Siemens WinCC: Why You Cannot Write to PLC Input I0.1 from HMI

1. Problem Overview

Engineers commissioning Siemens WinCC (WinCC flexible 2008, WinCC V7, or TIA Portal WinCC) panels against S7-300 / S7-400 controllers frequently attempt to "force" or "set" a digital input such as I0.1 directly from an HMI button. The HMI button is configured with the SetBit event and the tag points at the input address. In every documented case the bit never latches, and the operator sees the input remain 0 regardless of how many times the button is pressed. Status bits (Q addresses) read back correctly, so the WinCC-to-PLC connection itself is healthy.

This article documents the root cause, the proper substitute architecture (flag-bit / Merker / DB bit with parallel logic in the PLC program), and the exact WinCC tag and STEP 7 configuration required to simulate a physical input from an HMI panel without modifying the original machine program in any meaningful way.

2. Root Cause: The S7 Scan Cycle Owns the I Image

Every SIMATIC S7 CPU executes a deterministic scan cycle. For an S7-300 with the default scan order, the cycle is documented in the S7-300 Automation System, CPU 31xC and CPU 31x Operating Instructions and is summarized as:

1. CPU writes the Process Image of the Outputs (PIQ) to the physical output modules.
2. CPU reads the physical input modules into the Process Image of the Inputs (PII) - this is the only event that sets bits in I, IB, IW, and ID.
3. CPU executes the user program in OB1, FCs, and FBs, top to bottom.
4. Operating system runs self-test, communication, and time-of-day interrupts.
5. Cycle restarts at step 1.

The PII is a memory area in the system memory of the CPU that is refreshed once per cycle from the input modules. The HMI writes through a PUT/DPWRDAT or through the configured S7 connection to the same system memory area, but the very next OB1 cycle overwrites any value the HMI wrote. The bit therefore appears to "immediately fall back to zero." This is identical to writing to an output from the user program at one location while another location clears it within the same scan; the last write wins, and the I image is always reloaded from the hardware.

3. Why HMI Tag Writes to I0.1 Always Fail

When a WinCC tag is configured with the address I 0.1 (WinCC notation) or EW0 / Bit 1 (STEP 7 notation), the panel sends a write request over the MPI/PROFINET/Industrial Ethernet connection. The CPU accepts the request and writes the byte into the PII. Within milliseconds the next OB1 cycle starts, the CPU reads input module 0 byte 0 from the backplane, and your write is gone. Operators may briefly see I0.1 = 1 in the tag status, but logic that reads I0.1 in the same scan will never see the forced value, and external monitoring of the physical terminal shows no voltage change.

The pattern is not a WinCC bug. It is the documented behavior of the S7 memory model. The same restriction applies to the Output area in a different way: writing Q0.0 from an HMI while OB1 also writes Q0.0 produces a race condition whose resolution is undefined.

4. The Correct Architecture: Flag-Based Input Simulation

The standard Siemens solution to "I need an HMI button to behave like a wired pushbutton on a specific input" is to keep the physical input wired and add a parallel flag (Merker, M area) in the ladder or FBD. The HMI writes the Merker; OB1 ORs the Merker with the real input; downstream logic sees the same result as if the physical switch had been pressed.

// STEP 7 FBD/segment logic substitute
// Network 1: simulate I0.1 from HMI
//     I0.1 (real sensor) ----+-- ( ) -- I0.1_sim
//     M0.1   (HMI flag)   ----+           (intermediate marker)
//     ---( )-- I0.1_sim, used downstream wherever I0.1 was used

Why this is the only safe pattern:

• It is non-invasive: the original I0.1 wiring is untouched, the original logic referencing I0.1 is untouched, and a single new network ORs in the substitute.
• It is deterministic: the OR is evaluated every scan, so the HMI can set the flag at any point in the cycle and the next scan picks it up.
• It is reversible: disconnect the OR branch or add a feature bit to enable/disable HMI override without changing the I/O list.
• It is multi-HMI safe: if six panels all write the same M0.1, last-writer-wins is acceptable for a momentary pushbutton simulation. If six panels try to write the same I0.1, the race is invisible because the CPU always overwrites the value.

5. Prerequisites

• STEP 7 V5.4 SP5 or later, with the original S7-300/400 program open or at least the symbol table editable online.
• WinCC flexible 2008 SP3 (or WinCC V7, TIA Portal WinCC) installed, with the project that connects to the target PLC.
• Configured S7 connection in WinCC flexible (MPI, PROFIBUS, or PROFINET) with the same rack/slot as the target CPU. Verify by reading any Q address successfully on the panel.
• Authorization to add one network to OB1 and one DB or Merker in the symbol table. If the original program is locked or compiled to a memory card without source, the flag can still be added by writing to a free Merker (M) byte from the HMI and using the existing free address space in the program.

