Sharing WinCC Flexible Tags with PCS 7 WinCC Explorer OS

Overview

In a PCS 7 installation that combines a WinCC Explorer Operator Station (OS) with one or more WinCC Flexible / WinCC Comfort Panel HMIs, it is common to discover that a tag originally defined for the HMI panel is also required in the OS faceplates, alarm logging, trend groups, or user archives. Because PCS 7 follows a strict server / client / HMI separation, a tag created natively in the WinCC Flexible project is not automatically visible to the OS server during compilation. The tag must be exposed through the STEP 7 / PCS 7 engineering layer using the standard PCS 7 attribute mechanism, after which the OS compile ("Compile OS") will create the matching WinCC Explorer tag, the HMI will read the same data block word, and any write performed on either side will be visible on the other.

This article documents the exact property set, the compile order, and the field-verification steps that make a shared DB20.DBW278 (or any equivalent data block word) visible to both WinCC Explorer and WinCC Flexible from the same STEP 7 / SIMATIC Manager project source. The procedure applies to legacy SIMATIC Manager based PCS 7 V7/V8/V9 projects; TIA Portal equivalents are noted where they diverge. Background on PCS 7 as a system is available in the official Siemens SIMATIC PCS 7 product page and the Siemens Industry Online Support portal.

Prerequisites

The following software, configuration, and project state must be in place before the procedure is performed:

• PCS 7 V8.0 SPx or V9.0 SPx with the SIMATIC Manager (STEP 7) component installed, or a TIA Portal PCS 7 V9.0 project migrated into the legacy SIMATIC Manager shell.
• STEP 7 V5.5 SPx or higher with the optional package "S7-PCT" or "PCS 7 Library" present on the engineering station.
• WinCC Explorer V7.x (matching the PCS 7 version) installed on the OS server.
• WinCC Flexible 2008 SPx or TIA Portal WinCC Comfort/Advanced (with WinCC Flexible compatibility) installed for the panel project.
• A valid S7-400 / AS 400 station configured in the project, with the HMI station and the OS server both assigned to the same S7-400 subnet (typically Industrial Ethernet / S7 connection).
• The WinCC Flexible project and the WinCC Explorer OS must both reference the same AS symbol; in this article the symbol is DB20.DBW278.
• The engineering user must have write privileges on the S7 program, the OS project, and the panel project folders (typically the local "Siemens" group or higher).
• The WinCC Explorer project on the OS server must be closed during the OS compile, or the compile will refuse to write the regenerated tag database.

Architecture: WinCC Explorer, WinCC Flexible, and the AS in PCS 7

PCS 7 separates the engineering and runtime environments as follows:

• AS (Automation Station) – The S7-400 CPU executes the STEP 7 user program, including all data blocks (DBs) referenced by the OS faceplates and the HMI panels. Tags that need to be shared must exist in the AS program as concrete DB addresses; symbolic addressing is preferred because the OS and panel projects reference symbols, not absolute addresses.
• OS (Operator Station) – Runs WinCC Explorer. The OS server is the runtime authority for faceplates, alarm logging, tag logging, and the user archive. The OS reads and writes its tag values from the AS using the S7-400 connection configured in the WinCC project. The runtime tag set is generated from the AS by the "Compile OS" function.
• HMI (WinCC Flexible Panel) – A Comfort / Compact / Operator Panel, or a PC Runtime panel, running WinCC Flexible or TIA-Compatible firmware. The panel reads and writes the same data block words but uses the WinCC Flexible connection editor to declare the connection, not the OS compile.

The key principle: the AS is the single source of truth. Both WinCC Explorer and WinCC Flexible merely read or write into the data block. A tag in WinCC Explorer does not "live" in the OS – it is a local runtime handle onto a memory address in the AS. The same is true of a WinCC Flexible tag: it is a handle onto the same AS address.

The implication is that for a tag to exist simultaneously in both WinCC Explorer and WinCC Flexible, it must first exist as a STEP 7 symbol on the AS, and the OS compiler must be allowed to read its visibility attributes.

