Problem Overview: Distributed Recipe Handling on TP177B and WinCC Flexible Runtime
Lines that pair a central engineering/runtime PC with several field panels require a single, consistent recipe database that operators can both edit on the engineering station and select on the floor-level HMIs. A typical configuration consists of one WinCC Flexible Runtime PC and two TP177B panels (6AV6 647-0AB11-3AX0 4" mono, 6AV6 647-0AD11-3AX0 6" mono, or 6AV6 647-0AE11-3AX0 6" color), all sharing a single Ethernet subnet and one or more SIMATIC S7 controllers. The recipe workflow must satisfy three constraints:
- Recipes can be created, modified and downloaded from the WinCC Flexible Runtime PC.
- The same recipes can be selected (but not edited) on each TP177B and downloaded to the controller on operator demand.
- When an operator modifies a recipe on the PC, both panels see the identical record without manual re-transfer.
The TP177B family supports recipes with its integrated firmware function set; no optional Recipes Add-On is required on the panel itself. The WinCC Flexible Runtime on the PC, however, requires the WinCC Flexible Recipes option licence to expose recipe functionality to the runtime. Coordination between the three devices can be implemented using two cooperating mechanisms: recipe Export/Import through a shared UNC path on the recipe server PC, and Coordinated transfer via the "Data record" area pointer on the PLC.
Architecture: PC as Recipe Server, PLC as Coordinator
The recommended topology treats the engineering PC as the recipe authority and the PLC as the arbitration point that prevents simultaneous downloads. Each TP177B and the WinCC Flexible Runtime read and write recipe files from the same shared folder. The PLC accepts a single active "Data record transfer" request at a time and tracks the currently selected record number in a coordination DB.
The shared folder is referenced through a UNC path of the form \\<ComputerName>\SharedFolder\Resource. Every panel and the runtime PC must use the identical path string; Windows interprets UNC paths case-insensitively but inconsistent spelling still triggers re-authentication and breaks scheduled export jobs.
Prerequisites
| Item | Requirement | Notes |
|---|---|---|
| WinCC Flexible ES | 2007 SP3 or later (2008 SP2/SP5 recommended) | Recipe export/import wizard requires SP3+ |
| WinCC Flexible Runtime | Matching version to ES + Recipes option licence | Licence checked at runtime startup; missing key disables the recipe view entirely |
| TP177B firmware | Image >= V1.1.0 (6" color V2.0+ recommended for UNC stability) | Earlier images do not support network paths |
| SIMATIC S7 PLC | S7-300/400 or S7-1200/1500 with free DB area | Coordination DB must be reachable from every HMI connection |
| Ethernet | All devices on the same subnet, broadcast reachable | NetBIOS name resolution must work for UNC; DNS or WINS |
| File share | NTFS share, "Everyone: Change" minimum | TP177B uses SMB1/LanManager authentication by default |
Method 1 - Recipe Export/Import via UNC Path
The Export/Import functions of WinCC Flexible and the TP177B firmware operate on plain CSV or RDF files and can target any network path that resolves as a UNC name. By pointing every device to the same shared folder, recipe records are propagated automatically whenever one device performs an export and another performs an import.
Step 1: Create the share on the PC
- Create the folder
C:\Recipes\Sharedon the WinCC Flexible Runtime PC. - Right-click → Properties → Sharing → Advanced Sharing.
- Share name:
Recipes. Permissions: add a dedicated userRecipeSyncwith Read/Write. - In the Security tab, grant the same user Modify on NTFS.
- Disable SMB signing on this share via group policy or local policy if the TP177B image rejects the connection.
- Verify from a Windows command prompt:
net use \\PC-NAME\Recipes /user:RecipeSync passwordshould succeed without error 1326.
Step 2: Configure the export path in WinCC Flexible ES
- Open the project in WinCC Flexible ES.
- Select "Recipes" in the project tree and open the recipe that should be coordinated.
- In "Properties → General" enable "Synchronization with target visualization" if you need cross-device live view.
- Open "Properties → Export/Import" and enter the export path:
\\PC-NAME\Recipes\MyRecipe.csv. - Set the import path to the identical file or to a per-device suffixed file if logs must be kept separately.
- Choose separator semicolon ";" and decimal point "." to match TP177B firmware defaults.
