TP177B Recipe Synchronization with WinCC Flexible Runtime PC

David Krause13 min read
HMI / SCADASiemensTutorial / How-to
Licensed PE Working through this on a live machine? A Maine-licensed engineer can take it from here — included with IMD hardware, by the hour for everything else. Book an engineer

Problem Overview: Distributed Recipe Handling on TP177B and WinCC Flexible Runtime

Lines that pair a central engineering/runtime PC with several field panels require a single, consistent recipe database that operators can both edit on the engineering station and select on the floor-level HMIs. A typical configuration consists of one WinCC Flexible Runtime PC and two TP177B panels (6AV6 647-0AB11-3AX0 4" mono, 6AV6 647-0AD11-3AX0 6" mono, or 6AV6 647-0AE11-3AX0 6" color), all sharing a single Ethernet subnet and one or more SIMATIC S7 controllers. The recipe workflow must satisfy three constraints:

  • Recipes can be created, modified and downloaded from the WinCC Flexible Runtime PC.
  • The same recipes can be selected (but not edited) on each TP177B and downloaded to the controller on operator demand.
  • When an operator modifies a recipe on the PC, both panels see the identical record without manual re-transfer.

The TP177B family supports recipes with its integrated firmware function set; no optional Recipes Add-On is required on the panel itself. The WinCC Flexible Runtime on the PC, however, requires the WinCC Flexible Recipes option licence to expose recipe functionality to the runtime. Coordination between the three devices can be implemented using two cooperating mechanisms: recipe Export/Import through a shared UNC path on the recipe server PC, and Coordinated transfer via the "Data record" area pointer on the PLC.

Architecture: PC as Recipe Server, PLC as Coordinator

The recommended topology treats the engineering PC as the recipe authority and the PLC as the arbitration point that prevents simultaneous downloads. Each TP177B and the WinCC Flexible Runtime read and write recipe files from the same shared folder. The PLC accepts a single active "Data record transfer" request at a time and tracks the currently selected record number in a coordination DB.

WinCC Flex RT PC Recipe Editor / Server TP177B Panel #1 Operator select only TP177B Panel #2 Operator select only SIMATIC S7 PLC Coordination DB Shared Folder \\PC-NAME\Recipes .csv / .rdf files Engineering File I/O (UNC) Area Pointer 67

The shared folder is referenced through a UNC path of the form \\<ComputerName>\SharedFolder\Resource. Every panel and the runtime PC must use the identical path string; Windows interprets UNC paths case-insensitively but inconsistent spelling still triggers re-authentication and breaks scheduled export jobs.

Prerequisites

Item Requirement Notes
WinCC Flexible ES 2007 SP3 or later (2008 SP2/SP5 recommended) Recipe export/import wizard requires SP3+
WinCC Flexible Runtime Matching version to ES + Recipes option licence Licence checked at runtime startup; missing key disables the recipe view entirely
TP177B firmware Image >= V1.1.0 (6" color V2.0+ recommended for UNC stability) Earlier images do not support network paths
SIMATIC S7 PLC S7-300/400 or S7-1200/1500 with free DB area Coordination DB must be reachable from every HMI connection
Ethernet All devices on the same subnet, broadcast reachable NetBIOS name resolution must work for UNC; DNS or WINS
File share NTFS share, "Everyone: Change" minimum TP177B uses SMB1/LanManager authentication by default
Critical: The TP177B image communicates with SMB shares using the legacy LanManager-compatible authentication mode. If the server enforces SMB2/SMB3-only signing, the export/import will fail silently. Configure the share to allow NTLM and disable SMB signing only for the dedicated service account used by the panels.

Method 1 - Recipe Export/Import via UNC Path

The Export/Import functions of WinCC Flexible and the TP177B firmware operate on plain CSV or RDF files and can target any network path that resolves as a UNC name. By pointing every device to the same shared folder, recipe records are propagated automatically whenever one device performs an export and another performs an import.

Step 1: Create the share on the PC

  1. Create the folder C:\Recipes\Shared on the WinCC Flexible Runtime PC.
  2. Right-click → Properties → Sharing → Advanced Sharing.
  3. Share name: Recipes. Permissions: add a dedicated user RecipeSync with Read/Write.
  4. In the Security tab, grant the same user Modify on NTFS.
  5. Disable SMB signing on this share via group policy or local policy if the TP177B image rejects the connection.
  6. Verify from a Windows command prompt: net use \\PC-NAME\Recipes /user:RecipeSync password should succeed without error 1326.

