WinCC VBS Indirect Addressing: Dynamic Tag Reading via HMIRuntime

Overview

WinCC V6.2 and later versions expose a powerful set of COM-like automation objects that allow VBScript (VBS) to read, write, and even modify the configuration of process tags at runtime. Indirect addressing — where one internal text tag stores the name (or the address) of a second tag — is the standard pattern for building reusable HMI screens, dashboard frameworks, and tag-agnostic diagnostic overlays.

This reference documents two distinct indirect-addressing approaches for WinCC VBS:

1. HMIRuntime.Tags pointer method — read a tag whose name is stored as a string in another tag. Best for read-only or one-shot read/write scenarios in picture scripts.
2. HMIGenObjects.HMIGO address method — physically reassign a tag's S7/S5 address at runtime. Use when the same configured tag must follow a dynamic PLC variable without rebinding every I/O field.

The tutorial targets WinCC V6.2 SP3 or higher (SP4/SP5/SP6 in modern installations), but the VBS object model is stable up through WinCC 7.x. All code samples are written for the WinCC VBS editor and execute inside picture events, global actions, or scheduled tasks.

Prerequisites

Indirect Addressing Concepts in WinCC

WinCC supports three levels of indirection for I/O fields, bar graphs, and online table controls:

The dialog-driven indirect addressing is fast but limited to a single read. VBS indirect addressing adds the ability to perform arithmetic, bit operations (XOR, AND, OR, shift), concatenation, and conditional logic on the dereferenced value before displaying or writing it back.

Configuring an Indirect Text Tag

Before any VBS dereferencing is possible, an internal text tag must exist in the project. Recommended defaults are summarized below.

Bind this tag to the I/O field Output Value property of an I/O field on the start picture. Operators will type the name of the actual process tag they want to inspect; the VBS action consumes the string and dereferences it.

HMIRuntime.Tags — Pointer-Based Indirect Read

The standard dereferencing pattern is a four-step sequence: obtain the HMIRuntime tag wrapper, read the pointer value, build a new tag wrapper for the dereferenced name, then read or write the dereferenced tag.

Step 1 — Dereference and copy

' WinCC VBS action triggered by I/O field "OutputValueChanged" or "OnClick"
Dim objPointer, strTarget, objTarget, varValue, objResult

' 1. Read the pointer tag (Text 8-Bit) configured in the project
Set objPointer = HMIRuntime.Tags("Temp")
objPointer.Read
strTarget = objPointer.Value

' 2. Defensive: empty pointer is a script error — abort cleanly
If Len(strTarget) = 0 Then
    HMIRuntime.Trace "Indirect address: pointer tag is empty, aborting." & vbNewLine
    Exit Sub
End If

' 3. Open the dereferenced tag
Set objTarget = HMIRuntime.Tags("" & strTarget & "")
objTarget.Read
varValue = objTarget.Value

' 4. Write result into a stable holding tag the I/O field can display
Set objResult = HMIRuntime.Tags("ResultTag")
objResult.Write varValue

Step 2 — Parameter mapping

Step 3 — Connection-qualified dereferencing

If multiple connections exist, fully qualify the dereferenced tag name to disambiguate:

Set objTarget = HMIRuntime.Tags("S7_400_Station1::Motor_Speed")

The :: separator follows the WinCC naming convention <Connection>::<Tag>. Without a connection prefix WinCC walks the default search order and may raise Script Warning 0x80040402 ("Tag not found").

HMIGenObjects.HMIGO — Runtime Tag Readdressing

For situations where the project is pre-loaded with a tag stub (e.g., DynamicTag) that must follow whatever PLC address the operator selects, use the HMIGenObjects COM object. This method rewrites the tag's TagS7S5Address property — the address of the Simatic S7/S5 target — and commits the change live.

' Reusable WinCC VBS function
Function SetAddress(ByVal TagName, ByVal Address)
    Dim HG
    Set HG = CreateObject("HMIGenObjects.HMIGO")

    If (HG Is Nothing) Then
        HMIRuntime.Trace "SetAddress: HMIGO object unavailable." & vbNewLine
        Exit Function
    End If

    HG.GetTag TagName           ' Load tag configuration into the object
    HG.TagS7S5Address = Address ' Assign new DB/byte/bit address
    HG.CommitTag                ' Persist the change to the runtime database

    Set HG = Nothing
End Function

Property reference for HMIGO

Practical Use Case — Bit Toggle via XOR

The classic operator scenario: a button toggles a single boolean bit in the PLC using an exclusive-OR mask of 0x01. With indirect addressing, the same picture object can toggle any selected bit on any selected tag.

