Siemens TIA Portal WinCC Alarm Log: Filter Incoming Messages Only

When commissioning operator-action logging on a Siemens HMI (Comfort Panel, Unified Comfort Panel, or WinCC Runtime Advanced/Professional), engineers routinely discover that the configured alarm log records both the incoming and the outgoing transition of every discrete alarm. For an operator-action audit trail such as Pump01 - Operator Tech13 press START, the outgoing event generated when the operator releases the button (because the trigger bit resets) is noise that doubles the log size and confuses the archive. This article documents the root cause, the available filter mechanisms in WinCC, and the verified configuration procedure in TIA Portal V20 to record only incoming messages.

1. Problem Definition

Symptom observed on the runtime alarm log:

• Every operator keypress that drives a discrete alarm via SetBitWhileKeyPressed produces two log entries.
• Entry 1: Pump01 START pressed by Tech13 – state = I (incoming).
• Entry 2: Pump01 START pressed by Tech13 – state = O (outgoing) or IO (incoming + outgoing on the same sample).
• The operator log file grows at 2× the expected rate and the archive becomes difficult to read.
• Filter check boxes for Pending alarm, Unacknowledged alarm, and similar states in the alarm log are disabled or greyed out, preventing the operator from limiting the display.

2. Alarm State Model in WinCC

WinCC distinguishes alarm states by event class. The discrete alarm class "Errors", "Warnings", and "System" expose the following transitions to the alarm log:

The behavior is identical across WinCC Comfort Panels, RT Advanced, and RT Professional. The runtime always emits one log record per transition; the log database is append-only and never collapses consecutive states of the same alarm.

3. Root Cause Analysis

The duplicated log entry is not a bug; it is the documented behavior of a discrete alarm whose trigger tag is connected to a momentary pushbutton function. The default keypress action SetBitWhileKeyPressed sets the tag while the key is held and clears it on release. Because the discrete alarm is configured on the rising and falling edge of that tag, the runtime records both:

1. Rising edge (key down) → I event.
2. Falling edge (key up) → O event.

The alarm log has no implicit state filter; it is an audit-grade buffer that must capture every transition for forensic purposes. Filtering is therefore the responsibility of the display (alarm view) and the archive view, not of the log itself. The operator log filter check boxes appear disabled in older TIA Portal versions because the alarm log viewer only supports user filters from TIA V17 SP1 onward for the log database, and from TIA V18 for the alarm view's pending-alarm toggle.

4. Solution Overview

Three independent mechanisms can be combined to achieve "incoming only" logging:

1. Alarm view filter – limits what is visible on the HMI screen without changing the log.
2. Alarm log filter – limits what is written to or replayed from the log database.
3. Discrete alarm configuration – suppress the outgoing event at the source by changing the trigger logic from an edge-triggered bit to a sticky latched bit.

For audit-grade compliance, option 3 is preferred: generate only the incoming event in the first place. For visual filtering on the screen without losing the outgoing event in the long-term archive, option 1 is the cleanest path.

5. Step-by-Step: Configure the Alarm View Filter (TIA V20)

The official procedure for filtering the alarm view on Basic Panels, Panels, Comfort Panels, RT Advanced, and RT Professional is documented in the TIA Portal V20 help. Open the alarm view configuration in the Inspector window and follow the path below.

1. Select the Alarm view object in the HMI screen tree.
2. In the Inspector window open Properties > Properties > Filter > Alarm filter.
3. Choose Custom to enable the filter expression editor.
4. Enter the filter string documented in Configuring filters in the alarm view on the Siemens TIA documentation portal.
5. Compile and download the HMI project.

5.1 Standard alarm view filter check boxes

For projects still on TIA V17 or older, the alarm view provides three pre-defined toggles that the runtime honors when the box is checked:

These check boxes are intentionally disabled in the alarm log viewer because the log is a historical record; filtering history would break the audit chain.

6. Step-by-Step: Configure the Alarm Log Filter

If the goal is to write only incoming events to the SQL/SDF-based alarm log (rather than merely displaying fewer rows), apply a log filter. The procedure is identical to the alarm view filter but uses the Alarm log configuration object instead of the alarm view.

