Writing Data from WinCC 7.0 to a SIMATIC S7-300 PLC

WinCC 7.0 can write values to a SIMATIC S7-300 PLC through a configured driver connection, a WinCC tag bound to a memory address, and a screen object (typically an I/O field) connected to that tag. The relationship is bidirectional: an operator entering a value in WinCC updates the PLC, and a calculation in the PLC updates the WinCC tag.

This reference covers the end-to-end configuration: verifying the physical connection, creating the S7-300 channel in WinCC Tag Management, defining tags with the correct address format (MD/MW/DB), and binding an I/O field on a Graphics Designer screen to the tag so the operator can change the value at runtime.

1. Prerequisites and Architecture Overview

Before opening the WinCC Explorer, confirm the following items are available and operational. Each one is a hard dependency; missing any item produces runtime communication errors that surface as connection-status red icons in WinCC Explorer and tag-quality "bad" indicators on the runtime screens.

• Working PLC connection: An MPI, PROFIBUS, or ISO-on-TCP (Ethernet) link between the S7-300 station and the WinCC station. The CP 343-1 Lean / CP 343-1 (6GK7343-1CX10-0XE0 / 6GK7343-1EX30-0XE0) and CP 342-5 PROFIBUS (6GK7342-5DA02-0XE0) modules are the most common interfaces on the S7-300 side.
• WinCC 7.0 installation: SIMATIC WinCC V7.0 or later with the appropriate driver channel. For S7-300 communication, the channel "SIMATIC S7 Protocol Suite" is installed by default with the standard WinCC package.
• License: To modify a project, an RC (Development / Configuration) license is required. An RT (Runtime) license only permits the project to run; configuration changes cannot be saved.
• STEP 7 project (optional but recommended): STEP 7 V5.5 / V5.6 with the S7-300 program source. Knowing the absolute address of the variable (for example, MD 100, MW 200, or DB10.DBD0) is mandatory for tag configuration.
• TCP/IP or PROFIBUS address: For ISO-on-TCP, the S7-300 CP must have a configured IP address reachable from the WinCC station; for PROFIBUS or MPI, the bus parameters must match.

2. Establishing the S7-300 Communication Channel in WinCC

WinCC connects to a SIMATIC PLC through a "channel" inside the Tag Management editor. For S7-300 PLCs, the channel to use is the SIMATIC S7 Protocol Suite. Within that channel, a "connection" represents the logical link to one PLC, identified by its network address.

2.1 Open the Tag Management Editor

1. Start WinCC Explorer and open your project (or create a new one: File > New > Single-User Project).
2. In the left navigation tree, right-click Tag Management.
3. Select Add New Driver → choose SIMATIC S7 Protocol Suite → click Open.

The SIMATIC S7 Protocol Suite exposes the following sub-channels; select the one that matches the physical interface between the WinCC PC and the S7-300 CP:

2.2 Create the Connection

1. Expand the chosen sub-channel (for example, Industrial Ethernet).
2. Right-click Industrial Ethernet → New Connection.
3. In the Connection Properties dialog, set:
   • Name: any descriptive label, e.g. S7_300_CP343
   • IP Address / Station Address: the IP of the S7-300 CP (e.g., 192.168.0.10) or the MPI/PROFIBUS address (e.g., 2)
   • Rack: typically 0
   • Slot: the slot of the CPU (typically 2 for S7-300)
   • Connection Type: ISO-on-TCP (default for CP 343-1)
4. Click OK. The connection appears in the tree with a red dot (not yet tested).

3. Creating a Tag for the S7-300 Memory Address

Tags are the bridge between WinCC and PLC memory. A WinCC tag is associated with one absolute address in the S7-300. Common memory areas used for HMI access include:

• Bit memory (M): MX, MB, MW, MD
• Data blocks (DB): DBx.DBXy, DBx.DBBy, DBx.DBWy, DBx.DBDy
• Inputs/Outputs (I/Q): rarely used for HMI write-back due to safety implications
• Timers/Counters (T/C): also available but specialized

3.1 Procedure

1. Right-click the newly created connection (e.g. S7_300_CP343) → New Tag.
2. In the Tag Properties dialog:
   • Name: e.g. SetpointValue
   • Data type: select the type that matches the PLC variable (e.g. Float 32-bit IEEE 754, Signed 32-bit, Word)
   • Address: enter the S7-300 absolute address. For a double word in bit memory at byte 100, enter MD 100. For a double word in DB10 starting at DBD0, enter DB10.DBD0.
   • Update / Acquisition cycle: e.g. 1 s (minimum 500 ms; lower values increase network load)
3. Click OK. The tag appears in the right pane with its full address.

The address field syntax must match exactly. Entering MD100 without the space, or selecting the wrong data type, causes the tag to read garbage or trigger an S7-300 "area length error" OB121 / SF LED on the CPU if a non-existent DB is referenced.

4. Binding an I/O Field on a WinCC Screen

The Graphics Designer is the WinCC editor for runtime screens. An I/O field (smart object) provides a configurable read/write input box that displays the current tag value and accepts operator entry.

4.1 Configure the Screen

1. Open Graphics Designer (right-click Graphics Designer in the navigation tree → New Picture).
2. From the Standard or Smart Objects palette, drag an I/O Field onto the picture.
3. Double-click the I/O field to open its configuration dialog.