Step 2: Configure the export path in WinCC Flexible ES

  1. Open the project in WinCC Flexible ES.
  2. Select "Recipes" in the project tree and open the recipe that should be coordinated.
  3. In "Properties → General" enable "Synchronization with target visualization" if you need cross-device live view.
  4. Open "Properties → Export/Import" and enter the export path: \\PC-NAME\Recipes\MyRecipe.csv.
  5. Set the import path to the identical file or to a per-device suffixed file if logs must be kept separately.
  6. Choose separator semicolon ";" and decimal point "." to match TP177B firmware defaults.
  7. Compile and download the project to the runtime PC.

Step 3: Configure the import/export path on each TP177B

  1. In WinCC Flexible ES, open the TP177B device configuration.
  2. Select the same recipe as on the PC.
  3. Set "Export path" and "Import path" to \\PC-NAME\Recipes\MyRecipe.csv.
  4. Set "Editor" to disabled on the TP177B panels so operators cannot modify records; only the PC may edit.
  5. Set the operator permissions: enable "Select recipe view" but disable "Edit/Add/Delete data record".
  6. Compile and transfer the project to each TP177B via Ethernet or MPI/Profibus-to-Ethernet routing.

Step 4: Trigger the synchronization cycle

Two operator actions drive the data flow:

  1. Operator edits Recipe_03 on the PC and presses "Export". The PC writes \\PC-NAME\Recipes\MyRecipe.csv with all 25 records.
  2. Each TP177B on recipe screen change or on a configured "Reload" button executes an Import from the same path; the new values overwrite the panel's internal copy.

To avoid operator confusion, configure an "Import on view change" event on the recipe view so panels always show the latest revision as soon as the operator navigates to the recipe screen.

Method 2 - Coordinated Transfer via the PLC Data Record Area Pointer

File-level propagation only handles which records exist. To actually push a chosen record into the PLC, the panels and the PC use the "Data record" area pointer (Siemens area pointer 67). Per the Siemens Basic Panels recipe synchronization entry, there are two ways to transfer recipe data records between the HMI device and PLC: coordinated transfer using the "Data record" area pointer, or uncoordinated direct tag access. Coordinated transfer is required when more than one HMI must arbitrate access to the same PLC tags.

Area pointer layout

Word offset Name Direction Function
DBW 0 Recipe number HMI → PLC Currently selected recipe (1..n)
DBW 2 Data record number HMI → PLC Data record within selected recipe
DBW 4 Request bit field HMI → PLC Bit 0 = Read, Bit 1 = Write, Bit 2 = "Busy" echo
DBW 6 Status PLC → HMI Bit 0 = Transfer running, Bit 1 = Transfer complete, Bit 2 = Error
DBW 8 Error code PLC → HMI Hex code (0x0000 = OK)

PLC coordination logic (S7-1200/1500 SCL example)

// Coordination DB for up to 3 HMI clients (PC + 2 TP177B)
DATA_BLOCK "dbRecipeCoord"
  STRUCT
    RecipeNo   : ARRAY[1..3] OF INT;     // requested recipe
    DataRecNo  : ARRAY[1..3] OF INT;     // requested record
    Request    : ARRAY[1..3] OF WORD;    // HMI request flags
    Status     : ARRAY[1..3] OF WORD;    // PLC status flags
    ErrorCode  : ARRAY[1..3] OF WORD;    // error per client
    ActiveClient : INT;                  // 0 = idle, 1..3 = who owns the bus
  END_STRUCT
END_DATA_BLOCK

FUNCTION_BLOCK "fbRecipeArbiter"
VAR
  iActive : INT := 0;
END_VAR
BEGIN
  // Highest-priority request wins
  IF iActive = 0 THEN
    FOR i := 1 TO 3 DO
      IF "dbRecipeCoord".Request[i].%X0 OR "dbRecipeCoord".Request[i].%X1 THEN
        iActive := i;
        "dbRecipeCoord".ActiveClient := i;
        EXIT;
      END_IF;
    END_FOR;
  END_IF;

  IF iActive > 0 THEN
    // Echo busy until PLC completes the recipe copy
    "dbRecipeCoord".Status[iActive].%X0 := TRUE;

