S7-300 CTU Counter to WinCC IO Field: Setup and Display

A frequent WinCC requirement is to count machine events on a SIMATIC S7-300 CPU and present the running total on the process screen. The pattern below uses an IEC CTU (Count Up) function block in the STEP 7 user program, exposes the current value (CV) through a global data block, and surfaces that value on a WinCC screen via an I/O Field. A screen button drives the counter reset input, completing a closed-loop operator interface.

Architecture Overview

The reference architecture for this implementation:

• Controller: SIMATIC S7-300 CPU 31x (e.g., 314C-2 PN/DP, 315-2 PN/DP, 317-2 PN/DP) running STEP 7 V5.5 SP2 or TIA Portal V13+.
• Impulse source: Output bit Q124.0 (or any BOOL that pulses once per event). The signal may originate from a sensor, a cycle-complete contact, or a software flag set inside OB35.
• Counter: IEC CTU instance placed in a global DB, with CV (current value) exposed as an INT or DINT.
• HMI: WinCC V7.4 SP1+ runtime or WinCC Professional V14+, with the SIMATIC S7 Protocol Suite driver.
• Network: Industrial Ethernet (TCP/IP), MPI, or PROFIBUS. Industrial Ethernet is the default for new installations.

Data flow: impulse → CTU.CU → CV (DB) → External Tag (WinCC) → I/O Field (screen). The reset path is: button on screen → WinCC tag → DB bit → CTU.R.

Prerequisites

Confirm the following before configuration:

• STEP 7 project compiles cleanly. The CPU hardware catalog supports your selected S7-300 CPU.
• WinCC Explorer opens without errors. The PLC connection state is Established in the channel diagnostics.
• The DB that will hold the counter has been generated, downloaded, and is reachable from the HMI tag browser.
• The HMI station has a valid runtime license with sufficient external tags for this application.
• You have access to the engineering station for STEP 7, the engineering station for WinCC, and the HMI runtime client.

Reference material to keep open:

• STEP 7 V5.5 Programming and Operating Manual (Siemens support portal, see the Siemens Industry Online Support entry for the S7-300 / S7-400 system documentation).
• WinCC V7 Information System (installed with the WinCC DVD) or the WinCC Professional help bundled with TIA Portal.
• SIMATIC S7-300 Module Data manual for your specific CPU.

Step 1: PLC Program — Implement the CTU Counter

1.1 Counter selection

Use the IEC CTU block from the IEC Standard Library. CTU is preferred over the legacy SIMATIC counter (ZAE/ZV) because it is re-entrant, parameterizable, and consistent with the IEC 61131-3 programming model. The CTU block has the following interface:

1.2 STEP 7 V5.x implementation

Create a global data block, for example DB100, named iCounter. Insert a CTU instance:

1. In the SIMATIC Manager, open the S7 program and select Blocks.
2. Insert a new Data Block (DB100), set the Symbolic Name to iCounter, and accept the default address area.
3. Open DB100 in the LAD/FBD/ST editor and declare:
   • instCTU — STAT, type CTU (IEC 61131-3 counter)
   • bReset — STAT, BOOL, default false
   • iPreset — STAT, INT, default 1000
4. Save and close the DB.

Open OB1 (or a dedicated FC/FB) and place the CTU block from the Standard Library > IEC Standard Library > Counters section. Wire the inputs as follows:

Network 1: Count up on rising edge of Q124.0
  A    Q 124.0                     // impulse bit from machine
  FP   M 100.0                     // edge memory bit
  =    DB100.DBX0.0                // CU input of instCTU (or symbolic: iCounter.instCTU.CU)

Network 2: Reset wiring
  A    "iCounter".bReset            // HMI-driven reset bit
  =    DB100.DBX0.1                // R input

Network 3: Preset wiring (optional)
  L    "iCounter".iPreset
  T    DB100.DBW4                  // PV input as INT

The FP (rising edge) instruction is essential when the source bit Q124.0 stays high for more than one OB1 scan. Without edge detection, the CTU increments on every cycle, producing a count that grows far faster than the actual events.

1.3 TIA Portal implementation

In TIA Portal, the workflow is similar but uses the project tree and a global DB typed in the IEC style:

1. Add a new global DB named iCounter.
2. Inside the DB, declare a static variable instCTU of type CTU.
3. Declare supporting tags: bReset (BOOL), iPreset (INT), and optionally iCurrent (DINT) that mirrors CV.
4. Open OB1, drag the CTU instruction from the Instructions > Basic Instructions > Counter operations palette, and assign the DB instance.
5. Wire the CU input to the edge of %Q124.0 using a rising-edge contact (P) or an FP logic block.
6. Wire the R input to iCounter.bReset.

