WinCC Structure Tag Odd Offset: Excel Tool Workaround

Overview: WinCC Structure Tags and the Offset Constraint

In TIA Portal, WinCC Comfort, WinCC Professional, and WinCC Unified all support structure tags (also called UDT instances on the HMI side). A structure tag is a composite HMI tag whose members are addressed via an offset from a base address, typically synchronized with a PLC User-Defined Data Type (UDT) through a tag connection or an S7-1500/1200 data block. For every member, the offset is calculated automatically when you drag a UDT from the PLC into the HMI tag table. The result is a list of BOOL, INT, REAL, STRING, and other typed sub-tags that the runtime can address either by symbolic name or by raw offset.

The WinCC engineering tool enforces a strict alignment rule for BOOL members inside a structure: a single BOOL occupies a full 16-bit WORD of the structure layout, and only bit positions 0 through 15 within that word are legal. This is the same rule that applies when a BOOL is placed inside a UDT in STEP 7, and it propagates from the PLC data block definition into the HMI tag table. Because the rule is enforced at the GUI level, attempting to type 1, 3, 5, 7, 9, 11, 13, or 15 as the byte offset for a new structure element is rejected without a dialog; the input field is locked or the value snaps back to an even value.

This behavior is documented in the TIA Portal Information System under the WinCC Professional / WinCC Unified "Structure tag" topic. The exact wording is: "BOOL tags are always one word long in their structure. Therefore, bit positions 0 to 15 are the only positions possible. This length of two bytes has to be taken into account for the offset value of the following element." The lockout is intentional, but it does not reflect a runtime restriction. The runtime is capable of reading a BOOL from any bit address on the PLC, including odd byte offsets, because the HMI tag is always backed by a full S7 byte or word read request and the bit is selected by the mask. The GUI is simply preventing accidental misalignment that would make the project harder to maintain when other engineers re-import the structure.

There are legitimate engineering reasons to force an odd offset: mirroring a third-party controller's data block layout, porting an existing WinCC flexible project where odd offsets were used historically, or matching a non-Siemens PLC's data structure (e.g. Modbus register maps imported through OPC UA). In all of these cases, the GUI lockout can be bypassed by importing the tag list through the Excel Configuration Tool or, for users comfortable with project files, by editing the TIA Portal project XML directly. Both methods are described below with the verification steps required to confirm correct runtime behavior. The TIA Portal Information System and the SIMATIC HMI product documentation are available from the Siemens Industry Online Support portal.

Why Word Alignment Is Enforced on BIT Members

The word-alignment rule on BOOL members originates in the S7 data block model. In STEP 7 V18 and later, a BOOL in a UDT occupies one byte logically but is allocated 16 bits of storage in the data block. The symbol name in the UDT binds to a specific bit of a specific word. The DB offset shown in the UDT properties reflects the byte offset, and the bit offset is shown in the "%X" portion of the fully qualified name. When the HMI imports this UDT, it produces a structure tag whose sub-tags carry the same bit addresses.

Three constraints follow from this model:

• Byte offset must be even. A BOOL can only start at byte 0, 2, 4, 6, 8, 10, 12, or 14 of its parent word. Bit offsets 1, 3, 5, 7, 9, 11, 13, and 15 sit on the second byte of a 16-bit word and are not addressable in the S7 BOOL model.
• Bit position 0 to 15 is the only legal sub-position. A BOOL with byte offset 0 and bit 7 is at fully qualified name DBx.DBb.byte0.%X7. Bit 7 of byte 1, however, is at DBx.DBb.byte0.%X15 because the second byte of the word is named "byte 0" in the offset schema used by the UDT compiler when the BOOL is the first element of the word. This is the source of the GUI's apparent "1, 3, 5" lockout: those values are not bit positions within a word, they are byte offsets that would place the BOOL into the second byte of the previous word, which is not an S7 legal address.
• Following elements are offset by two bytes. After a BOOL, the next member of the structure starts at the next even byte offset. The Information System callout "This length of two bytes has to be taken into account for the offset value of the following element" warns engineers to add 2 to the running offset after each BOOL, not 1.

For BOOL members of structures that mirror S7-1500 UDTs, this rule is correct and absolute. The runtime cannot honor odd offsets because the underlying S7 communication (S7Comm Plus or S7Comm over TCP/ISO-on-TCP) always reads the BOOL as a bit of a 16-bit word. If the HMI tag claims byte offset 1 for a BOOL, the HMI will read PLC bytes 1 and 2, mask bit X of the second byte, and return it as the BOOL state. From the HMI runtime's perspective this works; from the STEP 7 cross-reference perspective it is meaningless, because no such symbol exists in the DB. The result is an HMI tag that updates correctly but cannot be traced back to a UDT symbol, and the cross-reference tool in TIA Portal will not show it.

