Resolving WinCC Flexible RT Button Not Triggering PLC Output

Problem Description

A WinCC Flexible 2008 Runtime screen contains a START pushbutton configured with the event "Click -> SetBit -> I0.1" and a STOP pushbutton configured with "Click -> SetBit -> I0.0". A pilot light has its visibility bound to tag Q0.0. The underlying STEP 7 V5.x program in S7-PLCSIM is expected to drive Q0.0 from I0.1.

Observed behavior from the source case:

• An I/O field bound to I0.1 reflects a 0-to-1 transition when the pushbutton is clicked - confirming the HMI writes the tag.
• Manually checking the I0.1 box in PLCSIM immediately causes the WinCC Flexible lamp to light - confirming the lamp's visibility tag, the HMI connection, and the PLC logic path are otherwise functional.
• Clicking the START pushbutton in WinCC Flexible does NOT cause the lamp to light, even though the I/O field proves I0.1 was momentarily set.

The discrepancy is a classic PLCSIM simulation timing artifact combined with a missing PLC-side latch. The button delivers a one-shot pulse that the PLC scan may miss entirely, or that the program has no mechanism to retain. The I/O field reflects the HMI's own last write echo, not necessarily what the PLC's OB1 actually saw.

Data Flow Architecture and Diagnostic Workflow

The data path for the original case is fully virtualized on a single PC. PLCSIM emulates the S7 CPU, STEP 7 holds the program, and WinCC Flexible Runtime acts as the HMI. All three communicate over a local MPI or TCP connection that PLCSIM exposes. The diagnostic ladder works upstream-to-downstream; resolve each layer before moving on.

Diagnostic ladder - execute in order:

1. Confirm the HMI-to-PLC communication path with an I/O field diagnostic.
2. Audit the STEP 7 logic in OB1 for a latching mechanism on Q0.0.
3. Reconfigure the button event to Press/Release for a true momentary pulse.
4. Validate the lamp's visibility/appearance animation binding.
5. Compare the WinCC Flexible acquisition cycle against the PLCSIM scan cycle to rule out missed pulses.
6. Run a VAT-table verification to confirm the PLC's actual view of the tags.

Step 1: Confirm the HMI-to-PLC Communication Path

The first diagnostic move - and the one the original responder recommended - is to drop an I/O field on the screen and bind it to the same tag the button is writing. WinCC Flexible 2008 renders ### in an I/O field when the tag cannot be read from the PLC, which is a definitive connection-failure indicator. The connection is established at the start of Runtime, and the project will log a system alarm if the link to PLCSIM cannot be brought up.

Procedure:

1. In the WinCC Flexible 2008 project, drag an I/O field from the toolbox onto the active screen.
2. Open Properties > General > Tag. Select the same tag (I0.1) used by the button event.
3. Set Mode to "Output" so the field displays (does not write) the current value. Display type = Binary if you want a clean 0/1 readout.
4. Add a second I/O field for Q0.0 to verify the lamp's read path independently.
5. Compile and start Runtime. Verify both fields show the same value as the PLCSIM checkboxes when toggled manually.
6. If a field shows ###, the connection is broken. Open the HMI device configuration in WinCC Flexible and confirm the connection is enabled, the protocol parameters match PLCSIM (MPI address 2, baud rate 187.5 kbps for S7-300, or TCP/IP with the PLCSIM Ethernet interface), and the area pointer is configured for the CPU slot used by PLCSIM.

For projects being migrated to WinCC Unified (TIA Portal V17+), the equivalent diagnostic surface is the HMI connection diagnostics panel and the system alarm log. The conceptual checks (connection status, area pointers, tag access rights) are identical. See the Procedure if there is no connection (RT Unified) page in the TIA Portal V20 documentation for the unified-runtime flow.

Step 2: Audit the PLC Program Logic in STEP 7

The fact that manually checking the I0.1 box in PLCSIM lights the lamp proves the chain "I0.1 → ... → Q0.0 → HMI lamp" is correct. The chain is broken only when the HMI provides the input. This almost always points to one of three program-level defects.

