WinCC Flexible RT Cannot Write PLCSIM Bits in RUN Mode: S7 Process Image Overwrite

This technical reference documents a recurring fault in legacy Siemens engineering stacks where an operator input issued from WinCC flexible 2005 SP1 Runtime to a SIMATIC S7-300/400 CPU simulated in S7-PLCSIM V5.3 / V5.4 appears to be ignored when the simulated CPU is in RUN, but takes effect immediately when the CPU is placed in STOP. The behavior is not a tag-error, communication-stack fault, or PG/PC interface problem — it is a deterministic consequence of the S7 process-image update executed at the start of OB1.

1. Problem Description

Engineer creates a WinCC flexible 2005 SP1 project targeting a SIMATIC S7-300 station. The HMI tag points to I0.0 (input bit 0 of byte 0). The project is downloaded to WinCC flexible Runtime. The STEP 7 program is downloaded to S7-PLCSIM. The simulated CPU is placed in RUN. The operator toggles the bit in Runtime, either via a button configured as a momentary contact or by writing 1 to the tag through the WinCC flexible tag control.

Observed behavior:

• Tag value in WinCC flexible Runtime appears to update momentarily (the value is read back from the AS and reflects the last successful write).
• Cross-check with a STEP 7 Variable Table (VAT) shows the bit is reset to 0 within one OB1 cycle.
• Bit does stick when the operator changes it with the VAT while the CPU is in RUN — VAT operates on the same address, but the operator who wrote the bit is not the same write path the HMI uses; both write paths suffer the same overwrite.
• Bit persists in STOP because OB1 no longer runs; the process image is not refreshed.

Reported by the original engineer on a STEP 7 V5.4 + PLCSIM V5.3 + WinCC flexible 2005 SP1 stack. The condition is independent of the S7-PLCSIM interface selection (MPI, PROFIBUS, TCP/IP) and independent of the WinCC flexible connection type (S7-MPI / S7-PROFIBUS / S7-TCP/IP).

2. Root Cause: OB1 Process Image Update Overwrites HMI Write

Every S7-300/400 CPU maintains two process images:

When the operator writes I0.0 := 1 from WinCC flexible Runtime, the HMI opens an S7 communication job to the CPU and writes the value directly into the input process image. The CPU acknowledges the write. WinCC flexible displays the new value (it re-reads on the configured acquisition cycle). On the next OB1 cycle, the CPU copies the physical input state from PLCSIM's input buffer — which holds 0 because the user is not pressing any wired pushbutton — into the PII. The bit is overwritten with 0.

Mathematically, the HMI write is visible to the application for a window of:

t_visible = t_OB1 - t_HMI_write
where t_OB1 is the OB1 cycle time (typical 10–50 ms in PLCSIM, 5–20 ms on a real S7-315/317) and t_HMI_write is the moment the S7 communication partner (WinCC flexible) wrote the bit. If t_OB1 < t_HMI_write + OB1_period, the bit will be overwritten on the next OB1 entry.

This is the documented behavior of the S7-CPU firmware. The S7 communication services (PUT, GET, WRITE on operator panels) write directly into the process image; they do not write to the physical input. They cannot, because the physical input is a read-only buffer maintained by the I/O subsystem.

3. Why the Variable Table (VAT) Initially Appears to Confirm the Problem

The original engineer confirmed that a VAT write also fails in RUN, which appears to invalidate the “it is a WinCC flexible issue” hypothesis. It does not — it confirms it. STEP 7's Monitor/Modify and the VAT both write to the process image; they share the same write path as WinCC flexible. Any operator (HMI, VAT, another CPU via PUT/GET) that attempts to write I0.0 will see the bit reset on the next OB1 cycle.

The exception is direct peripheral access. If the VAT is set to “Modify” with the trigger Permanent and Trigger point: End of OB1, the write is forced into the PII immediately before OB1 exits, then OB1 begins again and overwrites it. If the trigger is Begin of OB1, the write is applied first, then OB1 overwrites it. The same outcome results: a single OB1 cycle of visibility.

4. Diagnostic Procedure

Use this checklist to confirm the fault class before changing the HMI tag address.

1. Confirm the address class. Open the STEP 7 Symbol Table. The tag must point to an I or PE address. I is process-image input; PE (or PIB/PIW/PID) is direct peripheral input. Both are overwritten by OB1.
2. Confirm OB1 is the cycle OB. In STEP 7, expand the Blocks container. If the project uses a custom OB (e.g., OB35 for cyclic interrupt) instead of OB1, the same rule applies — the OB refreshes the PII at its entry. Confirm that the HMI tag is being read/written via the same path used by the application code.
3. Force a STOP/RUN transition and observe the tag. Place the CPU in STOP. Set the bit from WinCC flexible. Confirm that the bit is visible in a VAT. Place the CPU in RUN. Within one OB1 cycle, the bit must return to 0. If it does, the diagnosis is confirmed.
4. Test with a marker bit. Change the HMI tag to M0.0 and re-test in RUN. The bit must now persist. If it does, the issue is conclusively the input-image overwrite and the application code does not need to be modified.
5. Check the application program. Even after moving the tag to M or a DB, confirm that no assignment in the user program re-clears the bit, for example a line of ladder logic that copies I0.0 into the marker and clears the source. The user program can mask the HMI write as well.

