Fixing PLC Address Errors on S7-1200 HMI Tags in TIA Portal V13

Problem Description: PLC Address Error on HMI Tags

When working with a Siemens S7-1200 CPU (firmware V4.x in the V13 environment) connected to a SIMATIC MP277 HMI panel running WinCC flexible 2008 SP5 or a TIA-converted runtime, engineers frequently encounter PLC address errors raised against individual HMI tags during runtime. The symptom typically appears as a system message on the panel, such as:

• Tag status: Address error — connection: HMI_Connection_1, tag: Tag_DB10_RealPart
• Tag status: Quality code BAD — tag not updated from PLC
• PLC tag invalid or address not present in S7-1200

The failure pattern is asymmetric: a working system is recompiled or partially re-tagged, and only some HMI tags begin reporting address errors. Tags inside a Data Block (DB) and tags mapped to absolute I/O addresses fail in different ratios depending on whether symbolic or absolute addressing is enabled on the PLC side. The panel remains online, the HMI connection itself is healthy (no connection-loss system message), and operator screens continue to update for the tags that still resolve.

Affected Versions and System Topology

Root Cause Analysis

The PLC address error almost always traces to one of four root causes when the underlying connection is healthy:

1. Stale HMI tag database after partial reconfiguration. TIA V13 maintains a separate tag cache for the HMI device and a separate cache for the PLC. When a PLC tag is renamed, moved, or its DB optimized/un-optimized setting is toggled, the HMI tag pointer becomes orphaned. Recompiling only one side does not invalidate the cached pointer on the other.
2. Optimized vs. standard DB access mismatch. In TIA Portal V13, a Data Block has the property "Optimized block access". When this option is enabled (default for S7-1200 V4.x), tags can only be reached symbolically. If the HMI is still bound to an absolute offset (e.g., DB10.DBD0), the panel issues an address error because the offset no longer matches the compiler's internal layout. The S7-1200 system manual explicitly states that symbolic-only optimized access is the default for new DBs.
3. Symbolic tag name re-resolution failure. When the PLC tag name in the HMI connection differs from the current PLC project — even by case (TIA V13 is case-sensitive for symbolic tags) or by a single renamed element — the HMI tag cannot be bound and the runtime raises an address error.
4. Recipe / HMI tag retention versus PLC download. A new PLC download that does not overwrite the HMI's tag table leaves the panel holding the old tag set. After the PLC initializes a new DB structure, the panel's cached tag list points at addresses that no longer exist. The "overwrite" option during HMI download is the canonical fix.

Diagnostic Procedure

Use this ordered sequence to isolate the failure. Do not skip steps; the order is the cheapest path to root cause.

1. Confirm the connection is healthy. On the MP277, open System > Information > Connections and verify the S7-1200 connection status shows Online, not Faulted or Disconnected. If the connection is faulted, the problem is network/TSAP-related and the tag-error symptom is secondary.
2. Filter the failing tag list. In TIA Portal, open the HMI device > HMI tags table and sort by the Status column. Failed tags will show a red icon; healthy tags show green. Capture the exact tag names, PLC tag references, and connection name for the red set.
3. Cross-reference the PLC side. Open the S7-1200 project > PLC tags and Program blocks > Data blocks. For every failing HMI tag, verify the referenced PLC tag still exists, has the same data type, and is in a DB that has been compiled and downloaded.
4. Check DB block access optimization. Right-click the DB > Properties > Attributes. Note whether Optimized block access is enabled. If it is, the HMI tag must use a symbolic reference, never an absolute offset like DB10.DBX0.0 or DB10.DBD4.
5. Validate the tag update ID. In the HMI tag properties, confirm the Acquisition mode is set to Cyclic in operation or Cyclic continuous, not On demand, if the tag must update on a scheduled basis. The default for S7-1200 is 1 s cycle.
6. Compare compiled tag list to runtime tag list. On the MP277, use Project > Transfer > Tag simulation (if licensed) to read live tag values. A tag that reports Quality = BAD in simulation confirms the address error, not a wiring or process issue.

Solution 1 — Overwrite Download to the HMI

The single most effective fix in the TIA V13 + MP277 environment is to perform an overwrite download of the HMI configuration. This replaces the panel's tag cache, screen definitions, and recipe data with the current engineering data.

