Resolving MP277 SmartTags Zero-Value Bug in VBScript Loops

Resolving MP277 SmartTags Zero-Value Bug in VBScript Loops

The Siemens SIMATIC MP 277 (Mobile Panel 277) family, when running WinCC Flexible 2008 SP2 / SP3 / SP4 image builds, exhibits a silent runtime failure when VBScript code accesses HMI tags through dynamically constructed names inside a For-Next loop. The tag is read, the file is written, the line count is correct, and yet every numeric column resolves to 0. The behavior is reproducible, has no HMI alarm entry, and disappears the moment each tag is touched by name at least once in the same script session. The pattern is frequently seen when a maintenance engineer batches 100–500 process values into a CSV or plain-text file on a network share using fFileWrite.LinePrint, and it is the most common cause of "ghost zeros" in operator log files generated by MP 277 panels.

1. Problem Statement and Scope

A VBScript routine of the following form is requested by the operator:

For i = 1 To 200
    fFileWrite.LinePrint "Pressione_US_" & addZero(i) & "=" & SmartTags("Pressione_US_" & addZero(i))
Next

Observable outcomes:

1. The destination file is created and the correct number of lines (200) is written.
2. The literal tag name portion is correct on every line (e.g., Pressione_US_001, Pressione_US_002).
3. Every value column reads 0 on the first invocation of the script after a project transfer or a panel reboot.
4. If a single literal reference such as SmartTags("Pressione_US_001") is executed anywhere earlier in the same script, the Pressione_US_001 value resolves correctly while the remaining 199 indices still return 0.
5. After touching every tag by name once, subsequent runs of the same loop return correct values for the lifetime of the runtime.

This is not a logic bug in the engineer's script. It is a tag-cache initialization artifact of the MP 277 WinCC Flexible script runtime that becomes visible only when the tag name is constructed dynamically rather than appearing literally in source code.

2. Affected Hardware, Image Versions, and Runtime

The official MP 277 operating instructions describe the panel's connectivity, file-system support, and the WinCC Flexible integration model. Reference the published manual for hardware limits before applying the workarounds in this article: MP 277 Operating Instructions (Siemens Support, attachment 23337820).

3. Root Cause Analysis

The MP 277 VBScript runtime pre-compiles a tag reference table the first time the panel boots into the project. Tags whose names appear as literal string constants in any compiled script are entered into the table during compilation. Tags accessed only through string concatenation (e.g., SmartTags("Pressione_US_" & i)) are not statically resolvable, so they are absent from the table.

Two cache layers cooperate to produce the symptom:

1. Compile-time literal cache. Populated from literal SmartTags("...") accesses found by the WinCC Flexible script compiler. Tag names constructed via concatenation cannot be resolved statically and never enter this cache.
2. Runtime value cache. Populated from PLC poll cycles and from on-demand acquisition triggered the first time the runtime requires a tag value. Tags whose acquisition mode is set to On demand or Cyclic on use are not polled from the PLC until first reference, and the very first reference returns the default value before the acquisition completes.

Inside a tight For-Next loop the runtime encounters SmartTags("Pressione_US_" & addZero(i)) for the first time. The value pointer has not been initialized in the connected PLC area; the runtime returns the default value (0 for numerics, empty string for alphanumeric tags). The line is written to the file with this default value, and because no project rebuild has occurred, the runtime does not retry the acquisition for subsequent loop iterations until the next script execution cycle.

Once the same script (or any script that touches the tag literally) explicitly references the same tag name, the cache is populated with the live PLC value, and future indirect access via concatenation returns the live value for the remainder of the runtime session. A panel reboot resets the cache and reproduces the bug.

4. Workarounds

Five approaches are field-proven. They are listed from least invasive (A) to most invasive (E).

4.1 Workaround A — Pre-touch subroutine (the canonical fix)

Declare a sub that explicitly assigns every tag name to a local variable. The WinCC Flexible script compiler registers each literal name in the tag cache; subsequent SmartTags() calls using string concatenation return the live value.

Sub loadVar()
    Dim a
    a = Pressione_Avanti_001
    a = Pressione_Avanti_002
    ' ... literal access up to ...
    a = Pressione_Avanti_200
End Sub

Call loadVar() at the top of any script that uses dynamic tag name construction. The sub body looks verbose but compiles to a no-op at runtime: the only side effect is cache registration. The pattern is the same workaround applied in WinCC Professional and TIA Portal V13–V15 when late-bound tag access is needed but the runtime cache is empty.

4.2 Workaround B — Pre-touch through an array

When the tag list is large (500+ tags) or generated dynamically, build an array of tag names and touch each entry once:

Dim tagNames(199)
For i = 0 To 199
    tagNames(i) = "Pressione_US_" & addZero(i + 1)
Next

' Force compile-time registration through explicit literal in a generator sub
Sub PreTouchAll
    Dim x
    x = SmartTags("Pressione_US_001")
    x = SmartTags("Pressione_US_100")
    x = SmartTags("Pressione_US_200")
End Sub

Workaround B reduces typing for very long ranges but still requires at least one literal reference for each unique tag name format. Use it together with the WinCC Flexible tag export to mechanically generate the literal list.

