WinCC Comfort VBScript: Building Dynamic HMI Tag References from Index Variables

Engineers commissioning parameter-driven HMI screens on S7-1200 and S7-1500 panels frequently need to map a single display field to one of N PLC tags based on a runtime index. The naive string-concatenation approach often returns a blank or stale value because the runtime collection is being indexed with a literal token rather than the constructed name. This reference covers the exact syntax fix, the UDT-element constraint that limits this pattern on WinCC Comfort, and the alternate architectures that scale beyond two or three indices.

Problem Statement

Consider a TIA Portal project with two machines, each owning two format strings exposed as DB elements:

DB_Machine_01.stFormat_1  : STRING[20] = "Vacuum"
DB_Machine_01.stFormat_2  : STRING[20] = "Sealer"
DB_Machine_02.stFormat_1  : STRING[20] = "Nozzle"
DB_Machine_02.stFormat_2  : STRING[20] = "Feeder"

The HMI side mirrors these as global tags DB_Machine_01_stFormat_1 ... DB_Machine_02_stFormat_2. The intended routine receives an index (1 or 2) and writes the resolved string into a read-only display tag value1. The original implementation looks correct at a glance but returns nothing on screen:

Symptom: the bound output field stays empty, even when index is a valid 1 or 2 and the underlying PLC tag is known to be populated. No runtime error is raised; the field just never updates.

Root Cause

The defect is a single pair of quotes. HMIRuntime.SmartTags accepts a String argument that names the tag to look up. The literal "tag" in the source above passes the four-character word tag to the collection, not the contents of the local VBScript variable tag. There is no HMI tag called tag, so the lookup returns an empty variant. The .Value property on an empty variant is also empty, which is what propagates to the display.

The corrected line removes the quotes so VBScript passes the variable's current string value:

Two additional defects in the same routine compound the issue and are worth correcting while you are in the file:

WinCC Comfort VBScript Tag Model

WinCC Comfort and WinCC Advanced use the same VBScript engine (cscript-compatible) but a reduced object model compared to WinCC Professional. The two collections the engineer needs are HMIRuntime.Tags and HMIRuntime.SmartTags.

The name argument is always a String matching the HMI tag name exactly. Tag-name lookup is case-insensitive on the HMI side, but the match is otherwise exact — including the PLC connection prefix if your tag is configured with one. Mismatches raise runtime error 13 (Type mismatch) or silently return Empty depending on the panel firmware.

Corrected Script

The minimal fix replaces the Set line and uses the variable directly. Two equivalent forms are shown; pick the one that matches the rest of your project style.

Form A — SmartTags read into a local

Form B — Tags collection with explicit Read

Form B is preferred for production code because it exposes the OPC UA quality code (good = 0, bad = &hC0000000&, uncertain = &h40000000&). On a Comfort Panel, quality code visibility is the cheapest way to catch a tag name typo, a disconnected PLC, or a non-existent DB element before it cascades into a "blank screen" complaint at FAT.

UDT Dynamic Access Constraints

If the HMI tags are not flat STRING globals but elements of an HMI-side UDT (PLC UDT mirrored to a WinCC UDT), there is a second defect class to check against the published Siemens support entry 109813306 — Current system behavior for dynamic access to elements of a user data type.

The relevant behaviours for TIA Portal V15.1 through V18 (WinCC Comfort/Advanced):

For the project in the source, the PLC exposes stFormat_1 and stFormat_2 as STRING members of a DB_Machine_xx block. If those blocks are themselves UDT instances on the HMI side, the V15.1 path will silently return Empty even after the string-construction fix. Move to the Tags collection form to clear the symptom.

Alternative Architectures

String concatenation works for two or three indices, but it scales poorly. Each new machine forces a new HMI tag, a new branch in the script, and a new HMI connection load. The following patterns replace concatenation with structured access and are the recommended approach once N exceeds 4.

