Siemens LOGO! KTP400: Toggle VW Variables in One I/O Field

Overview of the Engineering Requirement

The original field question is deceptively simple: Can a single I/O field on a Siemens HMI show or modify two different VW addresses (for example, VW523 and VW525), switching between them based on operator selection? The short answer is no, not directly, because a single I/O field can only be bound to one process tag at a time, and Basic panels such as the KTP400 Basic do not include a scripting runtime that can swap tags dynamically. The long answer is that there are at least four production-ready methods to achieve the desired behavior, each with different trade-offs in code footprint, panel firmware requirements, and maintainability.

This article provides a complete field-engineering reference for resolving the requirement on a SIMATIC HMI KTP400 Basic paired with either a LOGO! 8, S7-200, or S7-200 Smart controller. It includes ladder and SCL code, a TIA Portal configuration walkthrough, a verification matrix, a troubleshooting table, and best-practice commissioning notes drawn from real field deployments.

Understanding the Siemens Memory Model

VW Addressing in S7-200 and S7-200 Smart

The VW (Variable Word) prefix is native to the SIMATIC S7-200 and S7-200 Smart families. The V memory area is a single contiguous block of volatile data memory. Each VW address occupies one 16-bit word; two consecutive VW addresses (for example VW524) form a 32-bit double word (VD). On a CPU 224 XP, V memory spans from VW0 to VW10238, with byte boundaries aligned to even addresses. The CPU 226 extends the range to VW10239 in some firmware revisions.

S7-200 controllers are typically programmed with STEP 7 Micro/WIN, while S7-200 Smart controllers use STEP 7 Micro/WIN SMART. Both are still commonly integrated into TIA Portal projects through the S7-200 OPC server or a direct MPI/PPI/Profibus connection. Memory locations are absolute, with no symbolic tag database on the controller side, so the HMI tag must reference the absolute address.

VM Addressing in LOGO! 8

LOGO! 8 controllers do not use the VW prefix. LOGO! 8 uses Variable Memory (VM) addresses inside the LOGO! data block. A LOGO! 8 analog value occupies one VM word. The HMI connection between LOGO! 8 and a Siemens panel such as the KTP400 Basic uses the LOGO! access protocol over Ethernet, and only variables explicitly flagged as "HMI visible" in LOGO! Soft Comfort are reachable from the panel.

If your hardware is a LOGO! 8 and the address is written as VW523, the address is either:

1. A carryover notation from a prior S7-200 project that needs to be re-mapped to VM in LOGO! Soft Comfort, or
2. A custom data-block mapping where two LOGO! network analog values are mirrored into adjacent VM words.

Symbolic DB Addressing in S7-1200 and S7-1500

On S7-1200 and S7-1500, the V memory area does not exist in the same form. The recommended approach is symbolic addressing inside a global data block, with the HMI referencing the symbolic tag name. Numeric address binding is discouraged on these platforms.

Platform Comparison: Which Method Fits Which Controller

Controller	Address Style	Recommended Method	Panel Firmware
S7-200 CPU 224/226	VW523, VW525	Method 1: PLC-side multiplexer (MOVW)	WinCC Basic V13+
S7-200 Smart ST20/ST30	VW523, VW525	Method 1 or Method 4 (SCL pointer)	WinCC Basic V14+
LOGO! 8 BM with Ethernet	VM523, VM525	Method 1 with LOGO! analog multiplexer block	WinCC Basic V14+
S7-1200 CPU 1214/1215	DB10.DBW0, DB10.DBW2	Method 3 (UDT array) or Method 4 (SCL pointer)	WinCC Comfort V14+
S7-1500 CPU 1515/1516	DB10.DBW0, DB10.DBW2	Method 3 or Method 4 (Optimized DB)	WinCC Comfort V15+

KTP400 Basic I/O Field Capabilities

The SIMATIC HMI KTP400 Basic (6AV2 123-2DB03-0AX0 and successor 6AV2 123-2MB03-0AX0) is a 4-inch widescreen touch panel with 65,536 colors. It runs WinCC Basic / WinCC Comfort configuration in TIA Portal V13 SP1 and later. The I/O field is a fundamental input/output element that can be configured to:

• Display a process value (Output mode)
• Accept operator input to write a value back to the PLC (Input/Output mode)
• Switch between display and input modes by operator permission level
• Apply min/max range limits, scaling factors, and password protection

A single I/O field can be bound to only one PLC tag. The WinCC Runtime on the panel does not dynamically swap the underlying tag without scripted logic or an indirect addressing mechanism. This is the root engineering challenge behind the original question.

