S7-1500 Symbolic HMI Alarm Bit Access Using AT Overlay in TIA Portal

When migrating alarm handling from classic STEP 7 to TIA Portal on S7-1500 controllers, engineers routinely hit the same symbolic-access limitation that has existed since the days of S7-300/400: a 16-bit alarm word inside a data block (DB) cannot expose its individual bits to an HMI as named, browsable tags. The packed-word transport is mandatory because HMI/SCADA software reads alarm state via a contiguous 16-bit boundary, but TIA Portal does not assign unique symbols to bits inside a WORD. The fix is the AT (Access Type) overlay available in SCL for S7-1500 and S7-1200. This article describes the underlying constraint, three implementation patterns, HMI configuration on WinCC Comfort/Professional, runtime symbolic access on S7-1500, migration from classic STEP 7, and a verification procedure with a troubleshooting matrix.

1. The Symbolic-Access Problem in DB-Based Alarm Transport

Siemens controllers broadcast alarm state to HMI panels and SCADA systems using a packed bit pattern, one BOOL per alarm, sixteen alarms per WORD. The pattern is fixed by the S7 communication protocols and by the configuration blocks of the WinCC alarm control:

• Bit 0 = Alarm 0 (lowest priority)
• Bit 1 = Alarm 1
• ...
• Bit 15 = Alarm 15 (highest priority)

Inside the PLC program the alarms must therefore live in a 16-bit element. The HMI cannot poll 16 individual BOOL tags and reassemble them into a state word; the alarm control expects a contiguous WORD with a fixed starting address. In classic STEP 7, programmers wrote L DB10.DBW0 and referenced bits through DB10.DBX0.0...DB10.DBX0.7 and DB10.DBX1.0...DB11.DBX1.7. These bit addresses are absolute, not symbolic, because the PLC symbol table binds the WORD but not the BITs inside the WORD.

This carried into TIA Portal. A global DB of type AlarmDB containing a tag named AlarmWord : WORD shows one symbol in the project tree. An HMI connection sees one tag. The individual alarms cannot be named, grouped, or browsed. Programmers end up writing absolute bit logic throughout the code:

// Avoid: absolute, no symbol
IF "AlarmDB".AlarmWord.%X0 THEN
   // Motor overload bit is set
END_IF;

The workaround for two decades has been to alias the bits manually through a separate BOOL variable per alarm, requiring copy logic to keep the BOOL shadow in sync with the packed word. That copy is error-prone and adds scan time. TIA Portal V13 SP1 and later added a native mechanism: the AT overlay.

2. Why Packed-Word Transport Is Mandatory

The S7-1500 alarm control on WinCC Comfort/Professional and on HMI Tags uses the configured alarm tag as a 16-bit field per alarm word. Three classes of word are typically required:

Word Offset	Meaning	Direction	Bit Mapping
+0	Trigger bits	PLC to HMI	Bit n = active alarm
+2	Acknowledge bits	HMI to PLC	Bit n = ACK button pressed for alarm n
+4	Status bits	PLC to HMI	Bit n = active and not yet acknowledged

Each word is read as a single Put/Get cycle. The trigger word is consumed by the alarm control's event list; the acknowledge word is written by the operator; the status word is derived and read back for color coding. Splitting these into 48 individual HMI tags works at low alarm counts but multiplies the connection load and prevents WinCC from rendering a coherent alarm view. The packed-word pattern is therefore the canonical Siemens approach from S7-300 through S7-1500.

3. AT Overlay Fundamentals on S7-1500

The AT keyword in SCL declares an alternative view of the same memory location using a different data type. Both variables start at the same absolute address; one is the canonical source of truth (a WORD used by HMI), the other is a derived symbolic view used by program code. AT is supported in:

• Optimized blocks (S7-1200/S7-1500)
• Global data blocks
• Instance data blocks of FBs
• Local declarations of FBs and FCs

Reference documentation: TIA Portal V20 SCL manual: Symbolic access during runtime (S7-1500). The AT construct has existed in STEP 7 since the V5.x era for S7-400 but was only fully integrated into TIA Portal for S7-1500/1200 starting with V13 SP1.

