Finding SFC/SFB Usage in TIA Portal: Cross-Reference Workarounds

Problem Overview

Engineers working on S7-1200 and S7-1500 CPUs in TIA Portal routinely need to locate every call to a specific System Function (SFC) or System Function Block (SFB) inside a project. The classic use case is receiving an inherited, partially documented program — often commented in a foreign language — and needing to locate, for example, every DataLogCreate_SFB, DPRD_DAT, BLKMOV, or TSEND_C instance without opening every FB, FC, and OB individually. Cross-reference, which is the primary navigation tool in STEP 7 Classic and in TIA Portal, returns no results for these instructions.

The behavior is not a bug. It is a deliberate modeling decision inside the TIA Portal data model, and recognizing the underlying cause makes the available workarounds faster and more deterministic.

Root Cause: Why SFC/SFB Calls Disappear from Cross-Reference

In STEP 7 Classic, SFCs and SFBs lived as separate objects in the S7 program container. The S7-300/S7-400 cross-reference engine could index them because each call referred to a numbered object (SFC 20, SFB 52, etc.) that the engineering database recognized as a typed instance.

In TIA Portal, the data model changed. As Siemens' own functional documentation describes, the instructions visible on the task card are functions (FC), function blocks (FB), system functions (SFC) and system function blocks (SFB) — but SFCs and SFBs are modeled as direct calls to firmware functions, not as engineering objects in the project tree. See the symbolic/numerical mapping reference at the Siemens documentation portal: Symbolic and numerical names of instructions (S7-1200) - TIA Portal V20.

Consequences of this model:

• No project node exists for an SFC or SFB under Program blocks. They live under Program resources > System blocks as types, not as instances.
• Cross-reference indexes the call site but cannot resolve the call to an engineering object the way it does for FBs.
• Global search across the project for the symbolic name (e.g., "TSEND_C") does not match the instruction symbol unless the name also appears in a string the indexer can read.
• Usage lists, call structure, and assignment lists treat SFC/SFB calls as anonymous operations.

Search Method Comparison

Solution 1 — Program Resources Reference List (Recommended)

This is the fastest deterministic method when you know which SFC/SFB you want to audit. It is the approach Siemens support engineers typically recommend when the global-search limitation is reported.

1. Open the Project tree in TIA Portal.
2. Expand Program resources under the target CPU (for example, PLC_1 > Program resources > System blocks).
3. Locate the SFC or SFB of interest. Examples commonly encountered in data logging, communication, and motion projects:

4. Select the SFC/SFB node (single click).
5. Press Shift+F11 (Go to Reference List). TIA Portal opens a results pane listing every program block that references the selected firmware function.
6. Double-click any hit to jump to the calling network.

Solution 2 — Global Text Search on Network Comments

The second-most-reliable method works only when the original programmer added the symbolic name of the SFC/SFB to a network comment. For inherited code this is often missing. Use it as both a search tool and a forward-looking habit.

1. In the editor, open any block — typically OB1 or a frequently-called FB.
2. From the menu bar, choose Edit > Find and Replace or press Ctrl+F.
3. Switch the scope to All blocks in project (the dropdown in the search bar).
4. Enter the symbolic name, for example TSEND_C. TIA Portal V14 and later will scan network titles, network comments, and block comments.
5. Use Find next / Find all to enumerate hits.

Best-practice discipline going forward: every time you drop an SFC/SFB call, add the symbolic name as the first line of the network comment:

Then a future engineer (or yourself in two years) can find the call site via Ctrl+F with project-wide scope.

Solution 3 — Programmatic / Bulk Approach via Export and grep

For very large or legacy projects where the comment discipline is unknown, export the program and search the source.

1. In the project tree, right-click the PLC and choose Export > Export PLC to TIA Portal project archive. Or use Export > Export program sources if SCL/STL sources were saved separately.
2. Extract the resulting .zap20 (TIA V20) or .zap17 archive. The archive is a zip-compressed file with XML inside.
3. Recursively grep the extracted XML for the symbolic name. From a Linux shell or PowerShell:

4. Each hit is an XML file representing a block. Open the file in TIA Portal via Project tree > Program blocks > right-click > Open to land at the block, then visually scan networks for the call.

