Overview of the ProTool Tag Modification Problem
ProTool is the legacy Siemens configuration software used to program SIMATIC Operator Panels (OP), Touch Panels (TP), and early Multi Panels (MP) before the product line was succeeded by WinCC Flexible (2004) and later TIA Portal WinCC (2010). A common engineering task when commissioning, retrofitting, or migrating SIMATIC systems is the need to modify a tag address that is referenced by several screens, scripts, alarms, and recipes inside the same ProTool project.
ProTool projects are not global search-and-replace friendly: a tag instance bound to a screen object (a numeric I/O field, a bar, a trend view, a status display, an event-driven change) holds an internal pointer to a tag definition located in the central tag list. Modifying the address column of that tag definition will automatically propagate the change to every consumer of the tag — provided the data type is preserved, the connection remains valid, and the new address is reachable over the configured logical connection.
This article documents the supported, supported-with-caveat, and unsupported approaches for modifying a tag address in ProTool, the role of the Cross Reference tool, the data type preservation rule, and the recommended verification workflow before downloading the revised project to the panel.
Prerequisites
Before performing a tag address modification in ProTool, verify the following:
- ProTool installation: ProTool V6.0 SP2 or ProTool V6.0 SP3 is installed on the engineering workstation. ProTool CS (Configuration Software) is the design-time environment. ProTool/Pro RT is the runtime that executes on the panel itself.
-
Project backup: A complete
.pdbor.pbabackup of the active ProTool project has been archived. ProTool does not provide project versioning comparable to TIA Portal; manual snapshots are the only safe rollback path. - PLC program symbol table: A current export of the STEP 7 symbol table (S7-300/400) or the local symbol table of Micro/WIN (S7-200) is available so the new tag address can be validated against the PLC truth source.
- Online connection to the panel: A serial, MPI, PROFIBUS, or Ethernet path exists between the engineering PC and the target OP/TP/MP so the compiled project can be downloaded and the runtime tested.
- Original tag definition recorded: Note the original tag name, data type, PLC connection, and address. This information is required for cross-reference reconciliation and rollback if the new address proves incorrect.
ProTool Tag Architecture: Internal, External, and System Tags
ProTool classifies every variable in a project into one of three categories. The address-modification rules differ between them.
| Tag Class | Storage Location | Address Field Meaning | Modify Address? |
|---|---|---|---|
| External tag | PLC memory area | Symbolic or absolute PLC address (e.g. DB10.DBD0, MW20, VW100) |
Yes, with type preservation |
| Internal tag | Panel memory | Not a real address — symbolic panel-local name | No external address exists; rename only |
| System tag | Panel firmware | Reserved read-only addresses supplied by runtime | Not editable |
Speed references that drive setpoint inputs, actual-value displays, and trend archives on a machine HMI are almost always external tags pointing into a STEP 7 data block or a Micro/WIN V-memory area. This is the tag class where address modification is meaningful.
Supported PLCs and Communication Drivers
ProTool V6.0 ships with a fixed set of PLC drivers. The tag address syntax accepted in the address column depends on which driver is bound to the logical connection.
| PLC Family | Driver in ProTool | Address Syntax Examples | Typical Use |
|---|---|---|---|
| SIMATIC S7-300 / S7-400 | SIMATIC S7 - 300/400 (via MPI/PROFIBUS/Ethernet) |
DB10.DBD0, DB20.DBW4, MW20, I0.0, Q4.7
|
Most common configuration |
| SIMATIC S7-200 | SIMATIC S7 - 200 (PPI/MPI) |
VW100, VD200, MW0, QB0, IB0, SMB28
|
Lower-cost machine HMI |
| SIMATIC S5 | SIMATIC S5 (AS511 / PROFIBUS) |
DB10.DW0, FW20, MW0, IW0
|
Legacy retrofit projects |
| SIMATIC WinAC | SIMATIC S7 - 300/400 (slot PLC) | Same syntax as S7-300/400 | Soft-PLC scenarios |
| Third-party PLCs | OPC tunnel, Modbus RTU/TCP via gateway | Vendor-specific or Modbus register map | Less common with ProTool |
The communication driver is selected under Project > Connections in ProTool. Once the driver is set, the address field in the tag list validates the entered string against that driver's grammar.
