WinCC Flexible: Auto-Load Recipes via Tag Change Event

Overview

Loading a recipe automatically when a Boolean tag changes is a common requirement on SIMATIC HMI panels running WinCC flexible 2008 Compact, Standard, or Advanced. The task is conceptually simple: a PLC bit toggles (for example, when the operator changes a part number, when a barcode is scanned, or when a machine state changes), and the HMI must read the corresponding data record from its internal recipe storage and transfer it to the PLC. In WinCC flexible this is done with the system function SetDataRecordToPLC combined with a tag-change event.

The catch is that a direct, unthrottled call to SetDataRecordToPLC is unsafe. If the HMI is still transferring a previous record when a new trigger arrives, the second transfer collides with the first and the data ends up corrupt or out of order. The proper solution uses the "data record" area pointer (also referred to as the data mailbox in the WinCC flexible Communication manual) to handshake the trigger and confirm completion. This article walks through the full configuration on a TP700 Comfort panel connected to an S7-1200, including the area pointer, the tag event, the function call, and the handshaking sequence.

Prerequisites

Before starting, confirm the following hardware and software are present and matched:

• WinCC flexible 2008 SP5 or later (Compact/Standard/Advanced). The 2008 generation is the most widely deployed in the field; TIA Portal (WinCC Comfort/Advanced) follows the same architecture but with a different configuration dialog.
• A configured project with at least one HMI device, e.g. TP700 Comfort (6AV2 124-1MC01-0AX0) or a comparable panel supporting data records.
• A connected PLC: SIMATIC S7-1200 (CPU 1211C/1212C/1214C/1215C/1217C) or S7-300/400. The example below uses an S7-1200 CPU 1214C DC/DC/DC (6ES7 214-1AG40-0XB0) with firmware V4.4 or later, which supports PUT/GET-style access from the HMI.
• STEP 7 Basic (TIA Portal) V15.1 or later, or STEP 7 V5.5 SP4 with WinCC flexible 2008 SP5.
• A working Ethernet (PROFINET) connection between the HMI and the PLC, with both devices on the same subnet. The HMI acts as a PROFINET IO device on the panel port; the S7-1200 must have PUT/GET access enabled (Properties > Protection > Permit access with PUT/GET from remote partner).

You should also already have defined a recipe in the WinCC flexible project (Project > Recipes > New Recipe) that contains the tags you want to load into the PLC. The recipe's element list must include at least one tag with a matching PLC address so the transfer is meaningful.

Recipe vs Data Record Concepts in WinCC flexible

WinCC flexible uses two related but distinct terms that are frequently confused:

A recipe is a template. A data record is one row in that template. When you call SetDataRecordToPLC, you are not sending a recipe; you are sending a specific record (e.g. record number 3 of recipe "ProductMix") to the PLC tags. The matching system function GetDataRecordFromPLC reads PLC values back into a record for editing or storage.

Recipes can hold up to 1000 data records each, and each record may include up to 1000 elements. The recipe data is stored on the HMI's internal flash and survives power cycles, which is why loading on tag change is normally done from a record index supplied by the PLC rather than re-uploading a full record set.

Area Pointer Configuration: Data Record / Data Mailbox

The Data record area pointer is a fixed-size mailbox in the PLC memory that the HMI polls cyclically. It is the only built-in mechanism that lets the HMI react to a PLC-side request without scripting a full event-based protocol.

To configure the pointer in WinCC flexible 2008:

1. In the project tree, right-click the HMI connection (e.g. HMI_Connection_1) and choose Properties > Area pointer.
2. Enable "Data record" and assign a unique DB number + byte offset in the S7-1200, for example DB100, byte 0, length 8 bytes. The default 8-byte layout is fixed:

Accept the area pointer, compile, and download to the HMI. The HMI will now cycle-poll this mailbox at the configured acquisition rate (default 1 s; lower this to 250 ms for tighter response).

Triggering SetDataRecordToPLC on a Tag Change

There are two practical approaches to fire SetDataRecordToPLC from a tag change. The choice depends on whether you can modify the PLC program.

Approach A: Pure PLC-driven trigger (recommended)

The PLC writes the desired recipe and record numbers into the area-pointer mailbox, sets the job number to 2 (SetDataRecordToPLC), and waits for the HMI to echo status 1 back. No WinCC flexible scripting is required. The trigger tag in this case is implicit: any change in the desired record number on the PLC side starts the handshake.

Approach B: HMI-side script on a Boolean tag change

Use this when the PLC cannot be modified. In WinCC flexible 2008:

1. Create a Boolean tag, e.g. TriggerRecipeLoad on the PLC at M10.0 (or use an HMI-internal tag if no PLC is involved).
2. Open the Events dialog of the tag in the project tree (right-click tag > Properties > Events).
3. On Change Value, attach the system function SetDataRecordToPLC with the desired recipe number and record number as constants, OR with another tag providing the index.

