Resolving STEP 7 Symbol Server Errors in WinCC Tag Management

When integrating STEP 7 (SIMATIC Manager) projects with WinCC SCADA, engineers rely on the Symbol Server to bulk-transfer PLC tag definitions — symbolic names, data types, and absolute addresses — directly into the WinCC Tag Management database. A recurring fault, the "the selection is invalid, please note the selected data type or number of tags" dialog, blocks the transfer and halts commissioning. This reference documents the failure modes, the underlying root causes, and the field-proven remediation sequence for STEP 7 V5.4 / V5.5 / V5.6 against WinCC V7.0 / V7.2 / V7.3 / V7.4 environments, with verified workarounds for the most common version-pair mismatches reported on engineering stations worldwide.

1. Problem Overview

The STEP 7 Symbol Server is the bridge that lets WinCC consume symbolic names, data types, and absolute addresses directly from a STEP 7 S7 program. It is implemented as an out-of-process COM/DCOM service (the S7OLE service, hosted in S7oleax.dll) that exposes the STEP 7 program tree to any OPC-aware or Symbol-Server-aware consumer. Engineers typically reach it through one of three paths:

1. From WinCC Explorer, right-click Tag Management → Add new driver → SIMATIC S7 Protocol Suite → Symbols.
2. From the Windows Control Panel applet Siemens Automation → STEP 7 Symbol Server (the standalone snap-in used to verify the bridge independently of WinCC).
3. From the menu SIMATIC Manager → Options → Symbol Server, which opens the same snap-in from the STEP 7 side.

When the bridge is broken, two distinct symptom families appear:

1. Silent transfer: The Symbol Server node lists the STEP 7 program, the engineer drags tags into WinCC Tag Management, and no entries appear in the tag list. No error dialog is raised.
2. Dialog rejection: Selecting a tag, block instance, or data block and clicking OK produces the dialog "the selection is invalid — please note the selected data type or number of tags". The same dialog can also read "data transfer failed" when the symbol is non-symbolic or carries a malformed data type descriptor.

2. Symptoms and Error Catalog

The following error strings have been observed in the field, each reproduced verbatim from the WinCC Explorer, the WinCC Configuration Studio log, the Symbol Server snap-in, and the Windows Application event log. Match the exact text you see in your environment against this table before proceeding — the wording changes between service packs and reveals which code path rejected the call.

The dialog text is the primary diagnostic anchor. If the message references the "data type", the symbol is structurally incompatible — a UDT instance in STEP 7 V5.4 mapped against a WinCC V7.0 tag that cannot represent STRING[254] is the canonical example. If the message references the "number of tags", the selection has crossed the 32 768-symbol limit of a single Symbol Server block transfer, or has crossed the 1 024-symbol limit of a single OK-click in the WinCC dialog.

3. Architecture — How the Symbol Server Actually Works

Understanding the component stack prevents misdiagnosis. The Symbol Server is not a single executable — it is a chain of three components, each of which can independently reject a transfer request.

3.1 S7OLE — the COM facade

S7oleax.dll is registered as an in-process COM server with the ProgID Siemens.SymbolServer.1 and the DCOM appid {A6C8C5C0-1234-4B5A-9C3D-1A2B3C4D5E6F} (the precise GUID varies by service pack). It marshals tag selection calls from WinCC into a memory-mapped section that s7wtrapi.dll reads. When this DLL is unregistered — by an antivirus quarantine, by an interrupted STEP 7 uninstall, or by a Windows in-place upgrade — the chain breaks at the front.

3.2 s7wtrapi / s7wtrsax — the STEP 7 writer API

These two DLLs implement the writer side of the STEP 7 symbol export. They walk the offline S7 program of the currently registered STEP 7 project, walk the symbol table, and expose the result as a flat list. If the project is not compiled, the writer returns the last compiled schema; if no compile has ever occurred, the writer returns an empty list and WinCC sees no tags at all (silent failure mode).

3.3 s7oiex / S7DOS — the SIMATIC Manager broker

The S7DOS service is the broker that hands the offline S7 program to the writer. It must be running. On workstations where SIMATIC Manager has never been started, the service is dormant and WinCC must be the first consumer to wake it. If the service is stuck in Starting, the Symbol Server times out and the dialog appears with no further diagnostics.

4. Root Cause Analysis

Four independent root causes — and a fifth compound fault — produce the same dialog. Each must be ruled out in sequence before escalation to the vendor.

