WinCC Advanced V13 Indirect Tag Addressing via Multiplexing

Overview: Indirect Tag Addressing in WinCC Advanced V13

Indirect tag addressing allows an HMI screen, script, or faceplate element to reference a tag whose name (or PLC address) is not hard-coded at compile time but is resolved at runtime from an index, a pointer variable, or a script string. In WinCC Professional (WinCC RT Professional for PC-based panels) and in the legacy WinCC V7.x SCADA, indirect addressing of tag names is a first-class feature, and a single faceplate instance can be bound to any tag whose name is passed in as a string. In WinCC Comfort and WinCC Advanced (the runtime families delivered with TIA Portal for panel-class devices such as the SIMATIC TP1900 Comfort, TP700 Comfort, TP900 Comfort, TP1200 Comfort, TP1500 Comfort, TP2200 Comfort, the KTP400 to KTP1200 Basic/Comfort line, and the IPC227G / IPC277G with Comfort/Advanced runtime), the runtime engine does not expose this capability in the same way. The tag name must be known to the configuration compiler; what is permitted in runtime is tag multiplexing and address multiplexing using a fixed, pre-declared list of candidate tags or addresses. This document captures the engineering pattern, the TIA Portal V13 / V13 SP1 configuration steps, the VBScript boundaries on a TP1900, and the upgrade path to WinCC Unified V20 for projects that genuinely require dynamic tag names.

The Engineering Problem: Dynamic Tag Names in a Faceplate Popup

The typical application pattern is a pop-up screen that contains a faceplate with four push-buttons, and each button must write a Boolean value (0 or 1) to a tag whose identity is not known at engineering time. The user wants to:

1. Declare four internal string tags inside the TP1900 project, e.g. Button1_TagName, Button2_TagName, Button3_TagName, Button4_TagName.
2. From the calling screen, write four PLC tag names (for example DB100.DBX0.0, Motor1_Run, Valve_A_Cmd, Pump_Start) into those four internal strings.
3. Open the pop-up. On the Open event, the faceplate reads the four string values and treats them as the tag names that the four buttons will set or reset.
4. Tap a button, and the corresponding real PLC tag flips state.

Step 3 and step 4 are the parts that WinCC Comfort / Advanced cannot perform as written. The runtime does not allow the resolution tag = Tags("<value of Button1_TagName>") in the way that WinCC Professional allows it. The four PLC tag names must be declared as real HMI tags at compile time, and the faceplate must be wired to those real tags via an index that is selected at runtime. This is multiplexing.

Why Tagnames Cannot Be Set in Runtime in WinCC Comfort/Advanced

The TIA Portal engineering tool generates a fixed tag list for the runtime image. When the WinCC RT Advanced firmware boots on the TP1900, it loads a binary tag table that includes the type, length, start address, and update cycle of every tag declared in the project. The name-to-data-slot mapping is compiled into this image, and there is no API on the panel to add a new name-to-slot entry at runtime. VBScript on WinCC Comfort/Advanced is restricted to:

• Accessing tags that already exist in the project by their literal name, e.g. HMIRuntime.Tags("Motor1_Run").Write 1.
• Constructing a name from a concatenation of literal strings and writing the resulting text to a string tag, but not using that constructed text to dereference a tag.
• Iterating over the existing tag list using HMIRuntime.TagInfos and HMIRuntime.TagInfos.Count in V13 SP1 and later.

The legacy WinCC V7.x scripting model and the current WinCC RT Professional model both extend VBScript with the HMIRuntime.Tags collection, which accepts dynamic string expressions because the underlying C++ tag manager keeps a hash table that can be queried by name. On a TP1900 running RT Advanced, that hash table is replaced by a fixed-offset array of pre-declared tags, and the Tags(name) accessor is bound at compile time to a slot index, not a hash key.

