Resolving Missing HMI Alarm Tags in S7-300 with STEP 7 V5.5

Resolving Missing HMI Alarm Tags in S7-300 with STEP 7 V5.5

When commissioning or maintaining a SIMATIC S7-300 (CPU 31x / CPU 31xT / CPU 31xC) controlled machine, engineers frequently face the inverse problem: an alarm appears on the HMI, but the originating tag, signal source, or trigger word cannot be located in the STEP 7 V5.5 program. This article documents the official, vendor-documented methods to reverse-engineer and forward-trace HMI alarm trigger tags in a STEP 7 V5.5 / WinCC flexible project structure, the edge cases that block naive searches, and the verification checks that confirm a complete trace.

1. Problem Definition and Symptom Catalogue

Symptoms reported in the field consistently include one or more of the following:

• An alarm category appears in WinCC flexible as "No text assigned" or shows a red exclamation mark in the alarm view.
• The HMI alarm window lists a discrete alarm that has no tag association under Properties > General > Trigger Tag.
• Searching the STEP 7 symbol table by name returns zero results while the alarm text on the panel is meaningful (e.g., MOTOR_OVERHEAT).
• The alarm text differs in language between the HMI runtime and the STEP 7 comment table.
• Re-compiling the HMI produces event log entries 0x01F0xxxx warning that "Tag referenced by alarm not found".

Root cause in nearly all cases is one of:

1. The trigger tag is a bit within a data word (DBW / MW / IW / QW / PIW) rather than a stand-alone Mx.y or Ix.y, and the alarm editor stored only the parent word.
2. The symbol table entry was deleted or renamed after the HMI project was last exported, leaving an unresolved symbolic reference.
3. The PLC program is partitioned across multiple function blocks (FB) / functions (FC) with locally scoped STAT / TEMP variables, hiding the tag from the global symbol table.
4. The HMI is configured against a non-standard proxy DB or against the S7-300 process image of inputs (PII) / outputs (PIQ), bypassing the symbol table entirely.

2. S7-300 Memory Model Relevant to HMI Alarms

STEP 7 V5.5 exposes the following address areas that WinCC flexible can poll for alarm triggers. Confirm the area first; the trace strategy depends on it.

WinCC flexible discrete alarms most often use a trigger bit (x.0 ... x.7) embedded in a 16-bit word so that one DBW can pack up to 16 alarms. Always check the bit offset within the word, not just the byte/word address.

3. Prerequisites

1. STEP 7 V5.5 (5.5.0.0) with at least SP1 installed. Open SIMATIC Manager > Help > About to confirm the build. SP4 / HF7 or later is recommended to access the "Go To > Application" cross-reference feature described below.
2. WinCC flexible 2008 (SP2 minimum). The Alarm Management tree view is only present in the Professional edition; the Compact edition hides discrete alarm triggers.
3. The S7 project and the HMI project must be in the same ProTool/WinCC flexible integration path. Open the S7 project first, then start WinCC flexible from SIMATIC Manager > Options > WinCC flexible to ensure the symbol export link is current.
4. Read access to the source program blocks (*.AWL, *.KOP, *.FUP). Without know-how protection disabled, cross-reference will return only the interface declarations.

4. Method 1 — Reverse-Trace from WinCC flexible Discrete Alarm Editor

This is the fastest route when the engineer has access to the HMI project but not the PLC program.

1. Open the WinCC flexible project that ships with the S7-300 station.
2. In the project tree, expand Alarms > Discrete Alarms (or Analog Alarms for limit-value alarms).
3. Select the alarm row whose trigger is missing. The Trigger Tag cell displays the fully qualified tag, e.g., "DB_HMI".Alarm_Word[0].Bit3 or in absolute form DB20.DBX 4.3.
4. Note the address exactly as shown. WinCC flexible shows symbolic names only if the tag was imported from STEP 7; if it shows raw DBW / DBX, jump to Method 2 directly.
5. For analog alarms the trigger tag is typically a 16-bit PIW or DBW. The alarm properties dialog lists the limit, hysteresis, and tag in three separate columns — copy the tag from the leftmost column.

For very large WinCC flexible projects, use Project > Find (Ctrl+F) and search for the symptom text or alarm number; WinCC flexible will highlight the matching alarm row regardless of category.

5. Method 2 — Forward-Trace from Symbol Table to Logic Block

Use this when you have the alarm text (e.g., "Cooling pump overload") but not the address.

1. In SIMATIC Manager, open the S7 program and double-click S7 Program > Symbols.
2. Press Ctrl+F and search for a fragment of the alarm text or the descriptive part of the tag (e.g., COOLING or OVERLOAD). Match against the Symbol column, not Comment, unless you are specifically looking for documentation cross-links.
3. Locate the matching row. The Address column shows the absolute operand, the Data Type column confirms width.
4. Right-click the row and choose Go To > Usage in Program (German UI: Gehe zu > Verwendung im Programm). STEP 7 jumps to the first usage in the program editor.
5. If the tag is a DB element, double-click the corresponding DB in the Blocks container to open the data block view, then confirm the address and bit offset.

