WinCC Flexible Tag Combining: S7-300 and Omron CJ1M via OPC

WinCC Flexible Tag Combining: S7-300 and Omron CJ1M via OPC

When a single HMI panel must reflect state from multiple controllers — for example, an Omron CJ1M on the field network and a Siemens S7-300 in the same cabinet — the question of how to "combine values" in WinCC Flexible becomes a wiring problem rather than a programming problem. The HMI project can act as the bridge, but the architecture chosen dictates whether the resulting link is suitable for status-only display or for interlocks, alarms, and permissive bits. This reference walks through the three field-proven options: the ChangeValue / SetValue method, an OPC DA relay, and the PROFIBUS DP/DP coupler (with its PROFINET PN/PN cousin). Each option includes the exact configuration path inside WinCC Flexible 2008 SP5, part numbers, firmware constraints, and a verification routine.

1. Architecture Options at a Glance

2. Prerequisites

• WinCC Flexible 2008 SP5 with a valid licence for the target panel (Compact, MP 277, MP 377, PC Runtime, or Comfort Panel migrated into a V11/V12 project).
• Configured Connections to each PLC. At minimum:
  • SIMATIC S7-300: MPI / PROFIBUS / Ethernet (ISO-on-TCP or TCP RFC1006) — driver selection is automatic from the panel type.
  • Omron CJ1M: either Omron (Host Link) over RS-232C / RS-422, or Omron FINS Ethernet if a CJ1W-ETN21 (or CJ1W-EIP21 for EtherNet/IP) is fitted.
• Each external tag imported from the partner PLC (pointers / DBs on S7-300; CIO / W / H / D / EM area on CJ1M) must exist as a WinCC Flexible tag before the event handler is added.
• For Option C: a PROFIBUS DP/DP coupler, catalog number 6ES7 158-0AD01-0XA0, with GSD file siem80d7.gsd.
• For Option D: PROFINET PN/PN coupler 6ES7 158-0AC01-0XA0 with GSDML-V2.3-Siemens-PNPNCoupler-…xml.

3. Option A — Tag Combining via ChangeValue Event and SetValue

This is the in-panel method. The S7-300 tag is read on its normal acquisition cycle; whenever it transitions, the ChangeValue event on that tag fires a system function that writes the new value into a tag bound to the Omron CJ1M connection.

3.1 Configure the two tags

1. In the project tree, open Tags and confirm that both tags exist:
   • S7_Bit_CmdStart — Boolean, sourced from Connection_1 (S7-300), address e.g. DB10.DBX0.0.
   • OMR_Bit_Permissive — Boolean, sourced from Connection_2 (Omron CJ1M FINS Ethernet), address e.g. CIO 100.00.
2. Set Acquisition cycle on S7_Bit_CmdStart to 100 ms (fastest standard cycle; matches operator-response expectation for a start command).
3. Set Acquisition cycle on OMR_Bit_Permissive to 100 ms in the same direction (mirror). If you only need to set the Omron bit and do not need to read it back, you can disable the read cycle and rely solely on the event write.

3.2 Add the ChangeValue event

1. Right-click S7_Bit_CmdStart → Properties → Events tab.
2. In the ChangeValue row, click the ... button to open the function list editor.
3. Select System functions → Set / SetValue / SetBit. For a single-bit copy choose SetBit; for arbitrary data type use SetValue (it accepts any tag-compatible value).
4. Configure the function parameters:
   • Tag (output): OMR_Bit_Permissive
   • Value: S7_Bit_CmdStart (the same tag whose ChangeValue fired — this is the canonical pattern)
5. Compile, download to the panel, and test.

3.3 Useful system functions for bit combining

4. Option B — OPC DA Relay with WinCC Runtime as the Server

If your PC-based runtime is acting as the SCADA layer, expose the S7-300 tags as OPC DA items and let an OPC client (KEPServerEX, Softing OPC, Matrikon, or another HMI on the Omron side) bridge into CJ1M memory.

4.1 Server side (WinCC Runtime 2008 SP5)

1. Open WinCC Explorer → OPC → DA Server on the runtime PC.
2. Add each S7-300 tag as an OPC item. The default item name is Channel1\Connection_1\TagName.
3. Configure the OPC server security: by default it permits anonymous local read/write. For a multi-client setup restrict via dcomcnfg and Windows ACLs.

4.2 Client side

1. In your OPC client, subscribe to the S7-300 item and write to the CJ1M tag using the FINS gateway address (UDP/TCP port 9600 for Ethernet FINS).
2. Update rate 200 ms matches the typical WinCC polling cycle.

5. Option C — PROFIBUS DP/DP Coupler (Recommended for Critical Bits)

The PROFIBUS DP/DP coupler isolates two PROFIBUS networks electrically and copies a configurable I/O area between them. Each side sees the data as a DP slave, so no extra code in either PLC is required — the data lands in input (PI) or output (PQ) peripheral area on both controllers.