For BOOL members that should be bound to a non-S7 address — for example an OPC UA node of a third-party controller, or a Modbus coil imported through the Modbus TCP driver — the GUI lockout is a nuisance with no benefit. The Excel Configuration Tool is the official escape hatch for these scenarios. OPC UA and Modbus address mapping in TIA Portal is described in the SIMATIC HMI OPC UA server manual on the Siemens Industry Online Support portal.

Symptoms: What the GUI Actually Blocks

The most common way engineers run into the lockout is when creating a structure tag manually through the HMI tag editor. The visible behaviors are:

• In the "Offset" column of the HMI tag table, the input field does not accept odd numbers. Typing "1" is rejected; the field stays empty or reverts to the previous value.
• When a structure element is configured with type BOOL through the context menu, the bit position drop-down only offers 0 to 15. Values outside that range are not selectable.
• Importing a UDT from the PLC produces a structure whose BOOL members all have bit positions 0 to 7 of even byte offsets. The first BOOL is at byte 0 bit 0, the second at byte 0 bit 1, and so on. The "Offset" column on the HMI side shows the same even byte offsets as the UDT.
• If the structure contains a mix of BOOL and larger types (INT, REAL, DWORD, STRING), the offsets are automatically corrected to keep larger types aligned. A REAL following a single BOOL still starts at byte 2, not byte 1.
• Drag-and-drop from a non-S7 source (e.g. a Modbus tag list) into a structure produces a row that is greyed out and shows the error 0xFFFE0001 in the Quality Code column.

None of these symptoms indicate a fault. The TIA Portal Information System marks this as standard behavior, not an error. The remedy is therefore not a setting but a different import path.

Prerequisites

Before attempting the workaround, confirm the following:

1. You are running TIA Portal V16 or later. The Excel Configuration Tool is integrated as a TIA Portal add-in and requires the SIMATIC WinCC Excel Configuration Tool package, which is installed together with the SIMATIC WinCC Professional / Comfort / Unified option in the TIA Portal setup. See the TIA Portal Installation Manual at the Siemens Industry Online Support portal for the option list.
2. The HMI device is a WinCC Professional Runtime, WinCC Comfort Panel, or a WinCC Unified PC station. The Excel Configuration Tool is not supported for legacy WinCC flexible panels or for the S7-1200 basic panels.
3. You have write access to the HMI tag folder in the TIA Portal project, and the project is not currently checked into a multi-user server with another editor holding the HMI tag table open.
4. Microsoft Excel 2016 or later is installed. The add-in uses the .xlsx format and depends on the Open XML SDK; older Excel versions (2010, 2013) may install but are not officially tested.
5. If you intend to also edit the project XML directly, deactivate the project, copy the .ap16 / .ap17 / .ap18 project file, and prepare a text editor capable of opening files larger than 50 MB without locking. The TIA Portal blocks the project while it is open in the editor.
6. The S7-PLCSIM or S7-PLCSIM Advanced instance is available on the engineering station, or an S7-1200/S7-1500 controller is reachable on the network. This is required for the verification step.

Step-by-Step: Injecting Odd Offsets via the Excel Configuration Tool

The Excel Configuration Tool is shipped as a TIA Portal add-in and exposes a ribbon with three buttons: Export tags, Edit, and Import tags. The procedure below produces a structure tag with a BOOL member at byte offset 1 and a DWORD member at byte offset 3, demonstrating an "odd" placement that the GUI normally rejects. A reference workflow is shown in the SVG diagram below.

