Fixing KTP 600 HMI Analog Value Display Issue in TIA Portal V11

1. Problem Definition

A Siemens S7-1200 PLC (typical CPU 1214C, CPU 1215C, or CPU 1212C) running a TIA Portal V11 project drives a KTP 600 Basic color PN (6AV6 647-0AD11-3AX0) or KTP 600 Basic mono PN (6AV6 647-0AB11-3AX0) panel over PROFINET. Digital tags update correctly on every screen, but every scaled analog value reads as 0 on the HMI even though the same value is correct in the PLC's online watch table and in the configured scaling function block (FB).

The symptom is reproducible:

• Online in the PLC (watch table / monitor tag), the analog value reflects the real process value (e.g., 275.3, 12.45, 100.0).
• Online in the HMI, the same tag reads 0 continuously and never changes, even after a screen refresh, a tag re-compile, or a HMI restart.
• Bool / digital tags on the same HMI update as expected.

This is one of the most common symptoms of a configuration mismatch between TIA Portal V11 tag definitions and the way the S7-1200 stores scaled values in a data block (DB). It is almost never a hardware fault on the panel.

2. Why Only the Analogs Fail

Digital tags typically use the Bool data type, which is 1 bit and is mapped one-to-one with an HMI tag of the same access path. TIA Portal V11 handles Bool tags with the default update cycle without explicit data-type conversion. Scaled analog values, however, almost always leave the scaling block (FB / FC) in an Int, Word, DInt, or Real tag inside a DB. When the HMI tag is configured with the wrong data type or with the wrong access path, TIA Portal V11 silently writes 0 to the HMI variable because the PLC's process image cannot be interpreted.

3. Root Cause Matrix

4. Engineering Background: How TIA Portal V11 Maps Analog Tags

TIA Portal V11 (released alongside STEP 7 Basic V11 and WinCC Basic V11) treats HMI tags as pointers into the PLC's process image or DB. For a KTP 600 connected over PROFINET, the protocol is S7 Communication on top of TCP/UDP port 102. Each HMI tag carries three critical properties that must align with the source tag in the PLC:

1. Data type – Must match exactly. If the PLC holds a 32-bit Real, the HMI tag must be Real. If the PLC holds an Int, the HMI tag must be Int. TIA V11 does not auto-coerce between types.
2. Access path – The address (DB number, byte offset, bit offset) is resolved by the HMI tag definition. A wrong offset silently returns 0 because the read succeeds but lands on a different byte.
3. Length / Range – The HMI tag must be at least as long as the PLC tag. A common mistake is selecting Int on the HMI when the PLC stores the value as DInt (32-bit signed).

Because digital tags are 1 bit and the PLC's I, Q, and M areas expose bit-level access natively, an offset error on a Bool tag almost always lands on another Bool tag, so the user sees the "wrong" status but the tag still updates. With analogs, an offset error of even one byte lands on unrelated data and the value reads 0 or a noise value.

5. S7-1200 Analog Scaling Mechanics in TIA V11

The most common pattern in TIA V11 is to scale a raw analog input (0–27648 or ±27648 for current, ±10 V / 0–10 V) to an engineering unit using the SCALE / NORM_X / SCALE_X instructions or a custom FC. The scaled result must be stored where the HMI can read it.

Reference: Siemens STEP 7 Basic V11 manual collection.

Pattern (ST / SCL) inside a periodic OB (OB1 or OB35):

// Raw AI tag (e.g., IW96) holds 0–27648
// Engineering range: 0.0 – 100.0 °C
"DB_Scale".rRaw    := "AI_Raw";             // Int, input word
"DB_Scale".rEUMin  := 0.0;                 // Real
"DB_Scale".rEUMax  := 100.0;               // Real
"DB_Scale".rOut    := "SCALE_X"(
                           MIN  := 0,
                           MAX  := 27648,
                           VALUE:= "DB_Scale".rRaw
                         );
"DB_Scale".rTemp_C := ("DB_Scale".rOut / 27648.0)
                      * ("DB_Scale".rEUMax - "DB_Scale".rEUMin)
                      + "DB_Scale".rEUMin;

Critical points:

• The output "DB_Scale".rTemp_C must be a Real (32-bit floating point). Storing it as Int truncates the decimal portion and the HMI shows the wrong unit.
• The DB must have "Accessible from HMI" set on the data block itself and on every element the HMI references. With TIA V11 and S7-1200 firmware V4.x, this is toggled under DB Properties → Attributes.
• If the DB is marked "Optimized" (symbolic-only), older TIA V11 HMI tag definitions that use absolute addressing (DB100.DBD4) will read 0. Use symbolic access: drag the tag from the PLC tag table into the HMI tag table.

6. KTP 600 HMI Tag Configuration Procedure

Use this procedure to rebuild the HMI tag table correctly. Reference the WinCC Basic V11 manual: WinCC Basic V11.0 SP2 - Working with tags.