    IF "dbRecipeCoord".Request[iActive].%X0 THEN
      // Read from PLC tags into HMI tag buffer
      "fbRecipeCopy"(direction := READ, recipe := "dbRecipeCoord".RecipeNo[iActive],
                      record := "dbRecipeCoord".DataRecNo[iActive]);
    ELSIF "dbRecipeCoord".Request[iActive].%X1 THEN
      // Write from HMI tags into PLC tags
      "fbRecipeCopy"(direction := WRITE, recipe := "dbRecipeCoord".RecipeNo[iActive],
                      record := "dbRecipeCoord".DataRecNo[iActive]);
    END_IF;

    // Acknowledge and release the bus
    "dbRecipeCoord".Status[iActive].%X1 := TRUE;
    "dbRecipeCoord".Status[iActive].%X0 := FALSE;
    "dbRecipeCoord".Request[iActive] := 0;
    iActive := 0;
    "dbRecipeCoord".ActiveClient := 0;
  END_IF;
END_FUNCTION_BLOCK

HMI configuration (WinCC Flexible)

  1. In the TP177B project tree open "Connections".
  2. For each HMI connection, open "Area pointer" and add "Data record".
  3. Point it at DB 200, starting at offset 0, length 10 words.
  4. For the PC runtime use the same area pointer on its connection, but on a different DB number (DB 201) to keep client addressing unambiguous in the PLC.
  5. In each recipe, open "Properties → Synchronization" and select "Variables" mode rather than file mode.
  6. Map every recipe element to a DBW inside the recipe data DB (DB 100..DB 110 by record index).

This is the approach documented under "Program instructions that transfer recipe data" in the TIA Portal S7-1200 manual collection. Even though TP177B projects are still built in WinCC Flexible (not TIA Portal), the same logical handshake applies: write to the area pointer, watch the status bits, clear the request.

Licensing on WinCC Flexible Runtime

WinCC Flexible Runtime supports recipes only when the corresponding option licence is installed. Locate the licence status under "Start → Programs &rundll32.exe ... /self" or via the WinCC Flexible RT diagnostics view (URL http://localhost/rttags on older versions). Without the licence, the recipe view is hidden from the operator and any Import/Export function returns WinCC Flexible runtime error 0x8004A003 ("Component not licensed").

Feature TP177B (built-in) WinCC Flex RT
Recipe display Yes, integrated Yes, requires Recipes option
Recipe edit on panel Yes (must be disabled via ES) Yes
Export to network path Yes, UNC only Yes, UNC or local
Import from network path Yes, UNC only Yes, UNC or local
Cross-device arbiter No (PLC required) No (PLC required)

Wiring the Engineering Workflow

Because operators edit on the PC only, the engineering discipline is to bind the recipes in the WinCC Flexible ES to the same recipe definition that is downloaded to both TP177Bs. Recommended workflow:

  1. Define all recipes once in the master project that owns the PC runtime.
  2. In each TP177B sub-project, choose "Insert recipe from PC project" to guarantee identical element names, types and limits.
  3. Disable write access on the TP177B copy by clearing the "Operator may change data record" checkbox in the recipe properties.
  4. Re-compile and transfer all three devices each time the recipe definition changes.
Tip: If the TP177B project is rebuilt independently, an element-name mismatch between panel and PC will cause the file import on the panel to fail silently. Always import the recipe definition from the master project to keep them synchronized.

Verification Procedure

  1. On the PC, open the recipe editor and modify the value of a tag (e.g. Setpoint_Temp) in record 5 to 87.5. Press "Export".
  2. Open the file \\PC-NAME\Recipes\MyRecipe.csv in Notepad and confirm the value 87.5 is present in line for record 5.
  3. On TP177B #1, navigate to the recipe screen. The new value must appear within the configured polling interval (default 1 s for file import on view change).
  4. On TP177B #1 press "Download to PLC" for record 5. Confirm via STEP 7 / TIA Portal online watch that the corresponding DBW contains 87.5.
  5. Repeat the download on TP177B #2 with the same record number and confirm that dbRecipeCoord.Status[2].%X1 (Transfer complete) goes TRUE within 500 ms and the bus is released.
  6. During the transfer, attempt a download from the PC. The arbiter must reject with status word error code 0x0002 ("bus busy") and the operator sees a system event on the PC.