4.2 Configure the I/O Field

• Tag: click the ... button and select the tag created in step 3 (e.g. SetpointValue).
• Output / Input format: for a 32-bit integer, use 9999; for a real number, use 999.99; for a 16-bit unsigned, use 00000.
• Field type: leave as Input / Output to permit operator entry.
• Update: keep the default (every 250 ms while in focus / on each Acquire cycle).

Click OK to apply. Save the picture. With the WinCC project running, the I/O field displays the current value of the S7-300 tag, and an operator can type a new value and press Enter (or Tab) to write it back to the PLC. The PLC program reads the new value on the next OB1 cycle.

5. Common S7-300 Part Numbers and Constraints

Use this reference table when sizing the S7-300 side of the link. The CP module determines which sub-channel you select in the SIMATIC S7 Protocol Suite.

Note: S7-300 was phased out of general sale by Siemens. Firmware support and spare parts are maintained in the corresponding SIMATIC product phase-out schedule. For new installations, evaluate S7-1500 + TIA Portal + WinCC Professional / Unified. The WinCC V7.x line continues to receive maintenance for S7-300/400 integration.

6. Tag Addressing and Data Type Mapping

Choosing the correct data type is essential. The WinCC tag type must match the STEP 7 declaration exactly, or sign-extension and range mismatches will surface as soon as a negative number or a value above 32767 is written.

7. Step-by-Step Recap

1. Verify the WinCC PC can reach the S7-300 CP: ping 192.168.0.10 for Ethernet, or use STEP 7 "Accessible Nodes" for MPI/PROFIBUS.
2. Open WinCC Explorer → Tag Management → add the SIMATIC S7 Protocol Suite driver.
3. Create a new connection in the correct sub-channel; set IP / MPI / PROFIBUS address, rack = 0, slot = 2.
4. Right-click the connection → New Tag → set name, data type, address, and update cycle.
5. Open Graphics Designer → drag an I/O field → bind it to the tag → set the input/output format.
6. Save the project. Activate Runtime.
7. In Runtime, type the new value (e.g., 250) into the I/O field, press Enter. The S7-300 receives the new value; cross-check in STEP 7 with a VAT table or PLCSIM monitor.

8. Verification and Diagnostics

8.1 Connection status

• In WinCC Explorer, expand the connection. If the connection is healthy, the red dot becomes a small green or yellow icon. A persistent red dot indicates that the SIMATIC S7 Protocol Suite cannot establish a connection with the configured CP.
• Open the Channel Diagnosis tool (Start → SIMATIC → WinCC → Channel Diagnosis) to see real-time diagnostic counters (send/receive errors, timeouts, connection attempts).

8.2 Tag quality

• On a screen, configure an output field bound to the same tag. A quality code of 0xC0 (bad) signals a connection or address error; 0x00 (good) is normal.
• Force a read/write by toggling a test tag in the I/O field and confirming with STEP 7 online monitor (VAT table) or PLCSIM.

8.3 PLC-side check

• In STEP 7, open the relevant DB and check the value. If the value does not change after a WinCC write, the issue is on the HMI side (no write permission, wrong data type, or the address points to an M area that is overwritten by the S7 program in OB1).
• Monitor the S7-300 diagnostic buffer (online → PLC → Diagnostic Buffer) for "communication error" entries that indicate a malformed telegram.

9. Troubleshooting Matrix

10. Practical Tips and Field Caveats

• Use a Data Block, not M area, for setpoints: Bit memory (M) is volatile and the S7 program may reinitialize it on restart, mode change, or warm restart. A DB with a defined initial value gives predictable behavior. Mark the DB as "non-optimized" / "standard access" so that absolute addressing from WinCC is possible.
• Avoid writing directly to I and Q: Inputs and outputs are tied to the I/O process image; writing to them from HMI is either impossible or causes unintended side effects.
• Byte order for S7-300: S7-300 (and S7-400) are big-endian (Motorola byte order). The SIMATIC S7 Protocol Suite handles this automatically; mismatches in custom third-party tools are a common source of confusion.
• Update cycle: For a setpoint, 500 ms to 1 s is usually sufficient. Driving the cycle below 250 ms loads the S7 connection unnecessarily and can starve other HMI tags of the same channel.
• PLCSIM for testing: S7-PLCSIM allows tag writes from WinCC to be exercised without a physical S7-300. Set the connection's IP to the PLCSIM instance and use the same S7 Protocol Suite channel.
• Multiple HMI clients: Multiple WinCC stations writing the same tag is permitted; the last writer wins. For arbitration, use handshake bits (e.g., a "write-in-progress" BOOL cleared by the PLC after a successful transfer).
• Security for newer controllers: The S7-1200 / S7-1500 / S7-1500T controllers use certificate-based authentication for secure HMI communication. If migrating the pattern to those controllers, import the HMI certificate into the CPU's global certificate manager, and the CPU certificate into the HMI/engineering station. Refer to the TIA Portal documentation: Importing and Exporting Certificates (S7-1200/S7-1500/S7-1500T).

11. Performance and Sizing Notes

The SIMATIC S7 Protocol Suite supports up to 32 connections per channel instance, with up to 8,000 tags per project (license-dependent) and a maximum recommended update rate of 100 ms for high-priority data. For a single HMI station monitoring one S7-300 with fewer than 1,000 tags, a 1-second cycle is the standard baseline.

Estimated network load per tag per cycle (at 1 s): roughly 20–40 bytes per read, plus write traffic. With 500 tags at 1 s, expect 10–20 kbit/s sustained on an Ethernet segment — well below 100 Mbit/s, but still relevant for shared subnets.

12. Frequently Asked Questions