PLC-SCADA Communication in WinCC: Structured, Internal & Direct Tags Explained

• Use internal tags for HMI-only state; do not waste PLC bandwidth on values that never leave Runtime.
• Use process/direct tags when the value is owned by the controller and must reflect PLC quality.
• Use structured organization for repeated equipment such as motors, valves, tanks and drives.
• Tag naming, data type and ownership must be defined before graphics, alarms and scripts are built.

1. PLC-SCADA Communication Architecture in WinCC

A reliable WinCC project starts with a clear ownership model. The PLC owns machine logic, interlocks, sequence state and field values. WinCC visualizes and supervises those values, adds operator commands, alarms, trends and reports, and may hold HMI-only state. The communication driver and connection object sit between the two systems.

Before creating hundreds of tags, define the controller, connection type, PLC namespace, update requirement and whether each value is read-only, write-enabled or purely internal to the HMI.

2. WinCC Tag Types at a Glance

3. Internal Tags: Values Owned by WinCC

Internal tags exist in WinCC and are not addressed through a PLC connection. They are ideal for values such as selected screen number, report start/end time, local simulation flags, operator-entered temporary values or a script result that does not need to be stored in the controller.

• Choose a data type that matches the HMI function.
• Use a clear prefix or folder so internal values are not mistaken for PLC tags.
• Do not use an internal tag to imitate a real PLC status. That can create a dangerous visual mismatch.
• If the value must survive Runtime restart, confirm the required persistence mechanism instead of assuming all internal tags are retained.

HMI.Screen.SelectedUnit     INT
HMI.Report.StartTime        DATETIME
HMI.Simulation.Enable      BOOL
HMI.Popup.ActiveMotor      STRING

4. Direct / Process Tags Mapped to the PLC

A process tag represents a real item in the PLC or another external device. Configure the WinCC communication connection first, then create the tag with the correct controller data type and address. For a Siemens PLC, prefer symbolic addressing when the engineering environment and driver support it because the tag name follows the controller object rather than depending on a fixed byte/bit address.

Typical process tags include Motor01.RunFeedback, Tank01.Level_PV, Furnace.Temp_Set, VFD01.Speed_Act and AlarmDB.HighTemp.

5. Structured Tags for Repeated Equipment

Structured organization becomes valuable when many pieces of equipment share the same data model. Instead of engineering unrelated tag names for every motor, define a repeatable member set and apply consistent naming across the controller and SCADA.

Motor01.CmdStart
Motor01.CmdStop
Motor01.RunFB
Motor01.Fault
Motor01.Current_A
Motor01.Speed_Pct
Motor01.ModeAuto

The same member pattern can be reused for Motor02, Motor03 and so on. This improves faceplate engineering, alarm templates, scripting and maintenance. Where the WinCC generation supports structure types or integrated PLC structures, map the controller structure carefully and verify every member data type after compile/download.

6. Symbolic vs Absolute Addressing

For optimized data blocks, do not assume an absolute address exists in the same way as a non-optimized DB. Use the addressing method supported by the PLC/WinCC combination and keep the PLC and HMI engineering model aligned.

7. Tag Quality, Timestamp and Communication Status

A screen showing the last good numeric value can be misleading if communication has failed. For critical values, engineer visual quality indication or communication status. Distinguish a process value of zero from a tag that is bad, stale or unavailable.

• Monitor connection health and controller reachability.
• Use quality information where exposed by the WinCC interface.
• Record communication alarms separately from process alarms.
• Do not automatically overwrite a bad process value with zero.

8. Naming and Folder Strategy

A scalable project uses predictable names. One useful pattern is Area.Equipment.Signal or an equivalent hierarchy supported by the project. Keep commands, feedbacks, setpoints and process values distinguishable.

Line1.Conv01.CmdStart
Line1.Conv01.RunFB
Line1.Conv01.Fault
Line1.Conv01.Speed_SP
Line1.Conv01.Speed_PV

Use the same engineering vocabulary in PLC tags, WinCC tags, alarm text and documentation. Consistency reduces commissioning time more than clever abbreviations.

9. Step-by-Step WinCC Communication Workflow

1. Confirm PLC IP address, reachable network and controller operating state.
2. Create the correct WinCC communication channel/driver and PLC connection.
3. Test one known Boolean and one known analog value before bulk tag creation.
4. Create internal HMI tags separately from PLC process tags.
5. Build a structured naming convention for repeated equipment.
6. Verify data types and write permissions.
7. Place tags on a diagnostic screen showing value, quality and command status.
8. Only after communication is proven, map tags into alarms, trends, recipes and scripts.

10. Practical Lab: Motor + Analog Value

Create a small test with one motor and one analog process value. The PLC should expose Motor_RunFB, Motor_Fault, Speed_SP and Temperature_PV. WinCC should also contain an internal tag named HMI_SelectedMotor.

11. Troubleshooting WinCC Tag Communication

Lab Manual: Tag Types from Field to WinCC Runtime

The sections above explain the three tag types. This lab builds them on one tank with two pumps, with the pump logic in both ladder and SCL, and tests tag quality live.

Stage 1 – Field wiring and PLC tags

Stage 2 – Input mapping into DB_IO

"DB_IO".LT201_pct  := SCALE_X(MIN := 0.0, MAX := 100.0, VALUE := NORM_X(MIN := 0, VALUE := "LT201_Raw", MAX := 27648));
"DB_IO".LSL201_OK  := "LSL201_OK";
"DB_IO".P201_Running := "P201_Running";  "DB_IO".P202_Running := "P202_Running";

Stage 3 – PLC logic in ladder and SCL

The same logic in SCL – use whichever your plant standard prefers; both write the same DB members that WinCC reads:

// FB_Pump – InOut #Iface : UDT_PumpIF (Cmd_Start, Cmd_Stop, RunCmd, Running, Level)
#Iface.RunCmd  := (#Iface.Cmd_Start OR #Iface.RunCmd) AND NOT #Iface.Cmd_Stop AND #LowLevelOK;
#Iface.Running := #Feedback;
#Iface.Cmd_Start := FALSE;  #Iface.Cmd_Stop := FALSE;

// OB1 – one call per pump; WinCC sees "DB_Pumps".P201 and "DB_Pumps".P202 with the same structure
"IDB_P201"(LowLevelOK := "DB_IO".LSL201_OK, Feedback := "DB_IO".P201_Running, Iface := "DB_Pumps".P201);
"IDB_P202"(LowLevelOK := "DB_IO".LSL201_OK, Feedback := "DB_IO".P202_Running, Iface := "DB_Pumps".P202);
"DB_Pumps".LT201_pct := "DB_IO".LT201_pct;

Stage 4 – Link PLC tags to WinCC: three tag types

In Tag Management add the SIMATIC S7-1200, S7-1500 Channel, create a connection with the CPU IP address, then use AS Symbols to load the PLC symbols and drag the DB members you need into a tag group. The DB members must have Accessible from HMI ticked in TIA Portal. Names and menus can differ slightly between WinCC versions.

Stage 5 – Link the graphics

Faceplate events and dynamics are detailed in WinCC buttons and lamps.

Stage 6Perform and Test: Tag Types and Tag Quality

Start the pumps through their structure instances, change the internal screen tag, then cut the PROFINET connection and compare how internal, process and structured tags behave.