Overview
Engineers commissioning SIMATIC S7-1500 controllers against Comfort Panels, MTP unified panels, or Panel PCs running WinCC Runtime (TIA Portal V13 SP1 Update 9) frequently observe a transient "Address error" entry in the HMI system event log the first time the runtime is started, followed by "Error status ended" the moment any screen or faceplate that references a newly added tag is opened. The PLC remains in RUN, the address is valid, and the tag is wired correctly in the HMI tag table. The condition self-heals and never reappears on a warm restart, which is precisely what makes managers uncomfortable: the log shows a fault that is, technically, not a fault at all.
This article isolates the root cause to a tag-quality-of-service (QoS) timing race between WinCC Runtime startup and the first S7 connection acquisition cycle. It documents the diagnostic steps that confirm the diagnosis, the configuration parameters that suppress the cosmetic error, the project-hygiene practices that prevent recurrence after HMI re-downloads, and the verification steps that prove the fix on the bench or on the plant floor.
Problem Description and Symptoms
Observed at a multi-CPU, multi-panel site with S7-1500 CPUs (typical firmware V1.7 to V2.0) and SIMATIC HMI panels running WinCC Runtime Advanced or Professional under TIA Portal V13 SP1 Update 9. Symptoms are:
- On a cold HMI boot (or after a full project re-download to the panel), the WinCC system diagnostics viewer logs one "Address error" event per tag that was recently added to the HMI tag table — typically the last 1–2 dozen tags created or modified since the last compile.
- As soon as an operator opens any screen, popup, or faceplate that references one of the affected tags, the HMI quality code for that tag transitions from "Address error" to "Good", and the system event log records "Error status ended" for that tag.
- The error only appears at first run. After the first screen has touched every new tag, subsequent HMI restarts show no address errors at all — until the next batch of new tags is added.
- The condition reproduces when only the HMI is rebooted; the PLC has been in RUN for weeks. It also reproduces immediately after a delta download of a changed HMI project to a running panel.
- The PLC and the HMI confirm a valid S7 connection — connection diagnostics in TIA Portal show "Connected", the partner is reachable over PROFINET, and the CPU is in RUN with no diagnostic buffer entries.
None of the affected tag addresses are out of range, mis-typed, or pointing to an unconfigured DB. Verifying the address in the PLC tag table shows a 1:1 match with the HMI tag configuration.
Root Cause Analysis
The root cause is a deterministic startup race between three independent sequences:
- WinCC Runtime startup: The HMI runtime boots, loads the project, opens the S7 connection, and begins its acquisition dispatcher. The dispatcher is configured to poll tags on a fixed cycle (the "Update" property of each tag) but does not retroactively poll tags that were added to the project since the last cold start of the runtime.
- S7 connection establishment: The S7-1500 accepts the partner connection request, the CPU's communication resources are allocated, and the first read/write requests complete. On a panel restart with a PLC already in RUN, this sequence is short (typically < 2 s) but is not instantaneous.
- Tag cache initialization in WinCC: Internal tag buffers are populated lazily — the runtime stamps a tag with quality code "Bad - Address error" if its first read returns no data, and only repaints the quality code to "Good" on the next successful acquisition tick.
Newly added tags are particularly exposed because the runtime's dispatcher initializes the quality code at compile time as "Bad" until the first cycle of the update task has actually fetched the value. Tags that have been read at least once on a previous boot retain a "Good" quality code through the restart — they are warm in the cache, so to speak — which is why only the most recent additions show the symptom. This is also why the same symptom reappears after a delta download that re-touched the HMI tag table: the download invalidates the cached quality codes for the changed tag set.
Industry Online Support documents the same behavior class for WinCC V13 SP1 and V14 under FAQ entry ID 109751706 ("Why are address errors displayed briefly when starting WinCC Runtime?"). The vendor guidance is to either configure a valid start value on the tag, accept the transient event and filter it from the operator-facing system log, or change the acquisition mode so that tags are read before the first screen loads.
Diagnostic Procedure
Before changing any configuration, confirm the diagnosis with the following sequence. Each step rules out a more serious failure mode.
