Siemens S7-300 WinCC Flexible AND-Gate HMI Button Logic

Overview

This procedure describes a complete implementation of a Boolean AND-gate on a SIMATIC S7-300 CPU whose two inputs are operator push-buttons drawn on a WinCC Flexible runtime screen, and whose output drives both an HMI indicator (a circle that flips from red to green) and a physical output on the digital output module. The technique demonstrated - ladder AND of two HMI toggle bits plus a tag-driven appearance animation - is the foundational pattern for any HMI-controlled interlock, permissive, or start-enable logic on a S7-300 / S7-400 station programmed with STEP 7 V5.x and visualised with WinCC Flexible 2008 or WinCC Flexible 2008 SP3.

The pattern is intentionally simple, but each layer is described in engineering field-notes detail: the STEP 7 ladder network, the WinCC tag database, the button event configuration with toggle (set/invert) behaviour, the appearance animation, the compiled runtime download, and the on-line verification procedure. The same approach is reusable for start-permissive buttons, guard-door interlocks, two-hand control, and light-curtain arm/disarm logic, with the only variation being the action taken in the AND rung.

Prerequisites

• SIMATIC S7-300 station (CPU 31x or CPU 31xC, e.g. CPU 314, 315-2 DP, 317-2 PN/DP) running a valid firmware for the project's MW/STL/FBD editor. STEP 7 V5.5 SP4 or V5.6 is the typical engineering tool. The reference manual is SIMATIC S7-300 CPU 31xC and CPU 31x Operating Instructions.
• STEP 7 V5.5 (or V5.6) with the S7-300 hardware catalog installed.
• WinCC Flexible 2008 SP3 (or SP5) installed on the same engineering PC. WinCC Flexible is required for the SIMATIC Panel family (OP 77B, TP 177, MP 177, MP 277, MP 377). The reference is the WinCC Flexible 2008 User Manual.
• A wired MPI, PROFIBUS, or PROFINET connection between the panel and the S7-300 CPU. The PG/PC interface must be set to the same subnet (e.g. PC Adapter USB A2 for MPI/PROFIBUS, or TCP/IP for the built-in PROFINET port of the 31x-2 PN/DP CPUs).
• At least one digital input module (SM 321, e.g. 6ES7321-1BH02-0AA0) wired to two momentary switches on inputs I124.0 and I124.1 (the discussion uses the German E124.0 / E124.1 convention - "E" = Eingang = input) and one digital output module (SM 322, e.g. 6ES7322-1BH01-0AA0) whose channel Q124.0 is wired to a 24 V indicator lamp.
• Operator account on the panel with the rights to operate the screen buttons and acknowledge alarms. The default "User" group is sufficient for the two buttons used here.

Hardware and I/O Address Planning

The Boolean signal flow for this application is:

  HMI Button 1 (toggle) --> M0.1  --|
                                     |-- AND (U / A) --+--> M0.0 (HMI tag) -- Q124.0 (lamp)
  HMI Button 2 (toggle) --> M0.2  --|                   |
  Physical DI 124.0     --> I124.0 -+                   |
  Physical DI 124.1     --> I124.1 -+                  

For a clean, expandable implementation use the following absolute and symbolic address table. WinCC Flexible and STEP 7 share the same symbol table when the HMI is integrated in the STEP 7 project; symbols entered in STEP 7 propagate to the HMI tag dialog and pre-fill the Address field.

The German address notation (E/A) used in the original question is the IEC alternative: E = Eingang (input), A = Ausgang (output), M = Merker (flag/internal). STEP 7 displays both German and international addresses side-by-side by default in the program editor.

STEP 7 AND-Gate Implementation

Open the STEP 7 project containing the S7-300 station. Insert a new network (Network 1) into OB1 (or any cyclic OB). The simplest implementation is a single FBD/LAD AND instruction:

FBD view:

  |---I124.0---M0.1---(  &  )---M0.0---(  )---Q124.0
                         AND       Assign   Output

LAD view (the canonical implementation):

  |    I124.0     M0.1        M0.0        Q124.0
  |--| |--------| |-----------( )----------( )--
  |                          +---( )---+     
  |                          |   M0.1  | (self-hold if required)
  |                          +---| |---+

STL view (the lowest-level view, useful on S7-300 CPUs that do not allow LAD on every network):

  Network 1: AND of two operator inputs and two physical inputs
      U     I124.0         // physical switch 1
      U     I124.1         // physical switch 2
      U     M0.1           // HMI button 1 toggle bit
      U     M0.2           // HMI button 2 toggle bit
      =     M0.0           // AND result, used as HMI tag source
      =     Q124.0         // drive the physical lamp

  Network 1: AND-gate with two HMI toggle inputs
      U     M0.1
      U     M0.2
      =     M0.0
      =     Q124.0

Save the block (Ctrl+S), download the hardware configuration (HW Config) and the program to the CPU (PLC -> Download to Target System), and place the CPU in RUN. The M0.0 / Q124.0 bit is now live; the WinCC configuration below brings the operator side online.

