Configuring WinCC Professional RT Alarm Logging on TIA Portal V13

Q: How do I enable automatic alarm logging in WinCC Professional RT V13.0.1.0?

Open Alarm Logging → Settings on the HMI device, enable Activate alarm logging and Persistent storage, and choose a segmentation scheme (daily is recommended). Add a schedule triggered at Runtime start that runs the CSV export script. After the first RT start, the log file is created automatically with no operator action.

Q: Which SQL view contains the archived alarms from a previous Runtime session?

Use the union view ALGViewexLog (note the trailing ex) inside the CC_AlDb_<RuntimeID> database. The view combines all segment tables ALG_YYYY_MM_DD_HH and is rebuilt automatically on each segment rollover. The shorter ALGViewex view contains only the current in-memory session.

Q: What is the correct path for the alarm archive on Windows 7 x86 with WinCC RT V13?

By default C:\Program Files\Siemens\Automation\WinCC RT\WinCCProject\<ProjectName>\HmiLog\AlarmLog. The SQL service account NT SERVICE\MSSQL$WINCCPLUS must have Modify rights on the folder and any UNC share used for backup. On 32-bit Windows 7, do not redirect the path to a network share without testing the throughput – 100 torches generate up to 2 000 entries per shift.

September 25, 2026David Krause12 min read

Siemens Tutorial / How-to WinCC

Licensed PE Working through this on a live machine? A Maine-licensed engineer can take it from here — included with IMD hardware, by the hour for everything else. Book an engineer

1. Overview

WinCC Professional Runtime V13.0.1.0 running under TIA Portal V13 SP1 on Windows 7 x86 must persistently record alarm and operator-action events from the HMI tags (e.g. the on/off state of a hundred welding torches) and place the resulting log file in a known location the moment the Runtime starts, without operator intervention. Two distinct problems are typically encountered on this build:

No automatic log file is created at RT start-up. By default, the WinCC Alarm Control only shows a live buffer; archiving the buffer to a file or database must be configured explicitly through the Alarm Logging editor of the HMI device.
An event is reported every 2-3 seconds. When the PLC repeatedly sets a discrete bit, the alarm is queued as a new entry. This is corrected by enabling aggregation, using the "Single acknowledgment" alarm class, and using the "Message appears" / "Message goes" event pairing, plus state-based PLC logic.

This article documents the field-proven configuration of segment-based alarm logging, the elimination of repeated alarms, and a startup VBScript that automatically exports the alarm log to CSV. The methods are valid for WinCC Professional RT V13.0.1.0 through V16 and are still applicable on the current line under the WinCC Unified concept documented at the Siemens SIMATIC WinCC Unified Engineering product page.

2. Prerequisites

Item	Required value
Engineering tool	TIA Portal V13 SP1 Update 4 or later (V13 SP1 + HSP for V13.0.1 RT is recommended)
Runtime	SIMATIC WinCC Runtime Professional V13.0.1.0 (file version of HmiRTm.exe must match the project)
Operating system	Windows 7 SP1 x86 (32-bit) or Windows Server 2008 R2; 64-bit is supported on V14+
User rights	Local administrator account for installation; standard user is sufficient for RT operation
Database backend (optional)	Microsoft SQL Server 2008 R2 Express (bundled with V13) or SQL Server 2014 Express for V14+
Free disk space	≥ 20 GB for project + log segments
PLC connection	S7-300/S7-400/S7-1200/S7-1500 over PROFINET or PROFIBUS with valid HMI connection configured in Devices & Networks

Install the Runtime with administrator rights, following the procedure in the Installation of WinCC Runtime Professional guide. On Windows 7, ensure that the SQL Server (WINCCPLUS) service starts automatically and that folder redirection is disabled for the runtime user.

3. Alarm Logging Architecture in WinCC Professional RT

WinCC RT Professional stores alarms in two layers:

In-process alarm buffer – A ring buffer in memory containing the active and recently cleared alarms. Bound to the Alarm Control; cleared on RT exit unless the buffer is declared persistent.
Alarm Logging database – Microsoft SQL Server database CC_AlDb_<RuntimeID> with the segment files ALG_<yyyy>_<mm>_<dd>_<hh>.mdf located under C:\Program Files\Siemens\Automation\WinCC RT\WinCCProject\<ProjectName>\HmiLog\AlarmLog by default.

