WinCC Raw Data Tag Read/Write Configuration with C-Scripts

Overview of WinCC Raw Data Tags

WinCC raw data tags (German: Rohdaten-Tags) provide a high-throughput channel between the HMI/SCADA station and the SIMATIC controller. A single raw tag carries a contiguous block of up to 32,767 bytes of process data in one acquisition cycle, eliminating the need to declare one standard tag per process value. The official Siemens application example Rohdaten_6.zip (WinCC V6 SP4 baseline) demonstrates that a 10-byte raw tag can replace up to ten discrete BOOL/byte tags and shrink the project tag count proportionally.

Two C-script API calls form the foundation of every read/write implementation in WinCC V6 SP4 through V7.4 SP1 (the "Classic" product line):

• BOOL GetTagRaw(LPCTSTR pszTagName, BYTE* pData, DWORD dwLen); - copies dwLen bytes from the raw tag into the supplied buffer.
• BOOL SetTagRaw(LPCTSTR pszTagName, BYTE* pData, DWORD dwLen); - writes the contents of pData (length dwLen) back to the raw tag and onto the controller.

Both calls operate on the in-process image of the tag; for cross-station communication the tag must be configured as an external tag bound to an S7 connection with raw data enabled. The buffer pointer must reference an array sized at least dwLen bytes. Because the maximum raw tag length is 32,767 bytes, the canonical pattern is to allocate a working buffer of that size on the stack and use only the first Size bytes per project.

Prerequisites

• WinCC Engineering Station: V6 SP4, V7.0, V7.2, V7.3, or V7.4 SP1 (tested with V7.3 + STEP 7 V5.5 SP4 and V7.4 + TIA Portal V16). Source sample targets V6 SP4 / V7.3.
• Runtime Station: WinCC Runtime Professional or WinCC RT (Classic) on the same or a paired station.
• Controller: SIMATIC S7-300/400 with STEP 7 V5.5 (Classic) or S7-1200/1500 with TIA Portal V13+ for RT Professional projects.
• Configured HMI connection: MPI, PROFIBUS, or Industrial Ethernet (ISO-on-TCP / S7 Communication). For S7-1500, the connection type must be "SIMATIC S7-1200/1500" with the PUT/GET permission enabled on the CPU security settings.
• Data block in the controller: A non-optimized DB (S7-300/400) or an "Accessible from HMI" DB (S7-1500) sized to match the raw tag length. Optimized DBs in S7-1500 reject direct byte-offset access and require symbolic addressing.
• Global Script runtime: C-Interpreter (WinCC Classic) or VBScript/VBA runtime must be installed; "Global Script" feature enabled in the project properties.

Configuring the S7 Raw Data Channel in WinCC

1. Open WinCC Explorer and edit the project's HMI tag management.
2. Select the S7 connection (for example SIMATIC S7 Protocol Suite > MPI / PROFIBUS / TCP) and open Properties > Connection.
3. Verify that "Send/receive raw data block" is selected. Without this checkbox the driver will refuse raw tag requests and GetTagRaw returns FALSE.
4. Right-click the desired channel and choose New Tag. Set Name (for example PrTs_TestTag), Data type to Raw Data Type, and Length to the byte count of the corresponding DB area (for example 10 bytes).
5. Assign the tag to a DB number, byte offset, and bit (0) addressing string such as DB100,DBB0,BYTE 10. The full byte range DBB0..DBB9 will be transferred as a single packet.
6. In the Properties > Select tab set the acquisition mode: "On demand" for C-script driven reads, or a 250-500 ms cyclic acquisition if the screen must auto-refresh.
7. Confirm with OK and rebuild the runtime via the WinCC Explorer Computer > Properties > Tags dialog (regenerates the tag image used by Graphics Designer).

The C-Script Library for Raw Byte, Word, Float, and String Access

The reference implementation from the source sample defines two project functions that accept the tag name, buffer length, byte offset, and a value. The buffer is allocated on the stack at the maximum allowed size (32,767 bytes) and trimmed via the Size parameter.

