Confirm the TIA Portal version, project path, and project permissions before scanning.
Manual
HQ Scan Troubleshooting
HQ Scan issues usually come from TIA environment, Openness permission, scan scope, rule filtering, or export fields. Check the environment first.
Confirm the engineering environment first
HQ Scan prepares engineering data. If the TIA environment or permissions are not healthy, scan results are not trustworthy.
The current Windows user must have Openness permission. Repair and re-login if needed.
For large projects, scan one PLC, one DB, or one table first to validate the rule.
TIA Portal, project, or Openness permission is abnormal
A bad environment can produce empty scans, missing fields, or hard failures.
Make sure the installed TIA Portal can open the project. Use a TIA Portal major version that matches the project.
Confirm the current user belongs to the Siemens Openness-related group. After repair, sign in to Windows again.
Avoid read-only, temporary, unstable network, very long, or unusual-character paths. Copy the project to a short local path when in doubt.
Online scan by IP returns no tags
Online scan does not require local TIA, but it depends on what the PLC exposes through online protocols. Separate port reachability, OPC UA browsing, and exportable tags.
Enter `opc.tcp://PLC-IP:4840` or the PLC IP and confirm port 4840 is reachable. Reachable only proves the network path; the PLC OPC UA Server must also be enabled and allow variable browsing.
Port 102 reachability does not mean symbolic tag export is possible. Without a TIA project or OPC UA nodes, optimized DB symbols, comments, data types, and offsets cannot be enumerated reliably.
Online scan mainly prepares DB point results. If input, output, or memory-area variables must be delivered, map them explicitly in the engineering project or handle them in a separate list.
Confirm OPC UA is enabled, certificates/accounts are accepted, firewall rules allow access, and the target DBs or variables allow HMI/OPC UA/external access. Online scan uses PLC-exposed nodes as the point source.
Use offline TIA project scan for formal delivery lists when possible. If no project is available, expose the required variables explicitly through OPC UA before using online scan.
Reading still fails after repairing permissions
Openness permission changes usually require a Windows sign-out or a TIA/HQ Scan restart before they fully apply.
After adding the user to Siemens Openness-related groups, sign out of Windows, sign back in, then reopen TIA Portal and HQ Scan.
If the project came from a ZIP file, shared folder, or read-only path, copy it to a writable local path first.
If scan results are odd, confirm the TIA Portal major version matches the project version.
Scan result is empty, too slow, or unexpectedly large
Narrow the scan scope first, then check the project tree, PLC, and DB selection.
Confirm a real PLC, DB, or table is selected. Selecting only the project root is rarely the right first step.
Check whether the DB is inside the selected project-tree scope, can be read through Openness by the current user, is not excluded by Rule Center, and contains members that can expand to supported scalar points.
Narrow by PLC, DB, or project-tree branch. For 200k+ tag projects, scan and export in batches, especially when huge structured DBs exist.
Offline scan sees TIA project metadata. Online scan sees only nodes currently exposed by the PLC OPC UA Server. OPC UA exposure, DB access, project-tree scope, rules, and supported types can all change the count, so the totals do not have to match.
Use keep rules to define the main set, then exclude diagnostics, temporary variables, and intermediate values.
100k / 200k tag projects scan or export slowly
Do not validate every rule with one full scan. Scan by PLC, DB, or project-tree branch first, then merge results.
Scan by PLC or DB first. For 200k-tag projects, avoid repeated full export while rules are still changing.
Backup DBs, history DBs, load-memory DBs, and DBs with many arrays or UDTs are usually better reviewed after rules are stable. Validate scope, fields, and rules on business DBs and tables first.
Use keep rules to reduce the main set, then exclude diagnostics, temporary variables, and intermediates before export.
Before export, sample symbolic addresses, absolute addresses, and data types. Adjust scope or rules before importing into HQControl.
Symbolic address, absolute address, or data type looks wrong
Before importing into HQControl, confirm field meanings and the intended address mode.
The result table and export files use symbolic address as the point key. Review, rule matching, and import preparation should prioritize symbolic address, data type, and address metadata.
Symbolic address is the HQControl S7 symbolic / OPC UA access path. Engineering-tree wrapper segments and container names are context for review, not runtime access addresses.
Absolute addresses are used by S7 port 102 or Modbus-like paths. DB, byte offset, bit offset, and data type must be explicit. If an optimized DB does not expose a stable offset, use symbolic address.
Check scalar types such as BOOL, INT, DINT, REAL, LREAL, and STRING before import.
Names contain unusual characters, duplicates, or invalid HQControl identifiers
For stability, invalid names should be cleaned or discarded in HQ Scan before they enter the runtime system.
Symbolic addresses and import codes should avoid control characters, invisible characters, suspicious punctuation, or path symbols. Clean them through rules or the engineering project before import.
Tag codes must be unique within one device. Generate stable codes by rule, then confirm manually.
UDTs, arrays, and structs should be organized by reviewable scalar members. Values required for independent collection should be represented as explicit scalar members in the PLC project.
The export cannot be imported or fields do not match
Confirm the export template and the target HQControl address mode before importing.
Create the matching device code first. Excel `deviceCode` must exactly match, including case.
Export rules mainly cover parseable scalar DB members and engineering content that can be normalized as DB points. UDT, array, and struct containers describe context; scalar children are exported when they can be resolved reliably.
Core fields are `deviceCode`, `code`, `symbolicAddress`, and `dataType`. Confirm unique codes, accessible symbolic addresses, and PLC-matched data types before import.
Core fields are device, area, DB, offset, bit, access type, and data type. Check empty or conflicting fields first.
If the DB was outside the scan scope, unreadable, constrained by complex structures, constrained by access settings, or excluded in Rule Center, it will not enter the export. Go back to the HQ Scan result table and confirm whether exportable point rows were generated.