I/O Field Configuration Limits

Property	KTP400 Basic Limit	Notes
Tags per I/O field	1 process tag	Indirect tag requires WinCC Professional
Input modes	Input, Input/Output, Output	Configured per field in TIA Portal
Numeric formats	Binary, Octal, Decimal, Hex, BCD	Decimal is default
Data length	1 bit to 32 bits	Word (16-bit) matches VW
Scaling	Linear with offset	Min/Max field configurable
Operator authorization	0 to 9 levels	Configurable in user administration

Reference: SIMATIC HMI KTP400 Basic Operating Instructions (Siemens Industry Online Support)

Prerequisites

Before applying any of the methods below, verify the following:

1. TIA Portal V15.1 or later installed (V17 recommended for firmware V16 panels).
2. KTP400 Basic firmware V16.0.0.0 or later. Update the panel image if necessary.
3. HMI tag connection configured to the target PLC. For S7-200 use "SIMATIC S7 200" interface; for LOGO! 8 use the "LOGO!" driver.
4. The two source addresses (VW523 and VW525) are mapped to accessible HMI tags.
5. For write operations, configure the operator authorization level (typically level 3 or higher) in the HMI user administration.
6. For LOGO! 8: each source variable must be flagged as "HMI visible" in LOGO! Soft Comfort under the block properties.

Reference: LOGO! 8 System Manual (Siemens Industry Online Support)

Method 1: PLC-Side Multiplexer (Recommended)

The most robust, deterministic, and platform-agnostic approach is to perform the selection logic in the PLC. A single HMI tag (for example VW550) acts as a selector value. The PLC copies the selected source value into a common holding word (for example VW540) that the I/O field displays. For write-back, the PLC monitors the selector and writes the I/O field value to the appropriate target on an operator-triggered edge.

Ladder Logic for S7-200 (STEP 7 Micro/WIN)

Network 1 — Read Multiplexer (each scan)
LD    SM0.0
LPS
AB=   VW550, 1          // Selector = 1 -> VW523
MOVW  VW523, VW540
LRD
AB=   VW550, 2          // Selector = 2 -> VW525
MOVW  VW525, VW540
LPP

Network 2 — Write Multiplexer (edge-triggered)
LD    I0.0               // Write enable pushbutton on HMI
EU                      // Positive edge
LPS
AB=   VW550, 1
MOVW  VW540, VW523
LRD
AB=   VW550, 2
MOVW  VW540, VW525
LPP

The MOVW instruction copies a 16-bit word. Use MOVD for 32-bit values if the source and target are double words (for example VD523 and VD525).

SCL Implementation for S7-1200/1500

// FB_MuxWord reads the indexed value from a static array
IF "Selector" = 1 THEN
    "Display" := "DB_Source".Word[0];   // VW523 mapped to index 0
ELSIF "Selector" = 2 THEN
    "Display" := "DB_Source".Word[1];   // VW525 mapped to index 1
END_IF;

LOGO! 8 Implementation

In LOGO! Soft Comfort V8.3 or later, the equivalent implementation uses the analog multiplexer (Block 207) and analog demultiplexer (Block 208) from the "Analog" library.

1. Place an Analog Multiplexer with three inputs V1, V2, and selector S.
2. Connect the VW523 source to V1, VW525 to V2, and the selector tag (for example VM600) to S.
3. Connect the multiplexer output to VM540, which is the tag bound to the HMI I/O field.
4. Mark VM540 and VM600 as "LOGO! to HMI visible" in the block properties.
5. For write-back, use a separate write-trigger bit and an analog demultiplexer to direct the I/O field value back to the correct source.

