Resolving TIA Portal V13 HMI Tag Crash and Retentive KTP 400 Tags

Problem Overview

Engineers programming SIMATIC S7-1200 CPUs against a KTP 400 Basic panel in TIA Portal V13 Update 7 routinely encounter two coupled issues during the HMI commissioning phase of a project:

1. The TIA Portal development environment crashes when an HMI tag is being linked to a tag of an S7-1200 data block (DB).
2. The setpoint value entered at the panel (for example, a counter preset value PV) is lost when the 24 V supply is removed, even though the engineer expects the value to be remembered.

Both problems are reproducible on a single engineering station and originate from two independent root causes: a corrupted IM (Installation Management) folder in the TIA Portal project tree, and the absence of the Retain attribute on the relevant DB tag. This reference documents the engineering-grade workflow that resolves the IDE crash, then walks through the parameter set required to retain HMI-entered values across a power cycle on a KTP 400 Basic panel tied to an S7-1200.

Symptom Description and Affected Versions

The IDE crash presents itself when the engineer opens the HMI tag editor for a KTP 400 Basic, drags or selects a tag from the PLC tag table, or browses a data block tag in the tag-selection dialog of an HMI input/output field. The dialog appears to start populating the dropdown list, then TIA Portal terminates without a controlled shutdown. On Windows Event Viewer the application typically logs a .NET runtime exception of class System.NullReferenceException or System.IO.IOException in S7WP.exe (TIA Portal main process) or HMIRte.exe.

The crash is reproducible regardless of whether the DB is an Instance DB (IDB), a Global DB, or a DB of an FB with multiple-instance capability. It is, however, more frequent when:

• The DB tag is of type String, WString, or a derived UDT that contains a String.
• The project contains more than one HMI device of the Basic Panel family.
• The IM folder of the project has not been deleted since the project's last hardware reconfiguration (HWCN change, GSD update, firmware update of the CPU).
• The project was originally authored in TIA Portal V12 or V13 and then opened in a newer V13 update without a clean rebuild.

The documented symptom was first observed in TIA Portal V13 Update 4 and was not fully eliminated until V13 SP1 Update 9. TIA Portal V14 and later versions do not exhibit the same defect, but projects authored in V13 must be migrated through TIA Portal V13 SP1 before opening in V14 to avoid a secondary set of tag-resolution warnings.

Root Cause Analysis

Each TIA Portal project is stored on disk as a directory tree that contains, in addition to the source files visible in the project navigator, a hidden set of installation management files inside the IM subfolder. The IM folder caches the resolved cross-references between:

• PLC tag tables and DB tag declarations.
• HMI tag tables and their associated PLC tag proxies.
• Hardware configuration (HWCN) revisions and the symbol tables they reference.
• UDT (user-defined data type) member indices used by the HMI tag-resolution engine.

When the IM folder is out of sync with the actual project sources — typically because the engineer changed a DB tag's data type, renamed a UDT member, upgraded the portal version, or added a new HMI device without performing a Rebuild all — the HMI tag-selection dialog can dereference a null handle in the cross-reference cache, triggering the IDE crash.

Siemens engineering notes for TIA Portal V13 recommend that any structural change to DBs, FBs, or HMI tag tables be followed by a Compile > Software (rebuild all) operation. If the rebuild itself fails or if the IM folder was created against an earlier portal installation (for example, an upgrade from V12 to V13), the cache may still be poisoned even after a successful rebuild.

Project Folder Layout

MyProject/                <-- root project folder
  IM/                     <-- transient installation-management cache (regeneratable)
    Hmi\                 <-- HMI cross-references
    Plc\                 <-- PLC cross-references
    CrossRefs\           <-- inter-domain references (PLC <-> HMI)
  System\                <-- hardware configuration
  Program blocks/        <-- PLC source (logical view)
  HMI Tags/              <-- HMI tag tables (logical view)
  Devices/               <-- physical devices (CPU, KTP 400)
  Logs/                  <-- compile logs

Resolution Path A — Delete the IM Folder and Rebuild All

This is the fastest documented recovery path and resolves the IDE crash in the majority of field cases.

1. Close the project in TIA Portal V13. Do not simply minimize; close the project so that no TIA process holds the IM folder open.
2. Open Windows Explorer and navigate to the project's directory. For a typical default installation the path is:

   C:\Users\<user>\Documents\Automation\<ProjectName>\

3. Make a full backup of the project folder (copy to a USB drive or to a versioned directory). This step is mandatory; it lets you roll back if a subsequent step corrupts the project.
4. Locate the IM subfolder inside the project directory and delete it. The folder is normally hidden; enable View > Hidden items in Windows Explorer if necessary.
5. Restart TIA Portal V13 and open the project.
6. From the project tree, right-click the S7-1200 station and select Compile > Software (rebuild all).
7. Then right-click the KTP 400 Basic device and select Compile > Software (rebuild all).
8. Save the project.
9. Re-open the HMI tag-selection dialog and verify the crash no longer occurs.

