Setting S7-1200/1500 PLC RUN/STOP from WinCC Unified HMI

Overview

Operating state control of a SIMATIC S7-1200 or S7-1500 from a WinCC Unified Comfort Panel (or Unified PC Runtime) became natively supported in TIA Portal V18 Update 2 (V18.0.0.2). Prior to that release, the classic SetPLCMode function used on Comfort Panels (WinCC RT Professional / WinCC Advanced) was not implemented in the Unified HMI runtime, leaving engineers with only indirect options such as the PLC Webserver rendered inside a Web Browser control.

This reference documents the canonical mechanism introduced with V18: a system-defined HMI tag of the form @<ConnectionName>_PLC_OpStateCtrl that accepts discrete numeric values mapped to the SIMATIC operating-mode transitions defined in the S7-1500 system manual (STOP, RUN, startup, restart, reset to factory settings, etc.).

Prerequisites

Operating-State Tag Reference

The HMI project tree automatically exposes the following system tags once an S7-1500/1200 connection is configured. The @ prefix denotes a system-managed tag (not editable, address managed by the runtime). Replace <ConnectionName> with the exact HMI connection name from Devices & Networks > HMI connection > Properties > General.

OpState Read Values (@..._PLC_OpState)

OpStateCtrl Write Values (@..._PLC_OpStateCtrl)

Step-by-Step Configuration

1. Open the TIA Portal project containing the S7-1200/1500 station and the Unified HMI device. Confirm both devices are configured under the same project and that the HMI-to-PLC connection compiles cleanly.
2. Verify the connection name. In the project tree, select HMI device > Connections. The default name is the PLC station name (e.g. S7_1500_Station_1). The system tag will use that name verbatim.
3. Open the HMI tag editor (HMI device > HMI Tags) and use the filter to list only system tags. Confirm both @<ConnectionName>_PLC_OpState and @<ConnectionName>_PLC_OpStateCtrl exist. If they are absent, the engineering environment is below V18.0.0.2 or the connection is not of type S7-1500.
4. PLC protection setup. In the S7-1500 device configuration, navigate to Properties > Protection & Security > Access level. The HMI connection must have full access (write access to system data is permitted). If a password is configured, ensure the HMI connection supplies that password. The HMI uses the connection password from Devices & Networks > HMI connection > Properties > Connection mechanism.
5. Create screen controls. On the desired HMI screen, add two buttons: "STOP" and "RUN".
6. Configure the STOP button event:
   • Event: Press
   • Function: SetValue
   • Tag: @<ConnectionName>_PLC_OpStateCtrl
   • Value: 4
7. Configure the RUN button event:
   • Event: Press
   • Function: SetValue
   • Tag: @<ConnectionName>_PLC_OpStateCtrl
   • Value: 8
8. Add an operator-confirmation dialog to each button via the Confirmation property to prevent accidental triggering, especially for the STOP action.
9. Status visualisation. Add a symbolic IO field or text list bound to @<ConnectionName>_PLC_OpState so operators see the actual current state, not just the request outcome. Map the values 1, 2, 3 to "STOP", "STARTING", "RUN" text entries.
10. Compile and download the HMI project. Compile the PLC project if the connection was newly created.

JavaScript / Scripted Alternative

For Unified PC Runtime projects that use the scripting interface, the same effect can be achieved in the runtime API. The snippet below uses the TIA Portal WinCC Unified Scripting (V18+) to issue a STOP command:

// Stop the PLC referenced by HMI connection 'PLC_1500'
let conn = HMIRuntime.UI.SysFct.GetTag("@PLC_1500_PLC_OpStateCtrl");
conn.Write(4);  // 4 = unconditional STOP

// Then verify
let state = HMIRuntime.UI.SysFct.GetTag("@PLC_1500_PLC_OpState");
let current = state.Read();
if (current !== 1) {
    HMIRuntime.Trace("STOP command did not latch. Current state: " + current);
}

Wrap such scripts in a user-rights check (UMAC) so only the Maintenance role can execute them.