4.1 AS-OS Engineering component is not installed

The AS-OS Engineering option package is the runtime bridge that allows WinCC to call into the STEP 7 Symbol Server API. Without it, WinCC can browse the Symbol Server tree (the COM facade is present in the base WinCC install) but cannot bind selected symbols to its internal tag database (the writer API is gated behind AS-OS). The component ships only with the full WinCC DVD and is not included with STEP 7, with WinCC Runtime, with WinCC/PCS 7 add-ons, or with TIA Portal. This is the single most common cause of the fault in fresh installations and accounts for the majority of field reports.

4.2 STEP 7 / WinCC version mismatch

Siemens does not certify every combination of STEP 7 service pack and WinCC service pack. The combination STEP 7 V5.5 + SP3 against WinCC V7.0 SP3 has been documented as untested and produces the "selection is invalid" dialog intermittently — typically when the first tag selected is a UDT instance. Likewise, STEP 7 V5.4 SPx paired with WinCC V7.2 introduces UDT schema drift that surfaces as the same dialog when blocks are dragged from a multi-project environment.

4.3 Corrupted Symbol Server registration

Windows DCOM, the S7OLE service, and the Symbol Server DCOM appid must all be registered. Re-imaging, antivirus quarantine (Symantec Endpoint Protection and McAfee have been observed to quarantine S7oleax.dll after STEP 7 SP upgrades), or installing a second STEP 7 instance on the same workstation can deregister the Symbol Server without surfacing any other symptom. WinCC then sees the server object exist in the registry but cannot marshal the call, and the dialog appears.

4.4 STEP 7 project inconsistency

Uncompiled STEP 7 changes, a partially-saved S7 program, a missing source-of-truth between the offline and online program, or an unresolved UDT reference causes the Symbol Server to publish a stale or partial schema. WinCC's schema check rejects the version it receives. In multi-project engineering, this is the most common cause once AS-OS and version compatibility are both verified.

4.5 Compound fault

Any two of the above can mask each other. Reinstalling WinCC alone, for example, will not resolve a project that has never been compiled, and recompiling a STEP 7 project will not resolve a missing AS-OS install. Always apply Solution 1 (AS-OS) before assuming the version pair is the problem.

5. Affected Software Versions

The following table summarises the version pairs in which the fault has been observed in the field and the recommended fix path. Versions are taken from the Siemens Industry Online Support product matrix and the SIMATIC compatibility tool.

6. Solution 1 — Install AS-OS Engineering

AS-OS Engineering is the first-line fix and resolves the fault in roughly 80% of reported incidents. Install it on the engineering station that hosts both SIMATIC Manager and WinCC Explorer. The install is non-destructive — it does not remove the existing WinCC or STEP 7 install — but it does re-register the Symbol Server DCOM components and a reboot is mandatory.

6.1 Prerequisites

• Local administrator account on the engineering station.
• WinCC installation DVD matching the installed WinCC version (e.g., WinCC V7.0 SP3 DVD for a V7.0 SP3 install — the SP must match).
• STEP 7 V5.x installation media accessible, in case the Symbol Server DCOM components need repair.
• All running WinCC projects closed; SIMATIC Manager may stay open but should not be in the middle of a save.
• Antivirus temporarily disabled — Symantec and McAfee have been observed to quarantine S7oleax.dll mid-install.

6.2 Step-by-step installation

1. Insert the WinCC installation DVD. If autorun is disabled, launch Setup.exe from the DVD root as administrator.
2. Select the language and accept the license agreement.
3. On the Installation type screen, choose "User-defined installation". The default "Standard installation" does not include AS-OS.
4. In the component tree, expand WinCC → Options.
5. Tick AS-OS Engineering. The installer may also offer S7-PLCSIM, STEP 7 Connectivity, and WinCC Connectivity Pack; do not deselect STEP 7 Connectivity if it is currently installed, as it shares the S7OLE service.
6. Confirm prerequisites. The installer will display the warning "The STEP 7 Symbol Server will be re-registered. Other STEP 7 instances may need re-installation." Acknowledge.
7. Click Install. Typical install time is 3 to 7 minutes; allow 15 minutes on a workstation under group policy.
8. When prompted, restart the engineering station. The Symbol Server DCOM service is registered at boot — it cannot be registered on a running system.