4. Method A - AT Overlay on a WORD with ARRAY[0..15] OF BOOL

The simplest pattern: declare a WORD as the symbolic alarm source, then declare an AT overlay as an array of BOOL with the same starting address.

// Global DB "AlarmDB"
DATA_BLOCK "AlarmDB"
{ S7_Optimized_Access := 'TRUE' }
VERSION : 0.1
   VAR
      // Source-of-truth packed word sent to HMI
      TriggerWord  AT%Q* : WORD;   // output to HMI
      AckWord      AT%I* : WORD;   // input from HMI

      // Symbolic overlays - same addresses, different view
      TriggerBits  AT%Q* : ARRAY[0..15] OF BOOL;
      AckBits      AT%I* : ARRAY[0..15] OF BOOL;
   END_VAR
END_DATA_BLOCK

The access qualifiers %Q* and %I* are mandatory in optimized blocks and must match between the source and the overlay. Without them the compiler rejects the AT with the diagnostic "Different attributes for AT construction". After compilation the HMI sees "AlarmDB".TriggerWord and the PLC program sees "AlarmDB".TriggerBits[0]...TriggerBits[15], each with a fully qualified symbol that lands in the project symbol table.

Reading the bits in SCL is then purely symbolic:

IF "AlarmDB".TriggerBits[0] THEN
   "HMI_Trigger".MotorOverload := TRUE;
END_IF;

// Writing ACK back into the packed word
"AlarmDB".AckBits[3] := TRUE;

5. Method B - AT Overlay with a STRUCT / UDT for Named Boolean Alarms

When the sixteen alarms have well-known semantic names (MotorOverload, ValveStuck, LowPressure, HighTemperature...), an array of BOOL is still positional. Reading TriggerBits[7] six months later requires a comment hunt. A UDT-backed STRUCT overlays the same memory and exposes named members, which the HMI project tree can browse symbolically:

// UDT "UDT_AlarmWord"
TYPE UDT_AlarmWord
VERSION : 0.1
   STRUCT
      MotorOverload     : BOOL;   // bit 0
      ValveStuck        : BOOL;   // bit 1
      LowPressure       : BOOL;   // bit 2
      HighTemperature   : BOOL;   // bit 3
      LubricationFault  : BOOL;   // bit 4
      Spare05           : BOOL;   // bit 5
      Spare06           : BOOL;   // bit 6
      Spare07           : BOOL;   // bit 7
      CommunicationLoss : BOOL;   // bit 8
      BatteryLow        : BOOL;   // bit 9
      DoorOpen          : BOOL;   // bit 10
      EStopActive       : BOOL;   // bit 11
      Spare12           : BOOL;   // bit 12
      Spare13           : BOOL;   // bit 13
      Spare14           : BOOL;   // bit 14
      Spare15           : BOOL;   // bit 15
   END_STRUCT;
END_TYPE

Inside the alarm DB:

DATA_BLOCK "AlarmDB"
{ S7_Optimized_Access := 'TRUE' }
VERSION : 0.1
   VAR
      TriggerWord : WORD;
      AckWord     : WORD;
      StatusWord  : WORD;

      // AT overlays - same physical bytes, named view
      Trigger     AT%Q* : UDT_AlarmWord;
      Ack         AT%I* : UDT_AlarmWord;
      Status      AT%Q* : UDT_AlarmWord;
   END_VAR
END_DATA_BLOCK

From the program side the alarm is now fully self-describing:

IF "AlarmDB".Trigger.HighTemperature THEN
   // fault handling
END_IF;

"HMI_Trigger".MotorOverload := "AlarmDB".Trigger.MotorOverload;

The HMI alarm control subscribes to "AlarmDB".TriggerWord as the trigger tag; the program code uses "AlarmDB".Trigger.MotorOverload as the symbolic alarm source. Both reference the same physical bit; no shadow copy is needed.