1. In TIA Portal V13, select the HMI device in the project tree.
2. Right-click and choose Download to device > Software (all).
3. If the panel is in transfer mode, the download proceeds; if not, manually set the MP277 to transfer mode via the system menu.
4. Wait for the panel to reboot and the runtime to come up. The PLC address error system message should clear on the next tag acquisition cycle (default 1 s).

Solution 2 — Factory Reset of the S7-1200 and Re-download

When overwrite download does not clear the error, or when a firmware/Download mismatch has corrupted the S7-1200's tag database, perform a factory reset on the CPU before re-downloading the program.

1. Online > select the S7-1200 CPU > Online & diagnostics.
2. From the diagnostics tree, choose Functions > Reset to factory settings.
3. Confirm the Delete IP address and Reset PLC to factory settings options. The CPU enters STOP and clears all program, data, and tag definitions.
4. Cycle power to the CPU if the web server or display does not release.
5. Re-download the STEP 7 project (program blocks, PLC tags, DBs, and connection configuration).
6. Immediately follow with a TIA HMI download using the overwrite all option (Solution 1).

The factory reset is necessary when a previous download left the CPU in a state where a partial re-tag has been cached in the PLC's tag descriptor area (SZL list) but the program blocks reference a newer descriptor. The mismatch persists through a normal download and is only cleared by a full reset.

Solution 3 — Re-validate Symbolic HMI Tags

When tags were originally created with symbolic addressing but a DB was later rebuilt, the symbolic link is broken. The fix is to refresh the symbolic mapping.

1. Open the HMI tag that is failing in the HMI tag editor.
2. In the Connection field, verify the S7-1200 connection is selected (e.g., HMI_Connection_1).
3. In the PLC tag field, click the browse button and re-select the tag from the PLC's current symbol table. Do not type the name — re-select from the picker to ensure the underlying internal ID is rebuilt.
4. Compile the HMI project only (Compile > Software (rebuild all)).
5. Download to the panel with Overwrite all enabled.

DB and Optimized Access Considerations

The "Accessible from HMI/OPC UA" attribute on a DB tag must be set for the HMI to read the tag even when symbolic addressing is configured. If this attribute is cleared, TIA V13 will compile the HMI without error but the runtime will report an address error because the symbol is not exported across the S7 communication boundary. Set it via the DB tag's properties > Attributes > Accessible from HMI/OPC UA.

Verification Steps

After applying any of the three solutions, validate the system before declaring it healthy.

1. On the MP277, navigate to System > Information > Tag status. The previously failing tags should now show Quality = GOOD.
2. Force a value change in the PLC (e.g., toggle a bit or write a value via the watch table) and confirm the change appears on the HMI within one acquisition cycle.
3. Open the HMI tag log buffer; the PLC address error system message must no longer be present in the recent log.
4. Cycle power to the MP277 to confirm the tag list is stored persistently and recovers on cold start.
5. Run the HMI project in the TIA V13 simulator (RT) and confirm the same tags report GOOD quality on the simulator — this separates panel-hardware issues from project-configuration issues.

Preventive Measures

• Always set Accessible from HMI/OPC UA on every DB tag at creation time; this prevents silent symbol loss when the DB is recompiled.
• Decide once whether the project uses optimized or standard DB access. Mixing the two within a single project is a leading source of address errors after DB refactoring.
• Use the project-level setting Compile > Software (rebuild all) rather than incremental compile when DB structures change. Incremental compile does not always refresh the HMI tag table.
• Maintain a TIA Portal V13 SP1 Update 9 (or later) installation. V13 RTM through Update 4 had known cache invalidation bugs that were fixed in subsequent updates.
• After every PLC download, perform a corresponding HMI download with the overwrite all flag set, even if no HMI tag changed — the cost is one extra download and the benefit is consistency between the two project halves.

Troubleshooting Matrix

Related Configuration References

• S7-1200 Programmable Controller — System Manual, section on Block attributes and optimized access.
• WinCC flexible 2008 SP5 — User Manual, section on Tag connection and quality codes.
• TIA Portal V13 SP1 — Online Help, topic Compiling and downloading HMI tags.
• SIMATIC MP277 — Operating Instructions, section on Transfer mode and overwrite behavior.
• S7-1200 Communication — Function Manual, section on OPC/HMI visibility of DB tags.

FAQ