Displaying S7-1200 PWM Signal on Pro-face HMI: HSC Setup Guide

David Krause12 min read
S7-1200SiemensTroubleshooting
Licensed PE Working through this on a live machine? A Maine-licensed engineer can take it from here — included with IMD hardware, by the hour for everything else. Book an engineer

Problem Overview

An S7-1200 PLC is configured with a High Speed Counter (HSC1) reading an incremental encoder on inputs I0.0 and I0.1. The application logic generates a pulse-width modulated waveform on output Q0.0, with the duty cycle linked to encoder revolutions. The objective is to replace a bench Digital Storage Oscilloscope (DSO) with a Pro-face LT4301TM modular HMI and visualize the PWM waveform directly on the panel.

The engineering issue surfaces when the engineer wires the HMI to addresses QW1000 through QW1003, expecting to see a live PWM trace, and the display returns flat-line or undefined values. The failure stems from two architectural facts that must be untangled before any tag can be polled successfully:

  1. The S7-1200 HSC and the S7-1200 PWM output are independent hardware functions. HSC counts transitions on digital inputs; PWM generates a hardware-timed square wave on a digital output. They do not share a memory-mapped register you can graph directly.
  2. QW1000 to QW1003 are the control/feedback words of the PWM channel as written by the CTRL_PWM instruction. They are not an oscilloscope-style waveform buffer.

Clarifying HSC versus PWM in S7-1200

S7-1200 CPUs (1211C/1212C/1214C/1215C/1217C) include dedicated high-speed I/O hardware. These resources are partitioned as documented in the S7-1200 Programmable Controller System Manual:

Resource Direction Hardware Assignment Default Tag Address
HSC1 Input counter I0.0 (A), I0.1 (B), I0.2 (Z if used) ID1000 (DINT)
HSC2 Input counter I0.3, I0.4, I0.5 ID1004
HSC3 Input counter I0.6, I0.7, I1.0 ID1008
HSC4 Input counter I1.1, I1.2, I1.3 ID1012
HSC5 Input counter I1.4, I1.5 (DC only) ID1016
HSC6 Input counter I1.6, I1.7 (DC only) ID1020
PWM1 Output Q0.0 QW1000
PWM2 Output Q0.1 QW1002
PWM3 Output Q0.2 QW1004
PWM4 Output Q0.3 QW1006
PTO1 Output Q0.0 / Q0.1 (axis) QW1000 / QW1002
HSC and PWM/PTO hardware blocks are mutually exclusive on the same output byte. If Q0.0 is assigned to PWM1, the PTO1 path on Q0.0 is unavailable. Confirm CPU firmware supports the assignment using the device configuration in TIA Portal V13 or later.

For an application where an encoder's rotation drives a PWM duty cycle, the correct architecture is:

  1. HSC1 counts encoder edges and exposes the count in ID1000.
  2. The user program (OB1 or a cyclic OB) reads ID1000, normalizes it, and computes duty-cycle and frequency values stored in a global DB (e.g., DB_PWM.PWM_Duty, DB_PWM.PWM_Freq).
  3. The CTRL_PWM instruction block (FB PWM_CTRL from the standard TIA library) writes the duty-cycle ratio into QW1000 for PWM1, and the hardware pulse generator drives Q0.0.
  4. The Pro-face HMI polls the *user* tags (the duty cycle and frequency values) plus the HSC raw count. It does not poll the raw PWM waveform because no oscilloscope buffer exists in the S7-1200 firmware.

Prerequisites

  • S7-1200 CPU with DC output transistors (PWM is supported only on transistor outputs; relay outputs cannot generate PWM). CPU 1214C DC/DC/DC or CPU 1217C DC/DC/DC recommended for this application.
  • TIA Portal V13 SP1 or later (V16/V17 recommended for current engineering). The project must contain both the PLC station and the HMI station.
  • Pro-face LT4301TM with GP-Pro EX V4.09 or later installed. Confirm the LT4301TM supports the Siemens S7-1200 driver; the panel uses the Siemens S7 MPI/PROFINET protocol family.
  • Incremental encoder providing two channels 90 deg out of phase (A and B) wired to I0.0 and I0.1, plus 24 VDC encoder supply from the CPU.
  • Ethernet cable for PROFINET between the CPU's PROFINET port and the LT4301TM Ethernet port. The LT4301TM ships with one Ethernet port.
  • Familiarity with the S7-1200 Motion Control - PWM Function manual and the Pro-face LT4301TM Hardware Manual.

