Resolving WinCC Unified Cross-Reference Failures from PLC to HMI

Problem Statement

Engineers using TIA Portal with WinCC Unified (Comfort Panel, Unified Comfort Panel, or WinCC Unified PC Runtime) frequently report that the Cross-references editor does not show the link between a PLC tag in the S7-1500/S7-1200 program and its corresponding HMI tag on a Unified device. Symptoms include:

• The PLC tag (for example, DB_EM05.bClearTool) is referenced from the STEP 7 program and is shown as used, but the WinCC Unified side reports no cross-reference.
• The HMI tag exists, is mapped to the PLC tag, and updates correctly at runtime, yet Show cross-references in the project tree returns an empty result.
• Tags consumed only through JavaScript (VBScript is not used in Unified) — for example, by assembling a string tag name into a JSON object — never appear in any cross-reference, even when the script runs successfully.
• After importing a TIA V17 project into V18 or V19, cross-reference information is stale and must be regenerated.

The symptom is purely a project-tree navigation problem; runtime HMI communication is unaffected. The PLC and HMI still exchange data through the standard S7 communication path (PUT/GET or HMI connection), so operators see correct values on the panel. The cross-reference index, however, is what the engineer uses for impact analysis, change tracking, and qualification, and when it is wrong, GMP/FDA-style traceability falls apart.

How WinCC Unified Cross-References Work

WinCC Unified stores cross-reference information in an internal index that the engineering system (ES) builds from the parsed project data. The index is generated when the project is compiled and re-generated when the Cross-references editor is opened for the first time after a structural change. Three classes of usage are tracked:

1. Direct tag access — the HMI tag is bound to a screen object property (e.g., a button's Pressed event, an I/O field Process value), an animation, a logging tag, or an alarm. These usages are recorded.
2. PLC-side reference — wherever a STEP 7 tag, DB, or FB formal parameter is read or written, the index records the access point in the LAD/FBD/STL/SCL editor. The reverse direction (HMI tag to PLC tag) is then resolved through the HMI connection's tag mapping.
3. Script-based access — JavaScript written in the Unified RT runs at runtime in the Chromium-based scripting engine. Static analysis of the script source is performed by the ES, but the analyzer is bounded: it understands a small set of canonical access patterns and cannot dereference a tag built dynamically at runtime.

The Cross-references editor is opened from the project tree, the editor toolbar, or the Tools > Cross-references menu, depending on the TIA Portal version. The Displaying the 'Cross-references' editor (RT Unified) – WinCC Unified V20 manual documents the menu path: right-click on a tag in the project tree, select Cross-references from the shortcut menu, or use the Tools ribbon command.

Root Cause Analysis

Two distinct root causes account for nearly every reported case.

Root Cause 1 — Script Access via String-Built Tag Names

Unified JavaScript commonly uses the Tags() and HMIRuntime objects. The pattern that breaks cross-reference indexing looks like this:

// JavaScript in a Unified screen or scheduler task
let tagName = "DB_EM05.bClearTool";   // string literal
let payload = { tag: tagName, op: "set", val: 1 };
Tags(payload.tag).Write(payload.val);

The engineering system sees only the string literal "DB_EM05.bClearTool"; it cannot infer that this string is later used as a tag access. Therefore no cross-reference entry is written for the tag. This is by design: the analyzer would otherwise have to symbolically execute the script, which is not feasible in TIA Portal's offline indexer.

Two consequences follow:

• Replacing the string with the actual tag reference Tags("DB_EM05.bClearTool") inside the call (without indirection through a local variable) does register the usage in some TIA Portal versions (V18 Update 2 onward, with the V19/V20 cross-reference analyzer), but only if the tag name is a string literal that matches a configured HMI tag exactly.
• Indirect access through an array, JSON object, or template literal is never recognized.

