Siemens MP277 S7-300 Recipe Management: OPC Batch Buffer in SCL

David Krause13 min read
S7-300SiemensTechnical Reference
Licensed PE Working through this on a live machine? A Maine-licensed engineer can take it from here — included with IMD hardware, by the hour for everything else. Book an engineer

Overview

This reference documents a production recipe and batch management architecture built around a Siemens SIMATIC MP277 multi-panel, a CPU 317-2 PN/DP controller, and an office-level MS Access database. The pattern is deliberately PLC-centric: all recipes and batch jobs live in the S7-300 work memory so that a loss of network connectivity to the office PC cannot corrupt the production schedule. The HMI acts as a thin client, and OPC DA on the MP277 acts as the bridge between the office network and the automation cell.

The design answers three engineering questions that typically come up on this hardware generation:

  1. Should the recipe data live on the MP277 (WinCC Flexible recipe system) or in the S7-300 CPU?
  2. How do you expose the S7 tags to an office PC without paying for a separate OPC server?
  3. How much load memory and work memory does a custom PLC recipe buffer actually consume, and when does the design break down?

The remainder of the article gives a defensible answer to each, with parameter tables, SCL code fragments, commissioning checks, and a migration path forward to the S7-1500 generation.

System Architecture

The reference cell follows a strict three-layer model. Layering matters because the office PC, the HMI, and the PLC all have different availability and ownership characteristics, and a recipe system that crosses all three must be designed around the weakest link.

Layer Hardware Role Authoritative Data?
Office / ERP Windows PC + MS Access Recipe authoring, batch creation, order release Yes (master)
HMI / Edge SIMATIC MP277 10" Touch OPC DA server, operator display, recipe view Cache only
Control S7-300 CPU 317-2 PN/DP Batch buffer, runtime parameters, SCL state machine Yes (runtime)
Field ET 200S / sensors / drives Physical I/O No

The MP277 317-2PN/DP variant integrates both PROFINET and PROFIBUS DP interfaces, which is the exact part cited on Siemens migration guidance for the S7-300 generation. For the historical context and known caveats when moving from a CPU 318-2 DP to the 317-2 PN/DP architecture, see the official entry "What should you watch out for when migrating from the CPU 318-2 DP to the CPU 317-2 DP and CPU 317-2 PN/DP?".

The data flow is intentionally one-way authoritative on the office side and one-way authoritative on the control side. The HMI only caches; it never holds the only copy of a recipe.

Hardware Bill of Materials

Component Catalog Number (typical) Firmware Tested Notes
CPU 317-2 PN/DP 6ES7 317-2EK14-0AB0 V3.3 MMC mandatory; 1 MB work memory
MP277 10" Touch 6AV6 643-0CD01-1AX1 WinCC Flexible 2008 SP5 PROFINET interface, OPC DA server
MMC 6ES7 953-8LM20-0AA0 At least 4 MB for recipe buffer
CP 343-1 Lean (optional) 6GK7 343-1CX10-0XE0 Only if the CPU PROFINET port is fully used for I/O
Office PC Windows 7 / 10 MS Access 2010+ front end
Engineering note: The 317-2 PN/DP only has one PROFINET port. If the office network must be physically isolated from the PROFINET I/O ring, use a CP 343-1 Lean on the backplane bus and keep the CPU port dedicated to PROFINET I/O. Mixing office traffic and PROFINET real-time on a single port works but complicates QoS and firewalling.

Recipe Storage: WinCC Flexible Native vs PLC-Stored

This is the central architectural decision. The MP277 running WinCC Flexible 2008 ships with a built-in recipe system that stores records in a CSV file on the panel's internal flash. There is also the option of treating the PLC DB as the recipe store and using the panel as a view.

Criterion WinCC Flexible Recipe PLC DB Buffer (this design)
Storage owner MP277 flash S7-300 work memory (DB)
Loss of HMI Recipes unreadable Recipes still readable; PLC continues
Office-to-PLC data path CSV import/export + OPC tags OPC write directly into DB
Operator editing of records Designed-in Disabled by design
Indexing / looping in SCL Not supported Native with FOR / WHILE
Memory per 10 REALs Negligible (CSV) 40 bytes (10 x 4) plus name string
Memory per 1000 records x 200 REALs ~few MB CSV 800 kB DB

For this design the choice is the PLC-stored buffer because the operator is not authorized to edit parameters. Recipes are engineered in the office, released to the cell, and the operator only starts jobs. Native WinCC Flexible recipes invite parameter edits the procedure is trying to prevent.