S7-1200 PWM Output Configuration

Open the PLC device configuration in TIA Portal, navigate to Properties > Pulse generators (PTO/PWM), and enable PWM1 on Q0.0 with the following parameters:

Parameter Recommended Value Notes
Pulse generator output PWM1 Maps to Q0.0
Time base Milliseconds Use microseconds only if duty cycle resolution requires
Period (cycle time) e.g., 100 ms (= 10 Hz) Range 0.1 Hz to 100 kHz (1 MHz on CPU 1217C)
Initial pulse width 0 % of period Updated at runtime by CTRL_PWM
Hardware interrupt OB Optional Not required for the HMI display

Add the PWM_CTRL instruction in OB1. Sample ladder with associated data block:

// DB_PWM (Global DB)
DATA_BLOCK "DB_PWM"
  { S7_Optimized_Access := 'FALSE' }
  STRUCT
    PWM_Duty   : REAL;    // 0.0 .. 100.0 [%]
    PWM_Freq   : REAL;    // Hz
    HSC_Count  : DINT;    // mirror of ID1000
    PWM_Enable : BOOL;
  END_STRUCT;
END_DATA_BLOCK
// OB1 - PWM enable and CTRL_PWM call
      "PWM_CTRL_Instance"   CTRL_PWM
      |   EN    |   ENO     |
      | --PWM   |           |
      |         |           |
      // Inputs
      | --EN    |           |  // DB_PWM.PWM_Enable
      // Outputs (leave unconnected - HW auto-assigns QW1000)
      | --BUSY   |           |
      | --STATUS |           |

Although TIA Portal will display the PWM instance data block containing the period and pulse-width operands that the instruction writes to QW1000, do not interpret that word as a waveform buffer. QW1000 is a control word for the hardware pulse generator, not a sample buffer.

HSC Configuration for the Encoder Input

In the device configuration, expand High-speed counters (HSC) and enable HSC1 with these properties:

Property Value
Type Count
Operating phase Two-phase
Counting direction User program controlled (or hardware: A=count up, B=count down)
Initial counter value 0
Initial reference value 0
Input filter 0.1 ms to 1.0 ms depending on encoder pulse rate
Interrupt on CV = RV Optional - leave disabled unless used
Tag address ID1000 (DINT, 4 bytes)

Verify encoder wiring: A to I0.0, B to I0.1, Z (index, optional) to I0.2. The HSC1 will reset to its initial value at every STOP-to-RUN transition of the CPU, so any reference to "starting at 1" is simply the configured initial value.

For two-phase quadrature counting at 4x resolution, ensure the encoder pulse-per-revolution (PPR) rating is well within the HSC input frequency. S7-1200 HSC inputs accept up to 100 kHz single-phase and 80 kHz quadrature on CPU 1214C; CPU 1217C extends this to 1 MHz.

Calculating Duty Cycle from Encoder Revolutions

The mapping from ID1000 (count) to PWM duty cycle must be implemented in the user program. A linear mapping:

// OB1 - map HSC count to duty cycle
// Constants
CONST
  COUNT_AT_ZERO_DUTY   : DINT := 0;
  COUNT_AT_FULL_DUTY   : DINT := 1000;
END_CONST

#Temp_Real := DWORD_TO_REAL(COUNTER_VALUE_HSC1);   // read ID1000
IF #Temp_Real < 0.0 THEN
    #Temp_Real := 0.0;
END_IF;
#Duty := 100.0 * (#Temp_Real - DINT_TO_REAL(COUNT_AT_ZERO_DUTY))
                  / (DINT_TO_REAL(COUNT_AT_FULL_DUTY) - DINT_TO_REAL(COUNT_AT_ZERO_DUTY));

IF #Duty > 100.0 THEN #Duty := 100.0; END_IF;
IF #Duty < 0.0   THEN #Duty := 0.0;   END_IF;

"DB_PWM".PWM_Duty := #Duty;
"DB_PWM".HSC_Count := "Counter_HSC1".CV;          // mirror ID1000

Then feed DB_PWM.PWM_Duty into the PWM_CTRL instruction as the pulse-width percentage.