Step-by-Step: Modifying an Existing Tag Address
This is the preferred approach when the tag name should be preserved (e.g. it is used as a script variable, in a recipe, or in a multi-language export) but the underlying PLC address must change — for example when an S7 program has been refactored and the data block layout has shifted.
- Open the project in ProTool CS. From the project tree, expand Tags and select Tag List. The tag list editor opens in the working area.
-
Locate the target tag by name (e.g.
Speed_SetpointorSP_Motor1). Sorting by the Name column accelerates the search; the Filter button (funnel icon) supports substring filtering. - Record the original values of Connection, Data type, Length (for STRING), Acquisition cycle, and Limit value monitoring. These must remain identical after the change.
-
Edit the Address column of the tag in place. Type the new absolute address in the syntax required by the configured connection (for example
DB12.DBD12orVW220). Press Enter to commit. ProTool performs a syntax check; an invalid address displays a red field background and a tooltip describing the parse error. - Confirm data type preservation. ProTool does not warn if you change the data type by accident — it only validates address syntax. The engineer must manually verify the new address has the same physical width as the original (e.g. DBD = DWORD 32 bits; the replacement must point at a DWORD, not at a WORD or a BOOL).
- Save the project with File > Save or Ctrl+S. The project tree updates the modification timestamp on the Tags node.
- Compile with Project > Compile > All. Any unresolved cross-reference errors appear in the Output window.
- Download the compiled runtime to the panel using File > Transfer > to Panel…. For a recipe-only change, a partial transfer (transfer only the tag database) may be selected under Settings > Transfer.
Step-by-Step: Creating a New Tag and Bulk Reassignment
When the existing tag must be retired — for example because its data type must change (INT → REAL), because its acquisition cycle must change, or because the old address will continue to be used by another consumer — ProTool requires the engineer to create a new tag and reassign it to each screen object.
- Document every consumer of the old tag using the Cross Reference tool (Tools > Cross Reference or Ctrl+Alt+F). Export the result to a text file or print it for traceability.
- Create the replacement tag in the Tag List (Tags > New Tag or right-click in the tag list and choose Append Tag). Assign the new PLC address, set the data type to whatever the new address supports, and configure acquisition / limit monitoring as required.
- Open each screen that references the old tag. For every object bound to the old tag — typically a numeric I/O field, a slider, a bar, a status display, an animation, or a script event — open the object properties dialog (View > Properties) and select the new tag from the Tag dropdown list.
- Replace script references by opening the script editor (Tools > Script if scripts are enabled in the project) and renaming every occurrence of the old tag symbol. ProTool does not have a script-level find-and-replace; manual editing or an external text editor on a stripped export is required.
- Update alarms and recipes. If the old tag was bound to a discrete alarm or used inside a recipe structure, open Alarms > Discrete Alarms and Recipes and re-bind the references to the new tag.
- Save, compile, and transfer as in the modify-in-place procedure.
-
Leave the old tag in place with a
_deprecatedsuffix until the panel has been observed in production. Removing it prematurely will leave dangling references in compiled scripts that ProTool cannot warn about at runtime.
Cross-Reference Function for Bulk Updates
The Cross Reference tool (Tools > Cross Reference) is the engineer's primary safety net. It enumerates every location in the project — screens, templates, scripts, alarms, recipes, schedules, area pointers — where a given tag is referenced.
| Scope Selector | What Is Reported | Typical Use |
|---|---|---|
| Screens | Every object on every screen that reads or writes the tag | Count of UI bindings to update |
| Scripts | Every script line that mentions the tag | Identify arithmetic, control flow, or event handlers |
| Alarms | Every discrete / analog alarm bound to the tag | Avoid orphaned alarm triggers |
| Recipes | Every recipe element mapped to the tag | Prevent data-loss during recipe download |
| Schedules | Every time-of-day action referencing the tag | Less common; verify if used |
| Connections / Area Pointers | Whether the tag is part of a polling area pointer (e.g. Acknowledgement area) | Address-pointer-dependent tags |
The cross-reference list is sorted by location. Right-clicking an entry opens the corresponding editor at the exact line, accelerating manual reassignment.
