Switching Between Siemens Multipanel and WinCC Flexible PC

1. Overview: Dual-HMI Single-PLC Operator Authorization

Plant retrofits, line migrations, and operator-station rebuilds routinely produce a topology where two HMIs must share a single S7 controller: a fixed Siemens Multipanel (e.g. MP 277 10" Touch, MP 377 12" Touch, MP 377 15" Touch) mounted at the machine, plus a WinCC Flexible PC Runtime on a Panel PC or office workstation that the same operator may want to use remotely. Both devices project to identical tags on the same S7-300 / S7-400 / S7-200 CPU, and both can issue setpoint writes, mode changes, and acknowledgements.

The engineering question that follows is not whether this topology is legal — the SIMATIC area-pointer and tag-handle mechanisms do allow it — but how to ensure that only one HMI station has write authority at a time, that the inactive station is cleanly muted, and that the handover is logged and password-protected. The pattern used in the field is a PLC-resident control latch: one Boolean tag — typically HMIActive — that is set TRUE by the active station, FALSE by the standby station, and verified on every write through a screen-side enable expression.

This reference documents the full implementation: tag design on the S7 side, parallel configuration in WinCC Flexible on both the Multipanel project and the PC Runtime project, user-administration with role-based permissions, function-script enforcement, area-pointer wiring, and a verification procedure that exercises both handover directions.

2. Prerequisites

3. Architecture and Tag Design

The control latch is implemented as two bits in a global PLC data block so that both HMI stations read the same authoritative source and write through the same handshake:

• DB_HMI.ActLocal — Bool, set TRUE by the Multipanel when local operator takes control.
• DB_HMI.ActRemote — Bool, set TRUE by the PC Runtime when remote operator takes control.
• DB_HMI.LockLocal — Bool, TRUE blocks all Multipanel write tags.
• DB_HMI.LockRemote — Bool, TRUE blocks all PC Runtime write tags.
• DB_HMI.HMIActive — Bool, summary latch: TRUE = local active, FALSE = remote active.
• DB_HMI.OperatorID — Int, last accepted user number (1..32) for audit log.
• DB_HMI.HandoverAck — Bool, one-shot acknowledgement of handover event.

Create the data block in STEP 7 (or in the PLC program if running TIA):

DATA_BLOCK "DB_HMI"
  STRUCT
    ActLocal     : BOOL;    // request from Multipanel
    ActRemote    : BOOL;    // request from PC Runtime
    LockLocal    : BOOL;    // disables Multipanel writes
    LockRemote   : BOOL;    // disables PC Runtime writes
    HMIActive    : BOOL;    // TRUE = local active, FALSE = remote active
    OperatorID   : INT;     // 0..32
    HandoverAck  : BOOL;    // pulse, must be reset by both stations
  END_STRUCT
END_DATA_BLOCK

The mutual-exclusion rule, written in the OB1 cyclic scan, is straightforward:

// Mutual exclusion and latch state
IF "DB_HMI".ActLocal AND NOT "DB_HMI".ActRemote THEN
    "DB_HMI".HMIActive  := TRUE;
    "DB_HMI".LockRemote := TRUE;
    "DB_HMI".LockLocal  := FALSE;
ELSIF "DB_HMI".ActRemote AND NOT "DB_HMI".ActLocal THEN
    "DB_HMI".HMIActive  := FALSE;
    "DB_HMI".LockLocal  := TRUE;
    "DB_HMI".LockRemote := FALSE;
ELSE
    // Both asserted or both released - hold last state
    // Lock bits stay at their last value
END_IF;

// Pulse the handover acknowledgement on any change
"DB_HMI".HandoverAck := "DB_HMI".HMIActive XOR "DB_HMI_HMA_last";
"DB_HMI_HMA_last"   := "DB_HMI".HMIActive;

4. WinCC Flexible PC Runtime Project — Configuration

4.1 Connection definition

Open the PC Runtime project in WinCC Flexible ES. Under Project > HMI_1 [Name] > Connections configure an Ethernet (ISO-on-TCP) or Profibus (MPI/DP) connection depending on how the Panel PC is wired to the S7 CPU. Typical parameters:

4.2 Tag mapping for write authority

Create external tags for every operator-controllable point on the PC Runtime, each pointing at the matching PLC address:

• Sp_SetSpeed — Int, DB_HMI.DBW10
• Sp_ModeSelect — Int, DB_HMI.DBW12
• Cmd_Ack — Bool, DB_HMI.DBX14.0
• Cmd_Start — Bool, DB_HMI.DBX14.1
• Cmd_Stop — Bool, DB_HMI.DBX14.2

For every write tag, open Properties > Events > Change Value and enable the "Enable via PLC tag" option, then bind it to DB_HMI.LockRemote. WinCC Flexible supports a built-in enable mechanism that suppresses the write entirely when the assigned tag is TRUE. This is the cleanest way to enforce the latch from the configuration side, with no script overhead.

4.3 Take-control button (script)

Place an "Activate Remote" button on the main screen. Under Events > Press attach a function list that performs:

// Function list — Press event of "Activate Remote" button
SetBit("HMIActive_Sel");           // local HMIActive_Sel = TRUE
SetValue("DB_HMI.ActRemote", 1);    // request remote
SetValue("DB_HMI.ActLocal",  0);    // release local claim
LogMessage("Operator", "Remote station requested control");

Mirror the operation on the Multipanel side with the inverse logic. The two requests feed the mutual-exclusion block in OB1.

5. Multipanel Project — Configuration

5.1 Connection and tag mirroring

In the same WinCC Flexible ES session open the Multipanel project (target: MP 277 or MP 377). Define a connection identical in PLC endpoint but with the Multipanel's own IP or MPI address. Re-create the same external tags; the absolute addresses in the PLC are the same because both stations read the same DB.

For each Multipanel write tag, set Enable via PLC tag = DB_HMI.LockLocal. When LockLocal is TRUE the Multipanel cannot write to the PLC, even if a button is pressed.

5.2 Take-control button on Multipanel

// Function list — Press event of "Activate Local" button
SetBit("HMIActive_Sel");           // local HMIActive_Sel = FALSE
SetValue("DB_HMI.ActLocal",  1);
SetValue("DB_HMI.ActRemote", 0);
LogMessage("Operator", "Local Multipanel requested control");

Both stations are now peer-equivalent: each can assert its claim, each is blocked by the other's lock, and the latch in OB1 enforces mutual exclusion.

6. Area Pointers for Coordination

Beyond the latch tag, configure the coordination area pointer on both HMI stations so the runtime knows when the partner project starts and stops. In the connection properties of each project:

1. Enable the Coordination area pointer.
2. Reserve a byte in the same DB_HMI, e.g. DB_HMI.DBB20.
3. Bit 0 = "Coordinator active". Bit 1 = "Coordination bit — life sign". Bits 2..7 are user-definable.

WinCC Flexible sets bit 0 on the Multipanel side automatically when the panel starts; the PC Runtime does the same. Each station can poll CoordDB & 0x01 to confirm the partner is alive — a missing partner bit allows the active station to keep operating, while a reappearing partner triggers a handover prompt instead of an uncontrolled write race.

7. User Administration and Password Layer

A bare latch without authentication is not acceptable on most lines. In WinCC Flexible open Project > User Administration on both projects:

1. Define three groups: Operators (level 1, password required), Supervisors (level 2), Administrators (level 3).
2. Create user SUP_LOC in Operators on the Multipanel, SUP_REM in Operators on the PC Runtime.
3. Bind the "Activate Local" / "Activate Remote" buttons to a function list that first calls ShowLogonDialog if no user is signed in, then issues the SetValue to DB_HMI.ActLocal / DB_HMI.ActRemote.
4. Under Screen > Properties > Security, mark the handover screens as protected and assign them to group Operators or higher.

8. Display Logic — Hiding Inactive Writes

Suppressing writes is half the job. Operators should also see which station is active so they do not press buttons that silently fail. Add a status indicator on both projects:

// Animation — Visibility of "Remote Active" banner
if (GetTagBit("DB_HMI.HMIActive") == 0) {
    return VISIBLE;
} else {
    return INVISIBLE;
}

// Animation — Visibility of "Local Active" banner
if (GetTagBit("DB_HMI.HMIActive") == 1) {
    return VISIBLE;
} else {
    return INVISIBLE;
}

Color the input fields grey when the lock is TRUE (use the Appearance animation linked to the lock bit), and add a tooltip: "Locked — other station is active." This prevents operator confusion during handover.