The rebuild regenerates the IM folder with cross-references consistent with the current project sources. The HMI tag dialog should now populate without exception. Total expected downtime for a mid-size project (≈ 50 PLC tags, 30 HMI tags, 1 KTP 400 Basic) is 90 – 180 seconds.

Resolution Path B — Copy the HMI Project as a New Device

If the IM-folder deletion does not resolve the crash — typically because the original HMI device configuration itself is the source of the corruption — copy the HMI device to a fresh device instance:

1. In the project tree, right-click the KTP 400 Basic device and select Copy.
2. Right-click the HMI subnet or the project root and select Add new device, choosing the same KTP 400 Basic part number (for example, 6AV2 123-2DA03-0AX0).
3. When prompted, choose to copy the configuration from the existing device.
4. Delete the original (corrupted) HMI device from the project tree.
5. Right-click the new device and select Rename to restore the original device name so that PLC-side HMI references do not need to be re-mapped.
6. Compile the new device and verify the crash is resolved.

Path B is more invasive than Path A but is the correct course of action when the IM-folder rebuild fails to fix references inside a specific HMI device's tag table. Note that HMI connection references in the PLC project are by device name; if you rename the new device to match the original, no PLC-side re-mapping is required.

Resolution Path C — Apply the Latest TIA Portal V13 Update

Several crash signatures in TIA Portal V13 Update 7 were addressed in subsequent updates. Siemens released the following updates relevant to the HMI tag crash:

Updates are distributed through the Siemens Automation License Manager and the TIA Administration Tool. Always back up the project before applying an update, and confirm the installed version with Help > About > Installed software. Refer to the Siemens Industry Online Support portal for the readme files of each update.

Retentive Memory Fundamentals for the S7-1200

Once the IDE is stable, the second part of the question — how to retain an HMI-entered setpoint across a power cycle — requires understanding the S7-1200 retentive memory model. The S7-1200 retains selected memory areas across a power-off / power-on cycle using a non-volatile backup area whose size depends on the CPU model:

The retentive area is shared by M (merker) bits / bytes / words / double words and by DB tags whose Retain attribute is set. The default retainable size of 10 KB is split by the CPU firmware between the configured M area and the configured DB retain area. To change the boundary, open the device configuration of the S7-1200, expand Properties > General > Memory, and adjust the Retain area for M and the Retain area for DB sliders.

Memory Layout Calculation

The number of retentive DB tags that can be backed up is calculated as:

N_retentive_tags <= floor((R_db - R_overhead) / S_tag)

where:

• R_db = bytes of retain area allocated to DBs (from the device configuration slider).
• R_overhead = 8 bytes of firmware overhead per DB.
• S_tag = bytes occupied by the tag in the optimized or non-optimized DB schema (for example, 2 bytes for Int, 4 bytes for DInt, 256 + 2 bytes for a default String[254]).

For example, on a CPU 1214C with the default retain area of 10 KB allocated entirely to DBs (R_db = 10240 bytes) and four retentive Int tags plus one retentive String[32] tag (S_tag = 2 * 4 + 34 = 42 bytes):

N_max = floor((10240 - 8) / 42) = floor(243.5) = 243 retentive tags

For a single HMI-entered counter PV tag of type Int, the constraint is comfortably met on any S7-1200 CPU.

Configuring DB Tag Retention in TIA Portal V13

To mark a single DB tag as retentive so that an HMI-entered value survives a power-off:

1. In the project navigator, expand Program blocks and double-click the data block (for example, DB_HMI_Settings).
2. Select the Offline view of the DB to display the tag declaration table.
3. Locate the tag bound to the HMI field (for example, i_PV_Setpoint of type Int).
4. In the Retain column of the tag declaration, change the value from Non-retain to Retain.
5. Compile the DB with Compile > Software.
6. Transfer the new configuration to the S7-1200 with Online > Download to device.

The same parameter can be set declaratively in SCL. The attribute syntax is the RETAIN qualifier on the tag declaration:

DATA_BLOCK "DB_HMI_Settings"
{ S7_Optimized_Access := 'TRUE' }
VERSION : 0.1
NON_RETAIN
  STRUCT
    i_PV_Setpoint  : Int;        // HMI-entered counter preset; NON-retentive
    s_RecipeName   : String[32]; // HMI-entered recipe label; NON-retentive
  END_STRUCT;
END_DATA_BLOCK;

After the change:

DATA_BLOCK "DB_HMI_Settings"
{ S7_Optimized_Access := 'TRUE' }
VERSION : 0.2
  STRUCT
    i_PV_Setpoint  : Int;        // HMI-entered counter preset; RETENTIVE
    s_RecipeName   : String[32]; // HMI-entered recipe label; NON-retentive
  END_STRUCT;
END_DATA_BLOCK;

The transition from NON_RETAIN to a default (retain-eligible) header is the textual equivalent of setting Retain = Retain in the declaration table. Once downloaded to the CPU, the new attribute takes effect on the next STOP > RUN transition.

