Diagnosing WinCC Cross Reference CScript Function Call Issues

Overview

Siemens WinCC Cross Reference is the central usage-tracing tool inside the WinCC Explorer and the TIA Portal engineering environments. It indexes tag, picture, CScript standard function, CScript project function, and faceplate references so engineers can answer two questions during commissioning, refactoring, and validation:

• Where used — which other project objects consume a selected object?
• What used — which external objects does a selected object consume?

Beginning with WinCC V7.5 SP2, the Cross Reference GUI correctly resolves tag and PDL picture references inside CScript bodies as long as the source includes the standard header APDIALOG.h. The tool, however, does not index calls to CScript standard or project functions from within other CScripts or from picture event handlers in V7.5 SP2. This article documents the exact reproduction, root cause, V7.5 workarounds, and the V8.1 native solution that resolves the limitation through the new text-based Project Search engine.

Problem Symptoms

The defect manifests under the following configuration:

1. A project contains at least one project function (file *.fct) that calls two standard functions.
2. A start picture contains a button whose OnClick event calls the project function and the two standard functions directly.
3. The Cross Reference tool is opened with one of the called functions selected as the object filter.

Observed behavior on WinCC V7.5 SP2 Update 16:

• Tag references inside the CScripts are indexed correctly because the standard header #include "APDIALOG.h" is present.
• Picture references inside the CScripts are indexed correctly.
• Cross Reference shows zero usage for the project function called from another project function (function-to-function chain).
• Cross Reference shows zero usage for standard functions called from the picture OnClick event handler.
• The expected user result — a list of every script and picture invoking the selected function — is missing.

The same project opened in WinCC V8.1 returns at least two usage entries for each called function: the picture event handler and the calling project function.

Root Cause Analysis

The Cross Reference engine in WinCC V7.5 SP2 performs a token-based parse of compiled project artifacts. Its parser recognizes three classes of objects during the compile step:

The V7.5 SP2 indexer does not emit tokens for FunctionCall opcodes emitted by the CScript compiler. It only emits tokens for tag accesses (GetTag, SetTag) and picture references that survive through the APDIALOG.h macro layer. V8.1 introduces a text-based project search engine that scans the CScript source text and updates the Cross Reference database, which is why the same picture shows the call sites correctly in V8.1.

Verification Procedure

To reproduce the issue deterministically on an engineering station:

1. Open WinCC Explorer with a WinCC V7.5 SP2 Update 16 project.
2. Create a new project function PF_Demo() in the project function tree.
3. Insert two calls inside PF_Demo(): #include "APDIALOG.h" void PF_Demo() { SF_StandardOne(); // standard function call SF_StandardTwo(); // standard function call }
4. Add a button to the start picture and bind the OnClick event to: #include "APDIALOG.h" void OnClick(char* lpszPictureName, char* lpszObjectName) { PF_Demo(); SF_StandardOne(); SF_StandardTwo(); }
5. Compile the project (Project → Compile or right-click → Compile).
6. Open the Cross Reference tool (Tools → Cross Reference).
7. Select Project functions from the left-hand object tree.
8. Tick PF_Demo and the two standard functions.
9. Inspect the right-hand usage pane. The pane will be empty even though the project compiled without warnings.

The same procedure executed on WinCC V8.1 returns at least two usage entries per function (the project-function caller and the picture OnClick event).

Workarounds for WinCC V7.5 SP2

Three field-proven workarounds restore function-level traceability without migrating to V8.1.

Workaround A — Project-wide text search

Use the Windows command-line search inside the project folder to enumerate every file referencing a function name:

findstr /S /I /M "PF_Demo" "C:\Projects\MyWinCC\*.c" "C:\Projects\MyWinCC\*.pas"

This produces a flat list of files but loses script context. Pair the output with the call-site location reported in the script editor's Find All References (Ctrl+Shift+F) to recover line and column information.

Workaround B — Manual call-site matrix

Maintain a function-call matrix in a project documentation spreadsheet. The matrix lists, for every CScript function, the parent function or picture event that invokes it. Update the matrix in the same change-set as the source files. Treat the matrix as a peer artifact of the CScript source under source control.