1. Open the HMI device configuration in the TIA Portal project tree.
2. Expand Runtime settings > Logs.
3. Select the alarm log and open Properties > Filter.
4. Choose Custom and enter State = 'I'.
5. Confirm with OK and recompile the HMI station.

7. Step-by-Step: Generate Only Incoming Events at the Source

The cleanest engineering solution is to ensure the trigger tag does not fall back to FALSE when the operator releases the button. Replace the momentary SetBitWhileKeyPressed with a one-shot latching action.

1. Create an internal HMI tag HMI_Tag_Pump01_StartEvent of type Bool.
2. Create an HMI function FB_Pump01_StartEventLog with the following Structured Text body:

// Pump01 operator-action logger - latched
IF "Key_Pressed_Pump01_Start" AND NOT "HMI_Tag_Pump01_StartEvent" THEN
    "HMI_Tag_Pump01_StartEvent" := TRUE;     // set sticky
    "Pump01_Start_Pulse"        := TRUE;     // 100 ms pulse for discrete alarm trigger
END_IF;

IF "Pump01_Start_Pulse_Timer".Q THEN         // 100 ms IEC timer
    "Pump01_Start_Pulse"        := FALSE;
END_IF;
"Pump01_Start_Pulse_Timer"(IN := "Pump01_Start_Pulse", PT := t#100ms);

3. Bind the keypress function on the button to FB_Pump01_StartEventLog instead of SetBitWhileKeyPressed.
4. Configure a discrete alarm on the tag Pump01_Start_Pulse with acknowledgement model Without acknowledgement and a one-cycle minimum dwell.
5. Add a separate PLC-side reset function (operator logout, end-of-shift, or a dedicated Reset log button) to clear the sticky bit.

Because the discrete alarm trigger is now a 100 ms pulse and the underlying state bit never returns to FALSE in the same cycle, the runtime records only the I transition. The PLC receives the rising edge on Pump01_Start_Pulse, the alarm fires once, and the audit log contains exactly one row per operator action.

7.1 PLC-side equivalent (S7-1500 / S7-1200)

For projects where the operator action originates from a physical pushbutton wired to the PLC, replicate the latching in the PLC rather than the HMI:

// OB1 - Pump01 start latching
IF "DI_Pump01_Start" AND NOT "Pump01_Start_Latch" THEN
    "Pump01_Start_Latch" := TRUE;
    "Pump01_Start_Alarm" := TRUE;          // discrete alarm to HMI
END_IF;
IF "DI_Reset_Log" THEN
    "Pump01_Start_Latch" := FALSE;
    "AlarmAck_Pump01"    := TRUE;          // acknowledge to release HMI alarm
END_IF;

8. Parameter Reference

9. Verification Procedure

1. Compile the HMI station and download to the target device.
2. Start WinCC Runtime in online mode.
3. Press the Pump01 START button for one second and release.
4. Open the alarm view. Verify only one row appears with state I.
5. Open the alarm log viewer. Verify the underlying log file contains one I entry (or two if log filter is disabled – I and O).
6. Export the alarm log via Logs > Export CSV and inspect with Excel or pandas.read_csv:

import pandas as pd
df = pd.read_csv("alarmlog.csv", sep=";")
incoming = df[df["State"] == "I"]
print(f"Incoming events: {len(incoming)}")  # expect 1 per keypress

7. Confirm the timestamp matches the button-down event captured by an external data acquisition system.

10. Troubleshooting Matrix

11. Field-Commissioning Notes

• The minimum acquisition cycle of the alarm class must be ≤ the dwell time of the trigger pulse. A 100 ms pulse with a 250 ms acquisition cycle produces a single IO event; a 100 ms pulse with a 100 ms cycle produces a single I event.
• When the HMI panel is replaced or the project is migrated from WinCC flexible 2008 to TIA Portal, the alarm log database schema changes from .csv to .sdf / .udl. Re-test the filter after migration.
• On Unified Comfort Panels (MTP1500 to MTP2200), the alarm control exposes an additional FilterPills property; configure it the same way using State = 'I'.
• If the project uses WinCC RT Professional (PC-based), the alarm log is backed by Microsoft SQL Server. The same filter syntax applies, but the log can additionally be queried directly:

12. Frequently Asked Questions