Advantages of Method 1

• No scripting required on the HMI.
• Deterministic: every scan the HMI tag reflects the current selection.
• Compatible with all panel firmware versions, including KTP400 Basic.
• Easy to commission and troubleshoot with a watch table.
• No additional HMI tags, pointers, or scripts.

Disadvantages of Method 1

• One extra word (the selector) and one extra word (the holding register) in the PLC.
• Write-back requires a separate trigger to avoid continuous overwriting.

Method 2: HMI-Side Tag Multiplexer with VBScript

For panels running WinCC Comfort or WinCC Runtime Advanced with scripting enabled, a small VBScript can be attached to the "Change" event of a selector tag. The script writes the selected source value to a buffer tag bound to the I/O field.

Configuration Steps

1. Create three HMI tags: Selector, Buffer, and Source (or use two source tags directly).
2. Bind the I/O field to the Buffer tag.
3. Add a button or drop-down list bound to the Selector tag.
4. Configure the "Change" event of the Selector to execute the VBScript below.

VBScript Snippet

Sub Selector_Change(ByVal Item)
    Dim sValue
    sValue = SmartTags("Selector")
    If sValue = 1 Then
        SmartTags("Buffer") = SmartTags("VW523")
    ElseIf sValue = 2 Then
        SmartTags("Buffer") = SmartTags("VW525")
    End If
End Sub

For write-back, a similar script on a "Write" button handles the inverse operation. The panel must be a Comfort Panel for VBScript support; the KTP400 Basic does not include a scripting runtime. Use Method 1 for the KTP400 Basic.

Method 3: Indirect Tag Referencing via UDT Array

WinCC Professional and WinCC Runtime Advanced support indexed tags through the UDT (User-Defined Type) array mechanism. Define a UDT containing the two relevant word values, instantiate it as an array in a DB, and bind the I/O field to a tag whose index is controlled by another HMI tag.

This is the cleanest approach when:

• The two source values are already in adjacent memory.
• The selector can be a numeric index 0 or 1.
• The HMI tag database is symbolic.

Implementation

1. In the PLC, create a data block (DB10) with an array of two words, for example DB10.DBW0 and DB10.DBW2.
2. Map VW523 to DB10.DBW0 and VW525 to DB10.DBW2 in the PLC logic.
3. In the HMI, create a tag "DisplayWord" of type Word and an internal tag "Index" of type Int.
4. Bind the I/O field to a tag that uses a dynamic index. This requires WinCC Professional; on WinCC Basic/Comfort use the PLC-side multiplexer.

Reference: WinCC Professional — Working with Tags (Siemens Industry Online Support)

Method 4: Function Block with Pointer Arithmetic

On S7-1200 and S7-1500 in TIA Portal, indirect addressing through pointer arithmetic in SCL (Structured Control Language) is the most flexible method. A function block accepts a selector input and a pointer (Variant input) to the source array. The block copies the indexed value to the I/O field tag.

FUNCTION_BLOCK "FB_MuxWord"
VAR_INPUT
    Selector : INT;
    pSource : POINTER TO WORD;
    SourceCount : INT;
END_VAR
VAR_OUTPUT
    SelectedValue : WORD;
END_VAR
BEGIN
    IF (Selector >= 0) AND (Selector < SourceCount) THEN
        SelectedValue := (pSource + Selector)^;
    ELSE
        SelectedValue := 0;
    END_IF;
END_FUNCTION_BLOCK

This method requires a Comfort Panel or higher. It is overkill for the common case of two tags but is valuable when the multiplexer must be parameterised at runtime.

