Resolving WinCC flexible Basic Panel Multiplexed Tag Errors

When a Siemens Basic Panel (1st generation) is programmed with WinCC flexible 2008 SP3 and uses multiplexed (tag-in-tag) addresses such as DB [index].DBX19.2, the runtime on the physical panel can show ### in I/O fields and the default index from graphic lists, while the same project running under the WinCC flexible Runtime simulator (RT) on the engineering PC reports the correct values. The mismatch between RT behavior and panel behavior is the diagnostic signature of a known defect in unpatched WinCC flexible 2008 SP3 that has since been corrected in the official Siemens Hotfix/Update package.

This reference documents the affected versions, the failure mechanism, and the field-proven remediation sequence. It also covers the manual OS update that is mandatory after the engineering tool is patched, plus the diagnostic steps that confirm the bug before any software is touched.

1. Problem Summary

The fault is observed under the following configuration:

• Engineering: WinCC flexible 2008 SP3 without a subsequent Hotfix/Update applied.
• Runtime: Basic Panel 1st generation (KTP600 Basic color PN, KTP600 Basic mono PN, KTP1000 Basic, KTP1500 Basic). The 2nd generation Basic Panels (KTP400 Basic, KTP700 Basic, KTP900 Basic, KTP1200 Basic) are programmed in TIA Portal and are not in scope.
• Tag model: a tag where the data block number is replaced by an index variable, e.g. DB [index].DBX19.2 where index is an internal HMI tag, a tag read from the PLC, or a constant integer.
• PLC side: any S7-200 / S7-300 / S7-400 / LOGO! that exposes a data block with the expected byte/bit structure. Indirect addressing on the panel does not require indirect access on the PLC; the panel only resolves the symbolic or absolute DB reference at runtime.

Observable symptoms on the physical panel:

• I/O fields linked to the multiplexed tag render the placeholder ### regardless of the bit state.
• Graphic lists, symbol lists, and text lists bound to the multiplexed tag fall back to the default entry (index 0) instead of the resolved value.
• Replace DB [index].DBX19.2 with the absolute constant DB 201.DBX19.2 on the same project and transfer it again — the value displays correctly (0 or 1).
• WinCC flexible RT simulator with the same project and the same live PLC reports the correct bit, both with the constant and the indexed reference.
• The HMI-internal "index" tag can be monitored on the panel and shows the expected numeric value (e.g. 201), proving the multiplexer input is healthy.

The combination — correct simulator, correct constant on the panel, broken indexed reference on the panel — is the diagnostic fingerprint of this bug.

2. Affected Products and Versions

3. Root Cause

Multiplexed (tag-in-tag) addressing is the HMI equivalent of register-indirect addressing: the panel runtime must read the numeric value of the index tag, append it to the address prefix, and form the effective absolute address before each polling cycle. The concept is described generically in the Wikipedia addressing-mode reference — when the offset portion of the address is replaced by a value read from a register at runtime, the address becomes register-indirect.

In unpatched WinCC flexible 2008 SP3, the Basic Panel 1st generation runtime builds the address frame for the multiplexed tag incorrectly when the panel polls the PLC. The RT simulator on the engineering PC uses a different code path, which is why the same project works under RT and fails on the panel. The constant reference DB 201.DBX19.2 bypasses the multiplexer logic entirely and is therefore always correct.

The Siemens Update for WinCC flexible 2008 SP3 corrects both the engineering tool and the panel OS image. The panel image is the critical part — patching only the PC tool is not enough. The OS update must be pushed to the panel by a manual transfer, because the panel does not silently pull a new image on a normal project transfer.

4. Prerequisites for the Fix

1. An engineering PC with administrator rights.
2. The original WinCC flexible 2008 SP3 installation media or a current installation of WinCC flexible 2008 SP3 or later.
3. Network or USB connectivity between the engineering PC and the target Basic Panel (1st generation). ProSave is normally installed alongside WinCC flexible and provides the OS update channel.
4. Access to Siemens Support entry 58860033 to download the Hotfix/Update.
5. The panel's project file (.hmi) and the corresponding WinCC flexible project (.flex / .kpc / .kfw) — make a backup of both before changing anything.
6. Free disk space: typically 200 MB–1 GB on the PC and 8–16 MB on the panel for the new image.

5. Step-by-Step Remediation

5.1 Apply the WinCC flexible 2008 SP3 Hotfix / Update

1. Download the Update package referenced in Siemens Support entry 58860033.
2. Close all running WinCC flexible components and any ProSave instances.
3. Run the Update setup with administrator rights.
4. Reboot the engineering PC when prompted.
5. Verify the installed version in Start → Siemens Automation → WinCC flexible → Information or in the Help → About dialog of the WinCC flexible main window.

5.2 Manually Update the Panel Operating System

The Update package contains a new panel OS image. A normal project transfer does not install it. A separate OS update transfer is required.