Each segment contains the following fields which can be evaluated in VBScript or queried from SQL:

Column	Type	Description
MsgID	bigint	Internal alarm ID
MsgClass	int	Alarm class (1 = error, 2 = warning, 3 = system, …)
MsgState	int	1 = came in, 2 = went out, 3 = acknowledged, 4 = acknowledged with reset
MsgText	nvarchar(255)	Configured message text including tag values
TimeCome	datetime	Time stamp when the message came in (RT time)
TimeGo	datetime	Time stamp when the message went out
TimeAck	datetime	Time stamp of the last acknowledgement
PLC	nvarchar(64)	Source PLC name
UserName	nvarchar(64)	Logged-in user that acknowledged

4. Configuring Segment-Based Persistent Alarm Logging

In the TIA Portal project tree, expand the HMI device and double-click Alarm Logging.
Switch to the Settings tab in the editor.
Enable Activate alarm logging and Persistent storage of the alarm log. The persistent flag is mandatory – it is the parameter that makes the log survive RT restart.

Choose the segmentation scheme that matches the size of the installation. For 100 torches, a daily segment is usually optimal:

Scheme	Use when
Single segment	≤ 1 000 alarms/day, single-shift test rigs
Daily, single file	1 000 – 50 000 alarms/day (recommended for this project)
Weekly	Long-term compliance reports with few events
On reaching size	Memory-constrained industrial PCs

Set the Backup path to a UNC share, e.g. \\Archive01\WinCCLogs\<PlantLine>\, so the file is reachable from a reporting PC.
Confirm with OK and compile the project.

Note: The persistent flag requires that the SQL Server service account has write access to the backup path. On Windows 7, the default is NT SERVICE\MSSQL$WINCCPLUS; grant Modify rights on the share explicitly.

5. Making the Log File Appear Automatically at RT Start-Up

The Alarm Logging database exists as soon as Runtime has been started once, but the customer needs a plain CSV file from the first start. A scheduled VBScript in the Runtime scheduler is the cleanest path on V13:

In the project tree, right-click the HMI device → Add new folder → Schedules.
Add a new schedule named ExportAlarmsOnStartup.
Trigger: At Runtime start. Secondary trigger: every 24 h at 00:00:00 for the daily cut.
Attach a new VBScript action with the following code:


'------------------------------------------------------------
' WinCC RT Professional V13 – Alarm log export
' Triggered at RT start, runs every 24 h thereafter
'------------------------------------------------------------
Option Explicit

Const DB_NAME   = "CC_AlDb_HMI_RT_1"
Const EXPORT_DIR = "C:\WinCCExport\AlarmLog\"

Sub ExportAlarmLog()
    Dim oConn, oRs, oCmd, sSql, sCsv
    Dim sFile, sDate, iFile, fso
    
    sDate = Year(Now) & "_" & Right("0" & Month(Now),2) & "_" & Right("0" & Day(Now),2)
    sFile = EXPORT_DIR & "AlarmLog_" & sDate & ".csv"
    
    Set fso  = CreateObject("Scripting.FileSystemObject")
    If Not fso.FolderExists(EXPORT_DIR) Then fso.CreateFolder EXPORT_DIR
    Set iFile = fso.CreateTextFile(sFile, True, True)  ' Unicode
    
    iFile.WriteLine "TimeCome;TimeGo;TimeAck;MsgState;MsgClass;PLC;UserName;MsgText"
    
    Set oConn = CreateObject("ADODB.Connection")
    oConn.ConnectionString = _
        "Provider=SQLOLEDB;Data Source=(local)\WINCCPLUS;" & _
        "Initial Catalog=" & DB_NAME & ";Integrated Security=SSPI;"
    oConn.Open
    
    sSql = "SELECT TimeCome, TimeGo, TimeAck, MsgState, MsgClass, PLC, UserName, MsgText " & _
           "FROM ALGViewexLog" & _
           "WHERE TimeCome >= '" & FormatDateTime(Date, vbShortDate) & " 00:00:00' " & _
           "ORDER BY TimeCome ASC"
    
    Set oRs = oConn.Execute(sSql)
    Do While Not oRs.EOF
        sCsv = oRs("TimeCome") & ";" & oRs("TimeGo") & ";" & oRs("TimeAck") & ";" & _
               oRs("MsgState") & ";" & oRs("MsgClass") & ";" & oRs("PLC") & ";" & _
               oRs("UserName") & ";" & Replace(CStr(oRs("MsgText")), ";", ",")
        iFile.WriteLine sCsv
        oRs.MoveNext
    Loop
    oRs.Close : oConn.Close
    iFile.Close
End Sub

Compile the project, download it to the RT PC, and restart Runtime. The CSV file appears immediately in C:\WinCCExport\AlarmLog\ and is overwritten/extended at 00:00 each day.