5. Solution 1: Use Bit Memory (Merker / M Area) for HMI Tags

The preferred fix is to expose bit memory to the HMI. M area is read/write, persistent across OB1 cycles, and never overwritten by the I/O subsystem.

STEP 7 side:

1. Open SIMATIC Manager → S7 Program → Blocks.
2. Select Symbols and add a new symbol, e.g. Motor_Start_Cmd with address M 0.0 and data type BOOL.
3. Open OB1 and add a network that uses M0.0 as the start command, e.g.:

// OB1 - Network 1: Motor start with M flag
A     M0.0          // Start command from HMI
A     I0.0          // Hardware permissive (real input)
=     Q4.0          // Motor contactor

// Network 2: Latch start command if needed
A     M0.0
S     M0.1          // Latched run bit
A     I0.1          // Stop pushbutton (NC)
R     M0.1
A     M0.1
=     Q4.0

WinCC flexible side:

1. Open the WinCC flexible project.
2. In the project tree, select Communication → Tags.
3. Double-click the existing I0.0 tag and change the address to DB 0 / M 0.0 (WinCC flexible notation: address field shows MB 0, bit 0, data type Bool).
4. Recompile and start Runtime.

6. Solution 2: Use a Data Block (DB) for Structured HMI Communication

For larger projects, encapsulate all HMI-readable/writable bits in a dedicated DB. This is the modern TIA Portal convention and migrates cleanly.

1. In SIMATIC Manager, insert a new Data Block (Insert → S7 Block → Data Block). Assign DB number, e.g. DB100.
2. Declare the following structure in the DB:

DATA_BLOCK DB100
TITLE = HMI Interface
VERSION : 0.1
  STRUCT
    Start_Cmd       : BOOL;    // Bit 0.0
    Stop_Cmd        : BOOL;    // Bit 0.1
    Motor_Speed_SP  : INT;     // Word 2  - setpoint to drive
    Tank_Level_SP   : REAL;    // DWord 4 - setpoint to PID
    Heartbeat       : BOOL;    // Bit 8.0
  END_STRUCT;
END_DATA_BLOCK

3. In WinCC flexible, point the tag to DB100.DBX0.0 (Start_Cmd) and so on. Configure the connection as S7-MPI or S7-TCP/IP depending on PLCSIM interface selection.
4. In the user program, copy the relevant DBX/DXW into the application logic. Example for the start command:

// OB1 - Network 1: HMI start command via DB100
A     DB100.DBX 0.0    // Start_Cmd from HMI
A     I 0.0            // Hardware permissive
S     M 1.0            // Latched run bit
A     I 0.1            // Stop pushbutton (NC)
R     M 1.0
A     M 1.0
=     Q 4.0

Advantages of the DB approach:

• Symbolic access via the DB symbol table.
• Data types are enforced (no accidental INT write to a BOOL bit).
• Easy to migrate to TIA Portal — the DB structure maps 1:1 to a TIA Portal PLC data type (UDT).
• Watchdog / heartbeat bits can be implemented to verify the HMI is alive.

7. STEP 7 V5.4 / PLCSIM V5.3 Configuration Reference

This is the configuration used by the original report. Use it as a baseline for reproduction or for an environment that still depends on legacy software.

The Siemens KB article 13283804 describes the correct PG/PC interface assignment for S7-PLCSIM with STEP 7 V5.4 and WinCC flexible. The interface must be set to PLCSIM(MPI) or PLCSIM(PROFIBUS) — selecting PC Adapter (Auto) or any hardware adapter will produce the “Could not establish connection” dialog that the original engineer reported when attempting a project transfer.

8. PLCSIM and WinCC flexible RT Transfer Settings

The original engineer also reported a transfer error: “Could not establish connection. Please check your settings, interface, cables etc.” when selecting Project → Transfer → Transfer Settings in WinCC flexible. This is independent of the bit-overwrite issue but blocks the first-time commissioning. Fix:

1. Open Control Panel → Set PG/PC Interface.
2. Set the access point S7ONLINE to S7-PLCSIM (virtual MPI) for STEP 7 and to S7-PLCSIM (virtual) for WinCC flexible.
3. If using a real Ethernet adapter, install Microsoft Loopback Adapter and bind the PLCSIM(TCP/IP) access point to it. The loopback adapter is required because PLCSIM binds to the first local IP it finds and an active DHCP lease on a corporate NIC can cause intermittent connection drops.
4. In WinCC flexible RT, choose File → Transfer → Transfer Settings, then verify the connection attempt with Status. A green “Connection established” banner is required before Runtime tags are bound to PLCSIM.
5. Restart PLCSIM and WinCC flexible RT in the order PLCSIM first, RT second. The WinCC flexible RT boot sequence does not retry the connection aggressively on early WinCC flexible 2005 SP1 builds.