5.1 Hardware setup

1. Mount 6ES7 158-0AD01-0XA0 between the two PROFIBUS segments. Power it from 24 V DC on the X1 connector.
2. Set the PROFIBUS address on each side with the rotary switches (typical: 3 on the S7-300 side, 4 on the Omron side).
3. Decide the data direction. For "S7-300 bit → Omron bit" define 1 byte of outputs on the S7-300 side mapped to 1 byte of inputs on the Omron side.

5.2 S7-300 side — STEP 7 / TIA configuration

1. Install siem80d7.gsd (or the newer GSD revision included with the coupler).
2. Add the DP slave to the S7-300 master; insert the module 1 byte I/O (consistent).
3. The slave occupies PQ 256 on the S7-300 (defaults vary by master; verify in HW Config → Object Properties → Address tab).
4. In the S7-300 user program, write the bit you want to mirror:

   // OB1 — copy internal flag to peripheral output
         A   M      10.0     // source flag
         =   PQ   256.0      // mapped to CJ1M input byte

5.3 Omron CJ1M side — CX-Programmer configuration

1. Use a CJ1W-PRT21 PROFIBUS master (or CJ1W-CIF11 for lower-cost CPU-side PROFIBUS on CJ1M-CPU1x).
2. Import the Siemens GSD as a generic PROFIBUS slave, allocate one input byte to e.g. CIO 2000.
3. In the CJ1M program, read the bit:

   LD    CIO 2000.00
   OUT   W100.00      // local work-bit mirror

5.4 WinCC Flexible side

WinCC Flexible no longer needs to "combine" the bits at all — both PLCs have native copies. The HMI simply reads each tag on its native connection, which keeps the configuration manageable and the diagnostic surface smaller.

6. Option D — PROFINET PN/PN Coupler

The PROFINET variant is 6ES7 158-0AC01-0XA0. Configuration is identical in concept — install the GSDML, drag the device into each PROFINET topology, and the coupler copies slot data between two independent PROFINET controllers. The S7-300 PROFINET interface or a CP 343-1 acts as controller 1; an Omron CJ1W-EIP21 / CJ1W-EIP21S or any third-party PROFINET-capable slave acts as controller 2.

6.1 Slot mapping example

1. On the S7-300 side, slot 0 of the PN/PN coupler is configured as 1 byte output. The byte appears at PQW 256.
2. On the Omron side, the same slot is configured as 1 byte input. Through the CJ1W-EIP21 PROFINET device description, the byte is mapped to e.g. W300.
3. Diagnostic: the coupler has 4 status LEDs (BF1, BF2, SF, PWR) plus per-port link/speed LEDs. Both BF LEDs off and SF off confirms healthy exchange.

7. Verification Procedure

Regardless of which option is chosen, run the following four checks before signing off the panel:

1. Acquisition watch. In WinCC Flexible Runtime, open the tag simulator or online → Tags view and confirm S7_Bit_CmdStart and OMR_Bit_Permissive track within two acquisition cycles (≤ 500 ms for option A).
2. Edge test. Force S7_Bit_CmdStart low → high in STEP 7 with a VAT table. Verify the Omron bit goes high within one cycle and goes low again on the falling edge.
3. Restart test. Power-cycle the HMI panel. The Omron bit should not be the source of truth for any safety function — confirm by reading the safety-of-function risk assessment.
4. Coupler diagnostics (options C/D). Read the diagnostic buffer of the DP/DP or PN/PN coupler via the SIMATIC diagnostic tools or PROFINET Web server (PN/PN only, port 80, default IP 192.168.0.1).

8. Troubleshooting Matrix

9. Field-Proven Caveats

• Per-tag update rate vs panel load. A Comfort Panel can sustain roughly 4 000 tags at 250 ms. Driving ChangeValue handlers on a large number of tags (e.g. mirroring 256 bits one by one) will consume cycle time and may starve the visualisation. For multi-bit fields use a single word-level event with a script that copies the whole word.
• Endian mismatch. S7-300 stores words big-endian in DBs but PROFIBUS peripheral bytes are little-endian. When mapping 16+ bits through a DP/DP coupler, swap the byte order on the Omron side (use MOVR / XFRB) before using individual bits.
• Watchdog vs cyclic event. For latched alarms or one-shot transitions, the ChangeValue event fires every transition, not just rising edges. If you need rising-edge-only behaviour use a small script with a previous-value variable, or wire the event to a SetBit that the user code clears separately.
• Comfort Panel migration. WinCC Flexible 2008 SP5 projects migrate into TIA Portal V13 SP1 or later. Event handler names are preserved; SetValue becomes the equivalent SetTag function inside the Comfort Panel scripting environment.
• Safety / SIL classification. None of the four options above is acceptable for SIL 1 or above. For safety-relevant data exchange use PROFIsafe on PROFINET with a F-CPU and a F-I/O module — the DP/DP coupler can route PROFIsafe frames but the receiving PLC must also support PROFIsafe.

10. Sample Wiring Diagram (SVG)

11. Frequently Asked Questions