DB Attributes: S7_m_c = true and the OCM Property

The PCS 7 OS compiler generates a WinCC Explorer tag for every STEP 7 symbol that satisfies two conditions:

1. The data block (or the symbol entry) carries the operator-control-and-monitoring (OCM) attribute. In the SIMATIC Manager this is exposed as a checkbox in the special object properties of the data block ("Operator Control and Monitoring"). The WinCC tag name is derived from the symbolic name of the DB element.
2. The relevant data block element carries the S7_m_c attribute. S7_m_c is a STEP 7 attribute assigned to DB elements that should be exported to the OS. Its presence flags the element for the OS-Compile run.

For a WORD (DBW) or INT element used as a value selector, the relevant attribute set on the symbol is:

If either of these is missing, the OS compiler will silently skip the element; the tag will not appear in the WinCC Explorer tag management, and any faceplate that references the symbolic name will display "configuration error" at runtime.

Step-by-Step: Exposing a WinCC Flexible-Only Tag to WinCC Explorer

The following procedure converts a tag that is currently visible only in WinCC Flexible (for example DB20.DBW278) into a shared symbol that is also present in the WinCC Explorer tag management of the OS. The procedure is valid for SIMATIC Manager-based PCS 7 projects. TIA Portal equivalents are noted at the end of this section.

1. Open the AS Program in SIMATIC Manager

1. Launch SIMATIC Manager and open the PCS 7 project.
2. Navigate to the AS-400 station (or the relevant AS component, e.g. AS01).
3. In the right-hand pane, open the S7 Program container and then the Blocks folder.
4. Locate DB20 in the list. If DB20 does not yet exist, it must be created or generated by the CFC / SFC editor that owns the relevant chart.

2. Verify / Enable the OCM Property on the Data Block

1. Right-click on DB20 and select Object Properties.
2. In the General – Part 2 tab, locate the checkbox "Operator Control and Monitoring" (German: "Bedienen und Beobachten"). It must be checked.
3. Confirm with OK.

If the checkbox is grayed out, the DB has the "Know-how-Protect" attribute set. Either remove the know-how protection (Properties → Protection tab) or open the DB from a source that has the right to do so. The STEP 7 V5.5 Programming Manual covers the know-how protection workflow in detail.

3. Set S7_m_c = true on the DBW278 Symbol

1. Double-click on DB20 to open the data block editor.
2. Scroll to address DBW278 (or use View → Address → 278).
3. The row shows the symbolic name (e.g. iSel_VL_List), the address DBW278, and the data type INT or WORD.
4. Right-click the row and select Object Properties.
5. In the Attributes tab, locate the user-defined attribute named S7_m_c. The exact field is visible only if the "Show all attributes" toggle is enabled in the DB editor.
6. Set the value of S7_m_c to true. The field is case-sensitive; use lowercase per PCS 7 convention.
7. (Optional) Add or edit the S7_attr attribute with a short tooltip string, e.g. S7_attr = "Valve list selector".
8. Confirm with OK and save the DB.

4. Verify the AS is Compile-Consistent

Before the OS will accept the new symbol, the S7 program must compile cleanly:

1. In SIMATIC Manager, select the S7 Program folder.
2. From the menu, select Edit → Compile (or S7-Program → Compile on the toolbar).
3. Address any compiler warnings – in particular, "Symbol in DBxx has no S7_m_c attribute" warnings confirm that other tags are still hidden from the OS and are a useful inventory tool.
4. Do not download to the AS at this point if the plant is in production; the compile is enough to refresh the ES-side symbol table that the OS compiler will read.

5. Trigger the OS Compile

1. In SIMATIC Manager, navigate to the OS component (e.g. OS01).
2. Right-click the OS and select Compile OS (German: "OS übersetzen"). The dialog is the same one used for any incremental OS compile.
3. In the dialog, choose the scope:
   • Entire OS – regenerates the entire tag database; recommended after attribute changes.
   • Changes only – usually sufficient if the project is fully consistent.
4. Wait for the compile to complete. The status window will list the number of tags read from the AS; the count should now include DB20.DBW278.