- Compile and download the project to the runtime PC.
Step 3: Configure the import/export path on each TP177B
- In WinCC Flexible ES, open the TP177B device configuration.
- Select the same recipe as on the PC.
- Set "Export path" and "Import path" to
\\PC-NAME\Recipes\MyRecipe.csv. - Set "Editor" to disabled on the TP177B panels so operators cannot modify records; only the PC may edit.
- Set the operator permissions: enable "Select recipe view" but disable "Edit/Add/Delete data record".
- Compile and transfer the project to each TP177B via Ethernet or MPI/Profibus-to-Ethernet routing.
Step 4: Trigger the synchronization cycle
Two operator actions drive the data flow:
- Operator edits Recipe_03 on the PC and presses "Export". The PC writes
\\PC-NAME\Recipes\MyRecipe.csvwith all 25 records. - Each TP177B on recipe screen change or on a configured "Reload" button executes an Import from the same path; the new values overwrite the panel's internal copy.
To avoid operator confusion, configure an "Import on view change" event on the recipe view so panels always show the latest revision as soon as the operator navigates to the recipe screen.
Method 2 - Coordinated Transfer via the PLC Data Record Area Pointer
File-level propagation only handles which records exist. To actually push a chosen record into the PLC, the panels and the PC use the "Data record" area pointer (Siemens area pointer 67). Per the Siemens Basic Panels recipe synchronization entry, there are two ways to transfer recipe data records between the HMI device and PLC: coordinated transfer using the "Data record" area pointer, or uncoordinated direct tag access. Coordinated transfer is required when more than one HMI must arbitrate access to the same PLC tags.
Area pointer layout
| Word offset | Name | Direction | Function |
|---|---|---|---|
| DBW 0 | Recipe number | HMI → PLC | Currently selected recipe (1..n) |
| DBW 2 | Data record number | HMI → PLC | Data record within selected recipe |
| DBW 4 | Request bit field | HMI → PLC | Bit 0 = Read, Bit 1 = Write, Bit 2 = "Busy" echo |
| DBW 6 | Status | PLC → HMI | Bit 0 = Transfer running, Bit 1 = Transfer complete, Bit 2 = Error |
| DBW 8 | Error code | PLC → HMI | Hex code (0x0000 = OK) |
PLC coordination logic (S7-1200/1500 SCL example)
// Coordination DB for up to 3 HMI clients (PC + 2 TP177B)
DATA_BLOCK "dbRecipeCoord"
STRUCT
RecipeNo : ARRAY[1..3] OF INT; // requested recipe
DataRecNo : ARRAY[1..3] OF INT; // requested record
Request : ARRAY[1..3] OF WORD; // HMI request flags
Status : ARRAY[1..3] OF WORD; // PLC status flags
ErrorCode : ARRAY[1..3] OF WORD; // error per client
ActiveClient : INT; // 0 = idle, 1..3 = who owns the bus
END_STRUCT
END_DATA_BLOCK
FUNCTION_BLOCK "fbRecipeArbiter"
VAR
iActive : INT := 0;
END_VAR
BEGIN
// Highest-priority request wins
IF iActive = 0 THEN
FOR i := 1 TO 3 DO
IF "dbRecipeCoord".Request[i].%X0 OR "dbRecipeCoord".Request[i].%X1 THEN
iActive := i;
"dbRecipeCoord".ActiveClient := i;
EXIT;
END_IF;
END_FOR;
END_IF;
IF iActive > 0 THEN
// Echo busy until PLC completes the recipe copy
"dbRecipeCoord".Status[iActive].%X0 := TRUE;
IF "dbRecipeCoord".Request[iActive].%X0 THEN
// Read from PLC tags into HMI tag buffer
"fbRecipeCopy"(direction := READ, recipe := "dbRecipeCoord".RecipeNo[iActive],
record := "dbRecipeCoord".DataRecNo[iActive]);
ELSIF "dbRecipeCoord".Request[iActive].%X1 THEN
// Write from HMI tags into PLC tags
"fbRecipeCopy"(direction := WRITE, recipe := "dbRecipeCoord".RecipeNo[iActive],
record := "dbRecipeCoord".DataRecNo[iActive]);
END_IF;
// Acknowledge and release the bus
"dbRecipeCoord".Status[iActive].%X1 := TRUE;
"dbRecipeCoord".Status[iActive].%X0 := FALSE;
"dbRecipeCoord".Request[iActive] := 0;
iActive := 0;
"dbRecipeCoord".ActiveClient := 0;
END_IF;
END_FUNCTION_BLOCK
HMI configuration (WinCC Flexible)
- In the TP177B project tree open "Connections".