2.1 Missing Latch on Q0.0 (Most Common Cause)

If OB1 contains a single rung equivalent to:

Network 1:
      I0.1        Q0.0
   ---| |------( )---

then Q0.0 is true only while I0.1 is true. The button's momentary SetBit pulse will close the contact for one HMI cycle (typically 100-500 ms) and Q0.0 will go true only during that window. If the user is not holding the button down for at least one full OB1 scan, they will not see the lamp change state. Insert a latch:

Network 1: Start/Stop with SR flip-flop (Set dominant)

   I0.1        I0.0
   --| |--------|/|---------|S|     M0.0 / Q0.0
                                  (Q0.0 is latched on I0.1 pulse)

   I0.0        M0.0
   --|/|--------| |---------|R|     M0.0 / Q0.0
                                  (Reset dominant on I0.0 pulse)

   M0.0        Q0.0
   --| |--------------------( )
                                  (Q0.0 follows the latch)

The standard STEP 7 V5.x implementation uses an SR block from the Bit Logic folder. Place the SR block in Network 1, connect I0.1 to S, I0.0 to R, and route the output to Q0.0. This is the canonical "Start/Stop with two pushbuttons" pattern documented in the STEP 7 V5.x programming reference and reproduced in the Siemens Industry Online Support FAQ entry for "Latching with SR".

2.2 Wrong Input Address in the HMI Connection

Verify the HMI connection in WinCC Flexible points to the same PLCSIM instance. The tag I0.1 in the HMI must resolve to the same I0.1 in the STEP 7 program. Both must address the process input image byte 0, bit 1 in the default S7-300/S7-400 configuration. Mixing process image (I) and peripheral input (PIW/PIB) areas will cause writes to vanish without any HMI-side error: the write succeeds into one memory area while the PLC reads from another. The HMI tag's "Address" property in WinCC Flexible will show whether you are addressing the process image (DB 0/IB 0/PIB 0) or peripheral I/O - confirm both sides match.

2.3 Symbol Table Mismatch

If you are using symbolic addressing (recommended for maintainability), confirm the symbol for I0.1 in the S7 symbol table matches the symbol selected in the HMI tag table. A renamed or duplicated symbol in one of the two projects will silently route the write to a different memory location. To refresh: in WinCC Flexible, open the connection to STEP 7 and use "Update Symbols" from the S7 project. The symbol table must be re-imported every time the STEP 7 program is renamed or restructured.

2.4 OB1 Not Running

Confirm OB1 is being scanned. In PLCSIM with STEP 7 online, open the "Monitor/Modify" view of OB1; the status bits at the top must cycle. If OB1 is stopped (e.g., because the PLC is in STOP mode), Q0.0 will never update regardless of input. Check the PLCSIM status LED; it should be green (RUN) or yellow (RUN with diagnostic buffer entries). A red LED indicates STOP - investigate the diagnostic buffer via STEP 7 > PLC > Diagnostic Buffer. Common STOP causes in PLCSIM are uninitialized DBs, division by zero, or an OB that is missing (OB121, OB122) and therefore not handled.

Step 3: Re-Examine the Button Event Configuration

WinCC Flexible 2008 supports four button events that affect bit behavior. Selecting the wrong one is a top-three cause of "button looks dead" symptoms, particularly in PLCSIM environments where scan timing is variable.

For a START pushbutton intended to drive an SR flip-flop in the PLC, the most reliable configuration is:

1. Button Properties > General > Mode: Momentary (default).
2. Event "Press" -> function SetBit -> tag I0.1.
3. Event "Release" -> function ResetBit -> tag I0.1.

This guarantees I0.1 is true for the full duration the user holds the button - long enough for the PLC scan to register the 1 and latch Q0.0. The original "Click + SetBit" configuration writes a single one-shot; if the HMI cycle and PLC cycle are out of phase, the bit can be cleared before OB1 sees it.

3.1 SetBit vs. SetTag

For boolean tags tied to digital I/O, SetBit and ResetBit are the most efficient - they write a single bit at the protocol level and integrate with PLCSIM's I/O image. SetTag writes the entire tag value and is appropriate for integer or string tags. Mixing the two on the same bit is a common source of confusion; pick one and stick with it. If SetTag is used on a boolean tag, the HMI must write 0 or 1 explicitly; SetBit is the clean choice for digital I/O. A third option, InvertBit, toggles the bit each time the event fires - useful for click-driven toggles but not for start/stop logic.

