How HMIs talk to PLCs — drivers, polling and addressing
HMI–PLC communication in practice: native vs open drivers, symbolic vs absolute addressing, polling cycles and load, write handshakes, byte order and a connection troubleshooting checklist.
Every HMI tag is a request to a controller. Understanding the driver behind it explains most "values freeze" and "panel slow" complaints.
Driver types
| Driver | Examples | Notes |
|---|---|---|
| Native (same vendor) | WinCC ↔ S7 (S7comm-plus), FactoryTalk View ↔ Logix, GOT ↔ MELSEC | Symbolic access, tag import, best diagnostics |
| Third-party native protocol | Weintek/Pro-face/Kinco drivers for S7, MELSEC, Omron FINS, Logix CIP | Usually absolute addressing; check the vendor connection guide |
| Open protocol | Modbus RTU/TCP, OPC UA, EtherNet/IP | Works with almost anything; mapping and data types are your responsibility |
Addressing
- Symbolic (
DB_Motor.Speed,Program:Main.Speed) — survives program changes; needs tag import or browsing. - Absolute (
DB10.DBW4,D100,40001) — simple, but breaks when the PLC data layout changes. Use fixed communication blocks ("HMI interface DBs") so the layout stays stable.
Polling and load
- Panels poll only tags on the current screen plus alarms/logging/scripts that run in the background. Background logging of hundreds of tags at 100 ms can overload a small PLC.
- Group tags in contiguous blocks: one request for 50 consecutive registers is much cheaper than 50 single requests.
- Typical cycle: 100–500 ms for screens, 1 s or slower for trends.
Writes and handshakes
- Momentary buttons via communication are not real-time: the PLC may miss a pulse. Use set-by-HMI / reset-by-PLC handshakes, or write a command word that the PLC clears after execution.
- Never implement safety functions or jogging that depends on the HMI link without a watchdog.
Troubleshooting checklist
- Physical link and IP/serial settings (station number, baud, parity).
- Protocol options on the PLC side (PUT/GET on S7-1200/1500, FINS port, Modbus server enabled).
- Address ranges and data types (16/32-bit, signed/unsigned, REAL), byte/word order.
- Driver diagnostics on the panel (communication error codes, statistics).
- PLC communication load and connection limits (too many clients).
Connections
Open in Knowledge Graph →Loading the map…
Sources
Updated 2026-10-04