6. Method 3 — Cross-Reference (X-Ref) Function

The cross-reference is the only tool in STEP 7 V5.5 that lists all read, write, and access locations for an operand across the entire program. It is invoked as follows:

1. Open S7 Program > Blocks and double-click any logic block (OB1, FB1, ...).
2. From the program editor, place the cursor on the operand in question (e.g., the bit DB20.DBX 4.3) or, if the operand is unresolved, type it into the Go To > Cross Reference dialog (Ctrl+Shift+F3 on a German keyboard, or right-click > Cross Reference).
3. Choose the scope: All used locations, Only in this block, or User-defined.
4. Review the output table. The columns are: Block, Symbol, Address, Type (read/write/both), Language (LAD/FBD/STL), and Line.

6.1 Interpreting X-Ref for Alarm Triggers

Discrete alarm triggers are most often write-only (the PLC sets the bit, the HMI reads it). If the X-Ref shows only W entries, the trace is complete once you find the writing block. If the trigger is sourced from a flag set in OB35 (cyclic interrupt), filter for that OB explicitly because it is often excluded from the default scope.

6.2 Bit-Granular X-Ref

STEP 7 V5.5 supports the syntax DB20.DBX 4.3 directly in the X-Ref dialog. Do not use the parent word DB20.DBW 4 unless you intend to see all 16 bits simultaneously. For a quick scan of a 16-bit alarm word, use View > Display > Bit Memory / Data Block and watch the dynamic value table during a forced fault.

7. Method 4 — Search / Replace in STL/FBD/LAD Editor

When the program is protected, partially uploaded, or contains no symbol table at all, fall back to raw text search.

1. Open each block (OB1, FB1, FC5, ...) in the appropriate editor.
2. Press Ctrl+F and search for the absolute address, e.g., DBX 4.3. Use the address without the DB number when the DB context is implicit in the view; otherwise include the DB number.
3. Use Search > Replace to highlight all matches in the current block, then page through results with F3.
4. For a project-wide search, in SIMATIC Manager right-click the Blocks container and choose Find in Project (only available in STEP 7 V5.5 with the "Find/Replace" add-on installed).

8. Method 5 — WinCC flexible Symbol Export Cross-Check

When the alarm editor is missing but the underlying tag exists, the symbol export from STEP 7 to WinCC flexible may be out of date.

1. In SIMATIC Manager, right-click the S7 Program and choose PLC > Compile and Download Objects with the option Symbol Export enabled.
2. In WinCC flexible, open Project > Tools > Symbol Browser and refresh (F5).
3. Confirm the previously missing tag now resolves to an address. Re-compile the HMI station.

If the symbol still does not appear, check that the Operand column in STEP 7 has the Symbol (S7) only checkbox ticked in Options > Customize > Symbol Selection; otherwise only DBs exported with a known structure are listed.

9. Handling Partitioned Programs with Hidden Tag Namespaces

Many real-world S7-300 programs are written with a top-level OB1 that calls FB1, FB2, ... FBn, each with an instance DB carrying the bulk of the alarm flags. The X-Ref still works, but the engineer must explicitly open the instance DB:

1. In SIMATIC Manager, expand Blocks and identify the Instance DB (the small icon with DB + an arrow). For an instance DB of FB10, double-click it.
2. Inside the instance DB view, search the Name column for the alarm keyword (e.g., statOverTemp).
3. Confirm the Type column shows BOOL for a discrete alarm or INT / REAL for an analog alarm.
4. The Address column shows the offset inside the instance DB. To compute the absolute DB number, note the DB number of the instance (e.g., DB101 for FB10 instance 1) — the absolute address is then DB101.DBX offset.bit.

If the developer used multi-instance FBs (FB1 declared as STAT inside FB0), the X-Ref must be invoked from the outer FB; nested instance data is not directly addressable from the global symbol table.

10. Edge Cases and Common Failure Modes

11. Verification Procedure

1. From the located trigger bit, capture the X-Ref output as File > Print > Cross Reference for the project archive.
2. In WinCC flexible, open Tools > Symbol Browser and confirm the tag now resolves to a defined value.
3. Force the alarm bit from the STEP 7 variable table (Monitor/Modify) with a write operation. The alarm should appear in the HMI within one polling cycle (default 250 ms for WinCC flexible default connection).
4. Reset the force; confirm the alarm clears. If it does not clear, the program sets the bit repeatedly and a read location is missing from the X-Ref (typical for timers that latch).
5. Repeat the entire trace for each remaining alarm category. Document the symbolic name, absolute address, instance DB, and the writing block in the project README.

12. STEP 7 V5.5 → TIA Portal V13+ Migration Notes

If the project is later migrated to TIA Portal (V13 / V14 / V15 / V16 / V17), the tracing workflow changes substantially:

• Tags are no longer in a flat symbol table; instead they live in PLC tags > Default tag table or in user-defined tag tables.
• Cross-reference is opened by right-clicking the operand in the program editor and choosing Cross-references; the result window is similar but is filtered by software unit.
• HMI alarm triggers are configured in the TIA HMI alarms editor; the relationship is wired through HMI tags that reference PLC tags directly (no separate symbol export step).
• For S7-300 stations targeted by TIA Portal, the project must be migrated using Project > Migrate project; symbols and comments are preserved but instance DB offsets can change if multi-instance FBs are flattened.

13. Frequently Asked Questions