WinCC V7.4 Structure Tags: TIA Portal DB Addressing Setup

Structure Tag Architecture in WinCC V7.4

WinCC V7.4 supports complex data exchange with SIMATIC S7 controllers through structure tags (German: Strukturvariablen). A structure tag aggregates multiple elementary members of a single complex PLC data type—such as a UDT or DB-derived STRUCT—into one named WinCC tag. At runtime, the operator station reads the entire structure as a contiguous block from the AS, eliminating the need to maintain dozens of individual BOOL, INT, and REAL tags.

From the PLC perspective the source is always a data block (DB) on the S7-1500 / S7-1200 / S7-300 / S7-400. The structure tag in WinCC binds to the start address of that DB region. Member offsets are then generated automatically by WinCC based on the structure type definition. Refer to the WinCC V7.5 manual entry ID 109760739 — Working with WinCC for the navigation path "Structure tags folder" inside Tag Management; the V7.4 path is identical.

Prerequisites

1. WinCC V7.4 SP1 or later installed on the engineering station. SP1 introduced the modern structure tag editor; older V7.3 projects must be migrated.
2. TIA Portal V13 SP1 or later for the AS project. Symbolic-access-optimized DBs (S7-1500/1200 default) require TIA V14+ for full WinCC integration.
3. An established S7MAX / S7ISO / TCP/IP channel connection between the WinCC station and the PLC, configured under Tag Management > SIMATIC S7 PROTOCOL SUITE > MPI / PROFIBUS / TCP/IP.
4. The DB in TIA must be non-optimized (for absolute addressing) or expose symbolic names through the AS-OS engineering interface (for symbolic addressing).
5. The WinCC project must have the AS-OS connection active under Project Properties > AS-OS Connection; this is the gateway that publishes TIA symbols to WinCC.

TIA Portal DB Block Configuration

Begin by defining the source data block in TIA Portal. The block should mirror the structure you intend to build in WinCC, member-for-member. For a 16-bit field control, the TIA definition might look like this:

TYPE "UDT_Valve_1A2E2ST"
VERSION : 0.1
  STRUCT
    Command_Word   : WORD;     // 16 bits, byte offset 0
    Status_Word    : WORD;     // 16 bits, byte offset 2
    Setpoint       : REAL;     // 32 bits, byte offset 4
    ActualValue    : REAL;     // 32 bits, byte offset 8
    Endpos1        : BOOL;     // bit, byte offset 12.0
    Endpos2        : BOOL;     // bit, byte offset 12.1
  END_STRUCT;
END_TYPE

Instantiate this UDT inside DB29 (or any DB you prefer). The DB will occupy 13 bytes minimum. If symbolic access is desired, leave the DB optimized and let the AS-OS engineering export the symbols automatically. If absolute access is desired, uncheck Optimized block access in the DB properties so the compiler generates a fixed memory layout.

Defining Structure Types in WinCC

1. Open the WinCC Explorer and select Tag Management.
2. Right-click on the Structure tags folder and choose New Structure Type.
3. Enter a name, e.g. str_klappe_1a_2e_2st, matching the UDT on the PLC side.
4. Add the members in the same order, with the same data types and names as the TIA UDT. Member order is significant: WinCC computes byte offsets from top to bottom, just like the PLC.
5. For each member, set the External flag to checked. The External flag is the property the runtime uses to decide whether a member participates in the process image and is reachable from the HMI. Members that should not be transferred to WinCC (e.g., a local diagnostic field) remain unchecked.
6. Save the structure type. WinCC validates that member types and the implied byte layout are internally consistent.

Mapping the Structure Tag to a DB Address

1. In Tag Management, select the S7 channel connection (e.g., TCP/IP) and open its Connection Parameters. Verify the rack/slot of the AS.
2. Right-click the connection and choose New Tag. In the tag dialog, set the data type to your structure name (e.g. str_klappe_1a_2e_2st).
3. In the Address field, enter the start address of the structure in the DB. For a 16-bit-aligned UDT beginning at byte 4, enter:
   DB29,DBW4 (or, if the channel accepts byte granularity, DB29,DBB4 — both refer to the same physical start).
4. Confirm with OK. WinCC auto-generates the member offsets based on the structure type definition; you do not enter DBW5, DBW6, etc. for subsequent members.
5. Compile the WinCC project. Any structural mismatch (member order, type size, alignment) is reported as a tag-management warning before runtime.