Memory Sizing Calculation

Before writing any code, size the DB. The rule of thumb in STEP 7 V5.x is: every REAL consumes 4 bytes, every INT consumes 2 bytes, every BOOL consumes 1 byte but pads to the next even byte, and every STRING[n] consumes (n + 2) bytes for the S7-300 string header.

Use the closed-form estimate:

DB_size_bytes = N_records * ( SUM(REALS) * 4 + SUM(INTS) * 2 + SUM(STRINGS_i) * (LEN_i + 2) + 2 )

Reference example from a deployed system: 99 records x 50 REALs = 99 * (50*4) = 19,800 bytes, plus 99 x STRING[20] = 99 * 22 = 2,178 bytes. Total approximately 22 kB. That fits comfortably inside the 1 MB work memory of the 317-2 PN/DP with 99.7 percent of memory still free for cyclic tasks and diagnostic buffers.

Examine the scaling limit. If the design ever needs 1,000 records with 200 REALs each, that is 800 kB plus string overhead, which still fits the 317-2 PN/DP work memory but consumes more than 80 percent of usable space and is the point at which migration to a 317-2 DP with 4 MB or an S7-1500 becomes mandatory. The Siemens migration guide "Guide for Migrating SIMATIC S7-300/S7-400 to SIMATIC S7-1500" covers the sizing and topology change in detail.

SCL Implementation: Batch Buffer

The SCL below implements three structures: an in_buffer that holds the next batch job pushed by the office, a batch_list with 50 fixed slots, and a current_job that mirrors the slot the operator has armed. SCL is preferred over ladder for the index-based scan because a FOR loop over an array of UDTs is far shorter than 50 rungs of indirect addressing.

// DB901 - Recipe Definitions (UDT 901 = 10 REALs + STRING[20])
// DB902 - Batch List (ARRAY[1..50] OF UDT 901)
// DB903 - In Buffer (UDT 901)
// DB904 - Current Job (UDT 901)

FUNCTION_BLOCK FB901 "BatchManager"
VAR
    i         : INT;                // loop index
    emptySlot : INT;                // first free slot in batch_list
    armedSlot : INT := 0;           // slot operator has armed
END_VAR

BEGIN

    // --- 1. ACCEPT IN_BUFFER INTO BATCH_LIST ---
    IF "in_buffer_valid" = TRUE AND "office_release" = TRUE THEN
        emptySlot := 0;
        FOR i := 1 TO 50 DO
            IF "batch_list".slot[i].used = FALSE AND emptySlot = 0 THEN
                emptySlot := i;
            END_IF;
        END_FOR;

        IF emptySlot > 0 THEN
            "batch_list".slot[emptySlot] := "in_buffer";
            "batch_list".slot[emptySlot].used := TRUE;
            "in_buffer".used := FALSE;        // clear handshake
            "in_buffer_valid" := FALSE;        // office may now write the next
        ELSE
            "alarm_batch_list_full" := TRUE;   // raise operator alarm
        END_IF;
    END_IF;

    // --- 2. ARM A BATCH (operator button) ---
    IF "cmd_arm_batch" = TRUE THEN
        armedSlot := "hmi_selected_slot";
        "current_job" := "batch_list".slot[armedSlot];
        "cmd_arm_batch" := FALSE;
        "cmd_machine_reset" := TRUE;          // machine adjusts to new params
    END_IF;

    // --- 3. RELEASE A BATCH (after last piece) ---
    IF "cmd_release_batch" = TRUE THEN
        IF armedSlot > 0 AND armedSlot <= 50 THEN
            // zero the slot so it can be reused
            FOR i := 1 TO 10 DO
                "batch_list".slot[armedSlot].param[i] := 0.0;
            END_FOR;
            "batch_list".slot[armedSlot].name := '';
            "batch_list".slot[armedSlot].used := FALSE;
        END_IF;
        armedSlot := 0;
        "current_job".used := FALSE;
        "cmd_release_batch" := FALSE;
    END_IF;

END_FUNCTION_BLOCK

Three implementation rules to keep this code maintainable:

  1. Use a UDT for the recipe record, not parallel arrays. A change in parameter count then propagates to every slot automatically.
  2. Handshake with the office through two booleans (in_buffer_valid + office_release), not by polling the same byte. This protects against partial writes if the OPC link drops mid-record.
  3. Never let the office overwrite an armed slot. Either freeze the slot from office writes while armedSlot <> 0, or copy in_buffer to the slot on accept as shown above and never expose the slot itself to OPC.