' Picture event "OnClick" of a Toggle button
Dim objPtr, strTarget, objTarget, varRaw, varToggled

Set objPtr = HMIRuntime.Tags("Temp")
objPtr.Read
strTarget = objPtr.Value

If Len(strTarget) = 0 Then Exit Sub

Set objTarget = HMIRuntime.Tags("" & strTarget & "")
objTarget.Read
varRaw = objTarget.Value

' XOR with 1 to flip the least-significant bit
varToggled = CLng(varRaw) Xor &H1

' Bit-aware write: dispatch based on the tag's logical type
If (objTarget.TagType = 0) Then       ' Binary
    objTarget.Value = (varToggled And &H1)
Else
    objTarget.Value = varToggled
End If

objTarget.Write

To toggle a bit at an arbitrary position inside a word:

Dim lBitPos, lMask, lValue, lNewValue
lBitPos  = 5
lMask    = (2 ^ lBitPos)         ' 0x20 in this example
lValue   = CLng(objTarget.Value)
lNewValue = lValue Xor lMask     ' flip bit 5 only
objTarget.Value = lNewValue
objTarget.Write

Error Handling and Defensive Coding

WinCC VBS exposes no structured exception mechanism; failures fall back to On Error Resume Next. Place a single, project-wide error trap at the top of every action or picture script.

On Error Resume Next

Dim sErr, lErr
Set objPtr = HMIRuntime.Tags("Temp")
objPtr.Read

lErr = Err.Number
If lErr <> 0 Then
    sErr = Err.Description
    HMIRuntime.Trace "Indirect read failed at Temp: " & lErr & " - " & sErr & vbNewLine
    Err.Clear
    Exit Sub
End If

Common WinCC VBS error codes

Verification Procedure

1. Open the Graphics Designer and place an I/O field on the start picture. Bind its Output Value to ResultTag (configured as a signed 32-bit Binary tag).
2. Bind a second I/O field's Output Value to the pointer tag Temp (Text 8-Bit). Mark the field as Output.
3. Attach the indirect-read VBS action to the OnChange or OnClick event of the pointer I/O field.
4. Start WinCC Runtime (RT) and enter a known good tag name (e.g., PLC1::MotOn) into the pointer field.
5. Confirm in WinCC Explorer → Tags → Tag Management that the value displayed in the ResultTag I/O field matches the live PLC value.
6. To verify HMIGO re-addressing: enter a new address in the VBS, click the toggle button, and confirm the dynamic read now returns the new DB area.
7. Capture activity by enabling Tag Logging on the picture or by tailing WinCCdiag_Trace from HMIRuntime.Trace lines.

Troubleshooting Matrix

Performance and Security Notes

• Cycle placement. Schedule dereferencing actions on the picture's OnClick or tag OnChange event, not on the 250 ms cycle. Each call retrieves the latest value through the WinCC data manager — high-frequency scripts can saturate the channel.
• Caching wrappers. HMIRuntime.Tags(name) always allocates a new interface. If the same tag is dereferenced in a loop, store the wrapper once and reuse .Read / .Write.
• Operator privilege. HMIRuntime exposes all configured tags regardless of authorization unless picture-level Authorizations are set on the screen. Industrial deployments should always enable WinCC User Administrator and bind sensitive screens to an authorization level (e.g., "Operator level 5 – Maintenance").
• Address validation. Validate any operator-supplied address before passing it to HG.TagS7S5Address. An invalid address not only fails to commit but may corrupt the in-memory tag configuration. Use a regex such as ^(DB\d+\.DB[XBWD]\d+(\.\d+)?|M[WBXD]\d+(\.\d+)?|[EIA]\d+(\.\d+)?)$ before assigning.
• Audit trail. Every HMIRuntime.Trace call is captured to the diagnostics log when WinCCdiag is enabled, providing an audit trail for re-addressing events in regulated environments.

FAQ