Verification

1. Download the HMI configuration to the panel and switch the panel to online operation.
2. From the HMI, press the STOP button and observe:
   • The PLC STOP LED illuminates within < 2 seconds.
   • The @..._PLC_OpState tag transitions through 3 → 2 → 1 (RUN → STARTUP → STOP). On S7-1500 the transition can be near-instant; on S7-1200 it follows the OB100 startup time if it was started cleanly.
3. Press RUN. The CPU executes the startup routine (if defined) and reaches state 3.
4. On the PLC, monitor Online & Diagnostics > Operating mode to confirm the state change originated from the panel.
5. Force a connection loss (disconnect PROFINET cable) and verify the HMI shows the state as UNKNOWN (0) - this proves the tag is being refreshed and not statically latched.

Status Display Pattern

Beyond the simple button pair, the recommended operator-screen pattern combines request and feedback:

• Indicator lamp bound to the current state (RUN = green, STOP = red, STARTING/HOLD = yellow, DEFECTIVE = flashing red).
• Two push-buttons (RUN, STOP) with operator confirmation.
• Message in the HMI log triggered by a script that logs every state change with timestamp from @..._PLC_OpStateLastChange and operator user ID.
• Disable buttons when the connection is lost: bind the Enabled property of both buttons to an animation that compares the connection status tag against 0 (UNKNOWN) so they grey out automatically.

Security and Access Protection

Operating-mode control is a privileged function. Apply layered protection:

1. PLC side: assign the HMI connection a dedicated password and restrict CPU access so that only the HMI connection can write the system data. In TIA Portal, configure Protection & Security > Access level > Full access (no password) only if no protection is required by your safety case; otherwise issue a connection-specific password.
2. HMI side: place the RUN/STOP buttons on a screen or in an overlay that is part of the Service or Maintenance UMAC group. Operators in the Operator role should not be able to execute state transitions.
3. Audit trail: log every write to @..._PLC_OpStateCtrl with operator name and timestamp for GMP/FDA-regulated environments.
4. Confirmation: the STOP button should always require a two-step confirmation.

Alternatives When V18 Is Not Available

For installations locked on TIA Portal V17 or earlier, the following alternatives deliver equivalent functionality without the native system tag:

The Webserver approach is the most common workaround. To configure it:

1. In the S7-1500 device configuration, enable Webserver > Activate web server; permit Run/Stop under User management.
2. In the Unified screen, add a Webbrowser Control element. Set the URL to https://<CPU IP>/.
3. Authenticate the webserver user inside the embedded browser; subsequent operator clicks use the standard CPU web interface.

Troubleshooting Matrix

Compatibility With SetPLCMode (Legacy Comfort)

Engineers migrating from WinCC Comfort / RT Advanced should note that the legacy SetPLCMode function is not available in WinCC Unified runtime. The replacement is the @..._PLC_OpStateCtrl system tag described above. The numeric encoding differs from SetPLCMode:

Migrations that lifted Comfort panel logic into Unified must rewrite the constants accordingly.

Field-Commissioning Checklist

• [ ] TIA Portal >= V18 Update 2 confirmed in the title bar.
• [ ] HMI firmware image matches the engineering version (V18.0.0.2+).
• [ ] PLC firmware supports S7-1500 unified channel (any current S7-1200 / S7-1500 firmware).
• [ ] HMI connection password matches the PLC access-level configuration.
• [ ] Both system tags @..._PLC_OpState and @..._PLC_OpStateCtrl visible in HMI tag editor.
• [ ] RUN button writes value 8; STOP button writes value 4.
• [ ] Confirmation dialog enabled on STOP.
• [ ] Operator role cannot trigger state change; only Service role can.
• [ ] Status indicator updates within 2 seconds of PLC transition.
• [ ] Connection loss test: disconnect cable → state shows UNKNOWN.
• [ ] Audit log entry recorded for each transition.