WinCC Flexible Tag Configuration

WinCC Flexible connects to STEP 7 in two ways:

1. Integrated (recommended): WinCC Flexible is launched from inside STEP 7 (Start -> SIMATIC -> WinCC Flexible). The project tree shows the S7-300 station as a peer, and the HMI tag dialog reads the STEP 7 symbol table directly. Selecting a STEP 7 symbol in the HMI tag editor pre-fills the Address field with the corresponding absolute address.
2. Stand-alone: WinCC Flexible is launched as its own application and the connection to the S7-300 is configured manually via the "Connections" editor. Tags must be entered with their absolute address.

In both cases, three tags are required for the AND-gate application:

In the WinCC Flexible project tree, open Communication -> Connections and verify:

• Name: PLC_S7300
• Driver: SIMATIC S7 300/400
• Online status: the panel must show the connection as Online after the HMI runtime starts
• HMI device address / PLC address: match the MPI/PROFINET station numbers

In Project -> HMI Tags, create the three tags above. For each tag set Acquisition mode = Cyclic in operation and Cycle = 500 ms. The default is acceptable for human-speed buttons; tighten to 100 ms if the application requires faster debounce or display update.

HMI Button Configuration (Toggle Behaviour)

The two operator buttons must implement a toggle on click behaviour: the first click sets the bit to 1 and it must stay 1 after the operator releases the button; the second click resets the bit to 0. STEP 7 / WinCC Flexible does not provide a single "toggle" event function, but the Edit Bits -> InvertBit function list gives the exact semantics.

For Button 1:

1. Draw a button on the screen (Tools -> Button, or drag from the object library).
2. Open the button's Properties dialog. In the General tab set the Mode to "Switch" (not "Momentary"). This ensures that the visual state of the button follows the PLC bit, which lets the operator see whether the button is currently latched.
3. In the General -> Selected/Deselected appearance fields, set the button label to "Button 1" and optionally bind the "Pressed" graphic to a depressed-image.
4. Open the Events tab. WinCC Flexible exposes two relevant events: Click (fires while the operator presses the button) and Press (fires once on the down-stroke). The Click event is the correct event for a latching toggle.
5. Under Click add a new function list and choose Edit Bits -> InvertBit. In the parameter dialog, select the tag HMI_Button1_State (address M0.1).
6. Optionally, under Click also add Edit Bits -> SetBit on M0.1 and Edit Bits -> ResetBit on M0.1 in the Release event for a "press-hold-release" style. For a true latching toggle, the InvertBit on Click alone is sufficient and is the pattern used in the original application.

For Button 2, repeat the steps above with the tag HMI_Button2_State (address M0.2).

Alternative implementations:

• SetBit on Press, ResetBit on Click of the same button: acts as a one-shot (impulse) - not appropriate for a latching toggle.
• Toggle variable in the PLC: implement the toggle in STEP 7 by detecting a rising edge on the button-click event flag and writing the inverted state to a "latched" flag. This is the recommended pattern on S7-1200 / S7-1500 in TIA Portal where the panel writes to a "request" bit and the PLC owns the latched state.

HMI Circle Animation (Appearance Change)

The "circle that turns green" is implemented with the Animations -> Appearance property of a Circle object:

1. Insert a Circle (Tools -> Circle) on the same screen as the two buttons.
2. Open Properties -> Animations and add a new Appearance animation.
3. In the animation dialog:
   • Tag: HMI_AND_Result (M0.0)
   • Trigger: Cyclic, 500 ms (or Continuous for sub-second update)
   • Value range: 0 to 1
   • Appearance at value 0: Background color = red, line color = dark red
   • Appearance at value 1: Background color = green, line color = dark green
4. To make the value transition visible, add a second animation Visibility on a separate "OFF" label that is visible when M0.0 = 0, and an "ON" label visible when M0.0 = 1.
5. To animate a text caption alongside the colour, add a Text animation on the same tag and set two strings: "AND = 0" at value 0 and "AND = 1" at value 1.

The HMI runtime re-evaluates the appearance every acquisition cycle. With a 500 ms update and a typical operator response time of more than 1 s, the animation will appear to follow the bit state without perceptible lag.