Pro-face LT4301TM HMI Integration

The LT4301TM (5.7-inch QVGA TFT, 64K colors) is part of the LT4000M modular series and supports the Siemens S7 PROFINET driver. Configure the HMI project in GP-Pro EX with the following device/PLC settings:

Setting Value
Manufacturer Siemens AG
Series S7-1200 / S7-1500 (PROFINET)
Port PROFINET (Ethernet)
HMI IP address 192.168.0.10 (example)
PLC IP address 192.168.0.1 (must match CPU PROFINET port)
Communication cycle 100 ms default - reduce for trend fidelity
PLC rack/slot 0 / 1

Define the variables in GP-Pro EX:

Symbolic Tag PLC Address Data Type Display Purpose
HSC_Count DB_PWM.HSC_Count (DB1.DBD0) DINT Numeric display
PWM_Duty DB_PWM.PWM_Duty (DB1.DBD4) REAL Numeric + trend graph Y-axis
PWM_Freq DB_PWM.PWM_Freq (DB1.DBD8) REAL Numeric display
PWM_Enable DB_PWM.PWM_Enable (DB1.DBX12.0) BOOL Toggle switch / lamp

Ensure the DB_PWM is configured with non-optimized access (S7-Optimized-Access = FALSE) in TIA Portal so that the GP-Pro EX driver can address it by absolute offset. Symbol-only access requires GP-Pro EX V4.09+ with TIA Portal symbol export/import.

Communication Setup on PROFINET

  1. In TIA Portal, add the LT4301TM as an HMI device. Connect its PROFINET port to the S7-1200 PROFINET port in the Devices & Networks editor.
  2. Assign the HMI the IP address above and verify the PLC IP in the CPU's PROFINET interface properties.
  3. Use the HMI Tags table to either bind to PLC tags by name or by absolute address. For DBs, expose DB_PWM in the PLC data types folder.
  4. Compile the HMI and download. Use the GP-Pro EX Transfer tool to push the runtime project to the LT4301TM via Ethernet.
Do not attempt to display QW1000 as a 16-bit waveform. QW1000 is the PWM hardware control word and does not represent the analog level of Q0.0. The PWM waveform itself exists only as a voltage on the physical terminal.

Display Strategy: What Can Actually Be Shown

An HMI panel is not a DSO. A 5.7-inch QVGA panel can refresh its trend buffer at the configured polling rate (commonly 100-500 ms per point), far slower than the millisecond-scale edges of a PWM signal. Three realistic display options exist:

  1. Numeric gauge: Show duty cycle (0-100 %) and frequency (Hz) as numbers. This is the only representation that can update reliably within the HMI's polling bandwidth.
  2. Historical trend graph: Plot duty cycle vs. time. This produces a trend of how the duty cycle varies with encoder motion, which is often what the engineer actually wants to monitor in a tuning scenario.
  3. Logical representation: Use a fill-level bar driven by the duty cycle. This is the most visually direct mapping from PWM to a panel widget.

If a true oscilloscope-style waveform of Q0.0 is required, no HMI can deliver it without an external capture buffer. The S7-1200 firmware does not expose a PWM sample buffer; you would need a third-party module (e.g., a high-speed analog input module or an external MCU with DMA) to digitize the waveform and stream samples to the HMI.

Polling Rate Considerations

Match the HMI display update rate to the application needs:

Goal Minimum Polling Rate Driver Setting
Numeric duty cycle readout 200 ms GP-Pro EX: Communication Cycle = 200 ms
Smooth trend graph 100 ms Communication Cycle = 100 ms; Number of samples = 600 (1 min window)
Encoder position mirror 100 ms Same as above

Keep in mind that the S7-1200 PROFINET device can hold a limited number of simultaneous connections. Setting too many high-rate polled tags will saturate the controller and may produce communication timeouts.

