Resolving Alert Icon in WinCC Unified Basic HMI Tags

Problem Description

The WinCC Unified Comfort Panel and WinCC Unified PC RT display a small alert/warning icon inside an IO field, text field, or output area when the bound HMI tag cannot deliver a valid value from the connected S7-1500 CPU. The tag may show last-known value, dashes (---), or the original configured default, but the yellow/red alert glyph indicates that runtime quality is Bad or Uncertain.

Symptom signature:

• IO field, symbolic IO field, or bar shows the alert overlay.
• Tag is correctly defined in the HMI tag table with a valid connection.
• PLC online diagnostics show the tag area is reachable from the CPU side.
• Project compiled and downloaded to the panel without build errors.
• Firmware mismatch suspected (example from field: HMI runtime V19.0.0.0, S7-1500 CPU firmware V4.5, TIA Portal project V17 or higher).

Root Cause Analysis

WinCC Unified uses TLS-protected OPC UA-style communication with S7-1500 CPUs. The connection is rejected at the TLS handshake stage for one of four reasons documented in Siemens KB 109800515 - Communication to S7-1500 CPU with firmware V2.9 with the WinCC Unified Comfort Panel:

1. Certificate time check failure – the panel's clock and the CPU's clock differ by more than the validity window of the self-signed certificate. Both devices must share date, time, and timezone.
2. Firmware / TIA Portal combination outside the approved matrix – TIA Portal V17+ with S7-1500 firmware V2.9 has known restrictions; V18/V19 panels must use CPUs on the supported firmware list.
3. Tag address / data type mismatch – the HMI tag points to a DB that is shorter than the offset, or the data type (BOOL/INT/REAL/WSTRING) differs from the PLC symbol.
4. Project not fully recompiled – the HMI connection resource was changed but only an incremental download was performed. Stale PLC-HMI binding retains the old (now invalid) certificate reference.

Affected Versions and Components

Diagnostic Procedure

Run the following checks in order. Each step isolates one of the four root causes listed above.

1. Check the HMI connection diagnostics in the panel's Control Panel > Diagnostics > Connections. A red connection state confirms the TLS handshake is failing, not just a single tag.
2. Verify clock synchronization. On the CPU, open Online & Diagnostics > Time. On the panel, open Control Panel > Date and Time. The wall-clock UTC offset must match within ±60 s.
3. Confirm firmware combination with the Siemens compatibility tool. Refer to entry 109800515 for the V2.9 exception list.
4. Inspect the HMI tag properties: Connection, PLC device, address (e.g. %DB42.DBX0.0), and data type. Cross-check against the PLC symbol in the project tree.
5. Check whether the issue is tag-specific by binding the same connection to a fresh test tag. If only one tag shows the icon, the fault is in the PLC symbol; if every tag fails, the fault is in the connection or the panel certificate store.

Solution Path 1 - Correct Time and Date on Both Devices

WinCC Unified compares the panel's current time against the notBefore / notAfter fields of the CPU's certificate. If the panel clock is outside this window, the TLS handshake is aborted and the tag enters Bad quality, producing the alert icon.

1. On the S7-1500 CPU, enable NTP synchronization: Properties > Time of day > Time synchronization. Set the mode to NTP with a reachable server.
2. On the Unified Comfort Panel, open Control Panel > Date and Time. Set Time zone explicitly (e.g. (UTC+01:00) Amsterdam, Berlin) and enable Synchronize via NTP using the same NTP server as the CPU.
3. Force a manual time set on the panel if no NTP server is reachable: Control Panel > Date and Time > Set Date/Time.
4. Power-cycle the panel and re-download the project. The new TLS session will pass the validity check.

Solution Path 2 - Align Firmware Versions

WinCC Unified Comfort Panels require the S7-1500 CPU to be on a firmware release approved for the TIA Portal version used to engineer the panel. Per Siemens KB 109800515:

• TIA V17 + Unified Comfort Panel: S7-1500 CPU firmware must be ≥ V2.6, but V2.9 has documented restrictions. Upgrade CPU to V3.0 or higher (e.g. V3.1, V4.5, V4.7).
• TIA V18 + Unified: CPU firmware V2.9.x service packs or V3.x and higher.
• TIA V19 + Unified: CPU firmware V4.0 or higher is recommended.

Recommended action when the panel is V19 and the CPU is V4.5: keep CPU V4.5 (already on the supported matrix for V19 panels) and update TIA Portal to V19. Recompile the entire project after the portal upgrade.

Solution Path 3 - Correct HMI Tag and Connection Setup

1. In the project tree, right-click the HMI device and choose Compile > Software (rebuild all). This regenerates the connection resource and rewrites the tag pointer list.
2. Open HMI Tags > Show all tags. For each tag showing the alert, verify the following properties:
   - Connection: must point to the HMI connection that targets the correct PLC.
   - PLC tag or Address: must reference a DB that exists in the PLC program with sufficient length.
   - Data type: must match the PLC element exactly. A mismatch silently fails and the runtime marks the tag Bad.
3. Where the tag points to a PLC tag, navigate to PLC tags > Show all tags and confirm the tag is marked Accessible from HMI (the small HMI icon on the tag).
4. For DB tags, ensure the DB is not optimized-block-protected in a way that hides the symbol. If using an optimized DB with Accessible from HMI = false, change to true in the DB properties.

Solution Path 4 - Recompile and Re-download the Full Project

Incremental downloads leave stale TLS references in the panel runtime image. Always perform a full rebuild when changing connection parameters, certificates, or firmware targets.

1. In TIA Portal, select the HMI device.
2. Right-click and choose Compile > Software (rebuild all).
3. Right-click and choose Download to device > Software (all). Tick Overwrite all.
4. If the panel still rejects the connection, perform a Reset to factory settings on the Unified Panel (Control Panel > System > Reset) before downloading again. This clears the certificate trust store that may hold an outdated CPU certificate.

Alarm Control Quality Indicators

The Alarm control in WinCC Unified RT surfaces the same quality state for tag-bound alarm variables. Per the Alarm control (RT Unified) reference, each alarm row can show a connection-state indicator driven by the tag quality. If the alert icon appears in an alarm value column, run the four solution paths above for the alarm variable's source tag.

Verification

1. Open the HMI runtime on the panel. The IO field must display the live PLC value without the alert overlay.
2. Switch the PLC value to force a write-back (e.g. toggle a BOOL or write a new INT to the DB). The HMI must update within one acquisition cycle (default 1 s).
3. Open Control Panel > Diagnostics > Connections. The HMI connection row must show a green state with the latest update timestamp.
4. Trigger an alarm and confirm in the Alarm control that the value column shows the live tag value rather than a quality glyph.

Troubleshooting Matrix

Preventive Measures

• Always deploy a reachable NTP server to both the S7-1500 CPU and the Unified Panel. Avoid manual clock settings in production.
• Document the approved firmware combination in the project README. Update both CPU and panel firmware together when a TIA Portal upgrade is performed.
• Use Compile > Software (rebuild all) rather than incremental compilation after any change to HMI connections, certificates, or device firmware.
• Mark all PLC tags that the HMI must access with Accessible from HMI in the DB properties.
• Maintain a backup of the panel runtime image and a known-good CPU certificate pair.

FAQ