Troubleshooting Matrix

Symptom Likely Cause Diagnostic Fix
Export on PC writes empty file Missing write permission on share Check NTFS effective rights via icacls Grant RecipeSync Modify
TP177B import does nothing SMB signing mismatch or wrong UNC Enable "File browser" on panel, navigate to \\PC-NAME\ Disable SMB signing, fix path spelling
TP177B import returns "File not found" Export from PC uses .csv but TP expects .rdf Compare file extension in ES properties Align extension, both use .csv
Status word stays 0x0000 after request Area pointer configured on wrong connection WinCC Flex diagnostics: Connections → Status Re-assign pointer to the active HMI connection
Status word returns 0x0001 forever PLC never clears request bits Watch dbRecipeCoord.Request in online mode Add explicit reset in PLC arbiter
Operator can edit on TP177B ES checkbox not disabled Recipe properties → Operator rights Clear "Change" right for all user groups
PC runtime hides recipe view Recipes option not licensed WinCC Flex RT diagnostics → Licence Install Recipes option licence
Two HMIs download simultaneously PLC arbiter not enabled Watch ActiveClient in dbRecipeCoord Implement and call fbRecipeArbiter in OB1

Edge Cases and Field-Proven Caveats

  • Path length: TP177B firmware limits the export/import path to 128 characters. Long share names plus deep subfolders break UNC paths; keep the share at the root.
  • Decimal separator: European locales default to comma; TP177B firmware expects dot. Set the regional setting in WinCC Flexible ES to English (USA) for the recipe to avoid malformed CSV.
  • Concurrent export collision: If two devices export at the same instant the file may become empty. Implement a "busy file" sentinel (recipe.lock) checked at the start of the export function on each device.
  • TP177A / OP77B: These older panels do not support UNC paths and cannot participate in this scheme. They can only import from local storage or directly via tags.
  • S7-1200 web server option: If the S7-1200 also exposes recipes via the web server (see the S7-1200 program instructions reference), a separate read-only web client may coexist with the panel workflow; the PLC arbiter still applies.
  • Recipe size limit: TP177B internal recipe storage is 64 KB. With records of 100 elements of 32 bytes each, a 20-record recipe approaches the limit. Use external storage via the PC and treat the TP as a cache.

Performance and Timing

Measured on a TP177B 6" color, image V2.0.4, against a Windows Server 2019 share on the same Gigabit switch:

Operation Records Elements/record Time
Export 25 records CSV 25 30 ~ 1.4 s
Import 25 records CSV 25 30 ~ 1.9 s
Coordinated download to PLC (Area Ptr 67) 1 30 ~ 240 ms
Combined cycle (edit + export + 2 imports + 2 downloads) 25 30 < 6 s end-to-end

Operator wait time is dominated by the import phase. Polling intervals below 500 ms on the TP lead to CPU spikes above 70% on the panel; use event-driven import on view change instead.

Recommended Engineering Defaults

  • Share: \\PC-NAME\Recipes, NTFS Modify only for RecipeSync.
  • File: single CSV per recipe, UTF-8 without BOM, semicolon separator, dot decimal.
  • PLC: DB 200 (TP177B #1), DB 201 (TP177B #2), DB 202 (PC runtime), each with the same 10-word coordination prefix.
  • Arbiter: highest priority to the PC (iActive loops start at 3), TP177Bs share priority 2 and 1.
  • TP177B operator rights: select and download only; change, add, delete disabled.
  • Import trigger: on view change + every 30 minutes as safety net.

FAQ

Does the TP177B require an additional Recipes licence?

No. Recipes are part of the TP177B integrated firmware. The WinCC Flexible Runtime PC, however, requires the Recipes option licence; without it the recipe view is hidden and export functions return error 0x8004A003.

Which network path format do I configure on every device?

Use a UNC path such as \\PC-NAME\Recipes\MyRecipe.csv. All three devices (PC, TP177B #1, TP177B #2) must use the identical string, including capitalization, or the panels will not see updates.

Can two panels download the same recipe to the PLC at the same time?

Not safely. Implement the PLC arbiter FB shown above so that only one HMI owns the Data record area pointer (Siemens area pointer 67) at a time. The other HMIs receive status word error 0x0002 ("bus busy") and must retry.

What SMB settings are required for the TP177B to reach the share?

Enable NTLM authentication on the share and disable SMB signing for the dedicated service account. TP177B firmware uses legacy LanManager-compatible authentication; strict SMB2/SMB3 signing causes silent connection failures.

How do I stop operators from editing recipes on the TP177B while still allowing selection?

In WinCC Flexible ES open the recipe properties and under "Operator rights" clear the "Change data record", "Add data record" and "Delete data record" permissions for every user group. The "Select" and "Download to PLC" permissions stay enabled.

Back to blog