Equivalent Ladder Logic View

For engineers working in LAD/FBD, the configuration is identical and is performed only at the DB tag declaration level — there is no Ladder instruction that toggles the retentive attribute of a tag at runtime. Retentiveness is a compile-time attribute of the DB schema, not a runtime property. The S7-1200 firmware restores the retain area during the cold-restart sequence immediately before OB100 begins executing, so any code in OB1 that reads a retentive tag will see the persisted value.

Optimized vs Non-Optimized Block Access

For S7-1200 firmware V4.0 and later, optimized block access is the default and recommended setting. With optimized access enabled, the retain attribute is honored at the individual tag level, allowing mixed retain / non-retain tags within the same DB. With non-optimized access (legacy), the entire DB is either fully retentive or fully non-retentive, set by the NON_RETAIN keyword or the DB's overall Retain property. The migration path from V13 to V14 does not change this behavior.

Linking the KTP 400 Basic Input Field to a Retentive DB Tag

Once the DB tag is marked retentive, link the HMI input field on the KTP 400 Basic to that tag:

1. Open the KTP 400 Basic project and open the screen containing the counter preset input field.
2. Select the input/output field. In the properties pane, navigate to Properties > General > Process value.
3. Click the tag selection button. The dialog should now open cleanly (assuming Path A above has resolved the IDE crash).
4. Expand PLC tags > Program blocks > DB_HMI_Settings > i_PV_Setpoint.
5. Select the tag and confirm.
6. Set the field mode to Input/output so that operator changes are written back to the PLC tag.
7. Set the acquisition mode to Cyclic continuous for a counter PV, with a 1 s update cycle typical for commissioning.
8. Compile the HMI project and download to the KTP 400 Basic panel.

KTP 400 Basic Tag Limits

Refer to the SIMATIC HMI KTP 400 Basic operating instructions on the Siemens Industry Online Support portal for the full specification.

KTP 400 Basic Recipe Memory (Alternative to PLC Retain)

For longer-term persistence of operator-entered setpoints (for example, recipe data that must survive an MRES on the PLC), the KTP 400 Basic supports internal recipe storage. Recipes are stored in the panel's internal flash and are independent of the PLC retain area. Workflow:

1. Open the KTP 400 Basic project in TIA Portal V13.
2. Open HMI Tags > Recipe entries in the project navigator and create the recipe structure (for example, Recipe_1.Counter_PV of type Int).
3. On the HMI screen, place a recipe view control and bind it to the recipe data record.
4. Configure the recipe view's transfer mode to Tags / PLC if the active setpoint must be transferred to the PLC at runtime, or Tags only for panel-local persistence.
5. Download the project. Operator can now save the current setpoint to a named recipe data record that persists across PLC MRES.

The trade-off versus PLC retain is that recipe data must be explicitly transferred to the PLC via the recipe view — there is no automatic restore on PLC startup. For a counter PV, PLC retain is therefore preferred; for named recipes with multiple parameters, the panel's recipe memory is preferred.

Verification Across Power Cycle

To confirm that the value is actually retained after a power-off, follow this verification sequence on the commissioning bench:

1. Download the project to the S7-1200 CPU and the KTP 400 Basic panel.
2. Run the CPU. Navigate to the HMI screen containing the counter preset input field.
3. Enter a recognizable value (for example, PV = 12345) and confirm the value is written back to DB_HMI_Settings.i_PV_Setpoint. Verify this in TIA Portal via Monitor & Modify.
4. Power off the 24 V supply to the S7-1200 CPU. Wait at least 5 seconds to ensure the retain area is fully committed to non-volatile storage.
5. Power on the 24 V supply.
6. After the CPU completes its startup OB (OB100), read the value of DB_HMI_Settings.i_PV_Setpoint via Monitor & Modify. The value must be 12345.
7. Switch the HMI to the relevant screen and confirm the input field displays 12345.
8. If the value is 0, the retain attribute has not been set correctly. Re-open the DB, verify the Retain column, recompile, and re-download.

Online vs Offline Watch Behavior

The Monitor & Modify window in TIA Portal V13 displays the live value of the tag in the CPU's online watch table. If the watch table is opened before the CPU has finished its startup (before the RUN LED goes solid), the displayed value may be 0 momentarily. Wait for the RUN LED to become solid before reading the watch table; the actual retain restore happens during the firmware initialization, not during OB1 execution.

Troubleshooting Matrix

Migration and Long-Term Recommendations

For new projects and for sites that are commissioning beyond 2024, migrate from TIA Portal V13 to V16 or later. The IM-folder crash defect, the STRING tag resolution defect, and the manual retain-area slider have all been superseded by automated memory partitioning in V14+. Migration steps:

1. Open the V13 project in TIA Portal V13 SP1 Update 9 and save. Confirm a clean compile.
2. Open the project in TIA Portal V14. Allow the project migration wizard to update device descriptions and library references.
3. Re-download to the CPU and the panel.
4. Run the retain verification procedure documented above.

For sites that must remain on V13, lock the engineering station to TIA Portal V13 SP1 Update 9 to eliminate the IDE crash signature. Refer to the Siemens Industry Online Support portal for the official V13 SP1 Update 9 readme and download.

Frequently Asked Questions