Solution 4 — Online Reference List via PLCSIM or Live CPU

When the project is online with the CPU (or with PLCSIM Advanced), an additional path exists.

1. Establish an online connection to the target device.
2. Open Online & diagnostics > Call environment on the CPU.
3. Inspect the online block stack to confirm which SFCs/SFBs the CPU is currently executing. This is runtime evidence, not a project-tree enumeration, but is invaluable for debugging a hung SFC call.

For S7-1500 specifically, the Online > Traces recording can be armed against system-side tags that the SFC updates (for example, DataLogCreate_SFB writes RET_VAL and status outputs). Tracing those tags in time-stamped captures localizes the executing call without scanning project blocks.

Solution 5 — A Useful "Tag Trick" for Future Projects

A pragmatic workaround used by maintenance engineers when a project lacks comments: add a placeholder tag whose name matches the SFC/SFB symbolic name, drop it on a network adjacent to (or inside) the call. The tag is unused electrically — it can drive nothing — but the project-wide tag search will then find the block.

1. In the PLC tags table, add a tag such as find_TSEND_C of type Bool with a comment "Locate TSEND_C calls."
2. In each block suspected of using TSEND_C, insert an empty network and place the tag in an N.O. contact — or wire it to a M bit whose only purpose is to be search-able.
3. Use Go to tag usage (right-click tag, or Ctrl+Q) to list every block containing the placeholder, which is exactly the list of candidate TSEND_C call sites.

This is a workaround, not a feature. Use it on inherited code you are about to refactor heavily. Do not leave it in production code as documented structure; it pollutes the tag namespace.

Catalog Browse vs Usage Search — A Critical Distinction

A frequent source of confusion is that the right-side task card in the program editor does list SFCs/SFBs and lets you insert them — but the list is a catalog, not a project-wide usage index. Typing Ad or Cal in an empty box browses the catalog and lets you drop a new ADD or calculation block. It does not find existing uses in your project. This was the root of the original question's apparent conflict: the catalog search is for insertion, the project search tools are for location.

Catalog favorites in TIA Portal are organized under Instructions > Basic > Extended > Technology > Communication > Ident. The categorization differs from STEP 7 Classic, where SFC/SFB numbers were the primary grouping. New users expect SFC/SFB to live under their own folder; in TIA Portal they are scattered under Basic Instructions (timers, counters, math, move) and Extended Instructions (date/time, string, communication).

Difference Between S7-300/400 and S7-1200/1500 Naming

The naming table inside the Siemens documentation referenced above maps every symbolic instruction back to its numerical SFC/SFB equivalent for users migrating from STEP 7 Classic. Use that mapping when reverse-engineering older code.

Verification Procedure After Locating the Call Sites

1. For each located block, right-click the SFC/SFB box and select Go to > Cross-reference. This will at minimum confirm the wiring around the call (inputs, outputs, instance DB if any).
2. Compile the project (Compile > Software (rebuild all blocks)) and confirm no errors related to unresolved symbols appear.
3. Download to PLCSIM or the target CPU and run for one scan cycle, watching the ENO bit and RET_VAL of each located SFC/SFB to confirm the firmware call is reachable from the OB cycle.
4. Document the found call sites in a project-level comment on the system block entry under Program resources so future audits do not require re-running this procedure.

Troubleshooting Matrix

Forward-Looking Project Discipline

The root cause is structural; the cure is documentation discipline. Three habits prevent the next engineer from asking the same question:

• Always add the symbolic name as the first line of the network comment when placing an SFC/SFB.
• Create a project-level Documentation DB containing one row per SFC/SFB used, with columns: name, purpose, all call-site block names, owner. Reference this DB from the network comment.
• Run Solution 3 (XML grep on archive) at each project milestone to keep a current usage index in your CM tool. Treat it as a build artifact.

FAQ