Resolving Siemens WinCC Flexible Error 190011, 190012, and 190001 on OP 277 with Tag DB11DW22

This technical reference documents the root-cause analysis and corrective actions for the cluster of WinCC flexible 2008 system alarms 190001, 190011, 190012, 230000, 230005, 270006, 70018, 70022, and 110001 generated on a SIMATIC OP 277 6" / 10" panel when a connected S7 PLC rejects writes to tag DB11.DBW22. The alarm cluster is recurring on the runtime display even though the plant has not been modified, which is the strongest indicator that the underlying issue is a stale tag limit, a buffer restoration mismatch, or a connection state transition that has been re-armed after a password-list reload.

1. Environment and Component Identification

Before investigating the alarms, confirm the engineering environment. The runtime signals in the source correspond to a SIMATIC HMI panel that is configured with WinCC flexible 2008 SP3 (or later) and is communicating with an S7 PLC over MPI / PROFIBUS / Ethernet. The classic OP 277 6" (6AV6 642-0DC01-1AX1) and OP 277 10" (6AV6 642-0DC01-1AX2) ship with WinCC flexible 2008 as their default engineering environment. Identify the components below before any fault analysis is attempted.

Reference: SIMATIC HMI WinCC flexible 2008 Communication Part 1 (Edition 2008).

2. Alarm Cluster Decoded

WinCC flexible logs system alarms in the alarm buffer with a numeric event ID, the associated tag (if any), the text from the runtime catalog, the date, and the time. The cluster from the incident is shown below with the canonical Siemens text and the engineering meaning of each alarm.

3. Anatomy of the Tag DB11.DBW22

The address DB11.DBW22 is an absolute S7 data word (16-bit integer) inside data block 11, byte offset 22. The syntax is interpreted as:

• DB11 – instance / shared data block number 11.
• DW22 – data word starting at byte 22 (covers bytes 22 and 23, MOTOROLA / big-endian byte order by default in WinCC flexible).

If the runtime is configured with the symbol name rather than the absolute address, the configuration can still resolve to DB11.DBW22. Confirm the symbol table in STEP 7 (or TIA Portal) and verify that the corresponding data block is not optimized/block-optimized (S7-1500 only); on S7-300/400 this is not an issue because only absolute addressing is supported.

4. Why the Alarms Recur After a Project Reload

The incident timeline shows a strict ordering of events: 110001 → 150001 → 70022 → 70018 → 270006 → 230000 → 230005 → 190012 → 190011 → 190001. Each event has a deterministic relationship to the one before it, which makes diagnosis straightforward.

1. 110001 / 150001: After the OP 277 was re-commissioned with the January 2016 backup, the panel booted and re-established its MPI/PROFIBUS connection. The connection restoral event is recorded before the password list is processed because the user administration file is read after the runtime stack initializes the driver.
2. 70022 → 70018: The password list import started and completed successfully. This is informational; it does not normally correlate with tag write failures.
3. 270006: The project on the OP 277 does not match the persistent alarm buffer of the panel that was retained across the re-commissioning (or across a battery-backed reboot). WinCC flexible detects the CRC / version mismatch and discards the persistent alarm buffer. This is the single most important event in the cluster because it indicates that the alarms currently visible on the screen cannot be acknowledged via the buffer and must be cleared by re-acknowledging them in the active runtime.
4. 230000 / 230005: After the project reloaded, the configured input field for the tag re-armed its validation limits. The limits shown in the alarm text — "[0 – 999]" — are the values stored inside the WinCC flexible project, not the values from the PLC. The input was rejected because it exceeded 999, which is the configured upper limit.
5. 190012: The runtime attempted to convert the operator value (likely a real / floating-point string from an I/O field) into the INT type used by the tag DB11.DBW22 on the PLC side. The conversion failed (string not numeric, or out of INT range -32768..32767).
6. 190011: Because the conversion failed, no valid S7 write request was generated; the driver reports that the value could not be written to the PLC. On some panels, a partial request still goes out and is rejected by the CPU with S7 error code 0x0A (Object does not exist) or 0x05 (Address out of range).
7. 190001: Once the operator dismissed the dialog or the field regained a valid value, the error status ended. The fact that 190001 is also recurring strongly implies the field is being driven again (by a script, by a scheduled job, or by an automatic re-arming of an animation).