6.3 Verification

After reboot, open the Windows Control Panel → Siemens Automation → STEP 7 Symbol Server. The snap-in should open without error and list the most recently used STEP 7 project. If the snap-in reports "Symbol Server is not registered", proceed to Solution 3 (re-registration). If the snap-in opens but the project is empty, proceed to Solution 4 (recompile).

7. Solution 2 — Version Compatibility Remediation

When AS-OS is confirmed installed and the error persists, the combination of STEP 7 service pack and WinCC service pack is suspect. The remediation depends on which side of the matrix is older and on whether the workstation hosts only one WinCC version or several.

7.1 Determine the installed versions

Read the exact build from the registry to avoid trusting the splash screen, which sometimes reports the major version only:

HKLM\SOFTWARE\Siemens\Automation\Step7\CurrentVersion → "VersionString"
HKLM\SOFTWARE\Siemens\Automation\WinCC\Setup → "ProductVersion"
HKLM\SOFTWARE\Siemens\Automation\WinCC\Setup → "ServicePack"

Compare against the compatibility matrix in section 5. Any pair listed as "Fault observed" or "Intermittent fault" must be remediated before the next commissioning attempt.

7.2 Upgrade path (preferred)

1. Identify the most recent WinCC SP applicable to the installed WinCC version. For WinCC V7.0 the last SP is SP3 plus a hotfix; for V7.2 the last is SP2 plus a hotfix; for V7.3 the last is SP4.
2. Apply the WinCC SP first. WinCC upgrades are forward-compatible with STEP 7 but not always backward-compatible — installing a newer SP after a newer STEP 7 will leave the Symbol Server registered against the older STEP 7.
3. Apply the matching STEP 7 SP. As of writing, STEP 7 V5.5 is at SP4 and STEP 7 V5.6 is at SP1 — both certified against current WinCC releases.
4. Re-register the Symbol Server after each install: Start → Programs → Siemens Automation → STEP 7 → Register Symbol Server. The console should report "Symbol Server registered successfully."
5. Reboot and verify per section 10.

7.3 Downgrade path

If the WinCC version is locked by a project site standard (e.g., a brownfield plant standardised on WinCC V7.0 SP3 for years of validated runtime), downgrade STEP 7 instead. Uninstalling SP3 over SP2 is supported by the STEP 7 setup and does not require a full reinstall.

8. Solution 3 — Re-register the Symbol Server

When the AS-OS component is installed but the snap-in still reports "Symbol Server is not registered", or when the Windows Event Viewer logs DCOM Event 10016 against the Symbol Server appid, the COM registration is corrupt. Re-register from an elevated command prompt.

1. Close all Siemens applications — WinCC Explorer, SIMATIC Manager, the Symbol Server snap-in, and the WinCC Configuration Studio.
2. Open Command Prompt (Run as administrator).
3. Navigate to the STEP 7 installation path. The default is:
   cd "C:\Program Files (x86)\Siemens\Automation\Step7\S7BIN"
4. Re-register the Symbol Server DLLs in this exact order:
   regsvr32.exe S7oleax.dll
regsvr32.exe s7wtrapi.dll
regsvr32.exe s7wtrsax.dll
regsvr32.exe s7oiex.dll
5. Each call should return "DllRegisterServer in <file> succeeded." If a call returns 0x80070005 (access denied), the command prompt was not elevated — start over as administrator.
6. Reboot. The Symbol Server DCOM appid is reset during the next Register Symbol Server pass.
7. Launch Register Symbol Server from the Start menu. The console should report "Symbol Server registered successfully."

8.1 DCOM permission reset

If the re-registration succeeds but the snap-in still fails, the DCOM launch and access permissions have been overridden by group policy. Reset them in dcomcnfg:

1. Open Component Services (run dcomcnfg).
2. Navigate to Component Services → Computers → My Computer → DCOM Config.
3. Locate the entry STEP 7 Symbol Server (right-click → Properties).
4. On the Security tab, set Launch and Activation Permissions to Use Default and Access Permissions to Use Default. The defaults grant the local Interactive and Administrators groups the required access.
5. On the Identity tab, set Run this application as to The launching user. Avoid The system account; the Symbol Server requires the launching user's STEP 7 project context.
6. Apply, close, and reboot.

9. Solution 4 — Recompile the STEP 7 Project

If the Symbol Server is functional and the version pair is certified, the STEP 7 project itself is publishing an inconsistent schema. A full recompile rebuilds the symbol table that the Symbol Server exposes and is the only way to flush a stale schema. This step is also recommended as routine hygiene immediately before any WinCC tag import.