2.1 Array tag with index-driven selection

WinCC Professional and Unified support array tags. Comfort does not. If your project is on a Comfort panel (TP700 / TP900 / TP1200 / KP variants), skip this option and use an indexed-DB block instead.

2.2 Indexed DB block with pointer indirection

On the PLC side, build a contiguous block of N format strings:

DATA_BLOCK "DB_Formats"
  STRUCT
    stFormat : ARRAY[1..16] OF STRING[20];
  END_STRUCT
END_DATA_BLOCK

Copy the active machine's format into the array on each format change. On the HMI side, expose DB_Formats.stFormat[1..16] as 16 HMI tags, or as a single array tag if the panel supports it. The script reduces to a fixed offset:

This is the pattern the rest of the Siemens sample library uses for the same use case (format selection on a packaging line). It also makes the HMI connection list flat and audit-friendly.

2.3 Symbolic indirect addressing on the HMI

WinCC Comfort supports a limited form of symbolic indirection: any property or animation bound to a tag name can be redirected at runtime by writing the desired tag name into a configured multiplex tag tied to a multiplexed IO field. The benefit is that the script no longer needs to know the index — the IO field's Tag prefix is bound to the multiplex tag, and the operator selects a base index in a separate field.

Configuration steps (TIA Portal V17 example, TP700 Comfort):

1. Create an internal INT tag IndexMultiplex.
2. Add an I/O field on the screen and set its Tag prefix property to DB_Machine_0{IndexMultiplex}_stFormat_.
3. Add a second I/O field bound to IndexMultiplex; the operator types 1 or 2.
4. WinCC resolves the prefix + index + suffix on each refresh and binds the value automatically — no script required.

This is the most maintainable pattern for line HMI screens where the same display field shows the current format for the active machine, but it is limited to two index dimensions and does not work on TP1500 Basic panels.

Indirect Addressing Pattern (Recommended for the Source Project)

For the original two-machine × two-format case, the recommended code is below. It is defensive: it validates that the constructed name resolves to a real HMI tag, reads it through the Tags collection, and reports a quality code on the screen if the PLC link is down.

Bind the script to the Change event of an I/O field bound to index, or to a "Show format" button's Click event if you prefer explicit operator action.

Verification

1. Set a breakpoint on the t.Read line. Step through and confirm tagName contains the expected HMI tag name byte-for-byte (Watch window).
2. Confirm the tag exists in the HMI tag table: HMI tags → filter by connection → confirm the DB element is linked, not just declared.
3. Force the PLC tag to a known value with the Watch table (e.g. write "TEST" to DB_Machine_02.stFormat_2) and confirm the HMI display shows the same string after the script runs.
4. Disconnect the PLC connection (Online → Accessible nodes → uncheck). Run the script with a valid index. Confirm value1 shows the BAD qc=... branch, not a stale value.
5. Trigger the script with index = 3 (out-of-range). Confirm the ERR tag=... branch fires rather than crashing the panel runtime.

Troubleshooting Matrix

Cross-Platform Notes

The exact fix is portable across the WinCC family, with these caveats:

• WinCC Comfort / Advanced (TIA Portal) — VBScript only, no full VBA. The corrected pattern works on every Comfort panel from TP700 to TP2200 running V15.1 or later.
• WinCC Professional (TIA Portal) — Same VBScript syntax. Can also use the C / VB script IDE for compiled modules; the HMIRuntime.SmartTags pattern is unchanged.
• WinCC Unified (TIA Portal V17+) — JavaScript replaces VBScript. The pattern is HMIRuntime.Tags.Tags("name").Read() on the RT side; the collection name is plural and the method is Read(), not a property. The string-concatenation logic is identical.
• WinCC Classic (STEP 7 V5.x) — C scripting or VB scripting against a different runtime. The WinCC Classic DMOpen / GetTagChar family is the equivalent, with GetTagChar(lpszTagName) replacing SmartTags(...).

FAQ