OPC Communication Layout

The MP277 317-2PN/DP runs an OPC DA 2.05 server internally. The office PC acts as an OPC DA client, and the S7-300 is reachable from the panel as a tagged connection. The minimum tag surface for the office is shown below.

OPC Item (DA Item ID) PLC Symbol Direction Data Type Trigger
DB903.in_buffer.name DB903.name Office -> PLC STRING[20] On Release
DB903.in_buffer.param[1..10] DB903.param Office -> PLC REAL[10] On Release
DB903.in_buffer_valid Office -> PLC BOOL On Release
DB902.slot[1..50].used DB902.slot.used PLC -> Office BOOL[50] Cyclic 1 s
DB902.slot[1..50].name DB902.slot.name PLC -> Office STRING[20] Cyclic 1 s
DB904.current_job.name DB904.name PLC -> Office STRING[20] On change
DB904.current_job.pieces_done DB904.pieces_done PLC -> Office DINT On change
PLC.alarm_batch_list_full PLC -> Office BOOL On change

Recommended update rates on the OPC client: 100 ms for state flags and 1,000 ms for full slot lists. The MP277 OPC server is comfortable at this rate; pushing 50 slot records at 100 ms saturates the panel's user interface thread and causes screen redraw stalls.

Security note: The MP277 OPC DA server has no built-in authentication. Either deploy it on a physically isolated VLAN or front it with a VPN concentrator. Do not expose port 135 / 1024-65535 (OPC DA dynamic port range) to a corporate LAN without controls.

HMI Integration with WinCC Flexible

The operator screen set is intentionally minimal: a Batch Overview that lists all 50 slots, an Arm button, a Release button, and a parameter view that mirrors DB904.current_job.

Screen Elements Tags Events
Batch Overview List view (50 rows) DB902.slot[1..50].used, .name OnClick -> set hmi_selected_slot
Arm Button "Call Batch" cmd_arm_batch, hmi_selected_slot SetBit cmd_arm_batch
Release Button "Release Batch" cmd_release_batch SetBit cmd_release_batch
Parameters 10 I/O fields, read-only DB904.current_job.param[1..10]
Status bar Alarm word alarm_batch_list_full

To make the 50-row list manageable, build it with multiplex tags in WinCC Flexible. Define an index tag list_index (INT) and an array of pointer tags, then refresh on a 500 ms schedule. The alternative of manually placing 50 list views is brittle and consumes panel area memory.

Migration to S7-1500 / TIA Portal

When the recipe count grows, the office network expands, or the MP277 enters its end-of-service window, plan the migration. The STEP 7 V5.x project that owns FB901 and DB902..DB904 can be converted with the TIA Portal migration tool, but the UDT syntax and OPC surface require manual re-work.

Step-by-step:

  1. Open the STEP 7 V5.6 project and run File > Migration > TIA Portal. This produces a .am20 file the TIA Portal can read. See the official guide "Migration of STEP 7 projects (S7-300, S7-400) - TIA Portal".
  2. Replace the S7-300 STRING[20] S7 string header with the S7-1500 variant. The byte length is identical (n + 2) but the optimized block access setting will re-pack the DB.
  3. Re-validate the FB901 loop bounds; the 1500 CPUs accept 32-bit loop counters natively and skip the implicit INT-to-DINT conversion warnings.
  4. Migrate the WinCC Flexible 2008 project to WinCC Comfort / TIA Portal. The OPC server surface remains OPC DA on the Comfort Panel, but item IDs change to the TIA Portal syntax.
  5. Update the office MS Access VBA client to point at the new OPC item names.

For a forward-looking reference of the 1500 hardware, the migration guide "Guide for Migrating SIMATIC S7-300/S7-400 to SIMATIC S7-1500" provides a complete catalog of removed and changed features.

Verification and Commissioning

Run this 10-point checklist before handing the cell to production.

  1. Power up the CPU 317-2 PN/DP with the MMC inserted. Verify SF / BF LEDs are off and RUN is solid green.
  2. In STEP 7, download HW Config and the S7 program. Open DB902 online and confirm 50 slots of zeros.
  3. Force in_buffer_valid FALSE; push 51 records from the office OPC client. Verify slot 51 raises alarm_batch_list_full and is not stored.
  4. Force in_buffer_valid TRUE for one record; verify the slot populates and the in_buffer.used flag clears within one OB1 cycle.
  5. From the MP277, select slot 3 and press Call Batch. Verify current_job mirrors slot 3 and that cmd_machine_reset pulses for one cycle.
  6. Run the machine through the full batch; verify the piece counter increments and the slot becomes free after Release.
  7. Pull the office network cable mid-batch. Verify the running batch completes and cmd_release_batch still works locally.
  8. Reconnect the office network. Verify the next released batch appears in the next free slot.
  9. Force a power loss on the MP277 only. Verify the PLC still has all 50 slots intact in DB902 after restoration.
  10. Force a power loss on the PLC. Verify after restart that DB902 is reloaded from MMC with the last persisted state and the MP277 OPC server reconnects within 30 s.

