Resolving TIA Portal V14 SP1 Faceplate Popup UDT Stale Input

Problem Overview

When a WinCC Comfort/Advanced popup is built around a faceplate whose interface is a PLC User-Defined Type (UDT) array, a common symptom on TIA Portal V14 SP1 with TP1200 Comfort Panels (and equivalent Comfort/Advanced HMI panels) is that input parameters from the previously opened popup remain visible after the popup is reopened with a new array index. The new values only appear after the second invocation of the same popup instance. The first call always shows the previous popup's data; only the second call shows the correct values.

This stale-value behavior is observed when:

• A faceplate is used as the layout for a popup screen.
• The faceplate's interface is a PLC UDT (User-Defined Type).
• The HMI reads/writes values from an array element of the UDT, with the array index passed on popup call.
• The same popup is opened multiple times with different array indices in succession.

The expected behavior is that each popup call shows the values corresponding to the array index passed at call time. The defective configuration shows the prior popup's values on the first call, and the correct values on the second call.

Affected System Configuration

Symbolic address multiplexing of HMI tags to PLC UDT array elements was officially introduced in TIA Portal V14 SP1. Prior versions required fixed tag references and could not dereference an array index at runtime, so the pattern described here is specific to V14 SP1 and later.

Data Flow Architecture

The faceplate-popup pattern with multiplexed UDT arrays uses a three-stage data path:

1. The PLC program writes the desired array index to a tag in an HMI-side multiplex DB.
2. The HMI runtime reads the index and dereferences a symbolic pointer of the form HMI_DB.Prefix[Index].
3. The runtime displays the value of the corresponding element of the PLC UDT array in the IO field of the popup faceplate.

UDT and Multiplex DB Design

Define a UDT in the PLC that captures the data shape of one analog value entry. A typical UDT for an analog popup faceplate looks like the following SCL definition:

TYPE "UDT_AnalogValue"
STRUCT
    Value       : REAL;      // Process value
    ScaleMin    : REAL;      // Lower scale bound
    ScaleMax    : REAL;      // Upper scale bound
    UnitText    : STRING[10];// Engineering unit
    AlarmHi     : BOOL;      // High alarm active
    AlarmLo     : BOOL;      // Low alarm active
    Sp          : REAL;      // Setpoint
    Out         : REAL;      // Output (e.g., valve position)
END_STRUCT;
END_TYPE

Declare an array of this UDT in the global DB (Global_DB.AnalogValues : ARRAY[0..100] OF "UDT_AnalogValue"). The HMI cannot dereference an array of UDT directly for symbolic multiplexing in TIA V14 SP1, so a mirror DB (HMI_DB) is required. The mirror DB contains a single UDT element that is overwritten by the PLC before the popup is called.

DATA_BLOCK "HMI_DB"
STRUCT
    Index       : INT;       // Selected array index
    Selected    : "UDT_AnalogValue"; // Mirror of one array element
END_STRUCT;
BEGIN
END_DATA_BLOCK

The PLC cyclically copies the selected array element into the mirror before triggering the popup:

// OB35 - Cyclic Interrupt, 50 ms
IF "HMI_Cmd_OpenPopup" THEN
    "HMI_DB".Index := "SelectedIndex";
    "HMI_DB".Selected := "Global_DB".AnalogValues["HMI_DB".Index];
    "HMI_Cmd_OpenPopup" := FALSE;
END_IF;

The IO field on the popup faceplate binds to HMI_DB.Selected.Value symbolically. Because the HMI_DB contains a fixed tag name (no array index in the HMI tag itself), the runtime does not need to dereference an index on the HMI side - the PLC writes the chosen element into the fixed mirror slot.

Underlying Mechanism: Symbolic IO Field Multiplexing

Symbolic IO field multiplexing is the runtime mechanism in WinCC Comfort/Advanced that allows a single configured IO field on an HMI screen to read and write different array elements of a PLC UDT array based on an index variable. The index is typically an HMI tag of type INT or DINT that the PLC writes before the popup is triggered.

Workflow in a typical implementation:

1. The PLC maintains a global data DB and an HMI-side multiplex DB with a structure of symbolic pointers.
2. The PLC writes the desired array index into a tag the HMI can read (for example, HMI_DB.Index).
3. The HMI IO fields on the popup faceplate reference tags like HMI_DB.Prefix.InputValue where Prefix is the multiplexed array element.
4. When the index changes, the runtime dereferences the symbolic pointer and updates the IO field display with the new array element's value.