- Confirm the PLC is in RUN: Open the S7-1500 web server (default https://<cpu-ip>) and verify the operating state. A PLC that is still in STOP or in startup will leave HMI tags genuinely unreadable and the address error will be real, not cosmetic.
- Confirm the S7 connection is online: In TIA Portal, go to Online > Online & Diagnostics > Connections on the HMI device. The active connection to the CPU should show status "Connected" and the partner should be the correct S7-1500. If the connection is "Disconnected" or "Fault", stop and troubleshoot the network and the connection resource count on the CPU (S7-1500 supports a maximum of 32 simultaneous PG/HMI/OPC/Web connections — see the S7-1500 system manual, section on communication resources).
- Read the system event log on the HMI: In WinCC Runtime, open System Events / Diagnostic Overview. Record the time of the first address error, the tag name, the connection name, and the time of the corresponding "Error status ended" event. The interval between the two is the acquisition cycle. If the interval equals the configured update cycle, the diagnosis is confirmed.
- Use the HMI tag simulator or trace: In TIA Portal, enable a tag trace on one of the affected tags with a logging interval equal to the update cycle. Watch the quality code transition from "Bad - Address error" to "Good" on the first successful read.
-
Cross-check the address in the PLC: Right-click the HMI tag, choose "Go to connection", and confirm the absolute address (e.g.,
%DB42.DBX0.0for a Bool,%DB42.DBD4for a Real). Cross-reference in the S7-1500's PLC tag table or data block. The address must match byte-for-byte. Schneider Electric documents a parallel root cause — connection errors after a Unity Pro download caused by firmware incompatibility — and the same diagnostic principle applies: verify the connection, then verify the address (Schneider Electric FAQ FA234272). - Check the HMI tag acquisition mode: If the tag is set to "On demand", it is intentionally unread until a screen requests it. Change to "Cyclic in operation" or "Cyclic continuous" to force a startup read.
Solution A — Configure a Start Value on the Tag
The cleanest fix. A start value is a constant the HMI displays (and uses internally for calculations) until the first successful read from the PLC overwrites it. With a start value set, the tag never enters the "Bad" quality state because there is always a valid value in the tag buffer.
- In the TIA Portal project tree, open HMI Tags and select the affected tag.
- In the Inspector window, go to the Properties > Settings tab.
- Expand the Value group and enter a Start value appropriate for the data type:
- Bool:
0 - Int / DInt:
0 - Real:
0.0 - String: empty string
"" - WString: empty string
""
- Bool:
- Compile the HMI project (delta or full) and download.
The tag now initializes to the start value at runtime boot, displays it on the first screen, and is overwritten by the PLC value within one update cycle. No "Address error" is logged because the tag never entered the Bad quality state.
Solution B — Change the Acquisition Mode
Tags set to "On demand" are intentionally not polled until a screen requests them. New tags added to a project default to "On demand" if the engineer does not explicitly change the property. For tags that are referenced from screens, scripts, or faceplates that may load at runtime startup, change the acquisition mode to force a read during the very first update tick.
| Acquisition mode | Behavior at runtime start | Effect on "Address error" | Typical use |
|---|---|---|---|
| Cyclic in operation | Polled continuously while the screen containing the tag is the active screen | Suppresses error while the screen is active; can still appear on cold start if the home screen is not the one that contains the tag | Operator-visible process values on the current screen |
| Cyclic continuous | Polled continuously regardless of which screen is active | Suppresses the error from cold start; first read completes before the home screen is fully drawn | Background values, alarms, archives, scheduler data |
| On demand | Polled only when a screen or script reads the tag | Causes the cold-start error if no screen has requested the tag yet | Rarely accessed values, large arrays loaded on demand |
| On change | Polled only when the PLC reports a value change (S7-1500 supports this with the appropriate protocol setting) | Suppresses the error by design; tag is read only on demand from the PLC | Slow-changing setpoints, mode bits |
Recommended change for any tag referenced at runtime startup: set Acquisition mode = Cyclic continuous with an update cycle of 1 s for process values, 500 ms for alarms, and 100 ms for fast control loops. The S7-1500 supports far more than 1 s of cycle precision in this mode; the cycle is enforced by the WinCC dispatcher, not the PLC.
