WinCC Flexible 2008 Address Multiplexing: Reducing Power Tags

1. Problem Statement: Power Tag License Exhaustion

WinCC Flexible 2008 (SP2, SP3, SP4) tags are metered against a license key. Each project has a Power Tag ceiling printed on the license certificate or visible under Project > Properties > Licensing. Power Tags are runtime variables bound to a PLC address; internal tags and constant tags are not counted.

A typical symptom is a project that compiles cleanly in the engineering station but aborts at runtime download with:

The mismatch is fixed by reducing the counted Power Tag set without losing the data points visible to the operator. Siemens provides three built-in mechanisms:

1. Address Multiplexing (sometimes called "indirect addressing" or, in older Siemens literature, "tag multiplexing")
2. Array tags with index-based access
3. Boolean packing into WORD / DWORD PLC words

2. Tag Multiplexing vs Address Multiplexing: What Siemens Actually Calls It

The phrase "tag multiplexing" is not a discrete configuration object in WinCC Flexible 2008. There is no property called Multiplexed on a tag in the editor. What exists is:

• An address expression on a tag that contains a multiplexer index (an integer tag whose value is concatenated into the address at runtime).
• The multiplexer index itself (a 16-bit unsigned internal or external tag that drives the address calculation).

Siemens Support Entry ID 21807421 (see "How does tag multiplexing work?" on the Siemens Industry Online Support portal) describes the feature as: "With tag multiplexing you can access multiple tags via one index tag. For example, for visualizing similar machines you configure just one picture." The document applies to WinCC Flexible 2005/2008, and the same behaviour continues in WinCC Unified V20 under the renamed section "Address Multiplexing (RT Unified)" (see TIA Portal V20 documentation: Address Multiplexing (RT Unified)).

3. Power Tag Licensing Fundamentals

WinCC Flexible counts a tag as a Power Tag if all of the following are true:

• The tag's Acquisition mode is Cyclic continuous, Cyclic on use, or On change.
• The tag is bound to a PLC address (external) and is in the active project scope.
• The tag is enabled for use in screens, scripts, or logging.

Tags that do not count against the Power Tag license:

• Internal tags (HMI-local memory).
• Constants (literals shown on the screen).
• Tags disabled in the project or filtered out by an area pointer selection.
• Tags inside a screen that is not in the active screen tree on the target device.

The license check is performed at runtime start and at every project download. A typical error message displayed in the HMI loader is:

Error 130003:
"Maximum number of Power Tags exceeded.
The project requires 218 Power Tags,
but the license permits only 128."

4. Address Multiplexing Architecture

The multiplexer mechanism in WinCC Flexible 2008 works as a runtime address resolver. The configured tag carries an address expression with a placeholder; the placeholder is replaced by the value of the index tag on every read cycle.

4.1 Address expression syntax

The placeholder is the index tag name in angle brackets. For a tag whose value is read from DB100.DBW<IndexTag> (S7-300/400) or %DB100.DBW<IndexTag> (S7-1200/1500) the address dialog shows:

Address:      DB100.DBW<IndexTag>
Index Tag:    iMachineIndex    (INT, 0..11)
Acquisition:  Cyclic, 1 s

Runtime behaviour:
  If iMachineIndex = 0  -> reads DB100.DBW0
  If iMachineIndex = 1  -> reads DB100.DBW2
  If iMachineIndex = 2  -> reads DB100.DBW4
  ...
  If iMachineIndex = 11 -> reads DB100.DBW22

The PLC address offset is automatically scaled by the tag's data type. For a WORD (2 bytes) the index increments the address by 2; for a DWORD (4 bytes) by 4; for a BOOL by 1 bit (only meaningful with bit address syntax, see section 4.3).

4.2 Supported data types

4.3 Bit-level multiplexing

For BOOL tags the index drives a bit offset, not a byte offset. The address expression must use the bit syntax:

Address:      DB100.DBX<IndexTag>.0
Index Tag:    iBitIndex  (INT, 0..7)

This reads bit 0 of the byte formed by:
  iBitIndex=0 -> DB100.DBX0.0
  iBitIndex=1 -> DB100.DBX1.0
  iBitIndex=2 -> DB100.DBX2.0
  ...

For wider boolean fields pack eight machine-status bits into one byte and let the index select the bit, reducing the per-machine Power Tag count from 8 to 1.