1.4 Counter size and overflow

The IEC CTU returns CV as INT, which is a signed 16-bit value (range −32 768 to 32 767). For production counters that can exceed 32 767, choose one of the following approaches:

• Use a DINT-based counter function (e.g., a self-written ADD-based up-counter with L DINT arithmetic).
• Wrap the counter: when CV reaches 32 000, write a script to subtract 32 000 and increment a separate tally tag.
• Use the S7-300 standard counter (S_CU) which exposes BCD-coded 0–999 — only suitable for small counts.

Step 2: WinCC External Tag Configuration

2.1 Open Tag Management

In the WinCC Explorer, expand the tree Tag Management. Locate the SIMATIC S7 Protocol Suite entry. The S7 Protocol Suite is the standard driver set shipped with WinCC V7 and supports Industrial Ethernet, MPI, PROFIBUS, and TCP/IP channel units.

2.2 Select or create a connection

Under the appropriate channel unit (typically TCP/IP), right-click and choose New Connection. Assign:

• Connection name: PLC_S7_300_Connection
• IP address: the S7-300 Ethernet interface address (e.g., 192.168.0.10)
• Rack: 0
• Slot: 2 (typical for CPU 31x)

Save the connection. Right-click the new connection and choose Connection Properties to verify the settings.

2.3 Create the counter external tag

Right-click the connection, choose New Tag, and configure:

2.4 Create the reset tag

Add a second external tag named Counter_Reset:

• Data type: Binary tag (BOOL)
• Address: DB100,DBX8.0 (example offset matching the bReset declaration in the DB)
• Direction: Read/Write

Verify both tags in the WinCC Tag Simulator before proceeding to screen design.

Step 3: Graphic Designer — I/O Field Configuration

3.1 Open the process picture

In the WinCC Explorer, double-click the Graphics Designer editor. Open the desired .pdl file (e.g., Main.pdl) from the project.

3.2 Insert the I/O Field

1. In the Object Palette (right side of the editor), open the Smart Objects tab.
2. Select I/O Field.
3. Click and drag on the canvas to size the field. The I/O Field Configuration dialog appears.

3.3 Configure the I/O Field

In the configuration dialog, set:

• Tag: Counter_CV (the external tag from Step 2.3)
• Mode: Output (read-only; the operator cannot type a value)
• Data format: 99999 (5-digit signed decimal; supports −32 768 to 32 767)
• Field type: Output
• Update: 500 ms (matches the tag acquisition cycle)

Click OK to apply. The I/O Field now binds to the live CV value from the PLC.

3.4 Visual styling

Configure the appearance to match the surrounding process screen:

• Font: Arial 16 pt, bold
• Background: white
• Border: thin grey rectangle (1 px)
• Text alignment: right
• Field width: enough to display the maximum value (5 digits for INT, 10 digits for DINT)

Add a Static Text smart object to the left of the I/O Field with the label Counter: or Produced Parts: for context.

Step 4: Graphic Designer — Reset Button

4.1 Insert the button

1. From the Standard Objects tab, drag a Rectangle onto the canvas.
2. Right-click the rectangle and convert it to a Button (or use the Round Button smart object).
3. Position the button below the I/O Field. Add a Static Text child object with the label Reset.

4.2 Wire the button to the reset tag

Two common approaches are supported.

Approach A — direct tag write (recommended):

1. Right-click the button, choose Properties > Events > Mouse > Click.
2. Add a C action that sets the reset tag high for 200 ms, then low:

   SetTagBit("Counter_Reset", 1);
   

3. Configure a delayed action (via the Delayed Actions C function or a separate Release event) to clear the bit after the pulse window:

   SetTagBit("Counter_Reset", 0);
   

Approach B — toggle tag in the PLC:

1. Configure the button to write 1 to Counter_Reset on click.
2. Inside the PLC, add a self-resetting one-shot that holds R high for 200 ms then returns to 0.

Approach B is preferred when the button may be pressed multiple times in rapid succession; the PLC handles debouncing deterministically.

Step 5: Verification and Commissioning

5.1 Offline verification (WinCC Tag Simulator)

1. Open the WinCC Tag Simulator from the Windows Start menu.
2. Add Counter_CV and Counter_Reset.
3. Set Counter_CV to incremental values: 0, 1, 10, 100, 1000.
4. Confirm the I/O Field on the screen tracks the simulator value within one update cycle.
5. Click the Reset button and verify the screen value goes to 0.