Solution C — Configure the S7 Connection Properties
The S7 connection between the HMI and the S7-1500 must be configured so the HMI establishes the connection actively (the default) and the connection resource is reserved on the CPU side. Open Devices & Networks > Connections, select the HMI connection, and verify:
- Establish connection actively: set to true on the HMI partner. This is the default; do not disable it.
- Connection path: verify the interface (typically the HMI's PROFINET port) and the partner IP match the CPU's IP exactly. A common field error is the HMI pointing to a gateway IP or to a secondary PROFINET port on the CPU that is administratively down.
- Connection resource on the CPU: in the S7-1500 device configuration, open Properties > Communication and confirm the connection resource is set to "Display" or "Display and use". If a resource is set to "Block", the HMI cannot establish the S7 connection and a genuine address error will result — different from the cosmetic error described here.
- Maximum number of connections: the S7-1500 supports 32 PG/PC/HMI/OPC/Web connections in total. A panel that is sharing a CPU with multiple panels, a PG, an OPC UA server, and a web client can hit the limit silently. If you see persistent (not transient) address errors, this is the first place to look.
Solution D — Project Hygiene: Delta Compile and Full Recompile
Stale HMI runtime data on the panel's storage can mask the fix and reproduce the symptom on every restart until cleared. Siemens support recommends the following hygiene sequence whenever the HMI tag table has been edited significantly:
- Delta compile: right-click the HMI device in the project tree, choose Compile > Software (delta). This regenerates only the changed tag references and is the correct operation for routine edits.
- Full recompile (when the symptom persists): right-click the HMI device, choose Compile > Software (rebuild all). This regenerates the entire HMI runtime image, including the tag database, the screen database, and the connection table. It is slower but eliminates stale cross-references that a delta compile can miss.
- Clear runtime data before download: in the HMI download dialog, enable Overwrite target files and, for Comfort Panels and Panel PCs, optionally enable Delete HMI Data or Format internal storage. The data partition (where WinCC stores archives, logs, and the tag cache) must be cleared or the next runtime start will load the stale tag quality codes from the previous session.
- Recompile the PLC and the HMI together: when both the PLC program and the HMI project changed in the same engineering session, compile both before downloading. TIA Portal V13 SP1 does not always cross-check the PLC data block layout against the HMI tag references; an inconsistent build can leave the HMI pointing at addresses that the latest PLC compile has re-numbered.
Solution E — Filter the Cosmetic Event from the Operator Log
If the operations team cannot tolerate the entry at all (e.g., a regulated environment where every system event is audited), the cleanest solution is to filter the event class. The "Address error" event in WinCC Runtime is class "System"; "Error status ended" is class "System" with severity "Information". Both can be hidden in the system log without affecting real faults.
- On the HMI, in WinCC Explorer, open System Events.
- Filter the view by class System and search for Address error.
- Right-click the event, choose Acknowledge and Hide, or — for a permanent solution — add the event number to the suppression list in Project Settings > System Events.
- Verify the change in the runtime by restarting the HMI. The event will no longer be displayed, but it is still recorded internally for diagnostics; an engineer can re-enable the filter temporarily during commissioning.
Solution F — Delay the HMI Runtime Startup
For installations where the PLC and the HMI boot simultaneously (a common field case after a power failure on a non-UPS line), the race window widens. The runtime can be configured to wait for the S7 connection to be fully established before it begins polling tags:
- Open the HMI device configuration in TIA Portal.
- Navigate to Runtime Settings > Startup.
- Enable Wait for connection establishment and set the timeout to 30 s.
- Compile and download.
The runtime now blocks screen activation and tag polling until the S7 connection is up, eliminating the race entirely. The cost is a longer boot time on cold start (typically 2 to 5 s longer), which is acceptable for most operator panels.
Verification Procedure
After applying any of the solutions above, verify the fix with the following sequence. Each check has a clear pass criterion.