Step-by-Step: TIA Portal Configuration (Method 1, S7-200 Smart)

1. Open the TIA Portal project containing the S7-200 Smart CPU and the KTP400 Basic HMI.
2. In the project tree, expand "PLC_1" → "Program blocks" and add code to OB1.
3. Define the following tags in the PLC tag table or symbol table:
   • VW523 (Word) — Source A (for example, process setpoint)
   • VW525 (Word) — Source B (for example, actual value)
   • VW540 (Word) — Multiplexed display value
   • VW550 (Word) — Selector (1 = A, 2 = B)
4. Add the ladder logic shown in Method 1, Network 1, to the OB1 scan cycle.
5. Compile and download the PLC program. Verify the multiplexer with a watch table: set VW550 = 1 and confirm VW540 follows VW523; set VW550 = 2 and confirm VW540 follows VW525.
6. In the HMI configuration, add the HMI tag "Display" with PLC connection "PLC_1", address "VW540", data type Word. Add tag "Selector" with address "VW550".
7. Open the HMI screen and drag an I/O field from the toolbox onto the canvas. Configure as follows:
   • Process tag: Display (VW540)
   • Mode: Input/Output
   • Format: Decimal
   • Limits: 0 to 65535 for unsigned; adjust to ±32767 for signed
8. Add a drop-down list or two radio buttons bound to the Selector tag. Configure selection values 1 and 2.
9. Compile the HMI and download to the KTP400 Basic panel.
10. Run the system and verify the I/O field shows VW523 when Selector = 1 and VW525 when Selector = 2.

Step-by-Step: LOGO! 8 Implementation

1. Open LOGO! Soft Comfort V8.3 or later.
2. Add an Analog Multiplexer block (part of the "Analog" library).
3. Connect:
   • Input Ax to the analog value from network 1 (the LOGO! tag mapped to VW523 source)
   • Input Ay to the analog value from network 2 (the LOGO! tag mapped to VW525 source)
   • Selector S to a new network input wired to a LOGO! HMI variable, for example VM600
4. Connect the multiplexer output to a new network analog output, for example VM540, and mark it as "LOGO! to HMI visible".
5. In LOGO! Soft Comfort, open Tools → Parameter VM Mapping and ensure VM540 and VM600 are exposed as HMI variables.
6. Save and download the program to the LOGO! 8 base module.
7. In TIA Portal HMI configuration, create two tags:
   • Display → LOGO! connection → VM540
   • Selector → LOGO! connection → VM600
8. Add the I/O field and selector as in the S7-200 procedure.
9. Compile and download to the panel.

Communication Protocol Notes

Controller	Default Protocol	Baud Rate	Max Tags
S7-200 CPU 224 XP	PPI / MPI	9.6 kbps / 19.2 kbps	Limited by S7-200 OPC server
S7-200 Smart ST20	Ethernet (S7 Protocol)	100 Mbit	Unlimited (HMI tag database)
LOGO! 8 BM (6ED1052-1)	LOGO! Access over Ethernet	10/100 Mbit	64 HMI-visible variables per base
S7-1200 CPU 1214	Profinet / S7 Protocol	100 Mbit	Unlimited

For S7-200, the legacy PPI cable (6ES7 901-3CB30-0XA0) is required; for S7-200 Smart, a standard Ethernet cable to the CPU's RJ45 port is sufficient. The LOGO! 8 connects to the panel via the LOGO! Base Module RJ45 port; no additional hardware is required.

Scaling and Engineering Units

If VW523 and VW525 represent engineering values (for example, temperature in °C or pressure in bar), configure the I/O field with linear scaling. Define the PLC raw range and the engineering range, and TIA Portal will interpolate between them. For example, a 0 to 27648 raw count from an analog input module can be scaled to 0 to 100.0 °C using a multiplier of 0.0036 and an offset of 0.