6. Step-by-Step: Add the Substitute Flag in STEP 7

1. Open the S7 project in STEP 7 and open the symbol table (Options > Symbol Table).
2. Add a new symbol:
   Symbol: HMI_I0_1_SIM
Address: M 0.1
Data type: BOOL
   Comment: HMI substitute for digital input I0.1
3. If you also need a downstream "logical I0.1" that combines the real input with the substitute, add:
   Symbol: I0_1_LOGIC
Address: M 10.0
Data type: BOOL
   Comment: OR result of I0.1 and HMI_I0_1_SIM, used wherever I0.1 was referenced
4. Open OB1 and insert a new network (Network 7 in this example):
   

   Network 7:  HMI override for I0.1
     A   I0.1            // physical sensor
     O   M0.1            // HMI substitute (HMI_I0_1_SIM)
     =   M10.0           // I0_1_LOGIC, used downstream

5. Find every existing reference to I0.1 in OB1, FCs, and FBs. Right-click and use Replace Address to change I0.1 to M10.0 (I0_1_LOGIC). Keep one reference to the raw I0.1 in the new Network 7.
6. Save and download to the CPU. Use Download in RUN if the process is running and the new network does not affect a critical path. STEP 7 will warn about STOP -> RUN if the CPU is in RUN-p mode and the change is not in an FB with multiple instance capability.

7. Step-by-Step: Configure the WinCC Tag and Button

1. In WinCC flexible 2008, open the project and select Communication > Connections. Double-check that the configured connection matches the CPU rack and slot, and that the protocol is one of MPI, PROFIBUS DP, or PROFINET (Industrial Ethernet). See the WinCC flexible 2008 Communication manual for the connection parameters per CPU type.
2. Open Tags and create a new tag:
   Name: HMI_I0_1_SIM
Connection: <your S7 connection>
Address: M 0.1 (WinCC flexible notation, not I 0.1)
   Data type: Bool
Acquisition cycle: 500 ms (or 100 ms for fast response)
   Comment: HMI override for input I0.1
3. Open the screen where the pushbutton is placed (or add a new button). On the Events tab, configure:
   Press event -> SetBit -> Tag: HMI_I0_1_SIM -> (no value, BOOL self-references the bit)
   Release event -> ResetBit -> Tag: HMI_I0_1_SIM
   This gives a momentary pushbutton behavior that mirrors a real wired switch.
4. For a maintained (latching) button, use Toggle with a small script, or use two buttons, one SetBit and one ResetBit. The Toggle event is documented in Siemens Application Example 24109937 for similar patterns.
5. Compile the project and transfer to the panel. The runtime should now show the bit toggling correctly in the WinCC tag status, and the PLC logic that references M10.0 (I0_1_LOGIC) will see the simulated input.

8. Verification

1. Online in STEP 7, open OB1 and monitor Network 7. Press the HMI button; M0.1 should go to 1 within one acquisition cycle (default 500 ms), and M10.0 should follow.
2. Release the HMI button. M0.1 returns to 0; M10.0 follows only if the real I0.1 is also low.
3. Physically disconnect the sensor wire from input terminal I0.1. The HMI button should still drive the logic downstream of M10.0. This proves the substitute is independent of the real input.
4. Reconnect the sensor and drive it physically. The HMI button should be OR-able with the physical input (both can be active at once).
5. Watch the cycle-time OB1 statistics (Tools > Operating Mode > Module Information) and confirm that adding the OR network has not pushed the cycle above the configured maximum cycle time (default 150 ms on an S7-313C, 600 ms on an S7-416).

9. Advanced: Using a Data Block Instead of a Merker

For larger panels with many simulated inputs, prefer a dedicated instance DB over Merker bytes. The reason is symbolic clarity and the ability to download a single DB without affecting the rest of the program. A typical layout:

DATA_BLOCK "HMI_Overrides"
  STRUCT
    I0_0_SIM : BOOL;   // DB1.DBX0.0
    I0_1_SIM : BOOL;   // DB1.DBX0.1
    I0_2_SIM : BOOL;   // DB1.DBX0.2
    I0_3_SIM : BOOL;   // DB1.DBX0.3
    Panel_OK : BOOL;   // DB1.DBX0.4 - heartbeat from HMI
  END_STRUCT;
END_DATA_BLOCK;

In WinCC, point the HMI tag at DB1.DBX0.1 instead of M0.1. The OR in OB1 changes to:

Network 7:  HMI override for I0.1
  A   I0.1
  O   DB1.DBX0.1
  =   M10.0

10. Edge Cases and Field-Proven Caveats

11. Safety and Engineering Discipline

HMI-driven input simulation must never be used to bypass a safety-rated device (E-stop, light curtain, guard interlock). The S7 F-CPU variants (CPU 315F, CPU 416F) handle fail-safe I/O in a separate I image called the fail-safe I image; HMI writes to that area are not allowed by the F-runtime and the F-system will enter PASSIVATION if the safety signature is violated. Use the substitute-flag pattern only for operational inputs that do not participate in a safety function.

Document every HMI-owned flag in the project symbol table with a comment prefix such as [HMI-OVR]. During code review, the reviewer can grep for the prefix and confirm that no HMI override feeds a safety-relevant signal. This practice is borrowed from PLC coding standards (IEC 61131-3 naming conventions) and is especially important when more than one engineer maintains the program over the asset's life.

12. Quick Reference Table: HMI-to-PLC Tag Address Rules

13. FAQ