3.2 Acquiring the Tag for the I/O Field Diagnostic

When the I/O field is used to confirm the bit transition, the field's tag must be configured for read access. The I/O field is the HMI's local view of the tag; if the HMI just wrote 1 via the button, the I/O field will read 1 from the HMI's local tag cache - which is what the original responder was warning about. To get a true PLC-side read, the tag must be polled from PLCSIM with an acquisition cycle shorter than the bit pulse duration. The default 1-second cycle will not catch a sub-second pulse. Reduce it to 100 ms for time-sensitive diagnostics (see Step 5).

Step 4: Configure the Lamp Animation Correctly

A common reason the lamp appears "dead" is the animation choice, not the data path. WinCC Flexible 2008 supports two relevant animations for an indicator lamp:

Recommended configuration for a pilot light driven by Q0.0:

1. Place the lamp object on the screen.
2. Properties > Animations > Appearance: Add an Appearance list with two states (e.g., "Lamp_Off.png" and "Lamp_On.png"). Bind the value to tag Q0.0.
3. Properties > Animations > Visibility (optional): set the value range 0 = visible, 1 = hidden - then invert. This gives a redundant visual cue and lets the operator distinguish between "lamp is OFF" and "lamp is OFF because Q0.0 is not driven".
4. If using the legacy "Enable" property (right-click > Properties > Enable), confirm the lamp's underlying graphic is the lit-state image. "Enable" only enables/disables the object; it does not swap graphics.

The original configuration used "Visibility -> Enable tag Q0.0", which simply enables the object when Q0.0 is true. This works for a steady-state signal, but for a short-pulsed Q0.0 (which is what an unlatched rung produces), the lamp will flicker invisibly fast. Combine Appearance (for the on/off graphics) with Visibility only when the operator must see the lamp disappear entirely from the screen when inactive. For a self-latching configuration (Step 2.1), the Visibility animation will work correctly because Q0.0 is a steady state once latched.

Step 5: Eliminate Scan Time and Cycle Mismatches

S7-PLCSIM runs the simulated PLC's OB1 in a loop, with a configurable delay between scans. The default scan time is on the order of 100 ms. WinCC Flexible 2008 acquires HMI tags at a cycle defined per tag (default typically 1 s, adjustable down to 100 ms).

Failure scenario: The HMI writes a 1 to I0.1 for 100 ms (one HMI acquisition cycle), but PLCSIM only scans OB1 every 200 ms. The 1 is set and reset between two OB1 passes and OB1 never sees it. The bit in PLCSIM is technically "0" the entire time the PLC checks it.

The bit pulse must satisfy the relationship:

t_pulse >= t_HMI_acquisition + t_PLC_scan

where t_pulse is the duration the button holds the bit true, t_HMI_acquisition is the WinCC Flexible tag acquisition cycle, and t_PLC_scan is the PLCSIM OB1 scan interval. If any of these three are out of balance, the pulse can be lost.

Mitigations:

• Reduce the WinCC Flexible acquisition cycle for the affected tag to 100 ms or less (Tag Properties > Acquisition Cycle).
• Increase the duration of the HMI-side pulse by using Press + Release events instead of a single Click event.
• Adjust the S7-PLCSIM scan time to a smaller value via the PLCSIM menu > PLC > Scan Time. (Use this only for commissioning; rapid scan times can hide real timing issues that will surface on physical hardware.)
• Use a self-latching rung in the PLC (see Step 2.1) so even a sub-scan pulse is captured and held.

5.1 Why PLCSIM Behaves Differently from Real Hardware

A real S7-300/S7-400 CPU has a deterministic OB1 scan time of 1-50 ms depending on program length, and a real physical input (I0.1) is held true by the 24 V signal until the operator releases the pushbutton (typically hundreds of milliseconds). PLCSIM emulates the scan loop but the I/O "input" is whatever the HMI wrote last, latched for one acquisition cycle. If the HMI pulse is shorter than one OB1 scan, the CPU can miss it entirely. This is the single largest behavioral difference between PLCSIM and a physical S7 CPU for HMI-coupled tests. Always validate the button logic on physical hardware before commissioning.

