Recovering WinCC Tags from Corrupted Project MDF Database Files

Overview

When a Siemens WinCC 7.x project becomes corrupt and can no longer be opened in the WinCC Explorer or the TIA Portal, the underlying tag list is often still recoverable directly from the Microsoft SQL Server database files that WinCC writes into the project folder. This article documents two field-proven recovery paths for extracting a complete variable (tag) inventory from a damaged project and re-importing it into a clean replacement project:

1. Direct MDF attachment: attach the offline project database file (CC_<ProjectName>_<timestamp>.mdf) to a local Microsoft SQL Server instance and query the MCPTVARIABLEDESC table.
2. Smart Tools variable export/import: when the corrupted project can still be opened at least once, use the Smart Tools add-in to export variables to CSV and re-import them into the target project.

The procedures below apply primarily to WinCC 7.0 / 7.2 / 7.3 / 7.4 / 7.5 SCADA projects that use the classic SQL Server-backed project database. TIA Portal WinCC Professional / Comfort / RT projects use a different storage layout (binary project files plus SQL runtime fragments) and require a separate workflow covered at the end of this document.

Prerequisites

Identifying the Correct Database File

Inside the corrupted project folder you will typically find two SQL Server primary data files with similar names:

• CC_<ProjectName>_<datetime>.mdf — the offline / configuration database. This is the file you need for tag recovery.
• CC_<ProjectName>_<datetime>_R.mdf — the WinCC Runtime data archive. Holds process values, not tag definitions; not relevant for tag list extraction.

The trailing _R distinguishes the runtime archive. The filename also includes the project creation timestamp; older WinCC versions append additional numeric suffixes. Confirm the file belongs to the project by checking that CC_ prefix matches and that the file size is greater than ~5 MB (a healthy project database). A database of only a few hundred kilobytes is itself an indicator of partial corruption or interrupted writes.

Method 1 — Tag Recovery via SQL Server MDF Attachment

Step 1: Copy the Project Folder

1. Stop the WinCC Runtime if it is still active on the original server.
2. Copy the entire project folder to a recovery workstation (for example D:\Recovery\Project_01\).
3. Verify that both *.mdf and the associated *.ldf transaction log are present in the copy.

Step 2: Locate the WinCC Database Service Account

By default the WinCC project database service runs as the local user CCAdmin (older versions) or under the SYSTEM account (newer versions with WinCC 7.4+). To attach the MDF without a permissions error, either:

• Grant the SQL Server service startup account (default: NT Service\MSSQLSERVER) Full Control on the recovery folder, or
• Copy the MDF/LDF into the SQL Server default data folder (for example C:\Program Files\Microsoft SQL Server\MSSQL15.MSSQLSERVER\MSSQL\DATA\) so the engine can access the file directly.

Step 3: Attach the Database in SSMS

1. Open SQL Server Management Studio and connect to the local SQL Server instance.
2. Right-click Databases → Attach….
3. In the Attach Databases dialog click Add and browse to the offline MDF (CC_Project_01_*.mdf).
4. If the LDF is missing or corrupt, SSMS will warn that it cannot find the transaction log. Accept the default action to create a new log file (.ldf) automatically.
5. Confirm the database name (for example CC_Project_01_20240115) and click OK.

The database will now appear in the Object Explorer under Databases. If attach fails with error 5120 or 823, the MDF is too damaged for direct attach; in that case proceed to the Forced Attach with REBUILD LOG section below.

Step 4: Query the Tag Definition Table

The WinCC project database stores all tag definitions in a single canonical table:

Open a new query window against the attached database and execute the canonical recovery query:

The result set contains every tag defined in the project, including internal structure tags. To extract only the engineering-relevant columns:

SELECT
    VARIABLENAME      AS [Name],
    VARIABLETYPE      AS [Type],
    DATATYPE          AS [DataType],
    LENGTH             AS [Length],
    ADDRESS            AS [Address],
    CONNECTION         AS [Connection],
    GROUPNAME          AS [Group],
    COMMENT            AS [Comment]
FROM MCPTVARIABLEDESC
ORDER BY GROUPNAME, VARIABLENAME;

To produce a clean importable list (one tag per line, name only) for use in Excel, Notepad++, or the WinCC Tag Export wizard:

SELECT VARIABLENAME
FROM MCPTVARIABLEDESC
WHERE ISARCHIVED = 0
ORDER BY VARIABLENAME;

Right-click the result grid → Save Results As… → CSV with header. This file becomes the master import list for the new project.