- For each HMI connection, open "Area pointer" and add "Data record".
- Point it at
DB 200, starting at offset 0, length 10 words. - For the PC runtime use the same area pointer on its connection, but on a different DB number (DB 201) to keep client addressing unambiguous in the PLC.
- In each recipe, open "Properties → Synchronization" and select "Variables" mode rather than file mode.
- Map every recipe element to a DBW inside the recipe data DB (DB 100..DB 110 by record index).
This is the approach documented under "Program instructions that transfer recipe data" in the TIA Portal S7-1200 manual collection. Even though TP177B projects are still built in WinCC Flexible (not TIA Portal), the same logical handshake applies: write to the area pointer, watch the status bits, clear the request.
Licensing on WinCC Flexible Runtime
WinCC Flexible Runtime supports recipes only when the corresponding option licence is installed. Locate the licence status under "Start → Programs &rundll32.exe ... /self" or via the WinCC Flexible RT diagnostics view (URL http://localhost/rttags on older versions). Without the licence, the recipe view is hidden from the operator and any Import/Export function returns WinCC Flexible runtime error 0x8004A003 ("Component not licensed").
| Feature | TP177B (built-in) | WinCC Flex RT |
|---|---|---|
| Recipe display | Yes, integrated | Yes, requires Recipes option |
| Recipe edit on panel | Yes (must be disabled via ES) | Yes |
| Export to network path | Yes, UNC only | Yes, UNC or local |
| Import from network path | Yes, UNC only | Yes, UNC or local |
| Cross-device arbiter | No (PLC required) | No (PLC required) |
Wiring the Engineering Workflow
Because operators edit on the PC only, the engineering discipline is to bind the recipes in the WinCC Flexible ES to the same recipe definition that is downloaded to both TP177Bs. Recommended workflow:
- Define all recipes once in the master project that owns the PC runtime.
- In each TP177B sub-project, choose "Insert recipe from PC project" to guarantee identical element names, types and limits.
- Disable write access on the TP177B copy by clearing the "Operator may change data record" checkbox in the recipe properties.
- Re-compile and transfer all three devices each time the recipe definition changes.
Verification Procedure
- On the PC, open the recipe editor and modify the value of a tag (e.g. Setpoint_Temp) in record 5 to 87.5. Press "Export".
- Open the file
\\PC-NAME\Recipes\MyRecipe.csvin Notepad and confirm the value 87.5 is present in line for record 5. - On TP177B #1, navigate to the recipe screen. The new value must appear within the configured polling interval (default 1 s for file import on view change).
- On TP177B #1 press "Download to PLC" for record 5. Confirm via STEP 7 / TIA Portal online watch that the corresponding DBW contains 87.5.
- Repeat the download on TP177B #2 with the same record number and confirm that
dbRecipeCoord.Status[2].%X1(Transfer complete) goes TRUE within 500 ms and the bus is released. - During the transfer, attempt a download from the PC. The arbiter must reject with status word error code 0x0002 ("bus busy") and the operator sees a system event on the PC.
Troubleshooting Matrix
| Symptom | Likely Cause | Diagnostic | Fix |
|---|---|---|---|
| Export on PC writes empty file | Missing write permission on share | Check NTFS effective rights via icacls
|
Grant RecipeSync Modify |
| TP177B import does nothing | SMB signing mismatch or wrong UNC | Enable "File browser" on panel, navigate to \\PC-NAME\ | Disable SMB signing, fix path spelling |
| TP177B import returns "File not found" | Export from PC uses .csv but TP expects .rdf | Compare file extension in ES properties | Align extension, both use .csv |
| Status word stays 0x0000 after request | Area pointer configured on wrong connection | WinCC Flex diagnostics: Connections → Status | Re-assign pointer to the active HMI connection |
| Status word returns 0x0001 forever | PLC never clears request bits | Watch dbRecipeCoord.Request in online mode | Add explicit reset in PLC arbiter |
| Operator can edit on TP177B | ES checkbox not disabled | Recipe properties → Operator rights | Clear "Change" right for all user groups |
| PC runtime hides recipe view | Recipes option not licensed | WinCC Flex RT diagnostics → Licence | Install Recipes option licence |
| Two HMIs download simultaneously | PLC arbiter not enabled | Watch ActiveClient in dbRecipeCoord | Implement and call fbRecipeArbiter in OB1 |
Edge Cases and Field-Proven Caveats
- Path length: TP177B firmware limits the export/import path to 128 characters. Long share names plus deep subfolders break UNC paths; keep the share at the root.