6. Verify the Tag in WinCC Explorer

1. On the OS server, open WinCC Explorer.
2. In the Tag Management tree, expand the channel / unit (typically SIMATIC S7 PROTOCOL SUITE → AS-OS connection).
3. Look for the symbolic name of the element, e.g. iSel_VL_List. The address column should show DB20,DBW278.
4. If the tag is present, double-click it to verify the type (WORD or INT).
5. (Recommended) Open the project in Graphics Designer and check that faceplate I/O fields using iSel_VL_List no longer show the "configuration error" red triangle.

7. Verify the Tag in WinCC Flexible

1. On the engineering station, open the WinCC Flexible project for the panel.
2. In the project tree, open Communication → Tags.
3. Confirm that the tag with address DB20,DBW278 is still present and is not marked with a red "?" (which would indicate a connection problem or a tag that has been removed by re-import).
4. The tag should be of type Int or Word and should be tied to the same connection as the OS uses (i.e. the S7-400 connection, not a separate test PLC).

8. Runtime Verification

1. Download the S7 program to the AS (or accept the existing one if unchanged in logic).
2. On the OS faceplate I/O field bound to the new tag, change the value (e.g. by typing a new index into the text-list selector).
3. On the HMI panel, observe the same value. The panel and the OS are reading the same DBW, so the change must appear without any further action.
4. Repeat in the opposite direction: change the value from the panel and verify the OS reflects it.
5. (Optional) Use the S7 online watch table on the AS to confirm that the value is actually being written into the DBW at the expected scan cycle. The value should be latched exactly as written by either HMI; if it reverts to a different value, the AS program is overwriting it from a CFC chart and the assignment order in the runtime group must be reviewed.

WinCC Explorer Configuration Details

When the OS compile has been run, the new tag will be added to the WinCC Explorer project. Several details should be reviewed to ensure the runtime behaves as expected:

• Tag name: The WinCC Explorer tag name will be the STEP 7 symbolic name (iSel_VL_List), not the absolute address. Do not create a parallel tag in the WinCC Explorer tag management with the address DB20,DBW278; the OS will then have two independent channels to the same memory and any read from the wrong one will still work but any write to the manual tag will be overwritten by the symbolic one in the next cycle.
• Data type: Must match the DB element. A WORD (unsigned 16-bit) in STEP 7 will be imported as WORD in WinCC; a INT (signed 16-bit) will be imported as SIGNED 16-BIT.
• Limits and linear scaling: If the text-list selector uses a 0..n index, the WinCC tag limits should match (lower limit 0, upper limit n-1). Limits in WinCC are advisory only; they do not restrict writes from the AS, but they do drive the slider/input field validation in the faceplate.
• Acquisition cycle: The default S7 acquisition cycle in WinCC is 1 s; for a value selector used as an event source, a 250 ms or 500 ms cycle is more responsive.

WinCC Flexible Configuration Details

For the panel side, the same DBW is typically already present. After the OS compile, the panel does not need to be re-imported from the STEP 7 symbol table, but two checks will save field time:

• Connection type: The connection in WinCC Flexible must be an S7-400 connection pointing at the same AS the OS uses. If a test PLC or a simulation was used during panel development, the tag will read the wrong CPU.
• Update: On Comfort / Compact Panels and PC Runtime, the tag polling cycle is set per connection. A 500 ms update on a WORD selector is usually adequate.
• Limit values / text list linkage: If the panel uses a text list to render the index, the text list must be reachable from the panel project. Text lists in WinCC Flexible are local to the panel; they are not shared with the OS. The OS faceplate must carry its own text list that maps the same indices to the same human-readable strings.