Compiling, Downloading, and Verification

The download sequence is order-sensitive on the S7-300 / WinCC Flexible stack:

1. Compile WinCC Flexible project: Project -> Compiler -> Check Consistency. Resolve all warnings - WinCC Flexible refuses to start the runtime if any tag is missing a connection.
2. Transfer WinCC Flexible runtime to the panel: Project -> Transfer -> Transfer. The panel must be in Transfer mode (on most MP/Comfort panels this is the white "Transfer" button on the rear, or via the panel's main menu: Start -> Settings -> Transfer). For Ethernet transfer, configure the panel's PG/PC interface and the panel's own IP address in the same subnet.
3. Download STEP 7 program to the CPU: Open HW Config and the program blocks, then PLC -> Download to Target System -> CPU 315-2 PN/DP. The CPU is automatically restarted unless "Download in RUN" is explicitly selected.
4. Verify connectivity: On the panel, open the Connections diagnostic view (Start -> System -> Connections). The status column for PLC_S7300 must read Online.

On-line verification checklist:

Program-side verification in STEP 7 VAT (Variable Table):

Create VAT_1 with the columns Symbol, Address, Format, Status. Monitor M0.0, M0.1, M0.2, Q124.0 in real time while operating the panel. Toggle the two buttons and confirm the M0.0 column switches to 1 only when both M0.1 and M0.2 are 1.

Troubleshooting Matrix

Advanced Variations

Real output module in lieu of a flag. If a physical LED is wired to Q124.0, replace the flag M0.0 in the HMI tag dialog with the absolute output address Q124.0. The HMI will read the same bit the rung is writing, but the latency is one PLC cycle (~10 ms) faster than a flag because no extra bit is needed.

Three- or four-input AND. Extend the rung with `U M0.3` and `U M0.4` for buttons 3 and 4, and add the corresponding tags and buttons. The same appearance animation handles any number of inputs without modification, as long as M0.0 is still the AND of all of them.

Edge-triggered latching. Replace the `=` (assign) coil of M0.0 with a Set/Reset flip-flop:

      U     M0.1
      U     M0.2
      S     M0.0           // latch on AND
      UN    M0.1
      O     UN  M0.2       // clear when either input goes off
      R     M0.0

This keeps the lamp on after both buttons have been released, and clears it on the first input to fall. Add a third HMI button to manually reset if required.

Three-way indicator (red / yellow / green). Animate the circle's Background color with three values: 0 -> red, 1 -> yellow, 2 -> green. Bind to a tag of type BYTE (e.g. MB0) that is set to 0, 1 or 2 by the rung based on the AND result plus a partial AND. This is the conventional Siemens permissive indicator (red = unsafe, yellow = armed, green = running).

Migrating to TIA Portal. The same logic, with the same tag names, is built in TIA Portal V16 or later. The Comfort Panel configuration is in WinCC Comfort inside the TIA project. The button InvertBit function is still present. The main difference is that the HMI is added to the project as a "HMI device" peer of the S7-300 in the Devices & Networks editor, and the connection is configured on the HMI side. The S7-300 is a "non-TIA" station - it can be migrated with the "Migrate project" wizard to a TIA V16 project and edited there.

Field Commissioning Notes

• The S7-300 default Merker (flag) range is MB0..MB15, with byte MB0 holding M0.0..M0.7. Avoid MB0..MB1 if the project uses a retentivity configuration, as flags in this range are non-retentive by default in the S7-300 CPU. For retentive latches, move the AND result to a retentive bit (e.g. M200.0) and configure retentivity in the CPU properties (HW Config -> CPU -> Retentive Memory -> Merker ab MB200).
• The SM 322 output module typical on S7-300 (e.g. 6ES7322-1BH01-0AA0) sources 0.5 A per channel. A 24 V indicator at 20 mA is well within spec; a relay coil at 50 mA is also within spec. If the load is a heavy relay, fit a flyback diode (1N4007) across the coil.
• For the digital inputs on SM 321, the rated input voltage is 24 V DC; the type-1 input supports 0..5 V = "0" and 15..30 V = "1". A mechanical switch with bounce will be filtered by the module's 1.6 ms input filter; this is normally desirable. Software debouncing in the CPU is not required for the HMI button application.
• The WinCC Flexible runtime licensing is keyed to the panel. After building the project, the License Key must be installed on the panel via ProSave or the transfer dialog. A missing license shows a yellow warning banner at the top of the screen at runtime, and the HMI is in demo mode - it operates for 30 days and then stops.
• For projects that will be archived, always store both the STEP 7 source (.s7p) and the WinCC Flexible source (.hmi) in the same folder. The panel's compiled runtime (.fwx) is regenerated at transfer time and is not the authoritative project source.

FAQ