Simulating DBW Tag Values in WinCC 7.4 for Faceplate Color Mapping

When commissioning an HMI faceplate that visualizes a gear-lever position via a status square (white, grey, green, red), the colour thresholds tied to a DBW value such as DB501.DBW458 must be verified before going live. Connecting to the real AS (Automation Station) is often impossible during office engineering or pre-commissioning phases because of safety interlocks, hardware availability, or project partitioning across two PLCs (one standard CPU, one F-CPU). This article documents three reproducible engineering workflows that sweep a 16-bit DBW from 0 to 255 (or beyond) without a live PLC, using the WinCC V7.4 built-in tag simulator, S7-PLCSIM, or TIA Portal PLCSIM with the HMI runtime simulator. Every method ends with a verification step that captures the observed RGB value of the faceplate square so the value-to-colour mapping table can be written back into the project documentation.

1. Problem Definition and Scope

The engineering question is deceptively simple: which DBW numeric values produce which faceplate square colours? The challenge is that the mapping is encoded inside the faceplate (C/VBS script, range table, or configuration dialog) and is rarely documented. To reverse-engineer it, the engineer needs to drive the input value monotonically while observing the rendered square. With no PLC available, three classes of substitute exist:

• WinCC internal tag simulation – injects values directly into the WinCC tag DB without AS contact.
• S7-PLCSIM – runs the STEP 7 / TIA project in a virtual PLC that the WinCC runtime connects to as if it were real hardware.
• TIA Portal HMI simulation with PLCSIM – the integrated runtime simulator for Unified Comfort Panels and WinCC Professional.

The choice depends on which engineering tool generated the project. Classic STEP 7 + WinCC V7.4 deployments use Method 1 or 2. TIA Portal projects (WinCC Professional / Unified) use Method 3.

2. Prerequisites

3. Architecture and Data Flow

The DBW is the AS-side source of truth. Method 1 bypasses the AS and writes directly into the WinCC Runtime tag image. Methods 2 and 3 let the simulated CPU compute the value (or hold the value unmodified because no FC/FB is loaded). All three paths terminate at the same faceplate rendering pipeline.

4. Method 1 — Built-In Tag Simulation (WinCC V7.4)

WinCC V7.4 ships a tag-simulation runtime tool that can drive any internal or external WinCC tag with manual values, sine waves, ramps, or random data. It is the fastest path because it requires no PLC software and no virtual CPU. The tool is invoked from the Graphics Designer, from a configured button on a process picture, or from the Windows Start menu.

4.1 Launch the WinCC Tag Simulator

1. Open WinCC Explorer on the engineering PC.
2. In the navigation tree, right-click the Runtime tag that backs the faceplate, e.g. GearLever_Position.
3. Choose "Simulate". The Tag Simulator window opens with the selected tag pre-populated.
4. Alternatively launch it globally: Start > Programs > Siemens Automation > SIMATIC > WinCC > Tools > Tag Simulation.

4.2 Configure Manual Stepwise Value Injection

1. In the Tag Simulator dialog, ensure Mode is set to Manual (the default).
2. Select the tag GearLever_Position from the left list.
3. Type the desired value into the Set value field. Allowed range is determined by the tag data type:
   • WORD → 0…65535
   • INT → −32768…32767
   • BYTE → 0…255 (use this when the faceplate mapping is byte-based)
4. Click Apply (or press Enter). The value is written into the WinCC Runtime tag image immediately.
5. Repeat for each test value (0, 1, 2, … 255).

4.3 Alternative — Linear Ramp Mode

To automate the sweep instead of clicking 256 times, switch the simulator to Ramp mode. Set Start = 0, End = 255, Step = 1, Increment interval = 1000 ms. The tag will step through every byte value once per second. Combine this with a screen recorder to capture the colour transitions.

5. Method 2 — S7-PLCSIM (Classic STEP 7 + WinCC V7.4)

If the project is built in STEP 7 V5.5 / V5.6 and the faceplate mapping is driven by FC/FB logic that itself modifies the DBW, you must emulate the CPU so that the project can be downloaded. S7-PLCSIM V5.4 runs a virtual S7-300/400 CPU on the engineering PC; the WinCC RT connects to it over the Softbus (S7ONLINE → PLCSIM TCP/IP adapter).