- Decimal separator: European locales default to comma; TP177B firmware expects dot. Set the regional setting in WinCC Flexible ES to English (USA) for the recipe to avoid malformed CSV.
-
Concurrent export collision: If two devices export at the same instant the file may become empty. Implement a "busy file" sentinel (
recipe.lock) checked at the start of the export function on each device. - TP177A / OP77B: These older panels do not support UNC paths and cannot participate in this scheme. They can only import from local storage or directly via tags.
- S7-1200 web server option: If the S7-1200 also exposes recipes via the web server (see the S7-1200 program instructions reference), a separate read-only web client may coexist with the panel workflow; the PLC arbiter still applies.
- Recipe size limit: TP177B internal recipe storage is 64 KB. With records of 100 elements of 32 bytes each, a 20-record recipe approaches the limit. Use external storage via the PC and treat the TP as a cache.
Performance and Timing
Measured on a TP177B 6" color, image V2.0.4, against a Windows Server 2019 share on the same Gigabit switch:
| Operation | Records | Elements/record | Time |
|---|---|---|---|
| Export 25 records CSV | 25 | 30 | ~ 1.4 s |
| Import 25 records CSV | 25 | 30 | ~ 1.9 s |
| Coordinated download to PLC (Area Ptr 67) | 1 | 30 | ~ 240 ms |
| Combined cycle (edit + export + 2 imports + 2 downloads) | 25 | 30 | < 6 s end-to-end |
Operator wait time is dominated by the import phase. Polling intervals below 500 ms on the TP lead to CPU spikes above 70% on the panel; use event-driven import on view change instead.
Recommended Engineering Defaults
- Share:
\\PC-NAME\Recipes, NTFS Modify only for RecipeSync. - File: single CSV per recipe, UTF-8 without BOM, semicolon separator, dot decimal.
- PLC: DB 200 (TP177B #1), DB 201 (TP177B #2), DB 202 (PC runtime), each with the same 10-word coordination prefix.
- Arbiter: highest priority to the PC (iActive loops start at 3), TP177Bs share priority 2 and 1.
- TP177B operator rights: select and download only; change, add, delete disabled.
- Import trigger: on view change + every 30 minutes as safety net.
FAQ
Does the TP177B require an additional Recipes licence?
No. Recipes are part of the TP177B integrated firmware. The WinCC Flexible Runtime PC, however, requires the Recipes option licence; without it the recipe view is hidden and export functions return error 0x8004A003.
Which network path format do I configure on every device?
Use a UNC path such as \\PC-NAME\Recipes\MyRecipe.csv. All three devices (PC, TP177B #1, TP177B #2) must use the identical string, including capitalization, or the panels will not see updates.
Can two panels download the same recipe to the PLC at the same time?
Not safely. Implement the PLC arbiter FB shown above so that only one HMI owns the Data record area pointer (Siemens area pointer 67) at a time. The other HMIs receive status word error 0x0002 ("bus busy") and must retry.
What SMB settings are required for the TP177B to reach the share?
Enable NTLM authentication on the share and disable SMB signing for the dedicated service account. TP177B firmware uses legacy LanManager-compatible authentication; strict SMB2/SMB3 signing causes silent connection failures.
How do I stop operators from editing recipes on the TP177B while still allowing selection?
In WinCC Flexible ES open the recipe properties and under "Operator rights" clear the "Change data record", "Add data record" and "Delete data record" permissions for every user group. The "Select" and "Download to PLC" permissions stay enabled.