In the affected configuration, the multiplex DB contains structured members that map to UDT array elements. The IO field is configured with a tag prefix, and the array index is supplied at popup call time via the index tag. The runtime is supposed to update the IO field value on every acquisition cycle, but in practice it may lag by one cycle if the IO field mode and acquisition cycle are not configured correctly.

Root Cause: I/O Field Direction Mode

The root cause of the stale-value behavior is the I/O field Mode setting in the WinCC Comfort configuration. By default, an IO field bound to an HMI tag pointing into a multiplexed PLC UDT array is often configured in Input mode. In Input mode, the field reads the current value of the tag but does not write the value back to the PLC when the operator presses Enter or exits the field. Because the IO field does not write the value back, the PLC tag retains the value of the previous popup's array element until the next full update cycle from the HMI's point of view.

When the HMI is told to open a popup with a new index, the runtime updates the display value of the IO field immediately, but the underlying tag used for the next write operation may still point to the previous array element's data. The Input mode prevents the runtime from forcing a write-back of the displayed value, so the multiplex pointer state lags by one popup call.

By changing the IO field mode to Input/Output, the runtime is instructed to write the displayed value back to the PLC on every confirmation. This write-back operation forces the runtime to resolve the symbolic pointer fresh against the current index, propagating the new array element's value to the display on the very first popup call.

Diagnostic Procedure

Before applying the fix, confirm the following conditions to rule out other causes:

1. Verify the PLC is online and the HMI connection is established. The Online diagnostic view in TIA Portal should show the connection state green.
2. Open the HMI tag table and confirm the multiplexed tags have valid values. Use the Monitor function to inspect the raw values at the PLC and at the HMI.
3. Check the popup's trigger event. The index tag should be written by the PLC before the popup Open event fires. Verify this with a watch table or trace.
4. Inspect the IO field properties in the popup screen. Right-click the IO field, choose Properties, and read the Mode property under General. If it shows Input, proceed to the fix.
5. Verify the acquisition mode of the multiplexed tags. In the HMI tag editor, select the affected tag and check the Acquisition mode property. It must be set to Cyclic continuous for the runtime to poll the value at every cycle.
6. Confirm the PLC OB configuration. The index update code should be in a cyclic OB (OB35 on S7-1500) with a stable cycle time, not in OB1 with a sub-millisecond cycle.

Solution: Change IO Field Mode to Input/Output

1. In the TIA Portal project tree, expand the HMI device and navigate to the screen that contains the popup faceplate.
2. Double-click the screen to open it in the screen editor.
3. Click on the affected IO field to select it. The Properties inspector opens on the right side of the workspace.
4. Navigate to Properties > General > Mode.
5. Change the mode from Input to Input/Output.
6. Compile the HMI project (Project > Compile > Software, rebuild all).
7. Download the project to the TP1200 Comfort panel.
8. Test the popup sequence in runtime. Each popup call should now display the values corresponding to the current array index on the first invocation.

Acquisition Mode Configuration

The acquisition mode of the HMI tag determines when the runtime polls the PLC for a new value. For multiplexed PLC UDT array tags, the recommended setting is Cyclic continuous with a cycle time matching the popup's update requirement.

To configure acquisition mode:

1. Open the HMI tag table for the affected panel.
2. Select the multiplexed tag(s).
3. In Properties > Acquisition, set Mode to Cyclic continuous.
4. Set Acquisition cycle to a value between 100 ms and 1 s. For high-speed popups, 100 ms is recommended.

PLC Cycle Time and OB Configuration

A related issue can occur when the PLC's main OB (OB1) cycle time is very short (for example, 1-2 ms on a lightly loaded S7-1500). The HMI's communication stack may not complete a full read/write handshake within a single PLC cycle, leaving the multiplex index in a transitional state when the popup is opened.

A reliable workaround is to drive the multiplex index update from a dedicated cyclic OB with a fixed time base:

1. In the PLC program, add a new cyclic interrupt OB (for example, OB35) with a cycle time of 50 ms.
2. Move the code that writes the multiplex index into OB35 instead of OB1.
3. Ensure OB35's cycle time is configured in the PLC properties (Properties > Cyclic interrupts > OB35 > Cycle time).
4. Rebuild and download the PLC project.

This decouples the index update from the application's main scan, providing a stable 50 ms reference for the HMI's polling.

Troubleshooting Matrix

Verification Procedure

After applying the fix, verify the behavior in runtime:

1. Open the HMI runtime on the TP1200 Comfort.
2. Navigate to the screen that triggers the popup.
3. Trigger the popup with array index 0. Note the displayed values.
4. Close the popup.
5. Trigger the popup with array index 5 (or any other valid index). Verify the values shown match array element 5, not array element 0.
6. Close the popup.
7. Trigger the popup with array index 10. Verify the values shown match array element 10 on the first call, without a second call being required.
8. Repeat for several random indices to ensure deterministic behavior.
9. Power-cycle the panel and repeat the test to confirm the fix persists across reboots.

