Configuring WinCC v6 Alarm Logging with 16-Bit WORD Tag Bits

Problem Statement

In a Siemens WinCC v6.2.2.0 Alarm Logging configuration, an integrator must license all HMI tags as 16-bit WORD types because the available PLC tag pool only exposes WORD variables (for example S7 data block words reserved by the controller program). When opening Properties > Trigger on a single message in the Alarm Logging editor, the trigger-tag drop-down appears to offer only Binary Tag (BIT) and Unsigned Byte (BYTE). Selecting a 16-bit WORD tag is not offered, and selecting any of the bit positions 8 to 15 of a BYTE tag is greyed out. The integration team cannot redefine the PLC tags as bits or bytes because of license restrictions on the controller side, and they cannot create parallel bit tags without exhausting the WinCC runtime tag-count license.

The behaviour looks like a hard product limitation, but the underlying capability exists: WinCC v6 and v7 Alarm Logging fully support 16-bit WORD trigger tags and 32-bit DWORD trigger tags. The dialog presents the data-type label differently from what the tag database actually allows, which is what causes the confusion in the field.

Root Cause Analysis

The Alarm Logging Trigger dialog in WinCC v6/v7 lists every numeric tag of the project as a candidate. The data-type column shown in the dialog reflects the WinCC Tag Management data type that was assigned when the tag was created. A WORD tag created in Tag Management appears in the Alarm Logging trigger list exactly the same way as a BYTE tag, with one difference: for a WORD trigger tag the bit-position field accepts values 0..15 instead of 0..7. The "only BYTE or BIT" appearance reported from the field is in practice the result of one of three project conditions:

1. The WinCC tag was created with the data type Binary Tag or Unsigned Byte, not Unsigned Word. The tag database genuinely contains a 1-bit or 8-bit variable, so only bit 0 to 7 can be addressed.
2. The tag is a WORD on the PLC side, but the WinCC side was imported via the S7 channel with an incorrect address width, mapping it to a BYTE in WinCC. Address drift between PLC and HMI tags is the most common cause of the symptom.
3. The tag dialog filter is set to Byte only. In some builds the dialog has a filter that hides non-matching data types when the project has thousands of tags.

The licensing restriction cited in the field report is independent of the trigger mechanism. It concerns only the number of WinCC power tags licensed on the runtime. Reducing each WORD to 16 BIT tags would multiply the licensed tag count by 16, which is exactly why the engineer must keep the WORD and address individual bits inside it.

Data-Type Support Matrix for Alarm Logging Trigger Tags

The WinCC v6 / v7 Alarm Logging editor accepts any of the following WinCC tag data types as a message trigger source. Each row shows the valid range of bit positions that can be evaluated by the alarm state machine.

The Siemens documentation for the equivalent mechanism in WinCC Professional / TIA Portal (status tag for alarm groups) confirms the same bit-allocation principle: each alarm or alarm group occupies two bits in the status word, with bit 0 always the incoming edge and bit 1 the acknowledged edge. The reference is documented at TIA Portal V21 — Bit assignment of status tag (RT Professional).

Bit-to-Alarm Allocation Layout

When the project uses one WORD as the consolidated trigger source for 16 alarms, the bit-to-alarm mapping is fixed by the integrator. The convention used in most plants is little-endian, with bit 0 being the least-significant bit of the WORD, identical to the byte order used by STEP 7 when reading EW / AW / MW words.

Step-by-Step Configuration of a WORD Trigger Tag

1. Open WinCC Explorer on the engineering station and select Tag Management in the left navigation tree.
2. In the right pane, expand the S7 channel driver (for example SIMATIC S7 PROTOCOL SUITE > TCP/IP) and the connection used by the project (for example S7-1).
3. Right-click the connection, choose New Tag, and create a tag with the following parameters:
   • Name: AlarmWord_DB100_DBW50
   • Data type: Unsigned 16-bit value (this is the WORD data type in WinCC)
   • Address: DB100.DBW 50 (S7-300/400/1500 absolute address)
   • Length: 1 WORD (do not use 1 BIT — bit tags cannot be aggregated by Alarm Logging)
4. Confirm the tag is online by right-clicking the tag and selecting Update. The Value column must show the current WORD value from the PLC. If it shows "—" the address is wrong and the Alarm Logging trigger will never fire.
5. Open Alarm Logging from the WinCC Explorer data window. Right-click the message class that owns the discrete alarms (for example Error) and choose New Message, or open the existing message that must be triggered.
6. In the message Properties dialog, switch to the Trigger tab. Under Trigger tag select the WORD tag just created. The Bit column becomes editable; enter the bit position that this discrete alarm must monitor (0 to 15). The alarm fires on the configured edge (rising by default; configurable under Trigger > Edge).
7. Repeat step 6 for every discrete alarm in the WORD, using a different bit number for each. 16 alarms fit in a single WORD, 32 in a single DWORD.
8. Save, regenerate the runtime, and start WinCC Runtime in test mode to verify.