Data Type Preservation Rules
ProTool stores the data type with the tag definition, and every consumer of the tag relies on it. Changing the data type — even when the new type would physically fit the same memory area — is the single most common cause of "the value reads wrong after the address change" symptoms.
| PLC Memory Width | Acceptable Data Types | Width (bits) | Notes |
|---|---|---|---|
| 1 bit | BOOL | 1 | Address syntax: I0.0, Q4.7, M10.3, DB1.DBX0.0
|
| 1 byte | BYTE, CHAR, S5TIME (limited) | 8 | Address syntax: IB0, QB0, MB10, DB1.DBB0
|
| 1 word (2 bytes) | WORD, INT, S5TIME, DATE | 16 | Address syntax: IW0, QW0, MW20, DB1.DBW0
|
| 1 double word (4 bytes) | DWORD, DINT, REAL, TIME, TIME_OF_DAY | 32 | Address syntax: ID0, QD0, MD20, DB1.DBD0
|
| String | STRING | n × 8 | S7 STRING requires the first byte to be max length, second byte current length — the address must point to the length byte |
DB declared as ARRAY[0..9] OF REAL occupies 40 bytes. If the original tag pointed at DB10.DBD0 with data type REAL and the new tag points at DB10.DBD4, the read value will be the second array element, not a corrupted interpretation. However, if the data type were silently changed from REAL to DINT, the byte order would be misinterpreted as a 32-bit signed integer and the display would show nonsense.Symbolic vs Absolute Addressing in ProTool
When the ProTool connection is configured as "symbolic" (under Connection > Properties > Mode), the tag address column accepts STEP 7 symbol names rather than absolute addresses. In symbolic mode the address field shows the symbol; in absolute mode it shows DBx.DBWy.
- Symbolic mode advantage: The PLC program can be reorganized (a data block can be renumbered, an area can be moved) without touching the ProTool tag list, because ProTool resolves the symbol to the new absolute address at runtime.
- Symbolic mode disadvantage: The ProTool project must carry a copy of the STEP 7 symbol table, which has to be refreshed whenever the PLC program is recompiled with new symbols.
- Absolute mode advantage: The address is unambiguous and survives STEP 7 symbol-table refactoring as long as the data block layout is preserved.
- Absolute mode disadvantage: Any PLC-side data block renumbering forces a bulk update of every affected ProTool tag.
For projects where the data block layout is volatile (frequent STEP 7 refactoring during commissioning), symbolic mode with periodic symbol-table refresh is the lower-maintenance choice.
Compilation, Project Backup, and Download Procedure
The project compile step translates the tag list, screens, scripts, alarms, and recipes into a runtime image. A clean compile is mandatory before download.
- Clean rebuild: Project > Compile > All (Rebuild). Incremental compile sometimes hides stale references after a tag modification; the rebuild option regenerates the runtime image from scratch.
- Review the compile output: The Output window displays errors, warnings, and informational messages. Resolve every error before transfer. Warnings about deprecated tags, unused tags, or duplicate names should be triaged.
-
Stage the project backup: Before download, copy the compiled runtime image (typically
*.fwdfor OP/TP) to a versioned backup directory such asD:\HMI\Backups\<ProjectName>_<YYYYMMDD_HHMM>\. - Initiate transfer: File > Transfer > to Panel…. Configure the channel (MPI address, PROFIBUS address, or IP for Ethernet-based panels such as MP370). Set the transfer mode to "Complete" for tag-database changes — partial transfer does not always update the tag database on legacy OP panels.
- Confirm on the panel: The OP/TP/MP displays a confirmation prompt ("Receive transfer?"). Accept, then wait for the progress bar to complete without interruption.
- Allow automatic restart: The panel reboots into the new runtime image. Observe the splash screen and confirm the project name and version string match the expected build.
Verification and Runtime Testing
After download, perform a structured verification sequence before handing the system back to operations.
| Test | Procedure | Pass Criterion |
|---|---|---|
| Tag poll | Open Tools > Tag Simulator or STEP 7 Monitor/Modify and force a value at the new address | The HMI displays the forced value within one acquisition cycle |
| Round-trip write | Enter a setpoint on the HMI and read it back from STEP 7 | The PLC receives exactly the value typed on the HMI |
| Cross-screen consistency | Navigate to every screen that referenced the tag pre-change | All displays show the same value; no "###" overflow, no "???" communication error |
| Alarm integrity | Trigger the alarm condition at the PLC side | The discrete alarm appears with the correct state and text |
| Recipe integrity | Download a recipe to the panel, then upload it again | The recipe values round-trip without corruption |
| Trend continuity | Open a trend view that archives the tag | Trend curve resumes from the last logged value without a gap |
Migration Path: ProTool to WinCC Flexible / TIA Portal
ProTool V6.0 reached end-of-life when WinCC Flexible 2004 superseded it. ProTool projects can be migrated to WinCC Flexible via Project > Migrate ProTool Project; WinCC Flexible projects can be migrated to TIA Portal WinCC via Migration > Migrate WinCC Flexible project in TIA Portal V13 or later.