When the HMI detects a value change of TriggerRecipeLoad, it runs the function. This works, but the handshaking limitation still applies: if the function is called twice within the transfer time, the second call will fail. Always gate the trigger with the mailbox status word.

Handshaking with the Data Mailbox

The robust sequence for a SetDataRecordToPLC driven by the PLC mailbox is:

1. PLC waits until status word = 0 (no job in progress).
2. PLC writes the desired record number into DB100.DBD4.
3. PLC writes the recipe number into DB100.DBW2.
4. PLC writes job number 2 (= SetDataRecordToPLC) into DB100.DBW0.
5. HMI reads the mailbox within its cycle time, executes the transfer, writes the result into DB100.DBW8 and clears DB100.DBW0 back to 0.
6. PLC reads status word. 0 = done, >0 = error (see codes below).
7. PLC evaluates the result and clears the trigger bit.

The PLC ladder snippet for an S7-1200 in TIA Portal (SCL) looks like:

// SCL excerpt - trigger SetDataRecordToPLC when "LoadRecipe" edge detected
IF "LoadRecipe" AND "Mailbox".Status = 0 THEN
    "Mailbox".RecipeNo   := INT_TO_WORD("RecipeIndex");
    "Mailbox".RecordNo   := "RecordNo";          // DWORD
    "Mailbox".Job        := 2;                   // SetDataRecordToPLC
    "LoadRecipe" := FALSE;
END_IF;

IF "Mailbox".Status <> 0 AND "Mailbox".Status <> 1 THEN
    // error - log to diagnostics DB
    "RecipeError" := "Mailbox".Status;
END_IF;

Step-by-Step Configuration Procedure

1. Create the recipe. In the project tree, Recipes > New > name it ProductMix. Add elements (e.g. Setpoint_Temp, CycleTime, MixSpeed) pointing to PLC tags in a dedicated DB_Recipe in the S7-1200.
2. Add a few data records. Use the recipe view's editor to define record 1, 2, 3 with different parameter sets. These will live on the HMI's flash.
3. Create the data-record area pointer. Connections > Properties > Area pointer > enable Data record > assign DB100 at offset 0, length 8.
4. Define the trigger. If using Approach A, no scripting is needed - the PLC writes to the mailbox. If using Approach B, add a Boolean tag and configure its Change Value event to call SetDataRecordToPLC.
5. Wire the result. In the PLC, monitor DB100.DBW8 after the job and log non-zero values.
6. Compile and download the WinCC flexible project to the TP700 and the STEP 7 project to the S7-1200.
7. Set acquisition rate on the trigger tag and the area pointer to 250 ms or faster in the tag's Properties > Acquisition/Cycle tab, depending on the PLC scan.
8. Runtime test by toggling the trigger bit in the PLC's watch table and verifying the recipe values land in the target DB_Recipe.

S7-1200 and TP700 Integration Specifics

The S7-1200 firmware family has a few constraints worth highlighting:

• PUT/GET access must be explicitly permitted in TIA Portal under PLC properties > Protection > "Permit access with PUT/GET communication from remote partner". Without this flag, the area pointer polling returns 0x00FF (no connection) and the trigger never fires.
• Optimized block access for DB100 must be disabled (or, if enabled, the mailbox must be marked as non-optimized) so the HMI can poll it by absolute address.
• Cycle time on the S7-1200 should stay <50 ms for tight handshakes; a 100 ms cycle combined with 1 s HMI polling creates an obvious 1 s dead time on every transfer.
• TP700 Comfort panels support both S7-1200 and S7-1500 driver profiles. Choose the S7-1200/1500 profile (not the legacy S7-300/400 profile), because the legacy profile uses a different area pointer layout.
• Firmware match: TP700 Comfort firmware V14.0.1.0 or later and WinCC flexible 2008 SP5 (with the Hotfix for Comfort panels) are the most stable combinations. Older firmware may report 190001 errors on large recipes.

Verification and Commissioning

To verify the configuration end-to-end:

1. On the PLC, add a watch table with DB100.DBW0..DBW14 visible.
2. Force DB100.DBW2 = 1 (recipe 1), DB100.DBD4 = 3 (record 3), then set DB100.DBW0 = 2.
3. Watch DB100.DBW0 clear to 0 within one HMI cycle.
4. Watch DB100.DBW8 report 1 (success) or an error code (see below).
5. Confirm the recipe tags in DB_Recipe on the S7-1200 now contain record 3's values.
6. If using the recipe view on the HMI, set the view's display to "Record 3 of 1" and verify the visible values match.

To verify a tag-change-driven trigger, simulate the boolean rising edge by setting the tag in the PLC watch table, then confirm the function executes. The HMI logs the event in its alarm log under "Recipe".

Troubleshooting Matrix

Frequently Asked Questions