// Read a single byte from a raw tag at Offset
unsigned char BsGe_GetRawByte(char* TagName, short Size, short Offset)
{
    unsigned char RawData[32767];
    GetTagRaw(TagName, RawData, Size);
    return RawData[Offset];
}

// Write a single byte to a raw tag at Offset
BOOL BsGe_SetRawByte(char* TagName, short Size, short Offset, unsigned char Value)
{
    unsigned char RawData[32767];
    GetTagRaw(TagName, RawData, Size);   // Read-modify-write: never trample untouched bytes
    RawData[Offset] = Value;
    return SetTagRaw(TagName, RawData, Size);
}

For 16-bit words and 32-bit floats the same read-modify-write pattern is used, but the value must be copied into the buffer through a typed pointer. The endianness of the S7 CPU is little-endian (Intel format), so a 16-bit value at offset N occupies bytes N (low) and N+1 (high).

// 16-bit Word (INT / WORD) access
short BsGe_GetRawWord(char* TagName, short Size, short Offset)
{
    unsigned char RawData[32767];
    GetTagRaw(TagName, RawData, Size);
    return *(short*)&RawData[Offset];   // little-endian on S7
}

BOOL BsGe_SetRawWord(char* TagName, short Size, short Offset, short Value)
{
    unsigned char RawData[32767];
    GetTagRaw(TagName, RawData, Size);
    *(short*)&RawData[Offset] = Value;
    return SetTagRaw(TagName, RawData, Size);
}

// 32-bit Float (REAL) access
float BsGe_GetRawFloat(char* TagName, short Size, short Offset)
{
    unsigned char RawData[32767];
    GetTagRaw(TagName, RawData, Size);
    return *(float*)&RawData[Offset];
}

BOOL BsGe_SetRawFloat(char* TagName, short Size, short Offset, float Value)
{
    unsigned char RawData[32767];
    GetTagRaw(TagName, RawData, Size);
    *(float*)&RawData[Offset] = Value;
    return SetTagRaw(TagName, RawData, Size);
}

// Bool bit access (bit 0..7 of one byte)
BOOL BsGe_GetRawBit(char* TagName, short Size, short Offset, unsigned char Bit)
{
    unsigned char RawData[32767];
    GetTagRaw(TagName, RawData, Size);
    return (RawData[Offset] >> Bit) & 0x01;
}

BOOL BsGe_SetRawBit(char* TagName, short Size, short Offset, unsigned char Bit, BOOL Value)
{
    unsigned char RawData[32767];
    GetTagRaw(TagName, RawData, Size);
    if (Value) RawData[Offset] |=  (1 << Bit);
    else       RawData[Offset] &= ~(1 << Bit);
    return SetTagRaw(TagName, RawData, Size);
}

Spreading and Merging: The Internal-Tag Bridge Pattern

The I/O field in WinCC Graphics Designer cannot bind directly to a single byte offset inside a raw tag. The established workaround is to declare a parallel set of internal tags (regular WinCC tags with no PLC connection) and use C-actions to copy values to the raw tag (merge) and from the raw tag (spread) on every screen refresh or value change event.

// Cyclic C-action on the raw tag's OnChange event
char tagname[32] = "PrTs_TestTag";
short size = 10;
unsigned char buf[32767];
GetTagRaw(tagname, buf, size);

// Map bytes 0..9 to internal tags PrTs_B0 .. PrTs_B9
for (int i = 0; i < size; i++)
{
    char internal[32];
    sprintf(internal, "PrTs_B%d", i);
    SetTagByte(internal, buf[i]);
}

The merge (write) action, typically bound to the I/O field's "Output/Input" event when the operator presses Enter:

// Build the buffer from internal tags, then push to PLC
char tagname[32] = "PrTs_TestTag";
short size = 10;
unsigned char buf[32767];

for (int i = 0; i < size; i++)
{
    char internal[32];
    sprintf(internal, "PrTs_B%d", i);
    BYTE val;
    GetTagByte(internal, &val);
    buf[i] = val;
}
SetTagRaw(tagname, buf, size);

This pattern keeps each I/O field bound to a normal internal tag, which Graphics Designer can display, validate, and acknowledge natively, while the raw tag itself remains the single high-throughput conduit to the controller.