- Cold start, PLC in RUN: power-cycle the HMI only, leaving the PLC in RUN. Boot the runtime. In the system event log, confirm that no "Address error" event is recorded. The "Error status ended" event should also be absent (because the tag never entered the Bad state).
- Cold start, both powered simultaneously: power-cycle the panel and the PLC at the same time. Boot the runtime. The system event log may show a brief "Connection lost" / "Connection established" pair, but no per-tag address errors. Pass criterion: the number of "Address error" events in the log is zero.
- Delta download to a running panel: with the PLC and the panel in steady-state RUN, perform a delta download of the HMI project. Confirm in the system event log that the runtime does not log per-tag address errors during the reload.
- Add a new tag and restart: add a new HMI tag with a default acquisition mode of "On demand". Cold-start the HMI. The new tag will log an address error (because the default mode is "On demand"). Apply Solution B and verify that the same tag, after configuration, no longer logs the error on cold start.
- Connection-resource stress test: with all panels, the PG, and an OPC UA server connected, count the active S7 connections on the S7-1500 (via the web server's Communication > Connections page). Verify the total does not exceed 32. If it does, the address error becomes real rather than cosmetic and Solution C must be applied before any of the others.
Comparison of Solutions
| Solution | Effect on the symptom | Engineering cost | Risk | Recommended for |
|---|---|---|---|---|
| A — Start value on tag | Eliminates the cold-start error per tag | Low (per-tag property change) | None — the start value is overwritten by the PLC on the first read | All operator-visible process values |
| B — Acquisition mode | Eliminates the cold-start error per tag | Low (per-tag property change) | Increases network traffic if applied to many tags at sub-second cycles | Tags referenced at startup or in archives |
| C — Connection properties | Eliminates the error class for the whole panel | Medium (one-time, on every panel) | None if the connection was valid to begin with | All panels in a project |
| D — Project hygiene | Prevents stale-cache reproduction | Medium (compile and download) | None; required best practice | Every HMI download |
| E — Filter the event | Hides the cosmetic log entry | Low (one-time, on every panel) | Risk of hiding real events if filter is too broad | Regulated sites that require a clean operator log |
| F — Delay startup | Eliminates the race window | Low (one-time, on every panel) | Slightly longer cold-boot time | Installations with simultaneous PLC + HMI power-up |
Best practice is to apply Solutions A, B, C, and D together as a baseline, then add E or F only if the operations team specifically requires it. Solution A is the single most effective change because it removes the root condition (a tag buffer with no valid value) rather than suppressing the symptom.
Field-Proven Caveats and Edge Cases
- MTP and Unified Comfort Panels: on MTP1000/1200/1500/1900 panels running WinCC Unified, the same QoS timing race exists but is configured under HMI Tags > Properties > Quality Code Behavior rather than the V13 SP1 path. The fix logic is identical; only the menu path differs.
- Panel PC runtime: Panel PCs (SIMATIC IPC227G, IPC277G, IPC477G) running WinCC Runtime Advanced with a local S7-1500 connection may show the symptom more frequently because the local connection is much faster (sub-millisecond) and the runtime's dispatcher begins polling before the connection resource is fully bound. Solution F (delay startup) is particularly effective here.
- S7-1500 firmware < V1.7: older CPU firmware (V1.0, V1.1, V1.2) had known bugs in the communication stack that produced genuine address errors under specific timing conditions. Upgrade to at least V1.7 before applying the cosmetic fixes above. The release notes for the S7-1500 CPU firmware are published on the Siemens Industry Online Support portal (entry ID 109751706 and the firmware readme files).
- Time-of-day tags: the S7-1500's time-of-day (date_and_time) tags are sensitive to endianness and to the HMI's regional settings. An address error on a time tag may indicate a real format mismatch, not a QoS race. Inspect the HMI tag's data type and the PLC's DATE_AND_TIME declaration.
- Optimized DB access: S7-1500 data blocks default to "optimized" access, which means symbolic addressing only. HMI tags pointing to optimized DBs must use the symbolic name in the connection, not the absolute address. A misconfigured optimized-DB tag will produce a genuine address error, not a transient one.