Troubleshooting Matrix

Symptom Likely Cause Diagnostic Fix
Office writes succeed in OPC scout but in_buffer never populates in_buffer_valid not toggled by office client Watch DB903.in_buffer_valid online; check VBA client Add SetBit in MS Access after successful Write
Alarm batch_list_full permanent Office client fills buffer faster than release Count slot[1..50].used; check piece counter Reduce release gap or raise slot count from 50 to 100
Current_job shows zeros after Arm cmd_arm_batch pressed before slot populated Watch DB902.slot[hmi_selected_slot].used Disable Arm button when selected slot is empty
OPC DA client gets E_ACCESSDENIED DCOM not configured on Windows client dcomcnfg -> OPCEnum and Siemens OPC DA Server Enable anonymous access on OPCEnum, restart service
MP277 screen redraws slowly with 50-row list Update rate too aggressive WinCC Flexible diagnostics -> Cycle time Drop list update to 1 s; use multiplex index
Recipe lost after PLC restart DB marked as non-retentive; MMC not present STEP 7 -> DB Properties -> Retain Enable Retain on DB902 and DB904; verify MMC
Office sees stale slot[].used flags Cyclic OPC rate too slow; subscription dropped OPC scout -> subscription state Raise subscription keepalive to 5 s; reduce client read rate to 1 s

Field-Proven Caveats

Three observations from deployed systems that are not in the manuals.

  1. MMC wear. Every recipe release triggers a DB write. With 200 batches per shift, the work memory write is not the issue, but if the project also uses recipes for trace logging, prefer to keep the recipe DB in work memory and copy to a separate log DB only on batch close. This avoids unnecessary MMC writes that shorten card life.
  2. STRING[20] alignment. The S7-300 places STRING[20] at even byte boundaries inside a DB. If a recipe record mixes REALs and STRINGs without a UDT, the layout can be 2 bytes off. Always define a UDT and use the UDT as the DB row type to keep alignment automatic.
  3. OPC DA vs OPC UA. The MP277 OPC DA server does not speak OPC UA. If the office network is required to use OPC UA, install a third-party DA-to-UA bridge (for example, a Softing dataFEED OPC Suite or Kepware) rather than trying to add a UA server to the panel.

Frequently Asked Questions

How much work memory does a 50-slot buffer with 10 REALs and a 20-character name consume?

Approximately 3.3 kB: 50 slots x (10 REALs x 4 bytes + STRING[20] x 22 bytes) = 50 x (40 + 22) = 3,100 bytes plus a small per-slot used flag, totaling about 3.3 kB. This fits inside the 1 MB work memory of a CPU 317-2 PN/DP with 99 percent of memory still free.

Can the office PC write directly to the S7-300 without going through the MP277?

Yes, but it requires a separate OPC server such as SIMATIC NET OPC on a CP 343-1 or a third-party server. The MP277 design is preferred when no extra server hardware is justified, the office network is small, and a single OPC bridge point is acceptable.

Why use SCL instead of ladder for the batch manager?

FOR loops over an array of UDT instances are a one-line construct in SCL but require multi-rung indirect addressing in ladder. The batch manager scans 50 slots per cycle for an empty slot; in ladder this is 50 rungs of pointer arithmetic, in SCL it is a 6-line FOR loop. Maintenance cost drops accordingly.

What happens to in-flight batches if the office network drops?

Nothing. The batch_list DB in the PLC is the authoritative source at runtime. The office network is only consulted when releasing a new batch into the in_buffer. Loss of the office link cannot stop, abort, or modify a running batch.

When should the design be migrated off the MP277 and S7-300?

Plan migration when any of these become true: the recipe count exceeds 1,000 records, the office network must use OPC UA, the panel firmware is no longer covered by Siemens security updates, or the 317-2 PN/DP work memory usage exceeds 80 percent. The TIA Portal migration tool converts the STEP 7 V5.x project, and the S7-1500 with a Comfort Panel drops in as a like-for-like successor.

Back to blog