1. In SIMATIC Manager, open the affected S7 program.
2. Right-click the Blocks folder and select "Compile and Download Objects → Compile (all blocks)". For large projects (> 5 000 blocks) this can take 10 to 20 minutes; budget accordingly.
3. Watch the compile log for warnings as well as errors. Warnings of the form "Instance DB has no symbolic name" are silently dropped by the Symbol Server and surface as the "selection is invalid" dialog when the engineer tries to drag them.
4. Alternatively, for multi-project engineering, in the menu bar select Options → Compile Multiple S7 Projects. This is the procedure Siemens support recommended for environments with several S7 programs sharing one PC station, and is also the procedure that resolves the silent-failure mode of section 1.
5. When the compile finishes without warnings, save the project.
6. Restart WinCC Explorer and retry the symbol import.

9.1 Schema validation

Before re-attempting the transfer, validate that the symbol table is internally consistent:

Look for the following anti-patterns, all of which are silently dropped by the Symbol Server and surface as the "selection is invalid" dialog:

• Duplicate symbolic names pointing to different absolute addresses (STEP 7 permits the duplicate at the project level but WinCC rejects the ambiguity).
• UDT references where the UDT itself is in a different, uncompiled program or in a library that has not been opened on this workstation.
• Symbolic names exceeding 24 characters (STEP 7 truncates the displayed name; WinCC rejects the truncated form with a data-type error).
• Strings declared as STRING[n] with n > 254 — outside the WinCC STRING limit. WinCC 7.x supports up to STRING[254]; longer declarations must be split at the STEP 7 level.
• Symbols whose data type is POINTER, ANY, or Variant — these are not representable as WinCC tags and the Symbol Server flags them as invalid.
• Multi-instance DBs whose parent FB is in a different AS station of a multi-project.

10. Solution 5 — Clean Reinstall in the Correct Order

If Solutions 1 through 4 fail, the most reliable — but most disruptive — fix is a clean reinstall in the order prescribed by Siemens. This resolves DCOM corruption, mixed-version S7OLE libraries, partial AS-OS installs, and stale HKLM registry entries in a single pass. Schedule a maintenance window of two to four hours.

1. Uninstall STEP 7 first. Use the Windows Programs and Features applet, sort by publisher Siemens AG, and uninstall from the top down. Reboot.
2. Uninstall WinCC the same way. Reboot.
3. Delete the residual directories manually:
   rd /s /q "C:\Program Files (x86)\Siemens"
rd /s /q "C:\Program Files\Siemens"
rd /s /q "%APPDATA%\Siemens"
rd /s /q "%LOCALAPPDATA%\Siemens"
4. Delete the STEP 7 / WinCC registry hive (after exporting a backup):
   reg delete "HKLM\SOFTWARE\Siemens\Automation" /f
5. Reinstall STEP 7 from the original media. Apply the target service pack.
6. Reinstall WinCC from the original media. During the user-defined install, ensure AS-OS Engineering is selected.
7. Apply the WinCC service pack.
8. Re-register the Symbol Server as in Solution 3.
9. Reboot and test the import path end-to-end using the verification procedure in section 11.

11. Verification Procedure

After applying any fix, run the following verification sequence before declaring the workstation healthy. Each step exercises a different code path; failure at any step points to a different residual fault.

1. Open the STEP 7 Symbol Server snap-in. The local STEP 7 project must appear in the tree without a red ✗ next to the program node. A red ✗ indicates the project is not compiled; a yellow ! indicates the project is read-only or the user lacks write permission on the project directory.
2. Open WinCC Explorer → Tag Management. Right-click → Add new driver → SIMATIC S7-300 / S7-400 Protocol Suite → Symbols. The connection should report "OK" in the status bar.
3. Browse the program, select a single known-good tag (e.g., DB100.DBD0 — REAL), and click OK. The dialog should close without error and the tag should appear in Tag Management with the correct address, data type, and symbolic name.
4. Select a 10-tag range. The dialog should close and 10 tags should appear in Tag Management. This validates the multi-tag count code path that is the second branch of the "selection is invalid" message.
5. Select a UDT instance, e.g. DB200 — "Motor_UDT". The dialog should expand the UDT into its members and import each as a separate tag. This validates the UDT path, which is the most common source of intermittent faults.
6. Open the Windows Event Viewer → Application log. No Event 4900 / S7OLE errors and no Event 10016 / DCOM errors should have been logged during the test.
7. Restart WinCC Runtime and confirm that the imported tags update correctly from the live PLC. A tag that imports but never updates indicates the symbol was imported as a placeholder and the S7DOS connection was never bound.