Step 5: Map DataType Codes to WinCC Types

The DATATYPE column in MCPTVARIABLEDESC stores a small integer code. The mapping is:

If you intend to rebuild tag structure declarations in the target project programmatically, this mapping is essential for any custom import tool.

Step 6: Forced Attach with REBUILD LOG (Last Resort)

If standard attach fails with error 5171 (corrupt primary file) or 1813 (cannot open new database), use CREATE DATABASE FOR ATTACH_REBUILD_LOG:

CREATE DATABASE CC_Project_01_Recover
ON (FILENAME = 'D:\Recovery\Project_01\CC_Project_01_20240115.mdf')
FOR ATTACH_REBUILD_LOG;
GO

If the MDF still cannot be read, use the emergency mode attach:

CREATE DATABASE CC_Project_01_Emergency
ON (FILENAME = 'D:\Recovery\Project_01\CC_Project_01_20240115.mdf')
AS EMERGENCY;
GO
DBCC CHECKDB ('CC_Project_01_Emergency', REPAIR_ALLOW_DATA_LOSS);
GO

Method 2 — Tag Recovery Using Smart Tools Variable Export

If the corrupted project still opens (for example the Graphical Editor fails but WinCC Explorer loads) you can use the official Siemens WinCC Smart Tools add-in to export and re-import the variable list cleanly. The procedures below correspond to the documentation in Siemens support entry 22557737.

Step 1: Open the Project in WinCC Explorer

1. Launch WinCC Explorer and load the partially corrupted project.
2. Verify that the tag management subtree at least enumerates. You do not need full editor functionality.

Step 2: Launch the Smart Tools Variable Export

1. Open the WinCC Explorer menu Tools → Smart Tools → Variable Export (or launch SmartTools_VariableExport.exe directly from C:\Program Files (x86)\Siemens\Automation\WinCC\SmartTools\).
2. Select the active project in the dropdown.
3. Choose the export destination CSV file.
4. Select which tag groups to export, or leave at default to export the full project.
5. Click Export. Progress is displayed as tags are written to the CSV.

Step 3: Generate a Compatible CSV

The Smart Tools exporter writes a CSV with a header row containing the column names in German by default. The default schema is:

Translate the header to English if your target project / engineering team expects it:

Remove any rows where Name is empty or starts with @ (these are WinCC internal system tags that should not be re-imported).

Step 4: Import Into the Target Project

1. Open the clean replacement project in WinCC Explorer.
2. Navigate to Tag Management → right-click the target channel or group → Import… (or use Smart Tools Variable Import).
3. Browse to the CSV file. WinCC will display a dry-run summary showing how many tags will be created and how many duplicates (by name) will be skipped.
4. Confirm the import. Tags are created with the original data type, connection assignment, and address.

Step 5: Verify Connection Bindings

The CSV preserves channel/connection names, but the connections themselves (e.g., SIMATIC S7-1200, S7-1500, Allen-Bradley, Modbus TCP) must already exist in the target project. Before importing tags, confirm each connection referenced by the tag list is configured in the new project with the same name. Tags that reference a non-existent connection will import but remain "not connected" until the connection is added.

Importing the Recovered Tag List into a Fresh Project (Method 1 Output)

If you recovered tag names using the SQL query method, you have a one-column CSV of names without type/address information. To re-create the full tag definitions you have two options:

Option A: Bulk Create with Default Type (Internal Tags)

Open the target project's tag management, create the desired groups, then use the WinCC Tag Import wizard with a CSV in the format:

Name;Type
Tag1;Binary Tag
Tag2;Signed 32-bit
Tag3;Float 64-bit

This recreates all tags as internal tags. Suitable when the original PLC addresses are being rebuilt or when you intend to redirect addresses via AS-OS engineering.