PLC Tag	Raw Range	Engineering Range	Multiplier	Offset
VW523 (Temperature)	0 to 27648	-50.0 to 150.0 °C	0.0072	-50.0
VW525 (Pressure)	0 to 27648	0.0 to 10.0 bar	0.000362	0.0

Verification and Commissioning Checklist

Test	Action	Expected Result
Selector 1 display	Set Selector = 1	I/O field shows VW523 value
Selector 2 display	Set Selector = 2	I/O field shows VW525 value
Write to VW523	Set Selector = 1, press Write Enable, enter new value	VW523 updates, VW540 follows
Write to VW525	Set Selector = 2, press Write Enable, enter new value	VW525 updates, VW540 follows
Selector = 0 (invalid)	Leave Selector at 0	I/O field holds last value or shows 0
Communication loss	Disconnect Ethernet	I/O field shows "####" with status indicator
Firmware update	Re-image panel	Configuration retained if project transfer uses backup/restore

Troubleshooting Matrix

Symptom	Likely Cause	Resolution
I/O field always shows 0	VW540 not refreshed in scan	Verify multiplexer logic in watch table; ensure SM0.0 contact is used
I/O field shows garbage	Tag data type mismatch	Verify HMI tag is Word, not Bool or DWord
Selector does not change display	Selector tag address wrong	Verify VW550 is bound to the HMI selector element
Write-back writes to wrong tag	Selector evaluated after move	Add edge detection or place write logic in same scan
LOGO! tag not visible on HMI	Variable not HMI-visible	In LOGO! Soft Comfort, set the variable property to HMI visible
S7-200 not connecting to KTP400	PPI/OPC/MPI mismatch	Verify S7-200 PPI cable, baud rate, and station address
Display flickers between values	Multiplexer selector oscillating	Add hysteresis or use edge-triggered selection
Panel shows "####"	Overflow or out-of-range value	Check configured min/max on the I/O field and signedness of the tag
Communication timeout alarm	Bad HMI/PLC connection configuration	Verify PG/PC interface and the HMI connection in TIA Portal

Field-Engineered Best Practices

1. Always perform the multiplexer logic in the PLC. HMI-side scripting is fragile and tied to firmware versions.
2. Use a holding word (for example VW540) and a separate selector word (for example VW550). Do not overwrite the source VW523 or VW525 directly from the I/O field.
3. Document the meaning of the selector values 1, 2, 3 in the HMI screen labels. Use a drop-down list rather than a numeric input for the selector to eliminate operator error.
4. For write operations, implement a separate "write enable" pushbutton in addition to the I/O field to prevent accidental overwrites.
5. For LOGO! 8 deployments, mark all variables intended for HMI visibility explicitly in LOGO! Soft Comfort. Hidden variables cannot be reached from the panel.
6. Reserve a value of the selector (for example 0) to mean "no selection". The PLC should then hold the I/O field value or write a defined safe value.
7. If both VW523 and VW525 are updated every scan, the I/O field will follow whichever is currently selected. Use a one-shot edge trigger (positive or negative edge) on the selector to capture and hold a value if needed.
8. Test the system with the panel in offline simulation (TIA Portal HMI simulation with PLCSIM) before commissioning to avoid runtime surprises.
9. For signed 16-bit values, configure the I/O field limits to -32768 to 32767; for unsigned, configure 0 to 65535. Mismatched limits cause "####" overflow indicators.
10. For high-reliability applications, add a watchdog timeout: if the selector does not change for more than 60 seconds, default the I/O field to VW523 (the higher-priority source).

Comparison: Which Method to Choose

Criterion	Method 1 (PLC Mux)	Method 2 (VBScript)	Method 3 (UDT Array)	Method 4 (SCL Pointer)
Panel type	Any KTP400 / Comfort / Professional	Comfort or higher	Professional	Comfort or higher
Controller type	Any LOGO! / S7-200 / S7-1200 / S7-1500	Any	S7-1200 / S7-1500	S7-1200 / S7-1500
Code footprint	Small (10 lines ladder)	Small (VBScript)	Medium (UDT + array)	Large (FB + Variant)
Determinism	High (scan-based)	Medium (event-based)	High (scan-based)	High (scan-based)
Maintainability	Excellent	Fair (firmware-tied)	Good	Good (advanced)
Field-recommended?	Yes (default)	For Comfort+ panels only	For S7-1200/1500 with Professional HMI	For complex parameterised selection

FAQ