Word Layout, Bit Numbering, and Endianness

WinCC inherits the byte order of the underlying channel driver. The S7 channel returns the WORD value in big-endian byte order from the PLC, but the bit numbering within a byte is the same little-endian convention used by STEP 7 ladder logic (bit 0 = LSB of the low byte). For an S7-1500 the byte order can be reversed using the Byte order property of the tag — keep this property at Little-endian unless the controller has been explicitly programmed in big-endian mode.

Multi-Word Trigger for Large Alarm Populations

Plants that exceed the 16 alarms-per-word capacity bundle several consecutive words into a structured DWORD or use a status word per slave (one WORD per remote I/O station, for example). The Alarm Logging engine supports any combination of trigger tags; only the address mapping needs to be consistent between WinCC and STEP 7. A typical layout for 128 discrete alarms uses 8 consecutive DBW addresses mapped as 8 separate WORD tags, each configured with bits 0 to 15:

Each tag occupies only one licensed WinCC power tag regardless of how many bits within it are used, so 128 alarms consume 8 power tags instead of 128.

Equivalent Mechanism in WinCC Professional / TIA Portal

When projects migrate from WinCC v6/v7 to WinCC Professional (TIA Portal), the same WORD-as-trigger concept is preserved and expanded. WinCC Professional introduces the concept of a Status tag that holds 2 bits per alarm (incoming edge plus acknowledged state) for up to 16 alarms per word. The bit assignment is documented in the Siemens TIA Portal help for RT Professional:

• Bit 0 of alarm 1: incoming (1 = alarm present, 0 = gone)
• Bit 1 of alarm 1: acknowledged (1 = acknowledged, 0 = unacknowledged)
• Bit 2 of alarm 2: incoming
• Bit 3 of alarm 2: acknowledged
• ...
• Bit 30 of alarm 16: incoming
• Bit 31 of alarm 16: acknowledged

Bit 0 is the LSB of the status DWORD. The same scheme is used by legacy WinCC v7 when the message is configured with the Acknowledgement tab populated. Reference: Bit assignment of status tag (RT Professional).

Third-Party HMI Comparison

Engineers porting the same alarm concept to other HMI platforms will find the WORD-with-bit-selection pattern is universal across vendors:

Verification and Commissioning

After the configuration is saved, run the following verification sequence before the runtime is handed over to operations:

1. Tag read test. In WinCC Explorer, select the WORD tag and click Update. The current decimal value of the WORD must match the value visible in STEP 7 online watch on the same DBW address. If the values differ by a factor of 256, the byte order has been reversed.
2. Single-bit forcing. From STEP 7, force bit 0 of the WORD to 1 (using a SET instruction on DB100.DBX 50.0 or by toggling the bit in a VAT table). The corresponding message must appear in the Alarm Logging runtime window within one polling cycle of the S7 channel (default 1 s, configurable in the channel diagnostic settings).
3. Bit-by-bit walk-through. Repeat step 2 for every bit used in the project, logging the message number, the user text and the time stamp. Keep the log in the project folder as part of the Site Acceptance Test (SAT) documentation.
4. Acknowledgement path. For alarms with the With acknowledgement property set, force both the trigger bit and the acknowledgement bit to 1 and verify that the alarm goes from "incoming" to "acknowledged" and finally to "gone" in the Alarm Logging runtime.
5. Negative test. Force the trigger bit to 0. The alarm must move to the "gone" state. If the alarm remains stuck in "incoming" or "acknowledged", the edge configuration in the message properties has been set to Both edges or the message is configured as Flank-triggered incorrectly.
6. License verification. Open WinCC Explorer > Tools > License Management and confirm the licensed tag count covers all WORD and DWORD trigger tags used by Alarm Logging. Each WORD consumes one power tag from the RT license, regardless of how many bits are referenced.

Troubleshooting Matrix

Performance and Licensing Notes

Using one WORD trigger tag for 16 alarms reduces the S7 communication load by a factor of 16 compared to 16 individual BIT tags. The S7 channel performs one PDU read per tag per cycle, so bundling bits into WORDs halves or quarters the number of read requests to the controller, which on large plants with 500 or more alarms is the difference between a responsive HMI and a system that times out during picture change. The WinCC tag license model also favours WORDs: one licensed power tag covers up to 16 alarms in Alarm Logging.

The trade-off is that the trigger becomes level-sensitive rather than edge-sensitive unless the controller sets the bit only on a state change (typical for S7 FP / FN positive/negative edge detection). For level-sensitive alarms that need acknowledgement, prefer the WinCC TIA Portal status tag mechanism, which uses two bits per alarm to track both state and acknowledgement.

Where a project has a large alarm population distributed across many PLCs, distribute the WORDs by area: one WORD per cabinet, one per process cell, one per safety zone. This keeps the read-cycle time of each connection short and isolates communication faults to one area of the plant.

FAQ