SQL view name: On V13 the segmented tables are named ALG_YYYY_MM_DD_HH. The union view ALGViewexLog (note the trailing ex for "external") is provided automatically; do not query ALGViewex which only contains the active session.

6. Eliminating the 2-3 Second Alarm Repeat

When a torch is in continuous operation, the PLC will keep a discrete bit set, but a noisy contact, a non-latched HMI tag, or a script that re-triggers the bit on every scan causes the alarm to be re-issued. There are three independent mechanisms to suppress the repeat; in practice all three are required.

6.1 Aggregation in the alarm definition

Open Alarm Logging → Messages and select the affected message (e.g. Torch_001_ON).
Open the Properties of the message → Options tab.
Enable Aggregate messages and set the aggregation time to a value greater than the PLC scan period, typically 1 000 ms. The first occurrence is logged, and subsequent identical events within the window are counted but not re-logged.

6.2 Edge-triggered evaluation

For a simple on/off indication, configure two separate messages:

Torch_001_ON – triggered on the rising edge of Torch_001_State.
Torch_001_OFF – triggered on the falling edge.

The edge is evaluated by the alarm engine; a held bit does not generate additional entries. The message text can be parameterised as {T<0>} for the tag value and {T#TIME} for the time stamp using the placeholder editor.

6.3 PLC-side latching

The cleanest solution is a single-bit latch in the PLC that is set by the event and reset by an HMI operator action or by the next valid transition. The S7 example in STL:


//  Torch_001_State – momentary event
//  Torch_001_Latch  – set/reset by the alarm engine
A    "Torch_001_State"
S    "Torch_001_Latch"

A    "Reset_Torch_001"     // Operator button, edge-triggered
R    "Torch_001_Latch"

Bind the alarm to Torch_001_Latch. The alarm will come in exactly once per state change and remain in the log until acknowledged, which matches the operator's mental model of "which torches have lit since the shift started?".

7. Verification Procedure

Compile the project (Ctrl+B) – both configuration and script must compile without warnings. Warning "W:13031 – Database cannot be opened" indicates that the SQL service has not started yet; check services.msc.
Download the configuration to the target HMI device (right-click → Download to device).
Start Runtime. The first row of the CSV file should appear within 5 seconds, confirming the scheduled action executed.
Force a torch event from the PLC simulator. Check the Alarm Control – the message must come in exactly once, with a single TimeCome stamp and a TimeGo stamp when the bit is cleared.
Open the CSV in Excel; verify that the TimeCome column is monotonically increasing, and that the row count equals the number of unique state transitions, not the number of scan cycles.
Restart Runtime (RT button → Stop → Start). The persistent segment must still contain the previous alarms when queried via SQL.

8. Troubleshooting Matrix

Symptom	Likely cause	Action
No CSV file is created at start	Schedule not active, or script runtime disabled	Schedules editor → Schedule Properties → Active = true. Check Project > Runtime settings > Scripts > Execute VBScripts.
CSV exists but is empty	SQL view name wrong for the version	Query `SELECT name FROM sysobjects WHERE xtype='V'` against `CC_AlDb_<id>`; use the view that contains the historical records.
Alarm repeats every 2-3 s	Bit not latched, or aggregation not enabled	Enable aggregation with ≥ 1 000 ms window and switch to edge-triggered evaluation (sections 6.1 and 6.2).
Archive path inaccessible	Share rights, or UNC path on logon	Use a local path for the first test, then migrate to the UNC share after verifying SQL service account rights.
RT reports "DB-Net error 0x80004005" at start	SQL Server not started, or DB marked suspect	Restart `SQL Server (WINCCPLUS)`; check ERRORLOG under `C:\Program Files\Microsoft SQL Server\MSSQL10_50.WINCCPLUS\MSSQL\Log`.
Time stamps off by one hour	Daylight-saving time misapplied	Configure the HMI device's Time zone to UTC and select Local conversion in WinCC; alternatively, change the host to UTC and let the operator console convert.
Script compiles but line numbers missing in the log	Project compiled with Optimised access	Disable optimised access in the script properties for the scheduled task only.