Option B: Reconstruct Full Address from Source Project Files

For tags that need their original PLC address preserved, the address information is available in the same MCPTVARIABLEDESC table. Run:

SELECT VARIABLENAME, ADDRESS, CONNECTION
FROM MCPTVARIABLEDESC
WHERE CONNECTION IS NOT NULL AND CONNECTION <> ''
ORDER BY VARIABLENAME;

Combine the name/type/address/connection into a Smart Tools-compatible CSV and import as in Method 2 Step 4.

TIA Portal WinCC Professional Considerations

TIA Portal WinCC Professional / Comfort / RT projects do not use a directly attachable MDF file in the same way. Instead the engineering data is stored in the binary .ap16 / .ap17 / .ap18 project file. Recovery paths for corrupted TIA Portal projects are:

• TIA Portal Backup: open the most recent *.s7zip / *.zip backup created by the TIA Portal auto-save or by SIMATIC Automation Tool.
• Project history: TIA Portal keeps a history under %USERPROFILE%\AppData\Local\Siemens\Automation\Portal V<version>\<project>\History\.
• PLC tag table export: if the HMI tags are sourced from the PLC tag table, the PLC project may still be readable even when the HMI project is corrupted. Export the PLC tag list as XLSX and re-link it in the new HMI project.

Verification Procedures

After recovery and import, run the following checks before placing the project into service:

1. Row count parity: SELECT COUNT(*) FROM MCPTVARIABLEDESC in the recovered database vs. the imported tag count in the target project. Numbers should match within ~2% (allowing for stripped internal tags).
2. Random sample check: pick 10 tags across each group. For each, verify Name, Type, Address, and Connection in the new project match the SQL row.
3. Compile the project: in WinCC Explorer select Tools → Compile. Any unresolved references (for example to a missing connection or to a deleted structure tag) are reported here.
4. Runtime startup test: start WinCC RT in simulation mode (no PLC required). All recovered internal tags should initialize without error. Tags bound to non-existent connections will display -- in the diagnostics window; this is expected behavior, not a recovery failure.
5. Archive consistency: if the recovered project is to be promoted back to production, check MCPTVARIABLEDESC.ISARCHIVED column. Tags with ISARCHIVED = 1 were archived (deactivated) before the corruption and should remain disabled in the new project.

Troubleshooting Matrix

Field-Proven Caveats and Edge Cases

• Multi-language projects: tags in multilingual WinCC projects are stored once; the comment column may be in German even when the project UI language is English. Verify comment translation before re-importing into a new language environment.
• Structure tags and UDTs: structure types are stored in MCPTVARIABLETYPEDESC (not MCPTVARIABLEDESC). To recover user-defined types in addition to tag instances, query both tables and reconstruct the type hierarchy before importing tag instances.
• Aliases: aliases are stored in a separate table MCPTAGALIAS. If the project relies heavily on aliases (common in WinCC 7.4+ plant-modular projects), query this table as well and re-import via the Smart Tools alias import.
• Permissions on extracted CSV: WinCC imports fail silently if the CSV is opened exclusively by Excel. Close the CSV in Excel before starting the import.
• Code page: if your project contains non-ASCII characters in tag names (uncommon but seen in some non-English sites), export the CSV as UTF-8 with BOM, not ANSI. Otherwise the WinCC importer misreads characters.
• WinCC version mismatch: a tag list exported from WinCC 7.3 generally imports cleanly into 7.4 and 7.5. Going in the reverse direction (newer → older) may fail for tags using features added in the newer version. Use the oldest viable target version.

Related Resources

For the canonical Siemens guidance on this recovery workflow, see Siemens support entry ID 22557737. For TIA Portal project recovery specifics, refer to the TIA Portal help under "Restoring projects" and the SIMATIC Automation Tool documentation. Background on the WinCC project database schema is documented in the WinCC Information System under "Databases of WinCC" (path: WinCC Information System → Configuration → Tag Management → Databases).

FAQ