Reference: SIMATIC HMI WinCC flexible 2008 Communication Part 1 (Edition 2008), Appendix 9.1 "System Alarms".

5. Confirming the Root Cause

The likely root cause is a combination of two factors:

1. Range limit mismatch: The I/O field for tag DB11.DBW22 is configured with limits "0 – 999" in the WinCC flexible project. When an external system (PLC, script, or operator) attempts to write a value outside that range, the runtime first emits 230005, then 190012 if the value is not representable in the tag type, then 190011 when the write is dropped, then 190001 when the field recovers.
2. Persistent alarm buffer mismatch: The 270006 event indicates that the persistent buffer does not match the current project; this is a one-time event that should not be repeated unless the project CRC changes again (e.g., a recompile, a transfer of a new .pwl, or a firmware update on the panel).

A third, less common cause is block / DB protection: if data block 11 has been configured with know-how protection in STEP 7, the runtime may receive a return code that translates to "value could not be written" because the panel does not have the password for the block. Verify by reading DB11.DBW22 in STEP 7 online; if the variable cannot be monitored from the PC either, the block is protected.

6. Diagnostic Procedure

Run the procedure below in the order given. Each step produces a binary result (pass / fail) that points to the next step.

6.1 Check the live tag value in STEP 7

1. Connect the engineering station to the PLC with a PC Adapter (MPI/PROFIBUS) or directly over Ethernet.
2. Open the project in STEP 7 (or TIA Portal) and go online with the CPU.
3. Open the variable table VAT for DB11 and monitor DB11.DBW22.
4. Try to write a known value (for example 100) into the tag from STEP 7. If STEP 7 reports "Object access error", the issue is in the PLC (block protection, address out of range, or DB not loaded).
5. Run STATUS DB11 from the PG to confirm the data block exists and is not blocked by the security level.

6.2 Check the tag configuration in WinCC flexible

1. Open the project in WinCC flexible 2008.
2. Navigate to Project → HMI Tags → DB11_DBW22.
3. Confirm the following parameters:

6.3 Check the I/O field limits

1. Open the screen that contains the field bound to DB11.DBW22.
2. Select the I/O field and read the Properties → Limits tab.
3. Confirm the configured lower / upper limits match the operational range. If the upper limit is set to 999 and the PLC needs values up to, for example, 1500, the runtime will reject values between 1000 and 1500 with 230005.
4. If the value must be unbounded, configure the field as Limits = None in WinCC flexible. The runtime will then accept any value representable in INT (-32768 to 32767).

6.4 Check scripts that write the tag

1. In WinCC flexible, open Project → Scripts → Global Script and search for any SmartTags("DB11_DBW22") or HMIRuntime.Tags("DB11_DBW22") reference.
2. Confirm that the script does not assign a non-numeric string to the tag before the conversion step.
3. If the script reads from another tag and forwards the value, check the data types of both tags. A mismatch between a STRING source and an INT target is a frequent source of 190012.

6.5 Check the connection and bus profile

1. Verify that the PLC rack / slot of the CPU matches the configured connection in WinCC flexible.
2. Check the bus terminators on PROFIBUS segments — incorrect termination is the most common cause of intermittent 150001 (connection restoral) events that precede 190011.
3. On an OP 277 6" with MPI, confirm that the OP address differs from the CPU address (CPU = 2, OP = 1 / 3 are typical).
4. Capture an MPI / PROFIBUS trace with a diagnostic repeater if 150001 recurs more than once per shift.

7. Solutions

7.1 Adjust the I/O field range

If the runtime limit (0 – 999) is too restrictive, change it in WinCC flexible and re-transfer the project. Example for an I/O field bound to an INT tag:

1. In the I/O field properties, set Limits → Minimum = -32768, Maximum = 32767, or Limits = None.
2. Compile the project (Project → Compiler → All).
3. Transfer to the OP 277 over Ethernet (PN) or MPI.
4. Verify on the panel: open the screen, enter 1234, confirm it appears in the field and that the PLC VAT shows 1234 at DB11.DBW22.