5.1 Enable PLCSIM and Download the Project

1. Open STEP 7 V5.5 / V5.6 and load the project.
2. In SIMATIC Manager, choose Options > Set PG/PC Interface → S7-PLCSIM (TCP/IP). Confirm the access point S7ONLINE points to PLCSIM.
3. Start S7-PLCSIM. A virtual S7-400 CPU window opens. Use Power toggle to put CPU in RUN.
4. Return to SIMATIC Manager and click Download to target system. Choose the PLCSIM instance.

5.2 Selective Block Download (Avoid Overwriting Test Values)

When the project contains FC/FB blocks that write to DB501.DBW458 on every cycle, your manually entered test value will be overwritten before you can observe the faceplate. There are three engineering workarounds:

1. Delete the offending blocks from the PLCSIM image before download. In SIMATIC Manager, select the Blocks container, right-click → Download to Target System, then in the Download dialog uncheck the FC/FB that writes the DBW. PLCSIM will retain the last value because no block writes to that address.
2. Use a separate PLCSIM instance with only DB501 loaded. Create a stripped S7 program with a single DB501 (matching the original offsets) and download only that DB. The faceplate reads DB501.DBW458 with no writer blocks in the simulated CPU.
3. Hold the CPU in STOP after writing. Use PLCSIM to toggle RUN/STOP. In STOP, output image is frozen; in older PLCSIM versions the process image retains last values. Manually write via Monitor/Modify with trigger condition Permanent.

5.2b Multi-PLC Simulation with PLCSIM Advanced

S7-PLCSIM Advanced V2.0 SP1+ simulates up to 16 virtual CPUs in parallel and supports virtual Ethernet / PROFINET. For projects with separate AS and F-CPU:

1. Start S7-PLCSIM Advanced Manager.
2. Create one virtual instance for the standard CPU and one for the F-CPU.
3. Assign unique IP addresses in the same subnet as the WinCC connection.
4. Download both projects from TIA Portal (or STEP 7 with PLCSIM Advanced plugin) into the respective instances.
5. Start the WinCC Runtime; both connections are established.

5.3 Configure WinCC RT to Use PLCSIM as the AS

1. In WinCC Explorer, open Tag Management > S7-MPI/TCP.
2. Confirm the connection S7ONLINE resolves to the PLCSIM CPU's MPI / IP address (loopback 127.0.0.1 if PLCSIM is on the same PC).
3. Start the WinCC Runtime in Simulation mode by clicking the simulator icon in WinCC Explorer (or using WinCCExplorer.exe /SIM).
4. Open the picture containing the faceplate. The square will reflect whatever value the simulated CPU holds in DB501.DBW458.

5.4 Modify DB501.DBW458 Inside PLCSIM

1. In PLCSIM, choose Insert > Monitor/Modify > Single Variable.
2. Address: DB501.DBW458. Display format: DEC. Trigger: Permanent.
3. Set Modify Value to 0. Click Modify. Observe faceplate colour.
4. Increment by 1, click Modify, record colour, repeat up to 255.

6. Method 3 — TIA Portal PLCSIM with HMI Runtime Simulation

For TIA Portal projects (WinCC Professional / Unified), the integrated HMI simulator runs alongside PLCSIM in a single IDE session. The workflow is the most streamlined because TIA handles the connection wiring automatically.

6.1 Start the TIA Simulation Stack

1. Open the TIA Portal project containing the S7-1500 / S7-1200 CPU and the HMI tag that maps to DB501.DBW458.
2. Select the PLC_1 device in the project tree. Click Start simulation from the toolbar (the "play" icon with the PLC chip).
3. TIA launches PLCSIM and prompts you to choose between PLCSIM (single instance) and PLCSIM Advanced. Pick PLCSIM for a single CPU, Advanced for multi-PLC.
4. Download the hardware configuration and the user program to the simulated CPU.

6.2 Start the HMI Runtime Simulator

1. Select the HMI device (e.g. HMI_1 or TP1500 Comfort) in the project tree.
2. Click Start runtime (the eye icon). TIA compiles and starts WinCC Runtime Professional (or Unified RT) on the engineering PC.
3. The RT automatically connects to PLCSIM via the Softbus.