If any of the steps above still show stale values, repeat the diagnostic procedure and confirm:

• The IO field mode is Input/Output (not Input).
• The acquisition mode is Cyclic continuous.
• The PLC cycle time / OB configuration is stable.

Common Configuration Errors

Beyond the primary IO field mode issue, several related configuration errors can produce similar symptoms in TIA V14 SP1 faceplate popups:

1. Index tag declared as Word instead of Int. The runtime expects a signed integer for array indexing. A Word tag can produce out-of-range indexes that resolve to undefined array elements.
2. DB accessed with absolute address on PLC side. The HMI symbolic multiplexing requires symbolic access. If the PLC DB is configured with non-optimized access, the symbolic pointer cannot be dereferenced and the runtime falls back to the last valid pointer.
3. Index written by HMI instead of PLC. The index must be written by the PLC before the popup is opened. If the HMI writes the index (for example, via a script triggered by a button), the PLC may overwrite it on the next scan, producing a race condition.
4. UDT changed on PLC side but not recompiled on HMI side. After editing a UDT, the HMI tag table must be refreshed. Otherwise the tag's data type and size do not match, and the runtime may display only the first member of the UDT correctly.
5. Faceplate interface uses raw HMI tags instead of UDT members. This defeats the type safety of the UDT pattern and forces the engineer to wire each member individually, increasing the chance of misconfiguration.

Performance Considerations

Symbolic multiplexing with a 100 ms acquisition cycle on a TP1200 Comfort panel (or equivalent) consumes approximately 2-4% of CPU time per multiplexed tag. For popups with 10 or more IO fields, aggregate CPU load can reach 20-30%. If performance is a concern, consider the following:

• Use a 500 ms or 1 s acquisition cycle for non-critical displays.
• Group multiplexed tags into a single structure and acquire the whole structure as one tag.
• Limit the number of multiplexed tags to 20 or fewer per HMI panel.
• Use area pointers instead of symbolic multiplexing for very large data sets.

Comparison: Comfort vs Unified Faceplate Popup

Best Practices for Faceplate Popup Design

1. Always use Input/Output mode for IO fields on faceplate popups that read from multiplexed PLC UDT arrays. This forces a write-back and ensures the runtime resolves the symbolic pointer fresh on every confirm.
2. Set the acquisition mode of multiplexed tags to Cyclic continuous with a cycle time of 100 ms to 1 s. Avoid On demand for multiplexed tags.
3. Decouple the multiplex index update from the main PLC scan. Use a cyclic interrupt OB (OB35 on S7-1500, OB200 on S7-1200) with a 50 ms cycle time.
4. Define the faceplate interface with explicit UDT members, not raw HMI tags. This makes the faceplate reusable across screens and ensures type consistency.
5. Use distinct DBs for PLC data and HMI multiplex state. The PLC DB owns the truth values; the HMI DB is a temporary mirror used for pointer resolution. Never write back into the PLC DB directly from the HMI on a multiplexed pointer - always write to the HMI DB, then copy to the PLC DB in the PLC program.
6. Document the index variable's range and bounds-check in the PLC program. Out-of-range indexes can cause the HMI to dereference an undefined array element.
7. For new projects, use WinCC Unified (TIA Portal V18 or V20) with MTP Unified Comfort panels or Unified PC runtime. Unified faceplates use modern property interfaces and have fewer pointer resolution issues. See the Siemens documentation on Configure faceplate as pop-up (WinCC Unified) for the Unified equivalent of this pattern.

Migration Path to WinCC Unified

If the application uses TIA Portal V14 SP1 and is being upgraded, the faceplate popup pattern is fully supported in WinCC Unified (TIA Portal V16 and later). The Unified runtime resolves symbolic pointers more reliably and does not exhibit the stale-value behavior described in this article when the faceplate is configured as a pop-up with interface properties.

For new projects, consider:

• TIA Portal V18 or V20 with WinCC Unified Comfort panels (MTP series) or Unified PC runtime.
• Faceplate types with explicit interface properties.
• DB-bound tags with automatic dereferencing.

When migrating, the symbolic multiplexing pattern translates directly to the Unified faceplate property interface. The IO field mode change is not required in Unified because the runtime uses property-based binding instead of pointer-based binding. The Siemens documentation for faceplate-as-pop-up in WinCC Unified describes the interface tag and interface property application from a faceplate type to a pop-up window.

FAQ