4.4 Number of addresses addressable

The index tag is a 16-bit signed integer (range -32768..32767). The addressable address space is therefore 65536 units of the tag's type step. For WORD tags that is 128 KB of contiguous PLC memory, which is more than enough for typical multiplexing applications (12-40 machines).

5. Configuration Procedure in WinCC Flexible 2008 SP2/SP4

The following step-by-step configures a multiplexer that drives 12 identical machine pictures from a single set of screen objects, and demonstrates the Power Tag count reduction for a project that originally required 218 Power Tags.

5.1 Prerequisites

• WinCC Flexible 2008 SP2 (or later SP) with the ES installed.
• PLC project where process data is laid out in a contiguous data block, e.g. DB100 with a UDT UDT_Machine of 36 bytes per instance.
• Index tag of type INT, written by either the PLC (e.g. MW 200) or an HMI internal tag driven by a screen selector button.

5.2 Step-by-step configuration

1. Open the tag editor in WinCC Flexible. Right-click Tags > Analog / Binary and select New Tag.
2. Define the index tag first, because other tags reference it. Name iMachineIndex, type INT, address MW 200 (PLC) or leave address blank for an internal tag.
3. Create the multiplexed process tag. Name it e.g. rMachineTemp_PV, type REAL, address DB100.DBD<iMachineIndex>. The <iMachineIndex> placeholder appears in the address field as a token; the index tag is selected via a dropdown next to the address field.
4. Set Acquisition mode to Cyclic continuous with a 1 s cycle. (Use On change only for slow-changing setpoints to reduce HMI-PLC traffic.)
5. Repeat step 3 for every process value of the machine, using the same index tag. Each different data type requires its own tag, but every value type is multiplexed through the single index.
6. Map the tag to a screen object (IO field, bar, etc.). The object references rMachineTemp_PV, not a per-machine tag.
7. On the screen, place a machine selector: an IO field bound to iMachineIndex with limits 0..11, or 12 buttons that write 0..11 into the index tag via a "Set Value" event.
8. Compile and download. Verify in the HMI loader that the Power Tag count reported during download is 1 (the process tag) plus the index tag, regardless of how many machine instances the screen can show.

6. Worked Example: Cutting 218 Power Tags to 38

Original machine panel architecture (per machine):

After multiplexing, replace the 12 per-machine tags with 12 multiplexed tags (one per data point). Each multiplexed tag is still 1 Power Tag. Total goes from 12 × 12 = 144 + 2 = 146 down to 12 + 2 = 14 Power Tags for the data view, plus the multiplexed screen objects shared across machines. A more aggressive example combining multiplexed tags with a single combined status WORD per machine reduces further:

7. Alternative: Array Tags with Index Access

Array tags are configured in WinCC Flexible 2008 SP2 and later under Tags > New Tag > Data type: Array. The HMI treats the array as a single Power Tag regardless of element count, because only the base address of the array is counted as a connection point; each element is then accessed by index at runtime.

Tag: arrMachineHours[0..11]
Type: Array of DINT
PLC address: DB200.DBD0   (PLC holds 12 consecutive DINTs, 48 bytes)

Usage in VB script:
  HMIruntime.Tags("arrMachineHours").Write i, value

Usage in screen:
  IO field connected to arrMachineHours with index tag iMachineIndex

Array tags are most efficient when many identical-type values are stored in the PLC as a contiguous block (e.g. shift counters, daily production totals, temperature log buffers).

8. Boolean Packing into WORD / DWORD

Where the HMI only needs to display or set individual boolean states (Run, Stop, Fault, Auto, Manual, etc.), bundling them into a single WORD or DWORD on the PLC side and reading it as one multiplexed tag reduces 16 or 32 individual Power Tags to one.

PLC DB100 layout (UDT_Bits, 2 bytes per machine):
  Bit 0:  bRun
  Bit 1:  bStop
  Bit 2:  bFault
  Bit 3:  bAutoSelected
  Bit 4:  bManualSelected
  Bit 5:  bRemoteSelected
  Bit 6:  bMaintMode
  Bit 7:  bEStopActive
  Bit 8:  bDoorClosed
  Bit 9:  bLubricationOK
  Bit 10: bHeaterOn
  Bit 11: bCoolingOn
  Bits 12-15: spare

HMI side:
  Tag wMachineBits, type WORD, address DB100.DBW<iMachineIndex>
  Power Tag cost: 1 (versus 12 individual BOOL tags)

To display bit 3 (Auto) of machine 5 on the HMI, use a script:

' VBScript in WinCC Flexible 2008
Dim wVal, bAuto
wVal = SmartTags("wMachineBits")(SmartTags("iMachineIndex"))
bAuto = (wVal And (2 ^ 3)) <> 0
SmartTags("bAutoDisplay") = bAuto

This is the most Power-Tag-efficient approach but loses the per-bit direct binding available in the IO field dialog. Use it when a script-driven bit view is acceptable.

