Troubleshooting S7-1200 MP277 Array Tags in WinCC Flexible 2008

Problem Overview

When an S7-1200 PLC is connected to a Siemens MP 277 HMI panel running WinCC Flexible 2008, scalar tags (BOOL, INT, REAL) usually update without issue once the S7-300/400 driver is configured. Array tags, however, frequently fail to reflect values written by the PLC program. Typical symptoms reported in the field:

• Individual BOOL/INT tags from the same DB update on the HMI faceplate.
• Array elements of type Array[0..109] of DINT show 0, #, or constant stale values.
• Changes made in the PLC (verified with a watch table) are never visible on the HMI screen.
• Communication status between the panel and the S7-1200 shows Connected — the link is healthy; the data is simply not being read.

Root Cause Analysis

Three independent root causes account for nearly every field case. Each must be verified before assuming a single fault.

1. DB Attribute Mismatch: Optimized vs. Standard Block Access

The S7-1200 stores data blocks in two formats:

• Standard (non-optimized, compatible with S7-300/400): fixed start addresses, symbolic names are an additional layer. External partners (HMI, OPC, third-party) read bytes by absolute offset.
• Optimized block access: symbolic only, the compiler re-orders memory, no fixed byte offset exists. Available from STEP 7 Basic V11 onward and firmware V4.x of the S7-1200.

The S7-300/400 driver in WinCC Flexible 2008 requires the standard (non-optimized) format. If the DB that contains your array is created with optimized access enabled, every absolute address configured in the HMI tags points to a location the driver cannot resolve reliably — the panel reads garbage or zeros.

2. Array Address Mapping in the HMI Tag Editor

WinCC Flexible 2008 treats each array element as a separate external tag. When you create a single DINT tag, point to DB100.DBD0, DB100.DBD4, DB100.DBD8, ..., DB100.DBD436 (110 × 4 bytes = 440 bytes). Forgetting the 4-byte step for DINT, mixing 2-byte DBW offsets inside a DINT array, or starting at offset 1 instead of 0 is the most common user error.

3. Driver / Connection Parameters

The MP 277 must use the S7-300/400 driver (the only one WinCC Flexible 2008 SP2/SP3 ships that talks to the S7-1200 via the integrated PN/DP interface). The slot must be 1 (CPU 1200 slot in the S7-1200 rack), and the rack must be 0. A wrong slot is a frequent cause of "Connected, but no data."

Affected Versions and Compatibility

Prerequisites

• STEP 7 Basic / TIA Portal installed and licensed.
• WinCC Flexible 2008 SP2 or later with the S7-1200 HSP installed (TIA Portal > Options > Support Packages > SIMATIC HMI > MP 277).
• Ethernet cable between the MP 277 PN/DP port and the S7-1200 PROFINET port (direct or via switch).
• CPU in STOP when changing DB attributes (optimized ↔ standard).
• Active project backup (.ap13 / .zap13 / .s7p / .tfwx) before edits.

Step-by-Step Resolution

Step 1 — Verify the DB Block Attribute

1. In the TIA Portal project tree, expand Program blocks.
2. Right-click the DB containing the array, choose Properties.
3. Open Attributes and uncheck Optimized block access.
4. Confirm with OK. The compiler warning "Symbolic address only" disappears from the array element.

Step 2 — Declare the Array Correctly

Inside the standard DB, declare the array in the data block interface editor:

//  Data block "DB_Recipe" (DB100) — Standard block access
DATA_BLOCK "DB_Recipe"
  TITLE = Recipe values
  { S7_Optimized_Access := 'FALSE' }
  STRUCT
    RecipeValues : Array[0..109] of DINT;   // 110 elements × 4 bytes = 440 bytes
    Spare1       : DINT;                    // padding to keep alignment predictable
  END_STRUCT;
END_DATA_BLOCK

The S7_Optimized_Access := 'FALSE' attribute is exactly what the WinCC Flexible 2008 S7-300/400 driver expects. The array must be a member of a data block — array tags declared inside VAR_GLOBAL of a non-DB source cannot be addressed absolutely.