6. Method C - ARRAY[0..15] OF BOOL Directly in the DB

If the S7-1500 program is written entirely in SCL and the alarm-control tag accepts a BOOL array as the trigger source, the WORD layer can be eliminated. TIA Portal V18 onward allows alarm controls to bind to individual BOOL tags or BOOL arrays. In that case:

VAR
   Trigger : ARRAY[0..15] OF BOOL;
   Ack     : ARRAY[0..15] OF BOOL;
END_VAR

This pattern is clean but has three caveats:

1. The HMI driver issues 16 reads per scan instead of one; bandwidth on a heavily loaded PROFINET can suffer.
2. Some legacy HMI panels (TP177, OP77) cannot subscribe to BOOL arrays - only to WORD/DWORD.
3. WinCC Professional alarm control tags must each be defined explicitly; the alias table is then a maintenance burden.

For S7-1500 + WinCC Comfort/Professional this method is recommended only when alarms are sparse (fewer than 16) or when the symbolic view of the alarm must be browsable directly on the HMI without AT.

7. HMI Tag Configuration on WinCC Comfort / Professional

On the HMI side configure the alarm control with the packed-word tag as the trigger, the acknowledge word as the ack tag, and the status word as the status tag. Three configuration steps:

1. Open the alarm control in the HMI project. Under General > Trigger tag bind to "AlarmDB".TriggerWord using the absolute PLC tag or symbolic access. On S7-1500 with optimized blocks, symbolic access requires the "Symbolic access during runtime" option enabled on the connection.
2. Under Acknowledge tag bind "AlarmDB".AckWord. Ensure the access direction is read/write on the HMI tag.
3. Under Status tag bind "AlarmDB".StatusWord. The status word is computed by the PLC as the AND of trigger and the inverse of ack, or it can be supplied by a library block such as AlarmHandling.

The HMI alarm control will display up to 16 alarm messages per bound word. Each alarm message must have a unique message number; the message text, class, and acknowledge model are configured on the HMI side, not in the PLC.

8. Symbolic Access During Runtime on S7-1500

S7-1500 supports a feature called Symbolic access during runtime that lets an external application (HMI, OPC UA server, third-party SCADA) read and write PLC tags by their symbolic name rather than by absolute address. To enable it:

1. Right-click the S7-1500 device in the project tree and select Properties > Protection > Permit access with PUT/GET communication from remote partner. This must be ticked for OPC-style symbolic access.
2. Confirm the DB has the Accessible from HMI/OPC UA attribute set (default in optimized blocks since V14).
3. Confirm the connection on the HMI side uses S7ONLINE as the access point with the symbolic-access driver.

Full reference: TIA Portal V20 documentation: Symbolic access during runtime (S7-1500). This is the same capability that lets the AT overlay be visible to the HMI; without symbolic runtime access the HMI can only read absolute addresses and the AT overlay is invisible to it.

9. Trigger, Acknowledge, and Status Word Field-Proven Details

Modern Siemens application examples (e.g., the AlarmHandling library for S7-1500) define the alarm bit pattern as follows:

Bit Position	Trigger Word	Ack Word	Status Word
0	Alarm active	Operator pressed ACK	Active AND not yet acked
1	Alarm active	Operator pressed ACK	Active AND not yet acked
...	...	...	...
15	Alarm active	Operator pressed ACK	Active AND not yet acked

The status word is computed by the PLC each scan using the Boolean identity:

"AlarmDB".StatusWord := "AlarmDB".TriggerWord AND NOT "AlarmDB".AckWord;

If the AT overlay uses a UDT (Method B), the same calculation applies member-wise or by re-interpreting the word view:

"AlarmDB".Status.MotorOverload :=
   "AlarmDB".Trigger.MotorOverload AND NOT "AlarmDB".Ack.MotorOverload;

WinCC colors the alarm row red while Status.MotorOverload is TRUE, and switches it to green the moment the operator acks and the trigger clears.

