Resolving Siemens S7 DB Initial vs Actual Value Mismatch

Problem Definition

A SIMATIC S7 Data Block (DB) shows one value in the offline view of the TIA Portal project and a different value when the same DB is monitored online. A field case that typifies this symptom: an engineer observed an offline actual value of 14,000 and an online actual value of 19,000 for a flowmeter range setpoint stored in a global DB. The PLC program on the engineering station matched the in-CPU firmware build, and there was no other program source on disk. The discrepancy was not a corrupt download or mismatched firmware: it was the expected behavior of how TIA Portal stores the in-editor copy of the DB versus what the CPU holds in work memory after the most recent write.

Three things are happening at the same time and produce the symptom:

1. The offline project on the programming device is the TIA Portal DB editor view. The Initial value column there is the value that will be used at the next cold start, and the Actual value column reflects the last value read back from the CPU at the time the offline project was last synchronized online.
2. The online monitor view in TIA Portal reads the live work memory of the CPU. If a runtime source wrote to the tag since the last download, the live value differs from the editor's initial value.
3. The CPU preserves non-volatile actual values for retentive tags across STOP-RUN transitions and for all tags across a power cycle if the DB is loaded with the RETAIN attribute set on the relevant tag.

Once you understand that the offline view and the online view are not the same artifact, the symptom becomes diagnostic instead of mysterious. The engineering question becomes: who wrote the online value, and which value is the actual engineering intent?

Initial Value vs Actual Value in an S7 Data Block

In every S7-300, S7-400, S7-1200, and S7-1500 DB, each element has two values stored in the project and one value stored in the CPU at any given time.

For a non-retentive tag (default), the cold restart copies the initial value from load memory to work memory. For a retentive tag, the last actual value is preserved across STOP-RUN and across power-down if the retentive memory is sustained by the CPU's battery (S7-300/400) or by the maintenance-free supercap and SIMATIC memory card (S7-1500).

On an S7-1500, the DB editor exposes "Start value" instead of "Initial value" in some firmware revisions of TIA Portal V15.1 and later. Conceptually, the start value is the initial value; the online "Monitor value" is the actual value. The TIA Portal help system documents this terminology change in the S7-1500 system manual on the Siemens Industry Online Support portal at support.industry.siemens.com.

Why Offline and Online Show Different Values

The offline value seen in the DB editor is what TIA Portal cached the last time it synchronized with the CPU. If the user never clicked "Go online" and read the DB back, the offline view may show the initial value forever regardless of what the CPU actually has. The online value is the live work memory content at the moment of the read request.

Three conditions cause the offline actual value to look stuck while the online actual value changes:

1. No online sync has occurred. The offline actual value is the last value mirrored during the previous online session, or it never updated because the user has not been online.
2. A write occurred after the last download. Some HMI, program block, or communication partner wrote to the tag after the offline project was last synchronized. The CPU is correct; the offline project is stale.
3. Retentive behavior. A non-retentive tag can also show a different value if the CPU was STOPPED and then RUN while the program was reloaded, because reload behavior depends on the target system's "Download to device" options (consistent download vs reset and download).

Whenever the offline view disagrees with the online view, treat the online value as authoritative for runtime and the offline initial value as authoritative for the next cold restart. Decide which one is the true desired value, then make the project match the runtime by either rewriting the live tag or by updating the initial value and reloading.

Common Sources of Writes to a DB Tag

Any of the following can write a new actual value to a DB tag without your code visibly doing so. Run through this list when investigating a drift.

How to Find the Writer in TIA Portal

The standard investigative sequence is:

1. Identify the absolute address and the symbolic name. In the DB editor, the "Address" column shows the byte offset and the "Name" column shows the symbol. Note both, because HMI partners and OPC UA clients often use the absolute address while program code uses the symbol.
2. Run cross-references in the S7 program. Right-click the tag and select "Cross-references" or press Ctrl+Alt+F7. This lists every code site that reads or writes the tag. Pay special attention to any "Write" entries. On S7-1500 with TIA Portal V17 and later, the cross-reference result also lists cross-references from HMI tags if the HMI project is part of the same TIA Portal project.
3. Run cross-references in the HMI project. In the HMI tag list, right-click the tag and select "Cross-references". This lists every HMI screen, recipe, logging object, and script that references the tag.
4. Open a Watch table for the tag. Create a new watch table, add the tag, go online, and watch the value while toggling one suspected writer at a time. This pinpoints the writer if the value changes when only one suspected source is active.
5. Use the PLC trace. For S7-1500, the trace function can record the value of the tag and the trigger condition. Set a trigger that fires when the value changes and record the program cycle counter, which lets you map the change to a specific OB and time.
6. Disable the CPU write protection temporarily. Switch the CPU access level to "Complete protection (no access from PG, no access from HMI, no access from communication)" and watch the value. If it no longer changes, the writer is external. If it still changes, the writer is the program in OB1, OB35, or a cyclic interrupt.