Workaround C — Wrapper macro pattern

Wrap every project function call inside a no-op tag access. The wrapper forces the V7.5 indexer to emit a token because tag accesses are indexed:

The wrapper consumes one bit tag per call site. Cross Reference then surfaces the __CallTrace_* tag, which engineers can grep back to its declaring script using the standard tag cross-reference lookup.

V8.1 Native Solution

WinCC V8.1 ships with a Project Search engine that scans the full project source text and updates the Cross Reference database. The engine is enabled by default; engineers invoke it through:

1. Menu Tools → Project Search or the keyboard shortcut Ctrl+Shift+F.
2. Enter the function name in the search field.
3. Set scope to All project objects.
4. Set object filter to CScripts + Pictures.
5. Execute the search.

Project Search returns every match with line, column, file, and containing function or picture. The same index feeds the V8.1 Cross Reference GUI: when you select a project or standard CScript function and switch to the Usage tab, the pane now lists call sites inside other CScripts and inside picture events.

Configuration parameters

Configuring the Cross Reference Tool

Open the tool from Tools → Cross Reference. The dialog has two panes:

• Object tree (left): hierarchy of tags, pictures, CScript standard functions, CScript project functions, and library objects.
• Usage pane (right): filtered list of consuming objects with file path, line, and column.

Object-class filters are independent. Enable a filter to widen the search; disable a filter to narrow it. The V8.1 GUI adds a fifth filter named CScript calls which is the toggle that exposes function-to-function call sites. In V7.5 SP2 the toggle is absent.

State machine for index rebuild

V7.5 to V8.1 Migration Considerations

WinCC V8.1 is a forward-compatible drop-in upgrade for V7.5 SP2 projects. Migration steps:

1. Take a complete project backup using the WinCC Project Duplicator.
2. Open the V7.5 SP2 project in the V8.1 engineering station.
3. Run Project → Migrate — the tool converts the project database and rebuilds the CScript compiler cache.
4. Compile the project end-to-end. Resolve any V8.1 deprecation warnings (obsolete CScript APIs are removed).
5. Open the Project Search index and verify that the project function count matches the migration report.
6. Re-run the Cross Reference check from the verification procedure above; the result pane must now contain at least two entries per called function.

Comparison Matrix — WinCC Versions

Cross Reference Inside TIA Portal

TIA Portal V18 and later expose an equivalent Cross-references editor under Project tree → Common data → Cross-references. The TIA editor filters by criteria such as object type, address area, and access mode. For WinCC Unified panels the cross-reference information mirrors the TIA Portal editor rather than the legacy WinCC Explorer dialog. See the TIA Portal V21 cross-references documentation for the unified-panel workflow, including filter combinations and offline/online index behavior.

Troubleshooting Matrix

Field-Proven Validation Checklist

• Standard header APDIALOG.h present in every CScript that accesses tags.
• Project compiles end-to-end without CScript errors or warnings.
• Cross Reference tool opened from Tools menu (not shortcut).
• Correct object class filter enabled (Tags, Pictures, Project functions, Standard functions, CScript calls).
• V8.1 only: Project Search index status reported as Ready.
• Selected function shows at least one usage entry when called from a picture or another script.
• Migration report archived with the project backup.
• Wrapper-macro debug tags removed before production runtime build.

Commissioning Notes

During factory acceptance tests (FAT), engineers typically validate that every CScript function has at least one expected call site before locking the project for shipment. With V7.5 SP2 this validation must be done manually via grep or via the Workaround B spreadsheet. With V8.1 the validation can be automated: open the Cross Reference GUI on every function in turn and export the usage tab to CSV. A function whose usage CSV is empty is a candidate for dead-code removal.

For large projects with more than 500 CScript functions, automate the validation with a WinCC V8.1 ODK script that iterates over the Cross Reference database and writes a markdown report at the project root. The ODK interface exposes IRuntimeProject::GetCrossReferences for read-only enumeration.

Safety Considerations

CScript function-call tracing is a design-time feature. Do not enable wrappers such as Workaround C on production panels. Tag writes triggered by wrappers can pollute the tag logging database, fire archive events, and in safety-relevant contexts, trigger unexpected acknowledgements on alarm lines. Remove all wrapper macros before generating the runtime file and re-run the verification procedure to confirm the index is still functional.

FAQ