4.3 Workaround C — Continuous tag acquisition

Switch the acquisition mode of the connection to Continuous so the runtime keeps every tag current at the configured update rate:

1. In WinCC Flexible project tree, right-click the connection to the PLC.
2. Open Properties → Tags → Acquisition mode.
3. Select Continuous for the connection.
4. Rebuild the project and transfer to the MP 277.

Cost: higher network and PLC scan load. On a large project (1000+ tags) the PLC-side communication buffer can become saturated, increasing the risk of lost update events. Apply Continuous acquisition only on connections that handle the dynamically-tagged dataset, and keep On-demand acquisition elsewhere.

4.4 Workaround D — Recipe export with checksum

For batch recording of 100+ values, the documented Siemens pattern is a recipe with built-in export:

' Trigger built-in export from script
SmartTags("RecipeExportTrigger") = 1
' HMI writes a CSV with checksum via ExportDataRecordWithChecksum

Configure the recipe in WinCC Flexible → Recipes → define elements → Data record → Export path = \\server\share\file.csv. The runtime handles variable marshalling, includes timestamps, and computes the optional checksum. The advantage is that no dynamic SmartTags() access is needed; recipe elements are statically known to the runtime.

4.5 Workaround E — Archive export

For long-term logging, configure a tag archive and use the archive export functions:

' From the script runtime
SmartTags("ArchiveExportTrigger") = 1
' Configured export function: ExportTagLogCSV or ExportTagLogBinary

Archive exports operate on the internal archive database and are independent of the SmartTags cache. They are the recommended approach for shift reports, monthly logs, and any scenario in which the same tag is written multiple times with a timestamp.

5. Complete Working Example

The corrected script below writes 200 pressure values to a network file, applies Workaround A, and uses the Siemens FileCtl.File object (not desktop FileSystemObject, which is unavailable on Windows CE).

Sub WritePressureLog
    Dim i, f, sPath, sName, v
    sPath = "\\nas01\hmi_logs\Pressione_US_" & Year(Now) & _
            Right("0" & Month(Now), 2) & ".txt"

    ' --- Workaround A: force tag cache to populate ---
    Call loadVar()

    ' --- Open file in write mode ---
    Set f = CreateObject("FileCtl.File")
    f.FileName = sPath
    f.Mode = 8          ' fmOpenWrite (write + create if missing)
    f.Open

    f.LinePrint "Index;Tag;Value;Timestamp"

    For i = 1 To 200
        sName = "Pressione_US_" & addZero(i)
        v = SmartTags(sName)
        f.LinePrint i & ";" & sName & ";" & v & ";" & Now
    Next

    f.Close
    Set f = Nothing
End Sub

' --- Pre-touch sub: every tag name appears literally here ---
Sub loadVar
    Dim a
    a = Pressione_US_001
    a = Pressione_US_002
    ' ... (literal access lines 003 through 199 omitted for brevity) ...
    a = Pressione_US_200
End Sub

Function addZero(i)
    If i < 10 Then
        addZero = "00" & i
    ElseIf i < 100 Then
        addZero = "0" & i
    Else
        addZero = CStr(i)
    End If
End Function

6. Verification Procedure

1. Save the script in WinCC Flexible and rebuild the project (Project → Compiler → All).
2. Transfer the compiled project to the MP 277 using ProSave over Ethernet or USB.
3. Cycle power on the panel to clear the runtime tag cache.
4. Trigger WritePressureLog from a button configured with the Click event.
5. From a PC, open the destination file \\nas01\hmi_logs\Pressione_US_YYYY_MM.txt and verify:
   • File size > 0 bytes.
   • Number of data rows = 200 (excluding header).
   • Value column contains non-zero data for at least one active channel.
6. Run a regression test: set acquisition mode to On demand, re-transfer, reboot, and trigger the script with the loadVar() call commented out. The expected result is the regression to zero — confirming the cache root cause.
7. Restore acquisition mode to the original setting.

7. Diagnostic Matrix

8. Operational and Safety Considerations

• Maintenance mode. Place the MP 277 in maintenance mode before invoking CSV export scripts that take > 500 ms to complete. A long-running script on the operator panel blocks the HMI update thread and can mask alarms.
• Network credentials. The MP 277 stores share credentials in the registry of the Windows CE image. Use a service account with write-only access to the share; never embed interactive domain credentials.
• File retention. Implement a file rotation policy on the share. A 200-tag log written every minute produces ~30 MB per day; without rotation the share will exhaust its quota.
• Acquisition mode side effects. Continuous acquisition on a connection carrying 1000+ tags increases PLC-side communication load. Confirm the PLC supports the resulting scan rate using the WinCC Flexible diagnostics view.
• Migration path. The legacy WinCC Flexible runtime is end-of-life. New deployments should evaluate migration to a TIA Portal-based Comfort Panel with the modern VBScript / C scripting runtime, where the tag-cache limitation has been resolved.

9. References and Related Documentation

• SIMATIC MP 277 Operating Instructions (Siemens Support, document attachment 23337820) — hardware limits, network configuration, file system support.
• WinCC Flexible 2008 SP3 Scripting Manual (Siemens Support entry ID 18796011) — SmartTags object, FileCtl object, recipe functions.
• WinCC Flexible Communication Manual (Siemens Support entry ID 22027867) — tag acquisition modes, connection configuration.
• WinCC Flexible Recipe Configuration Manual (Siemens Support entry ID 21947772) — built-in data record export.

FAQ