exposes four data-type families:

The four radio buttons shown in WinCC v6 / v7 – Binary, Signed, Unsigned, Adapt format – map to:

• Binary – exposes one bit of the underlying OPC item.
• Signed – interpreted as VT_I1, VT_I2, VT_I4 or VT_R4.
• Unsigned – interpreted as VT_UI1, VT_UI2, VT_UI4.
• Adapt format – user-defined conversion from any incoming VT_ type to a target WinCC type.

For a single byte like VB1000, select Unsigned 8-bit value in the WinCC tag properties. The radio button labeled simply "Unsigned" with length 8 bits is the correct one. Do not select 16-bit or 32-bit, because WinCC will then sign-extend or zero-extend the byte into a wider variable and your process screens will show values that are 256× (or 2^24×) too large.

5. The "Adapt Format" Option – When to Use It

The Adapt format button in the tag dialog is required only when the WinCC data type is different from the OPC item data type, for example:

For a single byte where you want a numeric 0..255 in WinCC, you do not need Adapt format. Select the simple Unsigned 8-bit data type and leave adaptation off.

Use Adapt format only in these cases:

• You deliberately want the byte scaled into a 16-bit tag because the I/O field on the screen is configured for 16 bits.
• You read a 32-bit REAL from an S7-200 VD address and need endianness swap (S7-200 is little-endian for the high word, so the most common adaptation is FloatToFloat or DwordToFloat applied in the correct order).
• You read a packed status word and need to extract individual bits.

6. Step-by-Step Configuration Procedure

1. Open the S7-200 PC Access project and confirm that the symbol VB1000 is configured as BYTE. The PC Access Test Client should display the value 192 in decimal.
2. Start the PC Access OPC server (icon in the system tray turns green). The server registers itself as S7-200 PC Access in the Windows OPC Enum.
3. Open the WinCC Explorer and load your project.
4. In the project tree expand Tag Management > OPC > OPC Groups. If the OPC channel is not yet present, right-click Tag Management > Add New Driver > "OPC".
5. Right-click OPC Groups > New Group, name it S7_200_Group.
6. Right-click the new group and choose System Parameters > Filter. Browse to the PC Access server, select the item VB1000_Byte and add it to the selected list. The Item ID WinCC writes is the canonical name of the OPC item, e.g. S7:[S7-200_PCAccess]VB1000_Byte.
7. Click OK; WinCC creates a tag with a default name such as S7-200_PCAccess_VB1000_Byte and a default data type (often Signed 32-bit – change this!).
8. Open the tag properties dialog. In the Data Type dropdown pick Unsigned 8-bit value. Do not tick "Adapt format" unless you need byte-to-word or byte-to-dword scaling.
9. Confirm the Length field reads 8 (bits) and the Format adaptation column reads No.
10. Save the project, open Graphics Designer and place an I/O field on a screen. Bind the I/O field's output value to the new tag. Set the I/O field's Output/Input format to 999 (three decimal digits, leading zeros suppressed) or 000 (zero-padded to 3 digits) to display values 0..255 cleanly.
11. Activate the WinCC runtime and verify on the I/O field that the value updates to 192 (or whatever the PLC program is writing into VB1000).

7. Verification Checklist

8. Common Failure Modes and Remedies

9. Reference: Official Siemens Documentation

• Siemens Support Entry 21601611 – Communication between S7-200 and WinCC via OPC (PC Access)
• Siemens Support Entry 25736087 – Format adaptation in WinCC, sorted by AS data type
• Siemens Support Entry 22892718 – Step-by-step procedure for WinCC OPC tag configuration

10. Field-Proven Caveats

• Symbol name case sensitivity: PC Access symbol names are case-insensitive on the server side but the WinCC Item ID browser may render the canonical name with a different case. Always paste the canonical Item ID, never re-type it.
• Item ID syntax differences: On WinCC v6 the syntax is OPCServerName\SymbolName or S7:[OPCServerName]SymbolName. WinCC v7 TIA-converted projects may use the long form with an access path. The browse dialog in WinCC produces the correct syntax for the project version – use that, not a hand-written string.
• Poll group load: Putting too many byte tags in a single OPC group raises the per-group update load on the S7-200 CPU. Split into several groups with staggered update intervals if you have more than ~500 bytes.
• Variable storage in STEP 7 Micro/WIN: A symbol declared as VB1000 BYTE in the symbol table is functionally identical to a direct address; both expose the same memory cell to PC Access.
• Retentivity: V memory is fully retentive on the S7-200 by default. If your process requires the byte to start at 0 on power-up, clear it in the first scan using SM0.1 as the enable contact.

11. Frequently Asked Questions