10. Migrating from Classic STEP 7 (S7-300/400) to TIA Portal

In classic STEP 7 the AT keyword did not exist. The standard pattern was a hand-written shadow DB of BOOL tags with a copy OB:

// Classic STEP 7 - OB1 or OB35
L DB10.DBW0       // trigger word
T MW100

// unwind bits manually
A M 100.0
= DB20.DBX0.0     // MotorOverload shadow
A M 100.1
= DB20.DBX0.1     // ValveStuck shadow

Migration to TIA Portal:

1. Convert the DB10 to optimized access in TIA Portal; do not retain the absolute address layout.
2. Replace the shadow DB with a single DB containing the trigger/ack/status WORDs.
3. Add the AT overlay (Method A or B).
4. Replace every absolute bit reference (e.g. DB10.DBX0.0) with the new symbolic reference (e.g. "AlarmDB".Trigger.MotorOverload).
5. Re-bind the HMI alarm control to the new symbolic tags.

After migration the symbol table lists every alarm as a first-class citizen, the HMI project tree can browse them, and code review no longer requires a side-table mapping bit numbers to names.

11. Verification Procedure

After implementation, run this checklist before commissioning:

1. Compile the SCL source. Confirm the AT overlays compile without warnings. Common warning: "AT construction in optimized block - check access qualifiers" - resolved by adding AT%Q*, AT%I*, or matching the source attribute.
2. Download to the S7-1500 CPU. Open the watch table; force "AlarmDB".Trigger.MotorOverload to TRUE. Confirm the trigger word shows W#16#0001 and the status word shows W#16#0001.
3. Force "AlarmDB".Ack.MotorOverload to TRUE. The status word must drop to W#16#0000. The trigger word remains W#16#0001 until the actual alarm source is cleared.
4. On the HMI, open the alarm view. The MotorOverload row must appear red while status is TRUE, and green once acked.
5. Stop the PLC and look at the online Symbol browser in TIA Portal. All three AT overlays and their members must be visible. If they are not, check the Accessible from HMI attribute on the DB.
6. Power-cycle the HMI. Confirm the alarm state is restored correctly. If the alarms flash on restart, the trigger word was not being held in a retain area.

12. Troubleshooting Matrix

Symptom	Likely Cause	Fix
AT overlay does not compile	Different access qualifier (e.g. %Q* vs %I*) between source and AT	Match the qualifier exactly
HMI sees trigger word but alarms do not appear	Alarm control bound to wrong tag, or message numbers not assigned	Verify alarm control trigger tag, assign unique message numbers
HMI cannot subscribe to symbolic AT members	Symbolic access during runtime disabled on CPU	Tick "Permit access with PUT/GET" and confirm DB "Accessible from HMI/OPC UA"
Alarm flashes on HMI restart	Trigger word stored in non-retain area	Set the trigger WORD as RETAIN in the DB
Status word always zero	Status word computed but never written, or AT overlay read-only mismatch	Reassign StatusWord with %Q* qualifier, force recompute in OB1
Compile error: "Different attributes for AT construction"	Source is AT%Q* but overlay is plain BOOL without qualifier	Add AT%Q* to the overlay declaration
HMI shows alarm but ACK button has no effect	Ack tag not writable on HMI, or wrong access point on the connection	Set HMI tag to read/write, verify S7ONLINE access point
AT members show address 0.0 instead of overlay address	AT declared in non-optimized block, or compiler could not resolve overlap	Confirm optimized access on the DB
BOOL array visible on HMI but always FALSE	WinCC binding expects WORD but array bound instead	Bind the WORD for the alarm control; use ARRAY only for program logic
Cross-DB overlay returns wrong bit	AT declared in a different DB than the source WORD	AT overlay must reside in the same data block as the source

13. Performance and Footprint Notes

AT overlays are zero-cost at runtime. They generate no copy instruction and consume no additional memory; the compiler reuses the same DB offset for both views. The only cost is at compile time: each AT declaration increases the SCL compile time linearly with the number of overlays. For projects with 50+ AT overlays across the alarm DB, expect an additional 2-4 seconds of compile time on a mid-range workstation.

Compared with the classic shadow-DB approach, AT eliminates one DB entirely (the shadow DB), reducing the overall memory footprint by 16 BOOLs per alarm word - a small but useful saving on a CPU 1510 with limited work memory. On an S7-1516 or S7-1518 the savings are negligible but the maintainability gain is large.

14. Frequently Asked Questions