7.2 Recompile and re-transfer to clear the persistent buffer mismatch

The 270006 event is cleared by transferring a fresh project to the panel that matches the runtime CRC stored in the panel. Procedure:

1. Open the WinCC flexible project that was last transferred successfully.
2. Project → Transfer → Transfer Settings: confirm the panel type and the connection mode (MPI address / PN IP address).
3. From the engineering station, select Project → Transfer → Transfer to Device.
4. Confirm the transfer dialog and wait for the panel to restart.
5. After restart, the 270006 alarm should not reappear unless the project is recompiled or replaced.

7.3 Address S7 protection or address errors

If STEP 7 reports an access error on DB11.DBW22:

• Remove know-how protection from DB11 in STEP 7 (LAD/FBD/ST → Options → Know-How Protection → Remove).
• Confirm the data block length is at least 24 bytes (so that DW22 fits): use STEP 7 → DB11 → Properties → Address View and check the maximum byte offset.
• If the data block is shorter than 24 bytes, extend it in STEP 7 and re-download to the CPU. Do not extend a DB that has instance references without first running a consistency check.

7.4 Validate scripts

For each script that writes to DB11.DBW22, ensure that the source variable is converted to INT before the assignment. Example VBScript for WinCC flexible:

Dim sValue
sValue = SmartTags("SourceString")
If IsNumeric(sValue) Then
  Dim iValue
  iValue = CInt(sValue)
  If iValue >= -32768 And iValue <= 32767 Then
    SmartTags("DB11_DBW22") = iValue
  Else
    ' Out of INT range — do not write
  End If
Else
  ' Source is not numeric — do not write
End If

The CInt call performs the same conversion as the runtime, but inside a try-style guard so that 190012 is not generated when the value is non-numeric.

8. Verification Checklist

After applying the corrections, perform the checks below to confirm the alarm cluster does not return.

9. Preventive Measures

The recurrence of the alarm cluster — especially 270006 — indicates that the project was modified and re-transferred while alarms were still pending in the persistent buffer. Apply the preventive measures below to avoid the same cluster in the future.

1. Align limits with the PLC range: keep the I/O field limits consistent with the actual operational range of the tag, or set limits to "None" for read-only or scripted tags.
2. Centralize scripts: put all writes to DB11.DBW22 into a single function library that performs the conversion guard shown in section 7.4. This guarantees a single point of validation.
3. Acknowledge alarms before recompile: clear the alarm buffer from the panel control panel before recompiling and re-transferring the project. This avoids the mismatch that triggers 270006.
4. Version the project: keep a copy of every .hmi project, .pwl (password list), and runtime CRC together in the engineering backup. The OP 277 stores the CRC of the last successful transfer; if it does not match the project on the engineering station, 270006 will fire.
5. Document the password list lifecycle: 70018 / 70022 are normal events but should be referenced in the operator log. A typical pattern is to import the password list once after a project transfer and never again until the next project update.
6. Audit block access: do not enable know-how protection on DB11 unless it is required; the protection triggers a write reject that the panel translates into 190011.

10. Migration Path to TIA Portal

WinCC flexible 2008 has been superseded by WinCC in TIA Portal since V11. If the OP 277 is replaced by a Comfort Panel (TP700 / TP900 / TP1200) or a Unified Panel (MTP700 / MTP1000), the equivalent system alarms in the TIA Portal runtime use the same numeric IDs but the catalog is expanded. The migration steps are:

1. Open the project in TIA Portal (V16 or later recommended for the OP 277 migration tool).
2. Run Tools → Migrate Project; the tool translates DB11.DBW22 from absolute to symbolic addressing automatically if a matching symbol exists in the S7-300/400 project.
3. Recompile the HMI project and download to the new panel.
4. Validate the same checks from section 8.

Reference: SIMATIC WinCC in TIA Portal — System Alarms (Entry ID 109746495) (Siemens Industry Online Support).

11. Related System Alarms

The same family of alarms is documented in the WinCC flexible Communication manual. The most common siblings are listed below for cross-reference.

12. Quick Reference — Number Range to Source Mapping

Reference: SIMATIC HMI WinCC flexible 2008 Communication Part 1 (Edition 2008), Section 9.1.

FAQ