Wiring I/O Fields to Raw Tags in Graphics Designer

1. Open the target .pdl screen in WinCC Graphics Designer.
2. Insert an I/O Field from the Standard toolbox. Under Properties > Output/Input set the tag to the desired internal tag (for example PrTs_B3).
3. Configure Data Format as Decimal, Hexadecimal, or Binary depending on the byte interpretation (binary suits individual bit groups; hex suits byte-level diagnostic displays).
4. Under Events > Output/Input > Change, attach the merge C-action that rebuilds the raw tag buffer and calls SetTagRaw().
5. Under Events > Input > Keyboard > Enter (WinCC V7) or Events > Press (WinCC V6 SP4), call the same merge action so the value is committed only when the operator confirms.
6. For automatic PLC → SCADA refresh, configure a Scheduler action that runs the spread C-action every 250-1000 ms, or attach the spread action to the raw tag's OnChange event in tag management.
7. Disable the I/O field's Output behavior on read-only screens by leaving the Output/Input event empty and letting the cyclic spread populate the displayed value.

WinCC RT Professional (TIA Portal) Raw Data Configuration

From TIA Portal V14 onward, WinCC RT Professional inherits a refined raw data concept that integrates with the S7-1500 symbolic addressing model. The configuration steps differ from the Classic workflow:

1. Open the HMI device in TIA Portal and add an HMI tag of type Raw under HMI Tags > Default Tag Table. Length is specified in bytes; the driver accepts up to 32,767 bytes per tag.
2. Set the tag's PLC connection to SIMATIC S7-1200/1500 and enable "Send/receive raw data block" on the connection properties.
3. Address the tag with a DB number and byte offset using the format %DB100.DBB0:BYTE 10. The full byte range becomes the raw payload.
4. For S7-1500, ensure the DB has the attribute "Accessible from HMI" and "Optimized block access" is disabled if you require absolute byte addressing. Optimized blocks expose only symbolic offsets.
5. Reference the raw tag from a screen by binding it directly to an I/O field's Process value. RT Professional permits single-tag binding without the internal-tag bridge, but still requires custom scripts for partial-offset access.

Siemens documents the full procedure in the TIA Portal help portal at Raw Data Tag (RT Professional) - WinCC and the configuration specifics at Creating a raw data tag (RT Professional) - WinCC. For the S7-1500 reference architecture, see the application document Exchange of large data volumes between S7-1500 and WinCC V7.4 (PDF).

S7-1500 Engineering and Tag-Length Limits

When targeting the S7-1500 with raw tags larger than 1 KB, configure the connection's Maximum PDU size to at least 960 bytes. Below that threshold, the S7-1500's communication loader splits the raw payload into multiple PDUs and writes can take 2-4x the nominal cycle time.

Performance and Tag-Count Optimization

Empirical data from the source project's runtime (S7-315-2 PN/DP, 1,024-byte raw tag) shows that a 500 ms cyclic update of 100 internal tags via the spread action consumes < 2 ms of CPU on the WinCC server. By comparison, 100 discrete tags polled at the same cycle consume 35-50 ms because each tag triggers an independent PDU. The raw approach is therefore preferred for any screen family with more than ~30 tags whose values change in concert.

Troubleshooting Matrix

Verification and Commissioning Procedure

1. Tag-side check: In WinCC Explorer, open Tools → Tag Simulation and toggle each byte of the raw tag. Confirm that the controller's online watch shows the matching change. If yes, the channel is healthy.
2. Read-back check: In the PLC, set the DB to a known pattern (for example L B#16#AA into DBB0..DBB9 in OB100). Activate Runtime and verify the internal tags PrTs_B0..PrTs_B9 all read 0xAA via the spread action.
3. Write check: Enter 0x55 into the I/O field bound to PrTs_B3. Trigger the merge action. Online watch on the PLC must show DBB3 = 0x55 within one acquisition cycle.
4. Endurance check: Run the cyclic spread action for at least 10 minutes while a background script writes random values to the other bytes. Confirm that none of the non-target bytes change (read-modify-write integrity).
5. Performance check: Open Task Manager → Details on the WinCC server and observe CCArchive.exe or RT.exe CPU. A healthy 100-byte raw tag at 500 ms update should consume < 5% of one core.
6. Logging check: Enable the GSC diagnostics (WinCC Explorer → Computer → Properties → Diagnostics → Global Script). Trigger one write and confirm the C-action appears in the trace with no error code.
7. Operator test: On the live screen, enter several values via the I/O field, then navigate away and back. Spread action must refresh the displayed value from the PLC within one acquisition cycle.

FAQ