9. Logging the Handover Event

Configure an alarm/message in the message configuration of each project:

• Trigger tag: DB_HMI.HandoverAck (rising edge).
• Text: "HMI control handed over to %s — operator ID %d", with the active-station tag and DB_HMI.OperatorID as parameters.
• Class: Warning (orange) so it appears in both the operator log and the historian.

WinCC Flexible writes the message to its log file and to the configured archive (CSV, RDB, or SQL via the Logging option). Each station records the handover locally — set the archive retention to ≥ 30 days for audit traceability.

10. Verification Procedure

1. Compile both projects. In WinCC Flexible ES select Project > Compiler > All. Both the PC Runtime and Multipanel targets must compile clean. Address warnings on any tag whose enable-via-PLC property is missing.
2. Download PC Runtime. Start the Panel PC in transfer mode (or push via Ethernet/RDP). Confirm the runtime loads and the connection LED turns green.
3. Download Multipanel. Use Transfer > MPI/Profibus/Ethernet from the ES. Verify firmware compatibility — WinCC Flexible 2008 SP5 images target MP 277 FW ≥ V4.x and MP 377 FW ≥ V8.x.
4. Baseline test. Open STEP 7 online on the S7-300. Monitor DB_HMI.LockLocal and DB_HMI.LockRemote. They should both be FALSE on first scan.
5. Handover test A — local to remote. On the Multipanel, log in as SUP_LOC. Press "Activate Local". Confirm LockLocal = FALSE, LockRemote = TRUE, HMIActive = TRUE. Try pressing a write field on the PC Runtime — it should be greyed out and reject any value change. The handover alarm appears in both logs.
6. Handover test B — remote to local. Log in on the PC Runtime as SUP_REM. Press "Activate Remote". Confirm bits flip and the Multipanel now rejects writes.
7. Conflict test. Simultaneously press both "Activate Local" and "Activate Remote" from a second engineer laptop on the same network (use a second PC Runtime instance if needed). Verify that the latch holds its previous state — the XOR-snapshot in OB1 prevents both bits from being TRUE at once.
8. Connection-loss test. Disconnect the Ethernet cable from the PC Runtime. The Multipanel should continue operating normally. The PC Runtime should display a connection-failure alarm and re-show its input fields as soon as the cable is reconnected.

11. Troubleshooting Matrix

12. Field-Proven Caveats

• One project, two compilations. Build the project once for the PC Runtime and once for the Multipanel in the same ES session. Do not maintain two parallel sources; tag-list drift between them is the most common source of latch desync.
• Compile-time warnings on enable-via-PLC. WinCC Flexible 2008 SP5 emits a warning if the assigned enable tag is not the same DB number as the tag being protected. Treat such warnings as errors during code review.
• MP 277 vs MP 377 image. MP 277 expects *.img compiled for 800 × 480 / 640 × 480; MP 377 expects the same image file but loaded at a higher resolution. If you swap panels on the line, recompile rather than reuse the old .img.
• Transition to TIA Portal / WinCC Comfort. When migrating, the equivalent mechanism is the "Operate enable via PLC tag" property on each IO field and button under Comfort/Advanced. The PLC tag design in DB_HMI stays unchanged.
• Safety-relevant writes. This pattern is intended for operator-level control (setpoints, mode selection, acknowledgements). Do not route safety-relevant commands (F-Stop, safety door acknowledgement) through this latch; use the dedicated PROFIsafe stack on the F-CPU and a separate F-DQ pathway.
• Time synchronisation. Both stations should NTP-sync to the same time source so that handover messages can be correlated in the log. WinCC Flexible supports time synchronization via the Date/Time area pointer on the same PLC connection.

13. Standards and Documentation References

• Siemens Industry Online Support — WinCC Flexible entry point
• WinCC Flexible 2008 SP5 — Operating Manual (PDF)
• SIMATIC HMI MP 277 / MP 377 — Device Manual
• WinCC Flexible — Communication with S7-300/400 (entry point)
• S7-300 CPU 31x — Communication functions manual