Step 6: Verify in PLCSIM and STEP 7 Online

After applying the corrections, run the following verification sequence:

1. Compile and download the STEP 7 program to PLCSIM. Start PLCSIM and go online in STEP 7 (Online > Monitor/Modify).
2. Open a VAT table (STEP 7 > PLC > Monitor/Modify > VAT, or PLCSIM > Monitor/Modify). Insert I0.0, I0.1, Q0.0 in the address column. Set Monitor = Continuous Update.
3. Start WinCC Flexible Runtime. Confirm the I/O field for I0.1 reads 0 and the lamp is off.
4. Click the START pushbutton (pushbutton1) and HOLD it for at least 1 second. The I/O field should show 1, the VAT should show I0.1 = 1, and (after the SR flip-flop latches) Q0.0 should transition to 1.
5. Release the button. I0.1 should return to 0. Q0.0 should remain 1 (latched) - the lamp stays on.
6. Click the STOP pushbutton (pushbutton2) and HOLD it. I0.0 should be 1 briefly, Q0.0 should transition to 0, and the lamp should turn off.
7. Confirm the lamp on the WinCC Flexible screen reflects Q0.0 with the appropriate animation.

If step 5 fails (Q0.0 does not latch), return to Step 2.1 and verify the SR flip-flop wiring. If I0.1 does not change in the VAT while the button is held, return to Step 3 and verify the button event configuration. If the I/O field shows the bit change but the VAT does not, the HMI is writing to a wrong address or to the HMI's local tag cache; re-check the connection and area pointer. If Q0.0 latches but the lamp does not light, return to Step 4 and verify the appearance/visibility animation is bound to the correct tag.

Migrating to WinCC Unified: Connection Diagnostics Reference

If the project is later migrated to TIA Portal and WinCC Unified (V17 or later, including V20), the same logical checks apply with a different UI path. The Siemens TIA Portal V20 documentation describes the procedure when no connection can be established at runtime start. The key principles are identical:

• The HMI Runtime raises a system alarm if the connection cannot be established at start. Check the HMI alarm log in the diagnostics view.
• An I/O field showing ### in WinCC Unified has the same root cause as in WinCC Flexible: connection, area pointer, or tag-type error.
• The connection diagnostics panel in the HMI device configuration provides per-connection status that can be cross-checked with PLCSIM's online view.
• WinCC Unified supports S7-1200 and S7-1500 natively; S7-300/S7-400 support requires the legacy S7-PLCSIM or a connectivity pack.

Note that WinCC Unified is a separate product line from WinCC Flexible 2008 and is not a drop-in replacement. Migration is supported by the SIMATIC WinCC Engineering migration tool, but the project must be recompiled in TIA Portal before the WinCC Flexible project can be re-deployed. Tag names, event names, and animation APIs differ between the two product lines - plan for a full re-validation after migration.

Field-Proven Pitfalls and Verification Checklist

Verification checklist (each item must pass before the case is closed):

• [ ] WinCC Flexible I/O field for I0.1 shows a live value matching the PLCSIM checkbox state.
• [ ] WinCC Flexible I/O field for Q0.0 shows a live value matching the PLCSIM output indicator.
• [ ] STEP 7 OB1 contains an SR flip-flop (or equivalent latch) on Q0.0 driven by I0.1 (Set) and I0.0 (Reset).
• [ ] Button event uses Press (SetBit) and Release (ResetBit) for a true momentary pulse, or Click (InvertBit) only if a toggle is intended.
• [ ] Lamp uses Appearance animation bound to Q0.0; Visibility is optional and inverted if used.
• [ ] Tag acquisition cycle is ≤ 100 ms for time-sensitive bits.
• [ ] VAT table confirms I0.1 transitions to 1 when the button is held and Q0.0 latches after release.
• [ ] Manual PLCSIM checkbox manipulation on I0.1 still lights the lamp (regression check).
• [ ] System alarm log in PLCSIM and WinCC Flexible Runtime shows no connection-failure or address-resolution errors.

Frequently Asked Questions