1. Open ProSave from the WinCC flexible program group or directly from the installation path.
2. Select the panel type (for example KTP600 Basic color PN) and the connection type (Ethernet / PROFINET or USB).
3. Enter the panel's IP address (default for a KTP600 Basic color PN out-of-the-box is 192.168.0.4, subnet 255.255.255.0) and click Connect.
4. Switch to the OS Update tab.
5. Browse to the new panel image file. WinCC flexible 2008 SP3 Update distributes the images in a folder such as ...\WinCC flexible\Images\KTP600_Basic_color_PN\<version> or as a single .img file.
6. Check the box Update Boot Image / Reset to factory settings only if the panel is locked or the OS is corrupt. For a normal fix, leave it unchecked to preserve the existing project.
7. Click Update OS. The panel will reboot, show a progress bar, and restart in transfer mode.
8. Wait for the panel to settle on the transfer screen before continuing.

5.3 Re-transfer the Project

1. Open the original WinCC flexible project.
2. Compile the project: Project → Compiler → All. There should be no errors and no warnings about unresolved tags.
3. Select Transfer → Transfer to Target Device in the WinCC flexible menu, or use the transfer dialog started from the panel's Transfer button.
4. Confirm the transfer. The panel restarts and starts the new runtime with the corrected OS image and the new project.

6. Verification

After the OS update and project re-transfer, perform these checks to confirm the fix:

1. Constant sanity check. Confirm DB 201.DBX19.2 still reports the expected 0/1 on the same I/O field. This is the control test; it should already have been correct before the fix.
2. Multiplexed check. Set the HMI index tag to 201 and verify the I/O field now shows 0 or 1 instead of ###. Cycle the index through several valid data block numbers and confirm each resolves.
3. Graphic list check. Trigger a state that should select a non-default entry in the graphic list and verify the list updates accordingly.
4. Network traffic check. In the project, enable the HMI's Diagnostics → Tag Monitor view or use WinCC flexible's Tools → Tag Simulation on the engineering PC. Verify the panel is actually issuing GET requests for the resolved address DB 201.DBX19.2 on each cycle. The presence of the resolved request proves the multiplexer is now constructing the address correctly.
5. Cross-project confirmation. Load the second KTP600 Basic color PN project that uses the same indirect structure and verify it continues to work. This is the project that was already working; it should not regress.

7. Field-Proven Diagnostics Matrix

Use this matrix to localize the failure when the symptoms are ambiguous.

8. Configuration Notes and Best Practices

8.1 Data type of the index tag

The tag that drives the index must match the size of the address space the multiplexer is operating on. For data block numbers, an Int (16-bit, signed) or UInt (16-bit, unsigned) tag is the typical choice. Avoid Bool or Char — they are not large enough to hold a DB number and the panel will substitute a default value or display ###.

8.2 Range of valid indices

Always constrain the index at the source. If the PLC can write any value into the index tag, validate it on the PLC side or use a structured limit. Out-of-range indices on a data block number can resolve to a non-existent DB, which causes the panel to lose the connection to the polling area and the field will revert to ### for as long as the bad value is in place.

8.3 Polling performance

Multiplexed tags are inherently slower than direct tags. Each poll cycle must read the index, compute the effective address, and then read the resolved tag. On a Basic Panel 1st generation, keep the number of multiplexed tags to the minimum the application needs and prefer a single multiplexer per data block, with the index switching the entire DB view, instead of multiplexing each individual bit.

8.4 Alternative: array tag with index

For bit-level reads inside a known DB, consider using an HMI array tag whose elements are bits. The array index is then bound to the same index variable and the I/O field reads Heartbeat[index]. The array index path uses the panel's array fetch code path, which is more robust on older SP3 images. This is a workaround only — it does not replace the official Update.

8.5 Migration to TIA Portal

For new projects, prefer a TIA Portal / WinCC Comfort configuration. The Basic Panel 2nd generation (KTP400 Basic, KTP700 Basic, KTP900 Basic, KTP1200 Basic) and all Comfort Panels support multiplexed tags natively in TIA Portal and do not have the SP3-base bug. When retrofitting an existing WinCC flexible 2008 SP3 project, use the TIA Portal migration tool and validate all multiplexed tag bindings after the conversion.

9. Related Siemens Documentation

• Siemens Support entry 58860033 — Update for WinCC flexible 2008 SP3 / Hotfix
• WinCC flexible 2008 SP3 — System Manual (entry 18796024 in the Siemens Support database)
• WinCC flexible 2008 Communication — Manual (entry 18796299 in the Siemens Support database)
• Basic Panels (1st generation) Operating Instructions — KTP600 Basic / KTP1000 Basic / KTP1500 Basic (entry 21463908 in the Siemens Support database)

10. Frequently Asked Questions