Word vs Byte Addressing (DBW vs DBB)

The integrator's question "DB29,DBB4 or DB29,DBW4?" is the most frequent misunderstanding. Both notations point to the same physical byte on the S7 CPU, but the convention matters for clarity and tooling:

For a 16-bit first member (the typical Command_Word), both DB29,DBB4 and DB29,DBW4 are functionally equivalent—WinCC will read the same two bytes. The S7 driver requests the data in the largest granularity present in the structure, so the runtime performance difference is negligible. The convention adopted by most teams is to use DBW for word-aligned UDTs and DBB for byte-mixed UDTs.

Symbolic I/O Addressing with TIA Portal

WinCC V7.4 Update 6 and later, and all of V7.5, support symbolic I/O through the AS-OS connection. The engineering workflow is:

1. In the TIA Portal project, configure an HMI connection between the S7-1500/1200 PLC and the WinCC station under Devices & Networks.
2. Mark the WinCC station as an OPC UA or S7 symbolic client.
3. Compile the TIA project. The symbols of the DB (and any referenced UDTs) are exported to a server-side symbol table.
4. In WinCC Explorer, switch the tag dialog from Absolute address to Symbolic address. The dropdown now shows the UDT members exported by TIA.
5. Select the entire structure tag; the Symbol field will be populated automatically with the qualified name (e.g. DB29.str_klappe_1a_2e_2st). No byte offset is required because the AS resolves the address at runtime.

Symbolic addressing eliminates the External-flag pitfall and supports optimized blocks, but it requires the TIA project to be present (or its symbol table exported to XML) on the WinCC engineering station.

Verifying the Connection

1. Open Tools > Status of Connection in WinCC Explorer and confirm the S7 channel shows Connected with a green status indicator.
2. Launch Graphics Designer and bind an I/O field to a single member (e.g. str_klappe_1a_2e_2st.Setpoint).
3. From TIA Portal, force the variable DB29.Setpoint := 50.0 via a watch table and observe the WinCC I/O field. Update latency is typically 100–500 ms depending on the configured acquisition cycle and the S7 driver's burst size.
4. Check WinCC Explorer > Tools > Tag Logging or Diagnostics > Channel Diagnosis for any tag flagged with quality code 0x40 (Bad / No Communication) or 0x80 (Uncertain).
5. Force a writeback from WinCC (e.g., a button toggling Endpos1) and verify the BOOL change in the TIA watch table.

Troubleshooting Matrix

Field-Proven Caveats

• Alignment padding: The S7-1500 compiler inserts alignment bytes between BOOL members. If you have two BOOL fields separated by an INT, expect one padding byte. WinCC's structure type, however, packs members contiguously with no padding. Disable alignment in the TIA DB properties (Attributes > Optimized block access > OFF) or insert matching padding BYTE members on the WinCC side.
• Array inside a structure: A ARRAY[0..15] OF BOOL member must be entered as a single structure element with a 2-byte length. The WinCC editor will display the array as one I/O field, not as 16 individual BOOLS, unless you flatten it on the PLC side.
• Mixing signed/unsigned: The WinCC data type for a PLC WORD/INT/DINT must match the signedness. Selecting WORD for a signed INT shows wraparound at 32767; switch the WinCC type to INT.
• Re-numbering of members: Inserting a member in the middle of an existing structure type changes every subsequent offset. Always delete the structure instances first, modify the type, then recreate the instances; otherwise stale tag addresses persist in the project XML.
• Runtime vs. configuration: External flag changes made at runtime (via the WinCC tag simulator) are not supported; always modify the structure type at design time and recompile.

Cross-Platform Notes

The same structure tag mechanism is available in WinCC Professional (TIA Portal) with a slightly different editor location (HMI tags > PLC tags > Structure tags). The External flag is replaced by a "HMI-visible" attribute on the DB member. WinCC Unified (V16+) drops the absolute-address concept entirely in favor of AS-symbolic binding through the PLC's symbol server.

For S7-300/400 controllers, absolute addressing via DBn,DBBx is the only option because the older CPUs do not support symbolic access over the standard S7 channel. The DB must be not optimized (which is the default for S7-300/400 anyway).