Root Cause 2 — Stale Cross-Reference Index

After project edits, hardware reconfiguration, library updates, or migration between TIA Portal versions (V17 → V18 → V19 → V20), the cross-reference index can become inconsistent. The symptom is that a tag that is clearly used (and that the compiler reports as used) is shown with no usages in the Cross-references editor. The fix is to force a regeneration of the index. This is performed under:

1. Open the project in TIA Portal.
2. Select Settings from the Options menu (or in modern TIA: Project > Settings).
3. Navigate to General > Cross-references.
4. Click Recreate (the button label has been Update, Rebuild, or Recreate across versions).
5. Wait for the index rebuild; for large projects this can take 30–120 s per device.
6. Re-open the Cross-references editor and confirm the missing usage now appears.

This operation is non-destructive — it only regenerates the local index database, not the project itself. It is safe to run on a project that is under version control, although the new index will itself be a binary file that the VCS should ignore or commit depending on the team's policy.

Affected Versions and Patches

The cross-reference analyzer for Unified has been incrementally improved in the following TIA Portal releases:

Siemens recommends keeping the engineering system on the latest available update for the version line in use. The V20 documentation explicitly covers the cross-reference editor and the recreation procedure.

Step-by-Step Solution

Step 1 — Confirm the Tag Mapping

Before assuming a bug, verify the HMI tag is actually bound to the PLC tag.

1. In the project tree, expand the Unified device → HMI tags.
2. Right-click the HMI tag (e.g., bClearTool_HMI) and choose Properties.
3. In General > Settings, the Connection field must reference an HMI connection, and the PLC tag field must contain the fully qualified PLC tag (e.g., DB_EM05.bClearTool).
4. If the PLC tag field is empty, the tag is local to the HMI and the cross-reference will never reach the PLC.

Step 2 — Recreate the Cross-Reference Index

1. From the TIA Portal menu, choose Options > Settings > General > Cross-references.
2. Click Recreate. The progress bar appears in the status bar.
3. When the rebuild completes, right-click the PLC tag in the STEP 7 project tree and select Cross-references.
4. Confirm the HMI tag is now listed under the HMI device.

Step 3 — Refactor Indirect Script Access

For scripts that build tag names dynamically, refactor the access so that the engineering system can recognize the usage.

// Refactored: the HMI tag is referenced directly
let hmIRuntime = HMIRuntime;
let tag = hmIRuntime.Tags("DB_EM05.bClearTool");
tag.Write(1);

If the tag name is truly variable (e.g., one of n tool tags), create n explicit HMI tags and select among them with a static switch:

// Statically analyzable: every HMI tag is named in the script
let id = toolIndex;
let tag = null;
if (id === 0) tag = HMIRuntime.Tags("DB_EM05.bClearTool_T0");
else if (id === 1) tag = HMIRuntime.Tags("DB_EM05.bClearTool_T1");
else if (id === 2) tag = HMIRuntime.Tags("DB_EM05.bClearTool_T2");
if (tag) tag.Write(1);

Every HMIRuntime.Tags("...") literal is now a candidate for cross-referencing, and the analyzer will record the usage on the next recompile.

Step 4 — Update the Engineering System

If the project is on TIA Portal V17 or earlier, upgrade to V18 Update 2 or later, ideally the current V20 release. The upgrade is performed with the TIA Portal project upgrader and is non-destructive to the project data. After upgrade:

1. Compile the project (HMI device → right-click → Compile > Software (rebuild all)).
2. Recreate the cross-reference index as in Step 2.
3. Validate the missing usages are now reported.

Verification

After applying the fix, verify with the following sequence.

1. Open the STEP 7 project tree and right-click the PLC tag DB_EM05.bClearTool.
2. Select Cross-references. The editor opens.
3. Confirm the list contains at least one entry under the Unified HMI device, with the HMI tag's name in the Object column and the screen or script in the Location column.
4. Switch the Filter dropdown to All objects; the list should expand to include all dynamic access points in scripts and animations.
5. From the HMI side, right-click the HMI tag, choose Cross-references, and confirm the PLC tag is listed under the PLC station.
6. Download the rebuilt HMI runtime to the panel (or to the WinCC Unified PC Runtime) and confirm the operator view still shows the correct value.