9. Migration Notes for TIA V14 / V15 / V16 / V17 / V20

The configuration described above is forward-compatible. The main differences introduced in later versions are:

V14+ – the SQL instance is renamed to SQL Server (WINCCPLUS) with SQL Server 2014 Express. The ALGViewexLog view is unchanged.
V15.1+ – the alarm engine introduces a parameter Multi-line messages. Leave it disabled when exporting to CSV to avoid embedded newline characters.
V16+ – VBScript in schedules is replaced by C# and VB.NET scripts. The C# equivalent of the routine in section 5 is provided in the WinCC Professional script reference.
V17 / V20 – the new SIMATIC WinCC Unified Engineering concept uses a different archive backend (SQLite or PostgreSQL) and a JavaScript-based scheduled task. The migration path is documented in the WinCC Unified engineering manual.

10. Performance and Sizing Guidelines for 100 Torches

Assume 10 state changes per torch per shift (ignition, ramp-up, weld cycle, ramp-down, fault-clear, etc.) with two shifts, then:

Alarms per day: 100 × 10 × 2 = 2 000
Bytes per alarm (UTF-16 in the .mdf): ≈ 1 200 B
Daily size: ≈ 2.4 MB
Annual size at 5 % growth: ≈ 1 GB

With a daily segment scheme and a 90-day retention, the database is approximately 220 MB, well within the SQL Server 2008 R2 Express limit of 4 GB. A weekly or monthly scheme is therefore not required for this installation, and operators can keep five years of records on the local drive before archiving to a network share.

11. Field-Proven Caveats

Caveat – V13 and Windows 7 x86: 32-bit hosts are limited to 3.5 GB of process address space. With 100 torches and 1 s polling, the alarm engine reaches approximately 280 MB resident, leaving headroom but no margin for additional HMIs. Plan an upgrade to 64-bit Windows 10 IoT LTSC if the HMI is expanded.

Caveat – CSV encoding: Always open the exported CSV in Excel via Data → From Text/CSV → File Origin = 65001 (UTF-8). The default ANSI import mis-decodes the German umlauts and Polish diacritics in message texts.

Caveat – Operator authentication: Acknowledgement events are stored only if a user with the right to acknowledge the class is logged in. For an unattended line, configure an Auto-Login user in the Runtime settings to keep the audit trail complete.

12. FAQ

How do I enable automatic alarm logging in WinCC Professional RT V13.0.1.0?

Open Alarm Logging → Settings on the HMI device, enable Activate alarm logging and Persistent storage, and choose a segmentation scheme (daily is recommended). Add a schedule triggered at Runtime start that runs the CSV export script. After the first RT start, the log file is created automatically with no operator action.

Why does the same alarm appear every 2-3 seconds in the Alarm Control?

The alarm is being re-triggered every PLC scan because the discrete bit is not latched and the message is level-evaluated. Enable Aggregate messages in the message properties with a 1 000 ms window, switch the message to edge-triggered evaluation (rising edge = event, falling edge = clear), and latch the bit in the PLC so it remains set until acknowledged.

Which SQL view contains the archived alarms from a previous Runtime session?

Use the union view ALGViewexLog (note the trailing ex) inside the CC_AlDb_<RuntimeID> database. The view combines all segment tables ALG_YYYY_MM_DD_HH and is rebuilt automatically on each segment rollover. The shorter ALGViewex view contains only the current in-memory session.

What is the correct path for the alarm archive on Windows 7 x86 with WinCC RT V13?

By default C:\Program Files\Siemens\Automation\WinCC RT\WinCCProject\<ProjectName>\HmiLog\AlarmLog. The SQL service account NT SERVICE\MSSQL$WINCCPLUS must have Modify rights on the folder and any UNC share used for backup. On 32-bit Windows 7, do not redirect the path to a network share without testing the throughput – 100 torches generate up to 2 000 entries per shift.

Can I migrate this configuration to WinCC Unified in TIA V20?

Yes. The alarm concept is preserved, but the archive backend changes to SQLite or PostgreSQL and the scheduled task is implemented in JavaScript. The SIMATIC WinCC Unified Engineering product page and the V20 migration manual describe the import wizard. Re-aggregation and edge evaluation are configured in the same way.

David KrauseIndustrial Controls Specialist – Siemens Platforms

Industrial controls specialist focused on Siemens SIMATIC S7 platform, from the S7-300/400 series through the latest S7-1200/1500 controllers. Expert in TIA Portal configuration and WinCC SCADA integration.

Planning your next automation project? Explore IMD panel PCs and touch monitors.

Back to blog