5.2 Online verification (live PLC)

1. Download the STEP 7 program and the WinCC project to their respective targets.
2. Start the WinCC runtime.
3. In STEP 7, open a VAT (Variable Table) connected to the S7-300 and force Q124.0 high for one OB1 cycle, then low.
4. Confirm the CV in DB100 increments by 1.
5. Confirm the I/O Field on the HMI screen increments by 1 within 500 ms.
6. Press the Reset button and verify CV returns to 0.

5.3 Acceptance test

1. Trigger 100 impulses via the VAT.
2. Confirm the I/O Field shows 100.
3. Power-cycle the HMI runtime and verify the I/O Field re-establishes the live PLC value.
4. Press Reset five times; verify the counter remains at 0 (idempotent reset).
5. Disconnect the Ethernet cable for 30 seconds; reconnect; verify the I/O Field updates without a runtime restart.

Step 6: Channel and Connection Diagnostics

If the value does not appear on screen, walk the diagnostics in this order:

1. WinCC Explorer > Channel Diagnostics: confirm the SIMATIC S7 Protocol Suite shows the connection as Established. A Disconnected state indicates network or address configuration issues.
2. Tag Diagnostics: right-click the Counter_CV tag, choose Properties > Diagnostics. The current quality code should be Good (0xC0). A Bad code (0x00) indicates the address is unreachable or the DB is not loaded on the CPU.
3. STEP 7 VAT: confirm CV is updating online.
4. Wireshark / S7Trace: capture Industrial Ethernet traffic on the HMI port. The S7 Protocol Suite should be sending Read Var requests to the configured DB every cycle.
5. WinCC log files: review WinCC_Sys_xx.Log in the project Diagnostics folder for connection errors.

Troubleshooting Matrix

Extended Configurations

6.1 Displaying the preset value

To allow the operator to change the preset from the screen, add a second I/O Field bound to the CTU PV input. Configure the field in Input/Output mode so the operator can type a new value. Write the value back to the DB tag on every change. Validate the input range on the PLC side using a limit check before passing it to the CTU PV port.

6.2 Multi-counter screens

For projects that count multiple axes (e.g., four conveyor lanes), build a screen template that references parameter-driven tag names. Use WinCC structure tags to group Counter_CV, Counter_Reset, and Counter_Preset per lane. The template reduces the number of screens and centralizes logic.

6.3 Archiving with Tag Logging

To log the counter value for production reporting, configure a Tag Logging archive:

1. In WinCC Explorer, open Tag Logging.
2. Create a new archive named Production_Counter.
3. Add Counter_CV with an acquisition cycle of 1 s and a storage cycle of 1 minute.
4. Configure 30-day retention.
5. Display the archive in a WinCC Online Trend Control on a separate screen.

6.4 Cross-platform note: TIA Portal HMI tags

If the project is being migrated to TIA Portal with a Comfort Panel or WinCC Professional runtime, the configuration differs slightly. Tags are defined in the TIA Portal project tree under HMI Tags rather than in the WinCC Explorer Tag Management. The address is specified as %DB100.DBW0 and the I/O Field is configured from the HMI screen editor palette. The principle is identical: CTU in the PLC, external tag as the bridge, I/O Field as the display.

Parameter Reference

Edge Cases and Field-Proven Caveats

• Retentivity: by default, the contents of a global DB in the S7-300 are not retentive across a power cycle. To retain the counter, open the CPU properties in STEP 7, navigate to Retentive Memory, and add DB100 to the retentive area. Without this, the I/O Field will show 0 after a power loss even though the CTU logic continues to function.
• BCD vs INT CV: when using the SIMATIC standard counter S_CU (not the IEC CTU), the CV output is BCD-coded. Attempting to display a BCD value with a signed INT format produces garbage characters. Use only the IEC CTU for screen display unless you perform a BTI conversion first.
• HMI tag direction: the Counter_Reset tag must be Read/Write. A Read Only tag silently rejects write attempts from the screen button, with no error message in the standard logging.
• CPU 31xC integrated counters: the CPU 314C-2 and CPU 317-2 include hardware counters. These are configured via the hardware catalog and do not require a CTU block. If using a hardware counter, the address is in the input area (e.g., PEW 800) and the tag in WinCC points to the input word rather than a DB.
• Project migration from STEP 7 V5.x to TIA Portal: the IEC CTU block is preserved across migration, but the instance data layout may shift. After migration, verify the CV address by opening the DB online and confirming the byte offset matches the WinCC tag address.

FAQ