9. Process Image: Partial Update (OB1-PII/PIQ) Configuration

The S7-300/400 CPU defaults to full process-image update on OB1. The default PII size is 128 bytes, PIQ size is 128 bytes. If the affected input is outside the configured PII, the CPU never refreshes it from the physical module, and the HMI write would in fact persist. Verify the PII size in the CPU properties in HW Config:

1. Open HW Config.
2. Select the CPU and open Properties → Cycle / Clock Memory.
3. Confirm Process Image size for inputs and outputs. The PII must include byte 0 if the tag is I0.0.
4. If the project uses partial process image update (OB1-PIIxxx / OB35-PIIxxx), verify that the HMI tag's address is in the configured partial image. If it is not, the value is never refreshed and the HMI write persists, which can mask the original problem and cause an inconsistency with the user program.

For a quick fix, expand the PII to cover the affected byte. This does not address the root cause (you should not be writing inputs from an HMI) but it can unblock a hot-fix deployment.

10. Why Direct Peripheral Access (PEW / PIB) Is Not a Workaround

It is tempting to retarget the WinCC flexible tag to PEW0 or PIB0 and bit-mask bit 0. This is not a correct fix:

• PEW/PIB addresses are read-only on S7-300/400. An HMI write to a PE address returns a -3 (object access error) and is silently rejected by the S7 communication layer.
• Writing to a PE word and reading back bit 0 from PII will still be overwritten on the next OB1 cycle.
• Some WinCC flexible versions display the write as “successful” in the tag status field even when the S7 protocol stack rejected the write. Always cross-check with a VAT.

The only correct fixes are M area, DB area, or output process image (Q) for HMI-to-PLC commands that are not tied to a physical input.

11. Migration Path to TIA Portal / S7-1200/1500

The behavior in TIA Portal is identical in principle — the input process image is refreshed by the system task — but the engineering workflow is different:

• WinCC flexible 2008 SP1 / 2008 SP2 projects can be migrated to WinCC Comfort / WinCC Professional via TIA Portal “Migrate WinCC flexible project”.
• STEP 7 V5.4 programs can be ported with the TIA Portal “Migrate S7-300/400 project” wizard. The DB-based HMI interface (Section 6) maps 1:1 to a TIA Portal DB.
• On S7-1200/1500, the HMI write to an %I tag is rejected by the controller firmware with error code 0x000080A1 (“Access to input area is not permitted in this context”). The migration tool warns on this configuration but does not auto-fix it.

The DB-based pattern is the recommended template for any greenfield or migration project.

12. Troubleshooting Matrix

13. Verification Procedure

After applying the fix, run the following sequence to confirm the HMI write persists in RUN.

1. Place PLCSIM in RUN.
2. Open STEP 7 → Blocks → VAT (e.g., VAT_1). Add the new tag, e.g. M0.0 as BOOL. Monitor mode.
3. Open WinCC flexible RT. Toggle the button bound to the new tag.
4. Confirm: VAT shows the bit transition (0 → 1 → 0 on release, for a momentary button). For a maintained button, the bit must hold at 1 indefinitely while the CPU is in RUN.
5. Trigger an OB1 cycle interrupt (e.g., a long-running SFC47 / WAIT in the program) and confirm the bit is not overwritten during the extended cycle.
6. Place CPU in STOP. Confirm the bit holds its last value (validates that nothing in the OB1 / OB100 startup overwrites the flag).
7. Place CPU back in RUN. Confirm the bit holds.

Step 6 is a particularly important gate: if the startup OB (OB100) clears the bit on every RUN transition, the issue is in the user program, not in the HMI tag address.

14. Summary

The original engineer's diagnosis was correct: a WinCC flexible 2005 SP1 Runtime write to I0.0 on a STEP 7 V5.4 / PLCSIM V5.3 stack does not persist in RUN because the S7 CPU refreshes its process input image at the start of OB1. The fix is to move the HMI-communicated bit out of the I / PE area into a writable region: bit memory (M) for small projects, a dedicated data block (e.g., DB100) for structured projects. After retargeting the tag and recompiling WinCC flexible, the bit persists in RUN, in STOP, and across RUN/STOP transitions, and the engineer can “sleep very well.”