- Multiple panels on one CPU: a single S7-1500 with 8+ HMI panels can saturate the connection resource count. The error will not be transient — it will be persistent for the panels that lost the resource race. Distribute panels across multiple S7-1500s or add an OPC UA server with multiplexing.
Related Configuration Parameters (Quick Reference)
| Parameter | Location in TIA Portal | Default | Recommended for this symptom |
|---|---|---|---|
| Start value | HMI Tag > Properties > Settings > Value | 0 / 0.0 / "" | Always set for any tag referenced at startup |
| Acquisition mode | HMI Tag > Properties > Settings > Acquisition | On demand | Cyclic continuous for startup-referenced tags |
| Update cycle | HMI Tag > Properties > Settings > Acquisition | 1 s | 1 s for process, 500 ms for alarms, 100 ms for control |
| Establish connection actively | Devices & Networks > HMI Connection > Properties | true (HMI side) | Keep true; do not disable |
| Wait for connection establishment | HMI Device > Runtime Settings > Startup | false | true with 30 s timeout for installations with simultaneous power-up |
| Connection resource | S7-1500 Device > Properties > Communication | Display and use | Display and use; never Block |
| Maximum S7 connections | S7-1500 Device > Properties > Communication | 32 | Count: PG + HMI + OPC + Web ≤ 32 |
Frequently Asked Questions
Why does the "Address error" only show on the first runtime start and not on subsequent restarts?
The WinCC Runtime initializes the quality code of each HMI tag to "Bad - Address error" at compile time and only updates it to "Good" on the first successful read from the PLC. After the first run has touched every tag, the runtime's internal tag cache holds a "Good" quality code for each, so subsequent restarts do not enter the Bad state. Newly added tags have never been read, so they enter the Bad state on the next cold start until the first screen that references them triggers a read.
Is "Error status ended" a second error or the resolution of the first one?
It is the resolution. WinCC Runtime logs "Error status ended" as an informational event the moment a tag's quality code transitions from any Bad state to Good. The pair "Address error" / "Error status ended" indicates the tag recovered successfully; it is not two faults. To hide the cosmetic entry from the operator log, filter the specific WinCC event ID (140001 for the address error, 140002 for the resolution) in the system event configuration.
Will setting a Start value on every tag cause the operator to see a stale value if the PLC fails to update?
No. The Start value is only the value the HMI holds in its tag buffer until the first successful read from the PLC. If the PLC stops updating (e.g., the S7 connection drops), the tag quality code transitions to Bad and the HMI displays the configured "Value on connection loss" property, not the Start value. The Start value is solely a cold-start placeholder.
Do I need to upgrade the S7-1500 firmware to fix this?
Not for the cosmetic QoS race described here — Solutions A through F resolve it on any S7-1500 firmware from V1.0 onward. However, S7-1500 firmware versions below V1.7 had known communication-stack bugs that can produce genuine (non-transient) address errors under specific timing conditions. If Solutions A through F do not eliminate the entry, upgrade the CPU firmware to the latest V1.7 or V2.x release and recompile the project.
How many HMI panels can one S7-1500 serve before the address error becomes real rather than cosmetic?
The S7-1500 supports 32 simultaneous PG/PC/HMI/OPC/Web connections. With one PG, one OPC UA server, one web client, and a typical mix of panels, the practical limit is 8 to 12 panels per CPU before the connection resource count becomes the binding constraint. When the count is exceeded, the error is persistent (not transient) and the fix is to add a second S7-1500 or to introduce an OPC UA multiplexer rather than to apply the QoS fixes above.
Does a delta compile always clear the issue, or is a full recompile required?
A delta compile is sufficient when the HMI tag table itself has not been edited — only the screen layout or the PLC program changed. A full recompile is required when the HMI tag table has been edited (tags added, removed, renamed, or their data types changed) and the panel still shows the cosmetic error after the delta download. The full recompile regenerates the tag database image that the runtime loads on boot, which is what clears the stale quality codes.