1. Open the TIA Portal project containing the HMI station. Compile the project once to make sure all tag definitions are current.
2. Select the HMI station in the project tree, then choose HMI tags in the detail view. Confirm the table shows the existing structure tags without a yellow warning icon (a warning icon means the structure is not fully synchronized with the PLC UDT and any manual offset edits may be overwritten on the next re-import).
3. Click the Export to Excel button in the Excel Configuration Tool ribbon group. The tool generates a workbook named HmiTags_yyyyMMdd_HHmmss.xlsx in a location of your choice. By default, it lands in Documents\Siemens\Automation\TIA_Portal_Tags.
4. Open the exported workbook. You will see a header row with at least the columns: Name, Path, DataType, Length, InitialValue, AcquisitionCycle, PLC tag, Connection, Offset, BitOffset, Comment. The bit-level BOOL members of a structure are stored in the same row as the parent structure element; the offset is the byte offset within the structure and the BitOffset is 0 to 15.
5. Locate the BOOL row whose bit position you want to override. Change the Offset cell to the desired value, e.g. 1. Save the workbook. Note: the BitOffset cell must still be 0 to 15; the GUI lockout on the Offset cell is what the Excel tool is bypassing, not the BitOffset cell.
6. Repeat the procedure for any other members. To demonstrate a real use case, set a DWORD at offset 3 (which would normally require manual repositioning after the BOOL at offset 1). The Excel tool accepts the new offset without complaint.
7. Validate the workbook with the Validate button in the add-in. The tool checks for duplicate offsets, out-of-range bit positions, and length overflow. Resolve any red cells before proceeding.
8. Click Import to TIA Portal. The add-in writes the structure tag back into the project. A confirmation dialog lists the number of created, updated, and skipped tags. Skipped tags indicate validation failures; the dialog shows the reason (e.g. "Offset 1 is not word-aligned for BOOL"). The import will still succeed for the rows that pass validation, but if any critical structure members are skipped, the structure will be incomplete and the runtime will read undefined memory.
9. Save and compile the project. Open the HMI tag table and confirm the BOOL now shows an Offset of 1. The GUI may mark the row with a yellow warning triangle ("Offset is not word-aligned for BOOL"). This is a soft warning, not an error, and the project will compile and run.
10. Download the project to the runtime. The structure tag is now active with the odd offset.

Step-by-Step: Verifying the Structure in the HMI Tag Simulator

After importing the odd-offset structure, verify that the runtime reads and writes the bits as expected. The verification procedure uses the WinCC tag simulator and the S7-PLCSIM (or the S7-1500 software controller) on the PLC side.

1. Launch S7-PLCSIM or the PLCSIM Advanced instance, load the PLC program, and run it in STOP mode initially so the memory is at its initial values.
2. Launch the WinCC Runtime. On a WinCC Professional PC station, this is the WinCC Runtime entry in the Windows Start menu. On a Comfort Panel, use the transfer mode to load the compiled project to the panel and start it.
3. Open the HMI tag simulator (Tools > Tag Simulation in the TIA Portal online environment, or the TagSim control on the runtime desktop if you have the engineering option installed). The simulator lets you set the value of any BOOL, INT, or REAL HMI tag to a known value and observe the resulting PLC memory.
4. Set the BOOL at odd offset 1 to TRUE. In S7-PLCSIM, open the data block of the source UDT and observe the corresponding bit. The bit should appear in the bit-position-1 (bit %X9 of the parent word if the BOOL is the first member of the structure, otherwise the bit of the word in which the BOOL now sits) of the DB. If the bit does not appear, the HMI tag is not bound to the expected UDT member and the structure import is incomplete.
5. Toggle the BOOL to FALSE and confirm the PLC bit clears. This is the round-trip check that proves the HMI is reading the correct byte, not a shifted one.
6. For DWORD members at odd offsets, set the DWORD to 0xDEADBEEF in the HMI simulator and verify the four bytes 0xDE, 0xAD, 0xBE, 0xEF appear in the correct DB bytes. S7-PLCSIM displays the DB in byte order, so a DWORD at offset 3 in the HMI tag table must produce bytes 0xDE at DB byte 3, 0xAD at DB byte 4, 0xBE at DB byte 5, 0xEF at DB byte 6. If the order is reversed, the import set the HMI DWORD at a different offset than the PLC DWORD; you must re-export, correct the offset, and re-import.
7. Capture a screenshot of the HMI screen showing the structure member values. Save it in the project documentation folder for the next maintenance engineer.

Tag Offset Reference Table for Common Structures

The table below shows the byte and bit offsets for several common structure layouts, including those produced by the Excel Configuration Tool workaround. Use it as a reference when planning tag additions to a structure that has been modified to allow odd offsets.