Tag Multiplexing: The Supported Indirect Method

Tag multiplexing is configured per I/O field, per button, per toggle, or per symbolic I/O field on a screen. It allows the same screen object to display or write one tag out of a pre-declared list, with the active tag selected by an integer index tag (0..n-1). On a TP1900 faceplate with four Boolean buttons, the configuration is:

1. Declare the four candidate HMI Boolean tags in the project, e.g. Tag_ButtonA, Tag_ButtonB, Tag_ButtonC, Tag_ButtonD. These are real HMI tags, pointing to the PLC tags DB100.DBX0.0, DB100.DBX0.1, DB100.DBX0.2, DB100.DBX0.3 (or whatever the real destinations are).
2. Declare an internal USInt or Int tag named MultiplexIndex that will hold 0, 1, 2, or 3.
3. Configure the button "Events > Press" to write to the multiplexed tag. The tag itself is a placeholder; at runtime, the actual target is the entry in the list whose index equals MultiplexIndex.
4. Set MultiplexIndex from the calling screen or from a drop-down list in the pop-up.

The advantage is that only one faceplate is required, and the tag list can be extended (up to 256 entries in Comfort/Advanced V13 SP1) without redesigning the faceplate. The disadvantage is that the destination tags must be known at engineering time.

Address Multiplexing: When Tags Use the Same Area Pointer

Address multiplexing is the second indirect mode and is the right choice when the four button destinations are consecutive bits inside a single PLC DB or process image partition. The TP1900 can be configured so that the button writes to DB100.DBX<MultiplexIndex>.0, where MultiplexIndex is the runtime variable. This is more memory-efficient than tag multiplexing because only one area pointer and one index variable are required, but it requires the four targets to live in a contiguous bit range.

Typical TIA Portal settings for address multiplexing on a TP1900 button:

When the index changes from 0 to 3, the runtime writes to byte 0 bit 0, byte 0 bit 1, byte 0 bit 2, and byte 0 bit 3 in turn. The same address-multiplexed object is reused; the faceplate design does not need to know which physical bit it is currently bound to.

Configuring Multiplexing in WinCC Advanced V13 SP1 (Step-by-Step)

The official Siemens support entry for multiplexing in TIA Portal V13 SP1 documents the Inspector-window workflow. The full procedure for the four-button faceplate use case is:

1. In the project tree, open the pop-up screen that contains the faceplate with the four buttons.
2. Select the first button. In the Inspector window click Properties > Properties > Multiplexing.
3. Tick the Multiplexing option to activate indirect addressing. The default mode is Tag multiplexing; switch to Address if the four destinations are contiguous.
4. For tag multiplexing, drag the four candidate Boolean tags from the HMI tag table into the multiplex list. For address multiplexing, enter the start address and the bit stride.
5. Bind the Multiplex variable to the index tag (e.g. MultiplexIndex). The data type of the index must be an integer type; for 4 entries, USInt is sufficient.
6. On the Events tab, configure the press event to set the value to 1 and the release event to set the value to 0, or use a toggle event with a script that reads HMIRuntime.Tags("MultiplexIndex").Read and writes the inverse of the current value through the multiplexed tag.
7. Compile the project and download to the TP1900. Verify in the runtime that changing the index tag updates the active tag of the button in the connection list (online > tag diagnostics).

Reference: Addressing tags indirectly - WinCC Advanced V13.0 SP1 (Siemens Support, ID 109091876).

Implementing a Faceplate Popup With 4 Multiplexed Boolean Tags

The screen objects needed for the pop-up are:

The VBScript on the pop-up Open event (WinCC Advanced V13 SP1) is the only place where the calling screen passes information to the faceplate:

' --- WinCC Advanced V13 SP1, pop-up Open event ---
Sub OnOpen()
    Dim iIndex
    iIndex = SmartTags("CallerIndex")
    If iIndex < 0 Then iIndex = 0
    If iIndex > 3 Then iIndex = 3
    SmartTags("MultiplexIndex") = iIndex
End Sub

This is the pattern that replaces the originally requested "read 4 internal strings as tagnames" approach. The four internal strings from the original design (Button1_TagName .. Button4_TagName) are replaced by a single integer index, and the four real HMI tags are pre-declared in the project.

