TIA Portal Cross Reference: DB Variable HMI Usage Not Shown

1. Problem Statement

Engineers using TIA Portal for SIMATIC S7-1500/S7-1200 (and S7-300/400 with classic STEP 7 integration) frequently rely on the integrated Cross Reference tool to trace where a tag is read or written across the project. The expected behavior is that selecting a tag, either a memory bit (%M), an I/O address, a tag from a global data block (DB), or a PLC tag table entry, opens a Cross Reference editor that lists every point of use:

• Program blocks (OB, FB, FC, Instance DBs)
• HMI screens, tags, and connections (WinCC Comfort/Advanced/Professional)
• Other devices that reference the same PLC tag list

Starting with TIA Portal V12, the cross reference behavior for a DB element was changed: the result list no longer includes the HMI points of use. Only program-block usages are reported. The same is not true for a memory flag (%MW/%M): the cross reference for a bit memory address still lists HMI usage as well as STEP 7 usage.

This asymmetric behavior is confusing because the engineer's mental model is "Cross Reference = full project scope." When the tool returns only STEP 7 results for a DB tag, the missing HMI rows are often mistaken for unused HMI tags, a broken tag link, or a compile problem.

2. Behavior Matrix: M-Flag vs. DB Element

The table below summarizes the observed behavior on a representative project (S7-1500 CPU 1515-2 PN with WinCC Comfort Panel TP1500) and is consistent with the published TIA Portal help on cross references.

3. Root Cause: The V12 Performance Change

The V12 change is documented internally as a performance decision. The reasons cited by Siemens engineering and confirmed in field reports are:

1. Index size. In V11, a single DB element cross reference could enumerate every access, including HMI tag connections. For large DBs (10k+ elements) with deep WinCC tag trees, the index build time grew non-linearly and made the editor appear frozen.
2. Database cost. The V11 cross reference index was rebuilt on every change. V12 introduced lazy indexing for DB internals; the per-element HMI scan is now deferred until the user explicitly runs a full DB cross reference.
3. Scope ambiguity. With multiple HMI devices on a project (e.g. a TP1500, a WinCC Runtime Professional PC, and a WinCC Unified Client), V12 needed a project-wide query. Running that on a single tag was deemed too slow; running it on a DB is acceptable.

The direct consequence: the per-tag cross reference path in the right-click menu intentionally omits HMI results to keep the response time below the perceived UI hang threshold (roughly 200 ms–2 s depending on project size).

4. Affected Versions

If you must remain on V13, the DB-wide cross reference is the supported workaround. If you can migrate, V14 and later ship several cross reference fixes and the V20 Openness API exposes a stable CrossReferenceResult you can drive from a script.

5. Workarounds and Operational Procedures

5.1 Workaround A — Run the cross reference on the entire DB

1. In the project tree, right-click the data block (e.g. HMI_DB).
2. Select Cross references (not Go to → Cross references on a single element).
3. The editor opens a multi-row table: Object, Location, Access, Type, Path. The Path column now includes WinCC HMI devices, WinCC Unified Clients, and other HMI panels.
4. Filter on the column Type = HMI tag to scope to the HMI usages only.

This restores the V11 result scope. The cost is that the result is the union for the whole DB; you cannot filter directly to a single tag without a second pass. Most engineers solve this with the Find dialog (Ctrl+F) inside the result table.

5.2 Workaround B — Use a PLC tag table instead of a DB element

If the HMI must read/write a single bit or word, hoist the variable into a PLC tag table entry. Cross reference for a PLC tag has full project scope in every V12+ version, identical to the %M behavior. This is the lowest-risk fix when you control the data model.

5.3 Workaround C — Expand the DB to a writable node

The TIA Portal cross reference engine treats array slices and STRUCT members specially. Selecting a STRUCT and expanding to its leaf element can produce different results than selecting the leaf directly:

1. Open the DB.
2. Click the arrow next to the parent STRUCT to expand it.
3. Right-click the leaf tag and choose Cross references.

Depending on how the cross reference index was last built, the HMI rows may appear here even when the single-tag path returns nothing. Re-trigger the index from Project tree → right-click CPU → Cross references → Update before relying on this path.

5.4 Workaround D — Force a cross reference index rebuild

The index can be stale after a major change (HMI compile, DB restructure, library update). Force a rebuild:

1. Project tree → right-click the PLC device.
2. Choose Cross references → Update.
3. Wait for the status bar to show Cross reference data has been updated.
4. Repeat the DB element cross reference.

6. TIA Portal V14 and Later: What Changed

V14 shipped with restructured cross reference storage and several visible improvements:

• The Cross reference editor gained column filters, the ability to filter on Access (read/write), and a project-wide search field.
• The per-tag result is no longer guaranteed to omit HMI rows: for some projects, expanding the result list and clicking Show all reveals additional HMI rows that the V13 path silently dropped.
• A new Usage tab was added in the inspector for the most-used objects. The tab mirrors the per-tag cross reference and, in many cases, surfaces HMI usage even when the menu path does not.