The migration preserves the tag list, screen layout, alarms, and recipes — but address syntax may need minor adjustment because TIA Portal accepts symbolic tags using the S7-1500 symbol-table format. The following mapping is typical:
| ProTool Address | WinCC Flexible / TIA Portal Equivalent |
|---|---|
DB10.DBD0 (absolute) |
"DB_Motor".ActualSpeed (symbolic after import) |
VW100 (S7-200) |
"Data_block".Voltage (symbolic) |
MW20 |
Imported as Merker_20 in the PLC tag table |
For sites planning repeated tag changes, migrating to TIA Portal is the only durable remediation: TIA Portal supports project-wide tag renames and address changes that propagate to every consumer automatically, with a cross-reference graph that updates in real time.
Troubleshooting Matrix
| Symptom | Likely Cause | Remediation |
|---|---|---|
| Tag shows "###" on the HMI | PLC not reachable; address outside DB length; wrong connection selected | Verify Connection > Status, check DB length in STEP 7, confirm the tag's connection property points to the right PLC |
| Tag shows wrong value (offset by factor) | Data type mismatch (REAL interpreted as DINT) | Revert data type to original; verify the new address has the same width as the old |
| Compile error "Tag XYZ used in screen A but undefined" | Tag was deleted before all references were reassigned | Recreate the tag with the original name or update every reference |
| Compile error "Duplicate tag name" | New tag created with the same name as an existing one | Rename the new tag to a unique name (ProTool tag names are case-insensitive and global) |
| Trend view stops logging after change | Acquisition cycle changed unintentionally | Restore the original acquisition cycle; verify in the tag properties dialog |
| Alarm does not fire after address change | Alarm was bound to the old tag; reassignment was missed | Use Cross Reference to identify the alarm, re-bind to the new tag |
| Panel displays "Transfer OK" but runtime is unchanged | Partial transfer skipped the tag database | Re-transfer with "Complete" mode enabled |
| Address accepts but reports "invalid format" | Wrong syntax for the selected driver | Verify the connection's PLC family and use the matching address syntax from the driver table |
Can I modify a tag address once and have it automatically update everywhere in ProTool?
Yes — provided you only change the address column in the central Tag List while keeping the tag name, data type, length, and connection unchanged. ProTool propagates the new address to every screen object, alarm, recipe, and script that references the tag by name. The cross-reference tool (Tools > Cross Reference) lists all affected consumers so you can verify completeness before downloading.
Will changing the data type break my screens?
ProTool does not block a data-type change, but every consumer (numeric I/O field, bar, trend, alarm) trusts the data type stored on the tag definition. A REAL-to-INT or WORD-to-DINT change will result in misread values, overflow displays, or trend mis-scaling. Always preserve the original data type unless you also touch every consumer and update its format settings.
How do I bulk-replace a tag across every screen in one operation?
ProTool does not provide a bulk rename or bulk rebind. The supported workflow is: (1) document every reference with Cross Reference, (2) create a new tag with the new address/data type, (3) open each screen and reassign every object manually, (4) update scripts and alarms, (5) compile and transfer. Plan accordingly; large projects typically require migration to WinCC Flexible or TIA Portal for sustainable tag management.
Do I have to redownload the entire project to the panel after a tag change?
On most OP and TP panels, a complete transfer is required for changes to the tag database. WinCC Flexible and TIA Portal support partial delta transfers for some operations, but the legacy ProTool transfer workflow expects a full image. Allow the panel to reboot into the new runtime before resuming operation.
What happens if I delete a tag that is still referenced?
ProTool flags an unresolved reference at compile time but does not always catch references inside scripts or area pointers. The safest path is to leave the old tag in place with a _deprecated suffix until production has confirmed the new tag is fully wired, then delete the deprecated tag in a follow-up revision and re-compile cleanly.