Preserving PCS7 V8.1 Tag Values During Full Download After V6.1

Problem Overview

After migrating a SIMATIC PCS 7 project from V6.1 to V8.1, performing a full download (Full Download to AS) on the Automation Station erases all runtime tag values in the S7 CPU. Critical process values—most importantly the actual timer values of self-made locked function blocks used inside CFCs, internal counters, and operator-set parameters—reset to their initial values or zero. This is fatal in continuous processes where a return to last-known-good values is required to keep the plant running safely after a CPU stop or a forced re-download.

The root issue is that a full download rewrites the entire S7 user program and the data block image in the CPU load memory, and the retain attributes of those data blocks either do not cover the operator/timer values or are reset by the download itself. In PCS 7 V6.1, many installations survived a download because the project used the older AS-OS-Engineering data path; in V8.1 the same project triggers a complete re-initialization because the system data, block container, and symbol table are regenerated from the offline project.

Root Cause Analysis

Three conditions combine to produce the data loss symptom:

1. Block re-initialization: PCS 7's full download generates new instance DBs from the CFC/SFC offline compile. Any DB that is part of the downloaded program container is reloaded, and its initial values overwrite the values previously held in the CPU work memory.
2. Non-retentive tags: Timer setpoints, operator pre-set values, and accumulator outputs in custom CFCs are typically wired to IN/OUT parameters of instance DBs that are not configured with SET (non-retentive). Even if the underlying DB is retentive, full download resets the in-RAM image to the initial value.
3. Custom FB encapsulation: Self-made locked FBs hold internal timer words (S5TIME, TIME, DINT) inside STAT variables that are not exposed to the WinCC tag database directly. The PO-View can read block I/O, but internal STATs of locked FBs are not visible without exposing them as block outputs or via instance-specific access paths.

For the migrated V6.1 project, the symptom typically appears only after the first full download in V8.1 because V6.1 deployments were often maintained by partial downloads that never triggered full re-initialization. The migration recompiles everything, so the first full download is mandatory to align the CPU with the new block container.

Solution Strategy

There are four practical approaches, listed from least to most invasive. Choose based on how many tags must be preserved and whether the process can tolerate a brief stop.

Method 1: PO-View Export and Re-import Procedure

The Process Object View (PO-View) is the primary built-in tool for reading and writing runtime values of CFC block parameters at the engineering station. The procedure below restores CFC block I/O values to the state captured immediately before the full download.

Prerequisites

• SIMATIC Manager V8.1 (or higher matching the PCS 7 version) open with the migrated project.
• Online connection to the target AS established and tested (Accessible Nodes → AS online).
• All CFC charts compiled without errors.
• The list of chart paths and block names to capture (e.g., Unit1/REACTOR/CTRL_R1/PID1.SP).

Step-by-Step: Capture Values Before Download

1. Open the project in SIMATIC Manager, expand the S7 program node, and select the Charts folder.
2. Right-click the chart of interest and choose Process Object View (or select multiple charts and use Edit → Process Object View). The PO-View opens in a tabular form listing every block parameter with its online and offline value.
3. Switch the filter to show only the parameters of interest (e.g., setpoint SP, input PV, output OUT, and timer TI). Use View → Filter and set Parameter Class to I/O only.
4. Select all rows (Ctrl+A), then use Edit → Copy. The values are placed on the clipboard as a tab-delimited text block.
5. Paste into a fresh Excel worksheet (Ctrl+V). Save the worksheet as .xlsx with a timestamp, e.g., REACTOR_pre_download_2024-05-21_1430.xlsx.
6. Do not close or modify the worksheet—the columns must remain in the exact order produced by PO-View. The order is: Chart path, Block name, Block comment, Parameter, Value, Comment, Unit.

Step-by-Step: Re-import Values After Download

1. After the full download completes, wait for the CPU to be in RUN and the AS-OS connection to be established (all green in NetPro).
2. Re-open the same PO-View. The values will display the initial/offline values; this is expected.
3. Select the same set of rows in the PO-View. Re-order Excel so the column order is identical to the PO-View.
4. Select only the Excel cells containing the parameter values, copy them, then click into the PO-View Value column and use Edit → Paste. PCS 7 will write each value to the online block parameter.
5. For S7-400 AS, the write is committed when the focus leaves the row or when you press Enter. For S7-1500 AS (PCS 7 V8.1 supports both AS 410 and AS 410 SMART as well as ET 200 SP-based AS), the write is asynchronous and may take 200-500 ms per parameter to take effect.
6. Verify by reading the online value back from the PO-View (right-click → Update Monitor Values or F5).

Method 2: Handling Custom Locked FBs with Internal Timers

If the timers are encapsulated inside a custom locked FB (the FB source is not available or is protected by KNOW_HOW_PROTECT), PO-View cannot reach the internal STATs. The block only exposes the timer through an input that overwrites the internal value. The required pattern is therefore:

1. At the FB input that drives the internal timer, write the last-known setpoint value using either PO-View (if the input is exposed as a parameter) or via a direct S7 write (see Method 3).
2. Allow the internal timer logic to start counting from that value. For pulse timers (S5TIME encoded), the value is the duration; for IEC timers (TP, TON, TOF), the input is the preset time in milliseconds.
3. If the timer type is TIMER_P, TIMER_SE, or similar legacy S5 timer, the input word is encoded in BCD in S5TIME format. PO-View will display it as a time string (e.g., T#5s) and will convert it back automatically on paste. If writing via direct S7 access, the encoding is: bits 0-11 = value in BCD, bits 12-13 = time base (00=10ms, 01=100ms, 10=1s, 11=10s).

