Siemens TIA Portal: Configuring HMI Visibility and DB Tag Access

When engineers first open the TIA Portal PLC tag table or the properties dialog of a data block (DB) variable, they encounter two columns or attribute check boxes that look almost identical: "Visible in HMI" and "Accessible from HMI". The default behavior in the tag table shows PLC tags with both attributes set, while DB variables frequently appear with only Visible enabled and Accessible disabled (greyed or unchecked). This asymmetry is the source of almost every "I cannot write to my tag from the panel" ticket in STEP 7 / TIA Portal support.

This reference explains the meaning of each attribute, the engineering rationale behind the default, and the exact steps required to grant HMI write permission to a DB variable, with version-specific notes from STEP 7 Professional V11.0 SP2 through TIA Portal V19.

1. Semantics of the Two HMI Attributes

Both attributes belong to the Accessibility property group of a tag and are evaluated by the HMI device at runtime when the HMI tag is created from the PLC tag or DB tag reference. They are independent switches: enabling one does not automatically enable the other.

In other words: Visible in HMI controls visibility (selection in pickers, browseability, cross-reference), while Accessible from HMI controls mutability (write capability). The two are deliberately decoupled so that read-only tags (setpoints from the PLC, calculated values, diagnostic data) can be browsed in the HMI without granting the operator panel the right to overwrite them.

2. Why DB Variables Default to "Visible" Only

Siemens ships DB variables with Accessible from HMI = false by default as a fail-safe default. The reasoning is that DBs frequently contain structured process data that the PLC program owns and writes to internally (recipe values, machine states, production counters, alarms). Granting automatic write access to every DB element would expose the entire data model to the HMI, including variables that the application logic expects to control exclusively.

Conversely, the classical PLC tag table (created from the project tree under PLC > PLC tags > Default tag table or user-defined tag tables) contains the I/O, memory, and timer/counter addresses that are intentionally exposed to the HMI. The PLC tag table was historically the HMI-facing namespace, so Siemens enables both attributes by default there.

This default was introduced in STEP 7 V11 SP2 (manual reference: STEP 7 Professional V11.0 SP2, chapter 9.1.2.6 — "Configuring the HMI accessibility of PLC tags") and is preserved in every subsequent TIA Portal release, including the current V19.

3. Configuration Procedure: Enabling "Accessible from HMI" on a DB Variable

Follow this sequence to grant the HMI runtime write access to a specific DB variable.

Prerequisites

• TIA Portal project containing an S7-1200/1500 CPU and at least one HMI device (Comfort Panel, WinCC Runtime Advanced, WinCC Runtime Professional, or Unified Comfort Panel).
• An HMI connection established under Devices & Networks > Connections with an active S7 connection partner.
• The DB must be downloaded once to the PLC. Accessibility flags are stored in the offline project and compiled into the PLC hardware configuration download.

Step-by-Step

1. Open the project tree and expand the S7 CPU → Program blocks → the target DB (e.g., DB_Machine).
2. Right-click the DB and select Open (or double-click). The DB editor opens.
3. Switch the view from Details to the table view if it is not already selected. In TIA Portal V14 and later, the right-hand pane shows the column Accessible from HMI by default; in V11 SP2 and V13, you may need to enable the column via right-click on the table header → Show/Hide Columns.
4. Tick the checkbox in the Accessible from HMI column for each variable that the operator panel should be allowed to write.
5. Compile the PLC (right-click CPU → Compile > Software (rebuild all blocks)).
6. Open the HMI device → HMI tags. The HMI tag table automatically offers to import the new accessibility flag, or you drag the DB variable from the project tree directly into the HMI tag table.
7. Compile the HMI and download both PLC and HMI to the targets.

4. Tag Table Hierarchy: PLC Tags, DB Tags, HMI Tags

A TIA Portal project can contain up to three logically distinct tag namespaces. Understanding the boundaries prevents accidental misuse.

An HMI tag is a pointer: it carries the data type, acquisition cycle, limits, and scaling factors, and references either a PLC tag or a DB tag through the HMI connection. If the referenced source tag is not flagged Accessible from HMI, the HMI tag inherits read-only semantics regardless of the acquisition settings on the HMI side.

5. HMI Connection Configuration and S7 Routing

The HMI accessibility attributes are only one side of the contract. The HMI must also be bound to the CPU by an S7 connection that allows the requested direction. Misconfiguration at this layer causes the same symptom (no write capability) but requires a different fix.

5.1 Required HMI connection properties

• Connection type: S7 connection (TCP via PN/IE, or PROFIBUS DP for older panels).
• Partner interface: the CPU's PROFINET or PROFIBUS interface, depending on topology.
• Connection resource: the CPU must have a free S7 connection resource; S7-1200 CPUs in firmware V4.0 and later support 1–8 HMI connections depending on catalog number.
• PUT/GET access: for S7-1200/1500, the CPU's Properties > Connection mechanisms > Permit access with PUT/GET communication from remote partner must be enabled if the HMI is not in the configured access list. (HMI panels created in the TIA project are normally in the access list by default.)