Verification Procedure

  1. Power the CPU and download the TIA Portal project.
  2. In TIA Portal, use Online & Diagnostics > Traces to record DB_PWM.PWM_Duty and ID1000. Confirm that the duty cycle moves smoothly as you rotate the encoder.
  3. Use a bench oscilloscope on Q0.0 to verify the actual PWM waveform frequency and duty cycle against the recorded values.
  4. Power the LT4301TM, transfer the GP-Pro EX project, and switch to online mode.
  5. On the HMI screen, rotate the encoder and verify that the numeric duty-cycle gauge updates and the trend graph traces a smooth curve.
  6. If the HMI displays "No response" or shows dashes, open the GP-Pro EX System Configuration > Communication window and confirm IP/subnet reachability. Ping the PLC from a laptop connected to the same subnet.
  7. As a final sanity check, bind a simple BOOL or INT to a lamp/indicator on the HMI to confirm the HMI-PLC data exchange is fundamentally working before troubleshooting the trend.

Troubleshooting Matrix

Symptom Likely Cause Corrective Action
HMI shows dashes / "No response" Wrong IP, subnet mismatch, or unsupported driver Verify IP addresses, ping PLC, select Siemens S7 PROFINET driver in GP-Pro EX
HMI shows constant value, ignores encoder DB is optimized-block access; GP-Pro EX reads from wrong offset Set S7-Optimized_Access := FALSE on DB_PWM; re-import tags
HMI value updates but DSO shows no PWM on Q0.0 PWM channel not enabled in device configuration or output transistor off Enable PWM1 in device config; verify Q0.0 load and 24 V supply
PWM duty cycle does not change with HSC count OB1 logic not transferring ID1000 to duty calc, or scaling constants wrong Step through OB1 in online mode; watch ID1000 and DB_PWM.PWM_Duty
Trend graph jumps in steps Polling cycle too slow for encoder speed Reduce Communication Cycle to 100 ms; increase Number of Samples
HMI shows garbage on QW1000 Polling QW1000 control word and interpreting as waveform data Replace QW1000 polling with DB_PWM tag polling; do not bind QW1000 to a numeric display
DSO and HMI disagree on frequency PWM period set incorrectly in device configuration Re-check pulse generator period in Properties > Pulse generators
Encoder counts but HSC tag is 0 Encoder wiring reversed (A/B swapped) and phase mode misread Verify wiring; try single-phase counting first to isolate hardware

Best Practices

  • Keep HSC and PWM channel byte assignments unique. Document them in the project header so that firmware updates do not silently remap them.
  • Mirror HSC values into a DB rather than polling ID1000 directly from the HMI. Polling raw HSC process image tags can interact with HSC interrupts in some firmware versions.
  • Use GP-Pro EX's Symbol Import from a TIA Portal export to avoid manual address drift between PLC and HMI projects.
  • For high-frequency PWM above 10 kHz, accept that the HMI trend will only show an averaged duty cycle; rely on a DSO for waveform integrity checks.

Frequently Asked Questions

Can the S7-1200 HSC1 output a PWM waveform directly on Q0.0?

No. HSC1 is an input counter that latches pulses into ID1000. PWM1 is a separate hardware pulse generator that drives Q0.0 and is configured independently under Properties > Pulse generators. The two blocks share no register, so HSC1 cannot "create" a PWM output - the user program must compute the duty cycle from HSC1 and write it into PWM1 via the CTRL_PWM instruction.

Why does QW1000 not show a PWM waveform when polled from the HMI?

QW1000 is the PWM hardware control word that the CTRL_PWM instruction uses to load period and pulse-width values into the pulse generator. It is not a sample buffer of the Q0.0 voltage. Bind the HMI to user-program tags (e.g., DB_PWM.PWM_Duty) rather than QW1000.

What is the maximum PWM frequency for an S7-1200 CPU 1214C?

CPU 1214C supports PWM frequencies from 0.1 Hz up to 100 kHz on transistor outputs. CPU 1217C extends this to 1 MHz. Relay-output CPUs do not support PWM at all.

How fast can the Pro-face LT4301TM refresh a numeric display from an S7-1200?

With PROFINET and GP-Pro EX Communication Cycle set to 100 ms, the LT4301TM updates polled numeric tags at approximately 10 Hz. Trend graphs accumulate samples at the same rate. To view faster dynamics, lower the cycle, but be aware that the CPU has a fixed number of simultaneous PROFINET connections.

Do I need to disable HSC1 interrupts to display the count on the HMI?

No. HSC1 hardware interrupts (such as CV = RV) are independent of the HMI's read access to ID1000. The interrupt OB only fires when its event occurs; HMI polling reads the same process image without interfering.

Back to blog