For example, a S5TIME#t#5s value is encoded as 16#0050 in DBW. A S5TIME#t#1m30s is 16#1290. If the FB accepts the input as a TIME type (32-bit milliseconds), the value is straightforward: 1m30s = 90000 = 16#00015F90.

Method 3: Scripted S7 Read/Write for Internal FB Tags

When PO-View cannot reach the values, use a small SCL FB or an external script. The example below uses SCL inside PCS 7 to read a tag from one DB and write it to another before the full download, and to push it back afterward.

// SCL FB: SaveRestoreTag (called manually before and after download)
// Input: bSave (TRUE = capture, FALSE = restore), dwAddrSource, dwAddrTarget
// Uses a retentive DB to hold the snapshot

FUNCTION_BLOCK SaveRestoreTag
VAR
    bInit : BOOL := TRUE;
    sSaved : STRING;   // captured value as text (10 chars)
END_VAR
BEGIN
    IF bInit THEN
        // FB runs once after download - tag is in initial state
        bInit := FALSE;
    END_IF;
    IF bSave THEN
        // capture path
        sSaved := 'PRESET_VAL';  // would be IN/OUT of the CFC timer FB
        // write to retentive snapshot DB
        // "SnapshotDB".SnapValue := sSaved;
    ELSE
        // restore path
        // write back to the live FB input
        // "ReactorDB".TimerFB.SP := "SnapshotDB".SnapValue;
    END_IF;
END_FUNCTION_BLOCK

For a more generic solution, use snap7-python on an engineering PC connected to the same plant bus:

from snap7 import client, util
import time, csv

plc = client.Client()
plc.connect('192.168.0.10', 0, 1, 102)  # AS IP, rack 0, slot 1, TCP port 102

# read 100 bytes from DB 100 starting at offset 0
data = plc.db_read(100, 0, 100)
# decode as 25 REAL values (4 bytes each)
vals = [util.get_real(data, i*4) for i in range(25)]

with open('snapshot.csv','w',newline='') as f:
    w = csv.writer(f); w.writerow(['idx','value'])
    for i,v in enumerate(vals): w.writerow([i,v])

# after download restore:
buf = bytearray(100)
with open('snapshot.csv') as f:
    r = csv.reader(f); next(r)
    for row in r:
        util.set_real(buf, int(row[0])*4, float(row[1]))
plc.db_write(100, 0, buf)
plc.disconnect()

Method 4: WinCC Tag Export/Import for Operator-Side Values

Some values that are lost are not in the AS at all but in the WinCC tag management (e.g., internal tags, archive configuration initial values, user-defined tags). These can be exported:

1. Open WinCC Explorer on the OS server.
2. Right-click Tag Management → Export Tags. Choose CSV or XML format. Save the file as a backup.
3. After the full download and OS project re-compile, import the same file: right-click Tag Management → Import Tags.
4. Note: this restores only the tag definitions (name, type, address), not the runtime values. The runtime values come from the AS connection. If the AS connection is established, the WinCC tags will pick up the live values once the OS Runtime is restarted.

Verification Procedure

After applying any of the methods above, perform the following verification to confirm the values are correctly restored:

1. In SIMATIC Manager, open the PO-View for the same charts and select the same rows captured before the download.
2. Press F5 (Update Monitor Values) and confirm that the online value column matches the value stored in the snapshot Excel file.
3. Trigger a CPU STOP→RUN cycle and check that the values are still present (only relevant if the block is marked retentive; otherwise expect a re-initialization).
4. On the OS faceplate, navigate to the corresponding block and check that the displayed setpoint and timer values match the snapshot.
5. For each timer, observe the count-up or count-down to confirm the timer logic is starting from the correct preset, not from zero.
6. Save a fresh PO-View snapshot to a new Excel file labeled post_restore_<timestamp>. Diff the two Excel files (the pre-download snapshot and the post-restore snapshot) to confirm row-by-row equality.

Preventive Measures for Future Migrations and Downloads

To avoid the same problem on the next project or the next full download:

• Mark all instance DBs holding operator-set or long-lived timer values with the SET (retentive) attribute in the CFC block properties. This survives CPU STOP→RUN transitions but, on PCS 7 V8.1 with full download, behavior must still be verified empirically.
• Keep a PO-View snapshot as a standard pre-download step. Train operators to perform this snapshot during every planned full download.
• Where possible, avoid full download in production. Use incremental download to keep the working DB image intact.
• For locked FBs with internal timers, expose the timer value as an output parameter so PO-View can read and write it directly. This requires a recompile of the FB and a coordinated re-test of all instances.
• Document the list of values that must be preserved in the project Migration Guide so the next migration team knows exactly what to capture.

Related PCS 7 Tools and Documentation

For further reference, the following official Siemens documents describe PO-View operation, the AS-OS engineering workflow, and the V6.1 → V8.1 migration procedure:

• SIMATIC PCS 7 Engineering System (V8.1) - Function Manual
• SIMATIC PCS 7 Process Object View (PO-View) - Operating Instructions
• SIMATIC PCS 7 V8.1 Migration - Project Planning Guide
• SIMATIC PCS 7 CFC - Programming and Operating Manual
• SIMATIC PCS 7 SFC - Sequential Function Chart Manual
• SIMATIC PCS 7 WinCC Explorer - Tag Management Manual

FAQ