1. Open the TIA Portal project, switch to the HMI device view of the KTP 600.
2. Open HMI Tags from the project tree.
3. For every analog tag, delete the existing definition and recreate it. Do not edit the address field manually.
4. Click the small arrow next to the PLC tag column and choose "Browse..." (or "Select tag").
5. Navigate to PLC_1 → Program blocks → DB_Scale → rTemp_C and select it. TIA V11 will automatically fill the connection, data type, and access path.
6. Verify the resulting tag: Name = rTemp_C, Connection = the S7-1200 connection you created, PLC tag = the full symbolic path, Data type = Real.
7. Set the Acquisition cycle to 1 s (default) or 500 ms if your process needs faster updates. Do not leave it on "On demand" for process values.
8. Compile the HMI project (right-click HMI → Compile → Software (rebuild all)).
9. Download to the KTP 600 using PROFINET (Project tree → HMI → Download to device → Ethernet).

7. PLC-HMI Connection Validation

Reference: Configuring PROFINET between S7-1200 and KTP panels.

1. Open Devices & Networks in the TIA project.
2. Select the S7-1200, navigate to Properties → PROFINET interface [X1] and confirm the IP address (e.g., 192.168.0.1), subnet mask 255.255.255.0, and that "Use router" is unchecked unless required.
3. Select the KTP 600, navigate to Properties → PROFINET interface, set the IP (e.g., 192.168.0.10), subnet mask matching the PLC, no router.
4. Confirm the HMI connection (the green line between devices) is established: it must be an S7 connection, mode "Read/Write" (default), and the partner endpoint must reference the S7-1200 CPU (not the Ethernet port).
5. If the S7-1200 has multiple CPUs (unlikely on a single project) or a CP module, verify that the connection points to the correct CPU slot.

Test online by opening Online & Diagnostics on the KTP 600 and checking the connection status. A green "Connected" indicator plus a successful "Read tag" test in the HMI tag table (right-click → "Read") confirms the link.

8. TIA Portal V11 Version-Specific Caveats

Firmware and image downloads: Siemens KTP 600 / TP 177 support entry. Image and HSP files: HSP (Hardware Support Packages) for TIA Portal.

9. Field Diagnostic Procedure (Do This in Order)

1. Confirm the digital works, analog does not. If even digital tags fail, jump to network diagnostics first (cable, switch port, IP conflict). If only analog tags fail, continue here.
2. Open the HMI tag table, right-click the failing analog tag → "Read" (forces a single update). If the read returns the correct value, the tag pointer is correct and the issue is the update cycle.
3. Check the data type of the failing tag. Right-click the tag → Properties → Connection. Confirm the PLC tag path resolves to a Real, DInt, Int, or Word matching the HMI tag.
4. Check the access path. If you typed the DB offset manually, delete the tag and re-import it from the PLC tag table (drag-drop from project tree).
5. Confirm the DB is accessible. In the PLC, open the DB → Properties → Attributes → ensure "Accessible from HMI" is enabled (default true but can be disabled).
6. Recompile the HMI with "rebuild all" and re-download.
7. Restart the KTP 600 after download (power cycle or HMI restart from the loader menu).
8. Check the panel image version in loader (Control Panel → System → Info). If older than V12.0.0.0, plan an image update.
9. Watch the S7 connection diagnostic buffers. S7-1200 → Online & Diagnostics → Diagnostics Buffer. Look for "communication error" with error codes 0x80C3 (variable not found) or 0x80C4 (data type mismatch).

10. Error Code Reference (S7-1200 Communication Diagnostics)

Source: S7-1200 / S7-1500 communication diagnostics manual.

11. Verification Checklist

• PLC online watch table shows correct scaled value.
• HMI tag table "Read" function returns correct value within 1 cycle.
• HMI screen IO field displays the value live without manual refresh.
• Update cycle is set to a fixed value (1 s or 500 ms), not "On demand".
• Both PLC and HMI project are compiled "rebuild all" and downloaded together.
• No 0x80C3 / 0x80C4 errors in S7-1200 diagnostic buffer after 5 minutes of operation.
• DB element is "Accessible from HMI" = true.
• KTP 600 image version ≥ V12.0.0.0 for reliable Real tag handling.

12. Preventive Best Practices for Future Projects

1. Always drag tags from the PLC tag table into the HMI tag table. Never type DB offsets manually in TIA V11.
2. Maintain a tag naming convention: prefix scaled analogs with r_ (Real), i_ (Int), w_ (Word) to make the data type obvious in the HMI tag table.
3. Set the DB block attribute "Accessible from HMI" at the DB level (inherits to all elements) instead of per-element.
4. Keep the KTP 600 firmware current. Update through ProSave or SIMATIC Automation Tool. See Siemens KTP panel support page.
5. After any change to a PLC DB, run "Compile → Software (rebuild all)" for both the PLC and the HMI before downloading.
6. Maintain one library project with the scaling FB, HMI template, and pre-wired HMI tag list to avoid drift between similar machines.

13. Related Panel Comparisons

Source: Siemens SIMATIC HMI catalog.

14. FAQ