Common Edge Cases

Edge Case A — HMI Connection Over OPC UA

When the HMI device connects to the PLC through an OPC UA server (e.g., the SIMATIC S7-1500 OPC UA Server interface) rather than the native S7 protocol, the cross-reference link is established through the OPC UA mapping table, not the HMI connection. The recreation procedure still works, but the engineer must confirm that the OPC UA tag name matches the PLC tag name exactly. Mismatches in capitalization, namespace, or array index break the reverse link.

Edge Case B — Tag Used Only in a Dynamically Loaded Faceplate

Unified faceplates are loaded at runtime. The HMI tag used as the faceplate interface tag must be a PLC tag or a struct tag mapped to a DB; it cannot be a local HMI tag. If the faceplate is instantiated through a script, the cross-reference analyzer in V19 and earlier does not always register the usage because the script-level reference is a string-based instance name.

Edge Case C — Tags Reachable Through HMI Tag Multiplexing

Unified supports multiplexing, where a single HMI tag is bound to one of n PLC tags at runtime by setting a multiplex index. The cross-reference editor will list all n PLC tags as candidates, even though only one is active at runtime. This is correct behavior and not a bug.

Edge Case D — Library Tags

If the HMI tag is provided by a project library (master copy or type), the cross-reference link is established through the library instance, not the original type. After updating the library type, recreate the index to refresh the library instances' references.

Troubleshooting Matrix

Best Practices to Prevent the Issue

• Always access HMI tags through string literals inside Tags("...") or HMIRuntime.Tags("...") calls. Avoid indirection through arrays, JSON objects, or template literals.
• Recreate the cross-reference index after any of the following operations: device addition/removal, library update, firmware update of the PLC, project migration between TIA versions, and bulk tag rename.
• Keep the engineering system on the latest TIA Portal update for the version line in use. V20 is the current general-availability release as of 2026.
• Avoid using faceplate instance properties that are only assigned at runtime; expose the PLC tag through a structured HMI tag instead.
• Commit the project to a version control system that understands TIA Portal's binary format (e.g., TIA Portal Multiuser or a third-party VCS with the Siemens TIA File Handler add-in). Do not commit the cross-reference index; regenerate it after each checkout.

Performance Considerations

For projects with more than 50,000 HMI tags or more than 100 screens, the cross-reference index can take several minutes to rebuild. Run the rebuild on the engineering station, not on a remote desktop with a slow network drive as the project location, because the index is written to a local cache. The V20 rebuild is incremental: only changed objects are re-indexed, so subsequent rebuilds are typically 5–10× faster than the first.

When working in the TIA Portal Multiuser server mode, the cross-reference index is local to each client's workspace; recreating it on one client does not propagate to others. Coordinate the recreation across the team or use the project's scheduled nightly build to refresh all clients.

Integration With Other Engineering Tools

The cross-reference editor exports its result as a CSV file through the Export button on the editor toolbar. This CSV can be consumed by:

• Siemens SIMATIC Automation Tool for batch firmware update impact analysis.
• Siemens PRONETA for network topology and PROFINET diagnostics.
• Siemens TIA Selection Tool for hardware reconfiguration validation.
• External compliance tools (e.g., 21 CFR Part 11 impact reports) that read the CSV and produce a change-history document.

For S7-1500 software controllers (WinAC RTX, S7-1500S), the cross-reference index covers both the PLC and the HMI sides, but the index rebuild must be performed on the same engineering station that owns the project; distributed engineering with separated S7 and HMI projects does not produce a unified cross-reference.

Safety and Validation Implications

For SIMATIC WinCC Unified Safety panels, the cross-reference editor additionally lists the safety tag's usage in the safety program. The analyzer is stricter: any indirect access through a string variable is rejected at compile time, not merely at index time, because the safety runtime cannot tolerate a missing binding.

Related Editor: Go To Location

As an alternative to the cross-reference editor, engineers can use Go to location (right-click → Go to → Location) to jump from an HMI tag to its definition in the PLC. This function does not depend on the cross-reference index and is therefore always available. Use it for quick navigation; use the cross-reference editor for impact analysis and documentation.

FAQ