If the per-tag HMI omission is a hard blocker, plan a migration to V14 SP1 (or newer) and re-test. The V14 SP1 release notes contain explicit cross reference fixes; consult the Siemens Industry Online Support entries for "TIA Portal V14 SP1 cross reference" for the exact list.

7. TIA Portal Openness API: Programmatic Cross Reference

For teams that need a deterministic answer (audit, code review, CI pipeline, multi-project search), use the TIA Portal Openness API. The API is documented in the official TIA Portal help and the cloud manual.

The relevant object is IPlcCrossReferenceService, which returns a CrossReferenceResult describing every source of usage for a given STEP 7 object, including HMI tag connections, motion technology objects, and other devices.

Per the TIA Portal Openness documentation: Getting Cross References for STEP 7:

You can use the TIA Portal Openness to provide Cross Reference information on applicable STEP 7 objects. The Openness API returns CrossReferenceResult which contains the list of all references found for the requested STEP 7 object.

Typical C# usage pattern (V20):

// Assume plcDevice is the IPlcDevice reference obtained from the project tree
IPlcCrossReferenceService xrefService = plcDevice.GetService<IPlcCrossReferenceService>();

// Look up a DB element (here: tag "Start" inside DB 100)
IPlcTag dbTag = plcDevice.TagTables
    .Get("GlobalDB")
    .Tags
    .Get("HMI")
    .Get("Start"); // adjust to your tag structure

CrossReferenceResult result = xrefService.GetCrossReferences(dbTag);

foreach (CrossReferenceEntry entry in result.CrossReferences)
{
    Console.WriteLine($"{entry.SourceName} | {entry.AccessType} | {entry.Location}");
}

The CrossReferenceResult enumerates AccessType values such as Read, Write, and ReadWrite, and Location values that include ProgramBlock, HmiTag, HmiScreen, and OtherDevice. The Openness API does not have the V12-V13 limitation: HMI usages are returned regardless of whether the queried object is a DB element, a memory flag, or a PLC tag table entry.

8. Best Practices for HMI ↔ PLC Variable Usage

The cross reference oddity is a symptom of a deeper design question: where should HMI-consumed data live?

1. Centralize HMI tags in a single DB (or a PLC tag table). Use a naming prefix such as HMI_ so engineers can find them.
2. Never let the HMI reference internal scratch variables. Coupling the HMI to FB Instance-DB members or temp tags is fragile across recompiles.
3. Prefer symbolic HMI tags over absolute addresses. Symbolic links survive DB number renumbering; absolute links do not.
4. Avoid memory flags for HMI exchange in V12+ projects. Memory flags still work, but they bypass the structured data model. Use them only for handshake bits or legacy reasons.
5. Document the contract: which DB and which symbol are the canonical source for each HMI tag. Treat the HMI tag list as a derived view, not the source of truth.
6. Version the DB. Add a Version tag (e.g. WORD) and a CRC (e.g. DWORD) that WinCC reads at startup; this gives the HMI an immediate sanity check after a PLC download.

9. Step-by-Step Verification Procedure

Use the following procedure to confirm that the cross reference tool is reporting HMI usage correctly after a project change:

1. Open the project in TIA Portal V13 (or your working version).
2. Open the target DB and right-click a known-used tag, e.g. "Motor".Run.
3. Choose Cross references. Record the number of rows.
4. Right-click the DB itself and choose Cross references. Filter on Type = HMI tag. Record the count of HMI rows.
5. Open the WinCC tag list for the HMI device and locate Motor_Run linked to "Motor".Run. Confirm the connection status (green icon = linked, red = broken).
6. If step 3 returns fewer rows than step 4 (and step 4 contains the HMI references for the same tag), the V12 limitation is the cause. Apply Workaround A (DB-wide cross reference) for that DB.
7. If step 4 shows zero HMI rows but step 5 shows a green link, force a cross reference index update (Workaround D) and re-test.
8. If the gap persists across versions and projects, escalate to the Openness API path and capture the CrossReferenceResult as a build-time artifact.

10. Troubleshooting Matrix

11. Field Notes and Caveats

• The V12 change is a display change, not a data change. The HMI link itself is unaffected; only the cross reference report omits it.
• Cross reference results are computed at compile and at update time. An HMI added after the last PLC compile will not appear in the cross reference until the next PLC compile + cross reference update.
• Multi-project environments (one TIA project per factory line, shared DBs) must run the cross reference per project. The Openness API can iterate over a list of projects to build a merged view.
• For audit / regulatory documentation, never rely on a single TIA Portal screenshot. Capture the CrossReferenceResult from Openness and archive it alongside the project file.
• The Show all link in the inspector's Usage tab (V14+) is worth checking: it can reveal HMI usages that the right-click menu path silently hides.

12. Frequently Asked Questions