Failure at step 3 indicates the version compatibility fault is still active. Failure at step 4 indicates a per-symbol schema drift — return to Solution 4 and recompile, then check the symbol table for the patterns listed in section 9.1. Failure at step 5 indicates a UDT schema mismatch and points to a version-pair problem; the OPC workaround of section 12 is the practical mitigation.

12. Alternative — OPC DA / SIMATIC NET Path

When the legacy Symbol Server cannot be made stable — for example, in a fleet of workstations where the STEP 7 SP is dictated by another system and cannot be aligned with the WinCC SP — route the tag data through the SIMATIC NET OPC server. The OPC server exposes the same STEP 7 symbols under its S7 tab, and WinCC can consume them through the OPC channel rather than the SIMATIC S7 Protocol Suite channel. The integration steps are documented in the Siemens Industry Online Support entry "How do you use the variable symbols defined in STEP 7 with the OPC server of SIMATIC NET?". In summary:

1. Install SIMATIC NET on the engineering station, with the OPC server option selected. The version of SIMATIC NET must be certified against the installed STEP 7 version — the SIMATIC NET V14 SP1 release, for example, is the most recent to support STEP 7 V5.x as a data source.
2. Configure the PC station in the SIMATIC Manager Component Configurator with the OPC server slot and the IE General / PROFIBUS / MPI interface.
3. In the SIMATIC NET OPC Scout or the PC station configuration, open the Properties of the OPC server and switch to the S7 tab.
4. Browse the STEP 7 symbol table and mark the symbols to publish. The OPC server caches the symbol schema and is not sensitive to the same DCOM corruption that breaks the direct Symbol Server path.
5. In WinCC Tag Management, add the OPC channel and configure a connection to the SIMATIC NET OPC DA 3.0 server on localhost.
6. Add tags by browsing the OPC namespace. Each STEP 7 symbol appears as an OPC item with its full symbolic path (e.g., S7:[S7_Connection_1]DB100,DBD0).

The OPC path is more verbose to configure but is decoupled from the Symbol Server DCOM surface and tends to survive STEP 7 service pack upgrades that would otherwise break the direct path. The same pattern is used by third-party HMI packages; for reference, Pro-face's GP-Pro EX documentation describes the equivalent Import STEP 7 Project File workflow under "Common Settings (Symbol Variables) — Import STEP 7 Project", where the same STEP 7 symbol export is consumed by a different HMI engine.

13. Prevention and Best Practice

Once the workstation is healthy, the following rules prevent recurrence and minimise the cost of the next service pack cycle.

• Pin the version pair. Document the exact STEP 7 and WinCC service pack combination — including hotfix KB numbers — in the project's commissioning sheet. Never install a new STEP 7 SP on a running WinCC workstation without first verifying compatibility on a test bench or a clone VM.
• Always install AS-OS Engineering. Treat it as a mandatory component of any WinCC engineering station, not an optional add-on. Bake it into the workstation image.
• Compile before transfer. Always run a full Compile (all blocks) on the STEP 7 project immediately before the WinCC tag import. This guarantees a fresh symbol schema and surfaces the warnings that would otherwise surface in WinCC as the "selection is invalid" dialog.
• Image the engineering station. Take a full system image once the integration is verified. If the workstation is later rebuilt, the image guarantees that AS-OS, the Symbol Server DCOM registration, and the service pack combination are restored atomically.
• Check symbol table hygiene. Audit the symbol table at project hand-off for the six anti-patterns in section 9.1. Resolve them in STEP 7 rather than working around them in WinCC.
• Isolate WinCC versions on the same physical host. If a workstation must host two major WinCC versions (for parallel project migration), use separate Windows user profiles or a virtual machine per version. The S7OLE library does not tolerate side-by-side major versions.
• Whitelist the Symbol Server DLLs in antivirus. Add S7oleax.dll, s7wtrapi.dll, s7wtrsax.dll, and s7oiex.dll to the antivirus exclusion list. Re-register after any antivirus definition update that flags them.

14. Quick Reference Troubleshooting Matrix

15. Frequently Asked Questions