Alternative: Editing the Project XML Directly

For projects where the Excel Configuration Tool is not available, or for engineering work in version-controlled multi-user environments, the TIA Portal project can be edited by manipulating the project file. The .ap16 / .ap17 / .ap18 files are ZIP containers; inside them, the HMI tag definitions live in a path similar to IM\HmiTag\HmiTags.xml or in a per-station subfolder. The procedure is as follows:

1. Close TIA Portal. Copy the project file. Rename the copy to project_backup.ap18 for rollback.
2. Open the .ap18 file with 7-Zip, WinRAR, or the Windows ZIP support. Navigate to the IM/HmiTag folder. Extract the relevant XML file to a working directory.
3. Edit the XML in a text editor. Each HMI tag is a <Tag> element. The Offset attribute is stored in decimal or hexadecimal depending on the version. Replace the offset value with the desired odd value. Save the XML.
4. Drag the modified XML back into the ZIP container, overwriting the original. Confirm the archive is intact by opening it with 7-Zip and listing the contents.
5. Open the .ap18 project in TIA Portal. Compile the project. The tag table should show the new odd offset. If TIA Portal reports a malformed XML error, restore the backup and try again with a different editor. The most common cause of corruption is line-ending conversion (LF vs CRLF); keep the original line endings.

PLC Storage Model Behind the Rule

Understanding why the rule exists at all requires a closer look at the S7-1500 and S7-1200 storage model. The S7 BOOL is not stored as a single bit in a bit-addressable memory area; it is stored as a bit of a byte, and the byte is the unit of S7 communication. The BOOL's fully qualified name in a data block is "MyDB"."MyUDT"."MyBool".%X7, where %X7 refers to bit 7 of the byte addressed by the symbol. When the symbol is the first member of a word, the byte is byte 0 of the word; when it is the second member, the byte is byte 1 of the word. The WinCC structure tag mirrors this naming.

The S7 communication stack — S7Comm Plus for S7-1500, S7Comm over TCP/ISO-on-TCP for S7-1200/300/400 — reads the BOOL by reading the full byte (or the containing word) and applying the bit mask. The HMI runtime caches the byte in its tag database and refreshes it on the configured acquisition cycle. The odd-offset workaround is therefore safe at the protocol level; what it breaks is the cross-reference back to the UDT symbol, because the UDT does not contain a BOOL at byte 1 (or any other odd byte). The HMI tag becomes "orphaned": the runtime reads it correctly, but the TIA Portal cross-reference tool will not show it as bound to a UDT member.

For third-party controllers reached over OPC UA, the orphaning is irrelevant. The HMI tag binds to an OPC UA node, not to an S7 symbol, and the cross-reference tool handles OPC UA addresses through a different path. The odd offset is the natural fit for OPC UA BOOLs, where the node ID does not impose a word-alignment constraint.

Best Practices and Field Caveats

Twelve years of field deployments have produced a set of well-tested guidelines for working with structure tags and odd offsets in WinCC:

• Keep the PLC UDT as the source of truth. If you override the offset in the HMI tag table, the next UDT re-import will reset the offset back to the PLC value. Disable automatic synchronization for the affected structure element, or accept the GUI lockout and edit the PLC UDT instead.
• Document the override in the Comment column of the HMI tag table. A comment like "Offset 1: bound to OPC UA node ns=4;s=MyTag, do not re-import" prevents the next engineer from "fixing" the offset back to an even value.
• Test the override with the smallest possible structure (one BOOL, one INT). Once the principle is confirmed, apply the same offset scheme to the production structure. This isolates any read performance penalty to a known tag.
• Avoid using odd offsets for BOOL members that are part of a tightly packed bitfield. S7 communication groups bit reads by word; an odd byte offset forces the HMI to read an additional word, doubling the read load on the PLC connection.
• Consolidate odd-offset BOOLs into a single DWORD at the start of the structure and bind the individual bits via HMI expressions. The expressions read the DWORD, mask the bit, and present it as a derived BOOL. This keeps the structure aligned while still exposing the bit values to the operator screens.
• For WinCC Unified (V18 and later), the structure tag is called a PLC UDT instance and is imported through the PLC UDT dialog. The Excel Configuration Tool path is the same, but the XML attribute names differ. Always use the Excel tool of the matching TIA Portal version; mixing a V17 Excel with a V18 project corrupts the tag definitions.
• Watch the acquisition cycle. An HMI tag at an odd offset is read on the same cycle as the rest of the structure, but the underlying word read is larger. Reduce the acquisition cycle to 500 ms or longer for tags that change slowly, to keep the S7 connection load within the controller's connection budget.
• Log the override in the project's version control commit message. Include the TIA Portal version, the Excel Configuration Tool version, and the exact rows modified. This makes rollbacks reliable.

Troubleshooting Matrix

FAQ