Step-by-Step Resolution Procedure

1. Go online and read the DB. In the project tree, right-click the CPU and choose "Go online". Right-click the DB and choose "Monitor/Modify". Confirm the live actual value. If you have multiple CPUs (H-CPU, R-CPU, F-CPU), check all of them.
2. Compare initial value vs actual value side by side. In the DB editor's "Monitor" view, TIA Portal shows both columns. Note the initial value (yellow background on a retentive tag, white on a non-retentive tag in some versions) and the live actual value.
3. Establish the truth. Decide which value is the correct engineering intent. For a flowmeter range setpoint that is set at commissioning and not changed by operators, the offline initial value is the engineering intent. The online drift is a symptom of an unwanted write.
4. Find the writer using cross-reference as described above.
5. Remove the write at its source. If it is an HMI input, remove the input object or change the HMI tag's access mode to read-only. If it is a program write, gate the write with a condition (e.g. only execute on first scan) or move it to a different tag. If it is a partner PUT/GET, remove the block call from the partner or disable PUT/GET on the local CPU.
6. Restore the correct value. Open a watch table, set "Modify value" to the desired value, and click "Modify once" with the CPU in RUN. The live value is now correct. If the tag is retentive, the value persists across power cycles.
7. Align the initial value with the engineering intent. Edit the initial value in the DB editor to the correct value. If the tag is non-retentive, the next cold restart will copy this value. If the tag is retentive, you must either perform a memory reset or change the retentive behavior to make the initial value authoritative.
8. Re-download the DB to the device. Right-click the DB and choose "Download to device" > "Software (all blocks)" or just the modified DB. Choose "Consistent download" if you want the retentive actual values preserved, or "Reset and download" if you want a clean cold restart.
9. Verify. After download, go online and confirm both the initial value and the actual value match. Power-cycle the CPU (if safe) and confirm the value is still correct. Cycle the CPU STOP-RUN and confirm the value is still correct.

Locking Down a DB Tag Against Unintended Writes

After you have fixed the immediate cause, lock the tag to prevent recurrence.

CPU access protection (S7-1200 and S7-1500)

In the CPU properties under "Protection & Security", the four levels are:

• No protection (default)
• Write protection
• Read/write protection
• Complete protection (no access from PG, no HMI, no communication)

Select "Write protection" if the only path you want to keep is the engineering read, or "Complete protection" if the CPU is in a controlled environment. The protection password is required to change the level later. Documentation for these levels is in the S7-1200 and S7-1500 system manuals on the Siemens Industry Online Support portal at support.industry.siemens.com.

PUT/GET access

On S7-1200 and S7-1500, the CPU property "Permit access with PUT/GET communication from remote partner" controls whether a partner CPU can write to this CPU's DBs without explicit connection configuration. Disable it if you do not need this capability. S7-1500 CPUs with firmware V2.0 and later also support OPC UA, which has its own certificate-based authentication; review the OPC UA server configuration and disable anonymous write if it is enabled.

HMI tag access mode

In the HMI tag list, the "Access mode" column controls whether the HMI can read, write, or both. Set the access mode to "Read" for the flowmeter setpoint tag. Note that access mode on the HMI side is advisory: a determined programmer can still write via OPC UA or PUT/GET if those are enabled.

Know-how protection (program blocks)

For program code that contains the write, apply "Know-how protection" to the block. This encrypts the block so the write site is not visible to anyone downloading the program to the engineering station. Combined with CPU write protection, this makes accidental external writes impossible without the password.

Symbolic vs absolute addressing

Prefer symbolic addressing throughout the program. Absolute addresses are easier to write to from a partner via PUT/GET because the partner only needs the absolute address. Symbolic addressing forces the partner to either know the symbol or have a configured connection, both of which are auditable in the project.

Retention, MRES, and "Reset to Factory Settings"

Understanding CPU reset behavior is essential to align the offline initial value with the live runtime.

For the field case where the offline initial value is the correct engineering intent and the live value is a corrupted setpoint, the simplest recovery on an S7-1500 is: perform a memory reset, re-download the program, and let the retentive tag take its initial value on the first cycle. On an S7-300, the same procedure uses MRES instead of "Reset to factory settings".

Design Pattern: Keep Setpoints in Recipes, Not Bare DB Tags

If the flowmeter range setpoint is meant to be set once at commissioning and read-only thereafter, the engineering pattern that prevents this entire class of bug is to use the recipe view or the HMI "User-defined data type" pattern, where the setpoint is an element of a recipe record and is only written by an explicit operator action.