5.2 HMI device property — Access point

On the HMI device, the Connection editor (TIA V14+) or the HMI connections editor (V11–V13) must reference the S7 connection. If the connection is missing or points to a non-existent CPU, the HMI tag will not be able to write even when the source DB tag is flagged Accessible.

6. Runtime Behavior and OPC UA Mapping

The Accessible from HMI flag has implications beyond the HMI panel. The TIA Portal exposes the same set of flags to:

• S7 communication (PUT/GET) from other PLCs or SCADA systems — the flag controls the read-only contract across the S7 protocol.
• OPC UA server on the S7-1500 (firmware V2.0+): the variable is exported with an appropriate access level. By default, an OPC UA client can read all visible tags, but only tags flagged Accessible from HMI can be written.
• Web server of the S7-1200/1500 (user-defined pages): write attempts on non-accessible tags return a server-side error.

This means the flag is a project-wide authorization, not a panel-specific setting. A tag that is "Accessible from HMI" is accessible from any authorized partner. If the engineering intent is to allow write access from the panel only, the network topology (access list, firewall, PLC security mode) provides the additional containment.

7. Security Model: Read-Only vs Read-Write Boundaries

Plant security best practice in TIA Portal distinguishes three tiers of mutability:

Most production systems sit at 60–80% read-only, with writable tags limited to named operator inputs. Auditors and IEC 62443 reviews typically look for evidence that writable flags are explicitly granted, not implicitly default.

8. Version History: From STEP 7 V11 SP2 to TIA V19

The HMI accessibility flags were introduced with the launch of TIA Portal in V11 and have been preserved, with minor column-name changes, in every release.

9. Performance and Tag Filtering Considerations

Enabling Accessible from HMI on a tag does not change the acquisition cycle. The HMI polls the tag at the configured cycle, regardless of read/write status. However, three side effects are worth knowing.

1. Acquisition cycles must be sensible. Writable tags are usually operator-driven, so an acquisition cycle of 1 s is typical. Sub-100 ms cycles on hundreds of writable tags saturate the S7 connection.
2. Symbolic access overhead. On S7-1500 with optimized blocks, every HMI tag read/write incurs a symbolic lookup. The S7-1200/1500 hardware handles this efficiently, but large tag sets still benefit from grouped acquisition.
3. Connection count. Each HMI panel consumes an S7 connection resource from the CPU. S7-1214C, for example, allows 3 HMI connections; S7-1516 allows up to 32.

10. Bulk-Editing the Accessibility Flag

For large projects, individual edits are impractical. TIA Portal provides two efficient mechanisms.

10.1 Multi-select in the DB editor

1. Open the DB and switch to the table view.
2. Click the first row, then Shift+click the last row to select a range.
3. Right-click → Edit > Accessible from HMI. The setting applies to all selected rows.

10.2 Export and reimport via CSV

1. In the DB editor, choose Edit > Export and save the symbol table as CSV.
2. Edit the AccessibleFromHMI column in a spreadsheet.
3. Reimport via Edit > Import. TIA Portal matches symbols and updates the flags.

11. Troubleshooting Matrix

12. Cross-Reference and Diagnosis

The cross-reference (right-click on a tag → Cross-references) lists every screen, script, archive, and alarm where the tag is used. After toggling Accessible from HMI, run the cross-reference to confirm that the tag is only consumed in places where write access is intentional. Removing accidental write references prevents the HMI from silently overwriting values that the PLC program treats as inputs.

13. Best Practices for Plant Commissioning

• Define a tag classification standard at the start of the project. Document which categories (setpoints, modes, recipes) are flagged Accessible.
• Use naming conventions to signal mutability, e.g., suffixes _RO (read-only) and _RW (read-write).
• During the Factory Acceptance Test (FAT), run a script that exports the DB tag table and verifies the flag against the standard.
• Lock down the HMI runtime with user groups (Operator, Service, Administrator) so that writable tags are only exposed to authorized roles, even if the underlying tag is flagged accessible.
• At handover, deliver a tag export (CSV) that includes the Accessible from HMI column. The cybersecurity file the customer submits to their audit should include this export.

14. Migration Notes: STEP 7 V5.x → TIA Portal

Tags migrated from STEP 7 V5.x into TIA Portal are imported with the Accessible from HMI flag set to true by default. After a migration, audit the DB tags specifically: any tag that was previously a S7-mci shared read-only data block can be safely downgraded to Visible only. Conversely, setpoints and operator inputs that were intentionally writable should retain the flag.

15. Reference: TIA Portal Online Help Topics

For further reading, consult the TIA Portal Information System under the following navigation paths:

• Editing projects > PLC > PLC tags > Tag properties > Accessibility from HMI
• Editing projects > PLC > Program blocks > Data blocks > Defining the HMI accessibility of DB tags
• Editing projects > HMI > HMI tags > Creating HMI tags > Creating HMI tags from PLC tags
• Editing projects > OPC UA > Configuring the OPC UA server > Defining accessible tags