OS Compile: Incremental vs. Full, and the "Entire OS" Pitfall

In PCS 7 projects of moderate size, the "Compile OS – Changes only" option is the everyday workhorse. After changing a single S7_m_c attribute, however, the incremental compile sometimes misses the change and the tag does not appear. Field procedure:

1. If "Changes only" produces no new tag, run Compile OS → Entire OS. The full compile forces the OS to re-read the entire S7 symbol table, including all DB elements.
2. If the tag still does not appear, check the IML (Import / Export Log) in the OS compile output. The log lists the symbolic name, the source DB, and the reason for rejection ("S7_m_c missing", "DB OCM disabled", "data type unsupported").
3. If the IML is silent, the OS project may be locked (open in WinCC Explorer on the OS server). Close WinCC Explorer and re-run the compile.

Troubleshooting Matrix

Verification Checklist

Before signing off the change, walk the following checks on a live OS / panel pair:

• The DB element DBW278 has S7_m_c = true and the DB has OCM enabled.
• The S7 program compiles without errors or new warnings.
• The OS compile log shows the new tag as imported.
• The tag is visible in WinCC Explorer under the S7 channel.
• The tag is still visible in WinCC Flexible with the same address and type.
• Writing from the panel faceplate is reflected on the OS faceplate within one acquisition cycle.
• Writing from the OS faceplate is reflected on the panel within one panel update cycle.
• The AS online watch table confirms the DBW is holding the written value.
• No redundant hand-written tag exists in the WinCC Explorer tag management that points to the same address.
• The WinCC Flexible connection has write privilege for the HMI, not just read.
• Alarms / trends referencing the new tag (if any) compile without error on the OS.

Caveats and Field Notes

• Manual tags in WinCC Flexible are a frequent source of divergence. A tag that was added directly in WinCC Flexible (typed in by hand) will not be regenerated by an OS compile. If the panel project is later synchronized with the ES, the manual tag may be removed and the value will go red. The safer pattern is to have the panel project re-import the symbols from the ES, so the tag comes from the same source as the OS.
• Two parallel tags, same address, is a classic bug. When an operator writes a new value from the panel and the OS does not see it, the most common root cause is that the OS has a manually created WinCC tag pointing at the same DBW, and that manual tag has a different acquisition cycle. The remedy is to delete the manual OS tag and rely on the one generated by OS-Compile.
• Know-how-protected DBs block the OCM flag. If the engineering department has stripped the OCM attribute from a "secret" DB, even setting S7_m_c on the element will not bring the tag to the OS. The DB protection must be removed first.
• TIA Portal migration of a PCS 7 project retains the legacy attribute mechanism for the OS server during the migration window. New projects built in TIA Portal use the HMI tag and PLC tag tables directly; there is no S7_m_c in TIA, but the OCM / operator-control-and-monitoring equivalent is the "HMI accessible" and "HMI writeable" columns in the PLC tag table.
• PCS 7 V9.x with WinCC RT Professional on the OS server uses the same S7_m_c mechanism for OS-Compile from the AS, but the panel side is now WinCC Unified (TIA Portal). The "compile OS" workflow remains the authority for OS-side tags.
• Firmware version of the AS is not relevant to the visibility of the attribute; the S7_m_c is read by the engineering tool, not the CPU. However, the CPU must be in RUN or RUN-P for the operator write to take effect at runtime.
• Text lists are not shared. WinCC Flexible text lists and WinCC Explorer text lists are independent. If the same WORD value is rendered as a text label on both, two text lists must be maintained – one in the panel project, one in the OS project – and they must be kept in sync manually.
• Acquisition cycle on the OS determines how fast an OS-side trend or alarm reacts. The default 1 s cycle is fine for steady-state display, but for a value selector that drives downstream control actions, 250 ms is recommended.
• S7-m-c is per-symbol, not per-DB. Toggling the attribute on the DB-level OCM does not automatically export every element; the engineering intent is captured only on the specific element. This is deliberate – it allows PCS 7 to expose only the elements that are safe for an operator to write to.

FAQ