6.3 Modify DBW and Observe Faceplate

1. In the PLCSIM window, open the project tree, expand Program blocks > DB501.
2. Right-click DBW458 → Modify > Modify to 0. Observe the faceplate.
3. For stepwise sweep, right-click the data block → Monitor/Modify. Use the table view, enter Modify value = 1, click Apply, then 2, 3, … up to 255.

6.4 Stripping Logic Blocks in TIA

TIA Portal does not provide a per-block download exclusion in the PLCSIM path. Instead:

• Open the simulated CPU's Program blocks folder.
• Right-click the OB that calls the writer FC/FB (e.g. OB1 → Properties → Block call). Comment out the call statement with a NOP 0 line.
• Recompile and re-download to PLCSIM. The DBW is no longer overwritten.
• Alternatively, copy DB501 into a stripped project and simulate that project alone.

7. Determining the Value-to-Colour Mapping

Once the simulator is driving the DBW, record the colour at each value. The recommended capture method uses a pixel-grab VBS script bound to a button on the test picture:

' WinCC V7.4 VBS - sample pixel colour from faceplate square
Sub OnClick(ByVal Item)
    Dim sPicName, sObjName, x, y
    sPicName = "PictureWithFaceplate"
    sObjName = "Status_Square"
    x = 50   ' relative X inside object
    y = 50   ' relative Y inside object
    Dim lngColor
    lngColor = HMIRuntime.Screens(sPicName).ScreenItems(sObjName).BackColor
    MsgBox "Value=" & SmartTags("GearLever_Position").Value & vbCrLf & _
           "RGB=" & (lngColor And &HFF) & "," & _
           ((lngColor \ &H100) And &HFF) & "," & _
           ((lngColor \ &H10000) And &HFF)
End Sub

For TIA Unified the equivalent JavaScript uses the HMIRuntime API:

// TIA Unified / WinCC Professional - read faceplate colour
let val = Tags("GearLever_Position").Read();
let sq  = Screen.FindItem(".Status_Square");
let c   = sq.BackColor;
let r = c & 0xFF, g = (c >> 8) & 0xFF, b = (c >> 16) & 0xFF;
console.log(`Val=${val} RGB=${r},${g},${b}`);

Build a four-column log table (Value, RGB, Named colour, Confidence). The transitions between bands typically occur within a 1–3 value window. Mark the boundaries.

The exact thresholds must be confirmed against the actual project. The numbers above are illustrative.

8. Verification and Commissioning Checks

1. Round-trip test: With the simulator still running, read the tag back from the faceplate's underlying connection (WinCC Online Trend Control, 1 s logging). Confirm the displayed value matches the injected value to within 1 digit.
2. Band-boundary fuzz: Inject each band-boundary value plus/minus 1 (e.g. 50, 51, 52) and confirm the colour does not flicker.
3. Connection-status indicator: In WinCC Explorer → Diagnostics, verify the connection to PLCSIM (or simulated tag DB) is green. A red indicator means the faceplate is reading a stale value.
4. Document the mapping: Add a section to the project Functional Specification: “DB501.DBW458 colour bands: 0–50 white, 51–100 grey, 101–200 green, ≥201 red”.
5. Re-enable writer blocks: Once verified, restore any FC/FB download exclusions, recompile, and perform a fresh full download to PLCSIM to confirm the live logic still overwrites the DBW as expected.

9. Troubleshooting Matrix

10. Safety and Operational Considerations

• Never run an OS simulation that points to a process-active AS unless the safety PLC is also simulated or the safety chain is physically disabled and locked out.
• If the F-CPU is excluded from the simulation, the safety diagnostics will show the F-CPU as failed. Disable the F-CPU channel in WinCC for the duration of the test.
• Document any FC/FB exclusions in the test log so the production download restores them.
• Tag simulation in WinCC is local-only — it does not propagate to other clients on the network.
• PLCSIM Advanced instances are visible on the network at their assigned IP. Restrict them to a private subnet to avoid collisions with real CPUs.
• Always perform a final verification with the live AS before customer hand-over.

11. Frequently Asked Questions