S7-1200 WinCC Flexible Tag Write Error: Troubleshooting Steps

Problem Description

When configuring tags in SIMATIC WinCC Flexible 2008 SP5 against a SIMATIC S7-1200 CPU 1211, attempting to write a tag value from the HMI runtime to a Data Block (DB) bit (for example DB1.DBX0.0) returns the runtime error dialog: "Tag Value could not be written to the PLC". The HMI-PLC connection status reports Connected, yet every write attempt fails for one or more tags.

Configuration context for the affected projects typically looks like this:

• PLC: SIMATIC S7-1200, CPU 1211C (e.g. 6ES7211-1AE31-0XB0, 6ES7211-1BE31-0XB0, 6ES7211-1HE31-0XB0)
• Firmware: V4.x (4.0, 4.1, 4.2, 4.3, 4.4, 4.5, 4.6, 4.7) - default for any S7-1200 programmed in TIA Portal V13 or later
• HMI Engineering: SIMATIC WinCC Flexible 2008 SP5
• HMI Runtime: WinCC Flexible RT 2008 SP5 (on PC or panel)
• Tag example: DB1.DBX0.0 (BOOL) bound to a button "Set Bit"
• DB1 attribute Optimized block access already cleared by the engineer
• Connection in WinCC Flexible: SIMATIC S7-1200 over TCP/IP Ethernet

Root Cause Analysis

The error has several cumulative root causes on the S7-1200 platform. Each must be verified before the tag write will succeed. The most common combination is firmware V4.x with three default-off security options.

Cause 1 - Optimized Block Access

Starting with TIA Portal V13 and S7-1200 firmware V4.0, all new Data Blocks default to optimized block access. An optimized DB does not expose a fixed, symbolic memory offset. It uses a layout managed by the firmware, and only fully qualified symbolic access (for example "MyDB".MyTag) is allowed by the absolute address path.

WinCC Flexible 2008 SP5 does not support symbolic addressing on the S7-1200; it can only address the absolute memory location DB1.DBX0.0. If the DB is optimized, the absolute offset is invalid and the HMI write attempt is rejected with the error in question.

Fix: In TIA Portal, right-click DB1 → Properties → Attributes → uncheck Optimized block access. Recompile and download the DB to the PLC. Most engineers in this situation have already performed this step; if reads are succeeding but writes still fail, the issue is downstream in the CPU security settings.

Cause 2 - Access Protection Level of the Data Block

Each DB has a configurable access level. In TIA Portal, open DB1 → Properties → General → Protection. The default for new DBs in TIA Portal V15+ is often No access or a strict level. A setting such as Read access or HMI access with a configured password allows reads but blocks writes when WinCC Flexible 2008 SP5 cannot supply the password.

For an HMI that only needs to write a handful of bits, the cleanest configuration is:

• DB Protection: Full access (no protection), OR
• DB Protection: HMI access with an empty password

Cause 3 - CPU Security: PUT/GET Communication

From S7-1200 firmware V4.0 onward, Siemens introduced a CPU-level security option that disables remote read/write of data from any S7 client (including HMIs that use the legacy PUT/GET mechanism). The setting is in TIA Portal at:

Device Configuration → CPU 1211C → Properties → General → Protection & Security → Permit access with PUT/GET communication from remote partner

By default this option is disabled on new TIA Portal projects. WinCC Flexible 2008 SP5 relies entirely on the legacy PUT/GET mechanism to read and write tags on the S7-1200. If the option is disabled, the connection may still appear to be established (the partner can poll diagnostic data and read some areas) but every write request returns this exact error.

Fix: Enable the option, recompile the hardware configuration, and download to the CPU. Re-evaluate on the HMI runtime.

Cause 4 - Legacy HMI Communication (Firmware V4.0+)

For S7-1200 firmware V4.x, the PUT/GET option alone is not sufficient. TIA Portal offers an additional setting under the same protection pane for legacy HMI clients:

Device Configuration → CPU → Properties → Protection & Security → Support legacy HMI communication (WinCC Flexible and others)

When this is enabled, the CPU continues to support the older communication primitives that WinCC Flexible 2008 SP5 uses. Without it, newer firmware revisions refuse S7 write requests from WinCC Flexible 2008 SP5 even when PUT/GET is enabled.

Cause 5 - PLC Program or DB Not Loaded

If the HMI references DB1.DBX0.0 but the DB has not been downloaded to the CPU (only the program blocks were downloaded, or the download failed partway), the address is unresolved on the PLC and the write is rejected. Verify in TIA Portal:

• Project tree → CPU_1 → Program blocks - all DBs marked with a green check (downloaded)
• Online → Compare offline/online shows the DBs as identical

Cause 6 - Tag Address Typing in WinCC Flexible

WinCC Flexible 2008 SP5 treats the S7-1200 connection as a SIMATIC S7-1200 type. Tag syntax must use the period separator and the correct data type. A common typo is to use a comma (German locale) or to address a bit in a non-existent byte. Validate by creating a new IO field bound to DB1.DBX0.0 with data type BOOL and toggling the value from the HMI.