VBScript Workaround: Reading Internal Strings as Tag References

On WinCC Comfort/Advanced V13 SP1, the VBScript statement SmartTags("<variable-name>") and HMIRuntime.Tags("<name>") both require a string literal, not a constructed string. The following pattern is therefore not supported on a TP1900:

' --- Does NOT work on WinCC RT Advanced V13 SP1 ---
Dim sName
sName = SmartTags("Button1_TagName").Value      ' sName = "Motor1_Run"
HMIRuntime.Tags(sName).Write 1                  ' runtime error: tag not found

The runtime cannot resolve sName as a tag name because the tag manager has no hash table keyed on runtime strings. Two patterns are sometimes proposed in user scripts and both fail at runtime:

The VBScript engine on the TP1900 does have access to HMIRuntime.TagInfos for reading the properties (name, type, PLC address) of the existing tag set, which is occasionally useful for diagnostic scripts. It cannot, however, add new entries to the set.

Comparison: Comfort/Advanced vs Professional vs Unified

The decision tree for which product to use is driven by whether the application truly needs tag-name dynamism at runtime:

If the project already has a TP1900 with an active Comfort/Advanced licence, the pragmatic answer is to keep the panel and refactor the faceplate to use tag multiplexing. If the project is being designed from scratch and the four-button faceplate is one of many reusable widgets, the answer is to step up to WinCC Professional (PC runtime) or, for new designs in 2024-2025, to migrate to WinCC Unified V20 where dynamic tag binding is natively supported.

WinCC Unified Indirect Addressing (V20 Reference)

For projects that move to a Unified Comfort Panel (UCP) or to WinCC Unified Runtime on an IPC, Siemens documents two first-class mechanisms in the TIA Portal V20 help: indirect addressing via an HMI tag and indirect addressing via a screen object. The tag-based method resolves the active tag from the value of a separate HMI tag, and the screen-object method resolves it from a property of the screen object (for example the TagName property of a faceplate container). Both are exposed in the Inspector window of the screen object that consumes the tag.

The Unified path therefore matches the original engineering intent: the pop-up can be designed with a faceplate that has a string input, and the four buttons can each consume one of four dynamic tag references. Reference: Indirect addressing (RT Unified) - WinCC Unified, TIA Portal V20 documentation.

Troubleshooting Matrix: Common Errors and Fixes

Verification Procedure

1. Open the project in TIA Portal V13 SP1 and compile. There must be zero errors and zero warnings on the tag list and the screen compilation.
2. Download the project to the TP1900. Confirm that the RT loader reports the same number of tags as the engineering compile log.
3. Open the pop-up from the main screen. Verify that the MultiplexIndex tag is set to the value passed by the calling screen (use the online tag diagnostics view in the panel or in TIA Portal online).
4. Press each of the four buttons in turn. Read the corresponding PLC tag with a watch table in STEP 7 / TIA Portal. The bit must flip in the correct DBX byte.
5. Change MultiplexIndex from 0 to 3 and confirm that the next button press writes to the new destination tag, not the old one.
6. Power-cycle the TP1900 and confirm that the multiplexing configuration persists, that the index tag is re-initialised to its default, and that the four buttons retain their binding to the multiplexed list.

Field-Proven Caveats

• Multiplexing increases the engineering-time complexity of tag diagnostics. Each button is bound to a multiplexed list, and the active tag can only be read by inspecting the current value of the index. Plan for an additional HMI tag ("CurrentTargetName", string) that is written by a script each time the index changes, for operator display.
• On TP1900 with the early WinCC Advanced V13 (pre-SP1) firmware, the maximum number of multiplex entries is 16. SP1 raises this to 256. Confirm the panel's runtime image version under Panel > Online > Diagnostics > Runtime.
• VBScript on Comfort/Advanced cannot call HMIRuntime.Project.Deactivate or any other method that alters the running project. The panel is locked into the compiled image until the next download.
• If the project uses a S7-1200 / S7-1500 PLC, the DBX address of the multiplexed bits must be inside a DB that is marked as retentive only if the button state is supposed to survive a power cycle. Otherwise, non-retentive DBs will reset to 0 on PLC restart.
• Address multiplexing and tag multiplexing cannot be mixed inside a single screen object. Choose one mode per I/O field, button, or symbolic I/O field.