• Recipe view on HMI: The operator enters the recipe values, the HMI transfers them to the CPU DB in a single transaction, and the transaction is logged. The HMI tag list marks the tag as read-only outside the recipe view.
• Data record load from a user program: The program reads the recipe from a recipe DB on demand (e.g. on a button press), and the recipe DB itself is write-protected by know-how protection. The runtime setpoint DB is read-only from HMI.
• Initial value as commissioning source of truth: The commissioning engineer enters the correct value as the initial value in the DB editor, downloads the program, and the value is set in stone until the next cold restart or memory reset. No external write can touch it because the CPU access level and HMI access mode are locked down.

For a flowmeter range setpoint, the third pattern is the most common. Use it unless the operator needs to change the setpoint on the fly, in which case use the recipe view with audit logging. Whichever pattern is chosen, the TIA Portal help system documents the data block and recipe view configuration under "PLC programming" > "Data blocks" on the Siemens Industry Online Support portal at support.industry.siemens.com.

Verification Checklist

After applying the fix, run the following checks to confirm the symptom does not return.

1. Go online and read the DB. Initial value column == Actual value column. Both equal the engineering intent.
2. Open a watch table on the tag. Leave it open for at least one full process cycle. Confirm the value does not drift.
3. Cycle the CPU STOP -> RUN. Confirm the value is preserved (retentive) or reset to initial (non-retentive), as intended.
4. Power-cycle the CPU (if the plant allows). Confirm the value is preserved on retentive tags.
5. Disconnect any external partner and re-check. The value must be stable without the partner.
6. Re-enable the partner and re-check. The value must still be stable.
7. If the partner wrote the wrong value before, remove the write at the partner side and confirm the value no longer drifts.

Edge Cases and Field-Proven Caveats

Several cases recur in the field that are worth flagging explicitly.

Case 1: HMI written via array element

The HMI does not always write the full DB; it can write a sub-range (e.g. DB100.DBD0..DBD19) corresponding to a recipe element. The cross-reference will show the array element, not the individual tag. Look for any tag whose address overlaps the suspected tag. In TIA Portal, use "Go to > Usage" on the array symbol to see every element accessed.

Case 2: OPC UA write from an external SCADA

S7-1500 OPC UA server exposes DB tags as variables. The default security policy may allow anonymous read but require certificate-based write. If a partner SCADA has a valid certificate and the security policy permits it, it can write the tag. Inspect the S7-1500 OPC UA partner list and the security policy in TIA Portal under "OPC UA Server" > "Security". Disable anonymous write and require sign-and-encrypt for the production environment.

Case 3: A user web page on the S7-1500 web server

S7-1500 with firmware V2.0 and later supports user-defined web pages. A JavaScript AJAX POST to the AWP variable can write the DB. Inspect the user-defined web page source under "Web server" > "User-defined pages" in the CPU properties. Restrict the user to read-only role for the affected page, and remove the AJAX POST handler from the page source.

Case 4: Recipe view transfers on every HMI screen change

If the recipe view element is on the operator screen and the screen is refreshed on every navigation, the HMI may re-transfer the recipe values on every screen change. Inspect the HMI "Transfer" event in the screen's events list and confirm it is gated by the operator's "Save" button, not on screen load or screen change.

Case 5: The offline actual value is the cached online value at the time of the last save

The offline project file stores the actual value at the time of the last online read. If you are not online, the value is whatever the project was last saved with. It is not refreshed automatically when the CPU writes to the tag. This explains the symptom in the field case: the engineer sees 14,000 offline because that is the value at the last save, and 19,000 online because the CPU has since been written to.

Case 6: TIA Portal version mismatch

If the offline project is in TIA Portal V16 and the online CPU is firmware V2.6 but the project was originally built in V15.1, TIA Portal may refuse to read the DB online and may show the offline value as fallback. Confirm the TIA Portal version supports the CPU firmware per the Siemens TIA Portal release notes. The TIA Portal version compatibility matrix is published on the Siemens Industry Online Support portal at support.industry.siemens.com.

Case 7: The CPU was online-edited and the change was not committed

TIA Portal supports online editing of DBs and program blocks. If an engineer made a change online and the change was never committed to the offline project, the offline view will not reflect the online change. Look at the "Online" > "Compare" view to see pending online edits. Either commit the online change to the offline project or revert it before downloading.

Case 8: The value is held in a multi-instance DB of an FB, not the global DB

If the flowmeter range setpoint is a static variable of a function block, the value lives in the multi-instance DB of that FB, not in a standalone global DB. Cross-reference from the FB static, not the global DB, and verify the multi-instance DB's initial value and actual value independently.

Frequently Asked Questions