9. Differences in WinCC Unified / TIA Portal V20

The successor platform, WinCC Unified as of TIA Portal V20, formalizes the feature as Address Multiplexing (RT Unified) with explicit configuration objects.

• The address expression is now configured under the tag's Properties > Multiplexing tab rather than as inline angle brackets.
• The index tag can be selected from a dropdown that lists all HMI tags (internal and external) and PLC tags exposed via the HMI connection.
• Multiplexing can be combined with Quality of Service settings: an invalid index value (out of range) triggers a configurable fallback (last good value, default value, or quality code "bad-configuration").
• WinCC Unified no longer has a hard Power Tag count cap on PC Runtime for most configurations; the licensing model shifted to "Tags" counted with a higher ceiling and many licenses ship with 4k-32k tags. Mobile panels and Comfort Panels retain a Power Tag-equivalent cap.

For new projects on TIA Portal V18-V20, prefer the explicit Address Multiplexing dialog. For legacy WinCC Flexible 2008 projects that are being migrated, the angle-bracket syntax is auto-converted by the TIA migration tool, with manual review required for any tag where the index tag name was renamed during migration.

10. Verification and Commissioning

After configuration, perform the following checks before handing the panel to operations.

1. Power Tag counter: On the engineering station, run Project > Compiler > All > Consistency Check. The output should show "Power Tags used: N" where N matches the expected count from the design spreadsheet. The license error appears only on the runtime loader; this ES check gives a faster turnaround.
2. Index boundary test: On the HMI, set the index tag to -1, 0, max-1, max, max+1. Each value should produce a valid HMI display (or a defined quality code) without crashing the runtime. Invalid indices typically result in Quality Code: Bad - Configuration rather than a hard fault.
3. Cyclic stress: With the index tag driven by a PLC script that flips it 0..11 every 100 ms, observe in the HMI diagnostic page (if configured) that all values update and the cycle is smooth. Use Tools > HMI Diagnose on PC Runtime to see the tag cycle time.
4. PLC-HMI consistency: Write a known value (e.g. 123.45) to a specific machine's PV in the PLC. Set the index tag to that machine's index. Verify the HMI shows 123.45. Repeat for each machine index.
5. License check on target: After download, the loader reports the runtime Power Tag count. Confirm the number matches the design. The text of the loader dialog contains the exact "X Power Tags required, Y licensed" line.

11. Troubleshooting Matrix

12. Limits, Caveats, and Field-Notes

• Multiplexing is runtime-only. The ES, the HMI loader, and the connection diagnostics all show only the base tag (one Power Tag), not the effective number of accessible PLC addresses. The actual data points available to the operator are still bound by the address space the index tag can address.
• Multiplexing does not reduce HMI-PLC traffic. A multiplexed tag polled at 1 s still reads the current index's address every cycle. The PLC sees the same number of read requests as if 12 separate tags were configured, just sequential instead of parallel.
• Alarm logging on a multiplexed tag produces alarms tagged with the value of the index at the time of the event. If the index changes between the trigger and the HMI's archive write, the alarm may be attributed to the wrong machine. For high-integrity alarming, use dedicated tags per machine for the alarm source.
• Audit trails (WinCC Flexible 2008 SP3 "Audit" option) record the tag name, not the resolved address. If the audit log must show which machine a write was directed to, include the index tag in the audit entry manually via a script.
• Multiplexing is not available on all connections. OPC DA, OPC UA Client, and some third-party PLC drivers do not support inline index expressions. The placeholder works on native S7 MPI/Profibus/Profinet and on Modbus TCP (with restrictions on the Modbus address range).
• Index tag is single-threaded. If two screens on the HMI use multiplexed tags with different index tags, ensure the index tag is consistent. A common pattern is to drive one global index tag from a screen-stack mechanism so that switching screens does not leave stale indices.

13. Combining All Three Techniques

For a project that must fit a 128 Power Tag license but covers 18 machines with rich per-machine data, the typical maximum-compression design is:

This is an order of magnitude under the 128 Power Tag license, leaving headroom for project growth or for additional tag requests from operations without a license upgrade.

14. Frequently Asked Questions