Cause 7 - Connection Point Configuration

Confirm in WinCC Flexible's connection editor:

• Type: SIMATIC S7-1200
• Parameter: TSAP 01.01 for the local HMI and TSAP 03.01 for the remote PLC (slot 1, rack 0) - or the slot/rack that matches the CPU's actual position
• Station address: the IP address of the CPU, not a router address

Step-by-Step Resolution

1. Open the TIA Portal project that contains the S7-1200 CPU 1211 configuration.
2. Disable optimized access on DB1: Right-click DB1 → Properties → Attributes → uncheck Optimized block access → OK.
3. Lower the protection level on DB1: Properties → General → Protection → set to Full access or HMI access with no password.
4. Enable PUT/GET communication on the CPU: Device Configuration → CPU → Properties → Protection & Security → check Permit access with PUT/GET communication from remote partner.
5. Enable legacy HMI communication: Same pane → check Support legacy HMI communication.
6. Compile and download the hardware configuration to the CPU 1211.
7. Download all program blocks including the data blocks. Use Download to device → All.
8. Reboot the CPU after security changes - some firmware revisions only re-evaluate the protection settings at startup.
9. Open the WinCC Flexible 2008 SP5 project, regenerate the HMI tags from the connection. Right-click the connection → Tags → confirm DB1.DBX0.0 is listed with type BOOL.
10. Test with a temporary IO field: Drop an IO field on a screen, bind it to the same tag, change the mode to Output/Input, and attempt a write from the runtime. If the IO field accepts the write, the original button code is the problem (event/action misconfiguration). If the IO field also fails, the PLC security settings are still the culprit.
11. Restart the WinCC Flexible Runtime and retry the button write.

Verification

To confirm the issue is fully resolved, run the following checks in order:

1. Open TIA Portal → Online & Diagnostics on the CPU → check that no protection or connection errors are present in the diagnostic buffer.
2. In WinCC Flexible Runtime, click the button bound to DB1.DBX0.0. The error dialog must not appear. If the DB bit drives a visible output in the PLC program, confirm the lamp illuminates.
3. Monitor the bit in TIA Portal: Watch table → add %DB1.DBX0.0 → the bit should toggle to 1 on every button press.
4. Use an HMI trend or status display bound to the same tag to verify the read path is still working.
5. Cycle power on the CPU and HMI panel to confirm the configuration persists across reboots.

Firmware-Specific Compatibility Matrix

Diagnostic Decision Matrix

Migration Path to a Supported HMI Suite

WinCC Flexible 2008 SP5 is at end of life. Siemens supports only WinCC (TIA Portal) - Comfort Panels, Unified Panels, WinCC Runtime Advanced, and WinCC Runtime Professional. When the legacy HMI communication option is removed from the CPU firmware, the only path forward is a migration:

1. Open the WinCC Flexible 2008 SP5 project.
2. In TIA Portal (V15.1 or later), use Project → Migrate project and select the WinCC Flexible .hmi file.
3. Address the migration log entries. Common items: deprecated tags, unsupported controls, and any custom VB scripts.
4. Recompile for the new runtime (RT Advanced or RT Professional) and download.
5. Test all write operations against the same DB1.DBX0.0 address using the new TIA Portal connection (symbolic if desired).
6. Validate alarms, screen navigation, and any password-protected areas before going live.

Connection Parameters Reference

Common Mistakes to Avoid

• Enabling Optimized block access and symbolic access only in TIA Portal V15+ - these force the DB to be inaccessible by absolute address and break WinCC Flexible 2008 SP5.
• Setting the DB protection to No access and assuming the HMI's read permission flows from the project settings. DB protection is per-block.
• Forgetting to reboot the CPU after changing the protection settings. Firmware V4.x does not always re-evaluate the option at runtime.
• Loading only the program blocks, not the DBs. Always select All in the download dialog.
• Using a TSAP of 01.01 on the PLC and 03.01 on the HMI but then moving the CPU to a different slot/rack. The TSAP encodes the slot number.
• Leaving the WinCC Flexible project open during a TIA Portal download. Close WinCC Flexible RT before downloading new hardware configuration to avoid PLC reset issues.
• Assuming the connection state "Connected" implies full read/write permission. The S7-1200 firmware separates transport-layer connectivity from application-layer security.

Related Error Messages

The same root causes produce several adjacent errors in the WinCC Flexible runtime log and PLC diagnostic buffer:

FAQ