Step 3 — Configure the MP 277 Connection

1. In WinCC Flexible 2008, open Project > Connections.
2. Create or edit the S7-1200 connection:

Step 4 — Create the External HMI Tags for the Array

1. In WinCC Flexible, open HMI tags and choose New tag > External.
2. Set Connection = the S7-1200 connection created in Step 3.
3. Set Data type = DInt (32-bit).
4. Enter the address in the form DB <n> DBD <offset>:

Tag name             Address              Length (bytes)
Recipe_000           DB  100  DBD   0     4
Recipe_001           DB  100  DBD   4     4
Recipe_002           DB  100  DBD   8     4
...
Recipe_109           DB  100  DBD 436     4

The pattern is DBD[0 + 4 × i] for a DINT array starting at offset 0. For an Array[0..109] of REAL the same offsets apply (REAL is also 32 bits). For an Array[0..109] of INT use DBW[0 + 2 × i].

Step 5 — Verify the Same Data with a Watch Table

1. Open the S7-1200 online connection in TIA Portal.
2. Create a watch table with the same DB offsets (DB100.DBD0, DB100.DBD4, ...).
3. Force a value, e.g. DB100.DBD20 = 12345, and observe the MP 277 faceplate within one acquisition cycle.

If the watch table updates and the HMI does not, the problem is in the WinCC Flexible configuration (Steps 3-4). If neither updates, the problem is in the DB attribute (Step 1) or the PLC program is writing to a different tag.

Step 6 — Rebuild and Transfer

1. Compile the WinCC Flexible project (Project > Compiler > All) and transfer the runtime to the MP 277 via Ethernet or MPI/Profibus (PN recommended).
2. Download the STEP 7 program (with the corrected DB attribute) to the S7-1200. A re-download is mandatory; the runtime already on the CPU was compiled against the old optimized layout.
3. Cycle power to the panel if the new image requires it (rare; SP2+ does not need it).

Alternative: Symbolic Single-Tag Mode (Avoids the Array Problem Entirely)

If the array is a 110-element DINT recipe table and the recipe is edited only from the HMI, a robust alternative is to expose one symbolic tag per element rather than an array:

// Data block "DB_Recipe_Symbolic"
STRUCT
  Recipe_000 : DINT;
  Recipe_001 : DINT;
  ...
  Recipe_109 : DINT;
END_STRUCT

This is less elegant than a true array but works around the WinCC Flexible 2008 limitation. With TIA Portal + WinCC Comfort V11+ this hack is no longer necessary because the SIMATIC S7-1200 driver understands symbolic array access.

Alternative: Move to TIA Portal (Recommended Long-Term Path)

The root cause of the entire class of "array tags not updating" issues is that WinCC Flexible 2008 predates symbolic S7-1200 access. The clean fix is a migration to TIA Portal with a Comfort Panel:

1. Migrate the S7-1200 program to TIA Portal V16 or V17.
2. Replace the MP 277 with a Comfort Panel (e.g. TP700 Comfort, 6AV2 124-1GC01-0AX0) or KTP1200 Basic (6AV2 123-1MA05).
3. Use the SIMATIC S7-1200 HMI driver. Arrays of any length are imported as Structured tags automatically.

The S7-1200 array data type, as documented in the TIA Portal help, lets the block interface editor declare an array, expose it symbolically, and consume it on the HMI without offset arithmetic. See the official manual page at Array data type — S7-1200 manual collection.

Verification Matrix

Common Fault Patterns

Field-Commissioning Notes

• Before downloading, take a backup of the S7-1200 project, the WinCC Flexible project, and the MP 277 image. Use Card Reader > Backup (ProSave) for the panel.
• If the S7-1200 firmware is upgraded from V3 to V4, optimized block access becomes the default for new DBs. The Standard attribute must be re-applied to legacy DBs explicitly; it is not migrated automatically.
• WinCC Flexible 2008 SP2 introduced the S7-1200 connection as a separate driver entry on TIA Portal-side engineering but the field panel firmware still calls it the S7-300/400 driver. Do not mix the two on the same panel.
• For arrays larger than ~250 DINTs, prefer splitting into multiple DBs. A single HMI connection of the S7-300/400 type can read contiguous blocks faster, and the engineering becomes easier to troubleshoot.
• If the customer insists on symbolic access without migrating, the only stable workaround is the per-element symbolic pattern shown earlier.

Safety Considerations

FAQ