Resolving ##### Display Error on Siemens TP1200 Comfort HMI

Problem Description

When a Siemens SIMATIC HMI TP1200 Comfort panel displays ##### (five hash characters) in an I/O field instead of a process value, the HMI runtime is signaling that it cannot render the value within the configured display geometry, cannot resolve the associated tag address, or has lost the data update from the controller. On Comfort Panels (part numbers in the 6AV7884-xA range, including the 12.1" 6AV7884-2AH20-3BN0 used in this case), the same ##### pattern is produced regardless of root cause, which means a structured diagnostic procedure is required to differentiate between display geometry, tag validity, and PROFINET communication faults.

Three operational patterns help narrow the cause before any tool is launched:

• Momentary flicker: Values appear briefly, then ##### returns. This is the classic signature of an intermittent communication fault (PROFINET cable, partner device restart, watchdog reset of the HMI tag acquisition).
• Permanent on all tags: HMI shows ##### on every I/O field of every screen. Almost always points to a complete loss of the HMI-PLC connection (wrong device name, IP conflict, switched-off partner).
• Permanent on selected tags: ##### is restricted to specific I/O fields. This indicates a tag address mismatch (DB moved, optimized access, deleted tag) or an I/O field width that is too small for the value range.

The case that prompted this article fell into the first category: the panel was running normally, hardware work was performed on the machine, and afterwards every affected I/O field showed #####. The sequence is a strong hint that something on the network or in the controller state changed during the intervention.

Affected Hardware and Configuration

Before launching any diagnostic, identify every component in the HMI/PLC communication path. The order is critical because a fault in any link can produce ##### on the panel:

The TP1200 Comfort uses a single integrated PROFINET interface (X1) on the rear of the device, configured by default with IP 192.168.0.1 and PROFINET device name "tp1200-comfort". The S7-315-2 PN/DP is a PROFINET IO Controller on its PN interface (X1) and exposes a separate PROFIBUS DP master (X2) for MPI/DP. Confirm that the HMI's PROFINET device name, IP address, and subnet match the TIA Portal project configuration; a single byte that has been flipped by maintenance tooling is enough to make every I/O field show #####.

Root Cause Matrix

Five root causes account for the vast majority of ##### events on Siemens Comfort Panels. Use the matrix to map the observed symptom to the most likely cause before launching tools.

Diagnostic Procedure

Work the procedure top to bottom; do not skip steps. Each step yields evidence that either excludes a root cause or points to the next one.

1. Confirm the HMI is in runtime, not loader/simulation. Press the "Control Panel" button on the HMI (or the "Settings" gear in the system menu of the Comfort Panel). The panel must report "Runtime" mode. If it is in "Transfer" or "Simulation", the ##### pattern is expected and the controller is not at fault.
2. Read the HMI connection status. On Comfort Panels, the system screen "Connections" (under Settings > System > Connections) lists every configured logical connection. A red "X" next to the S7-300/400 connection confirms PROFINET failure; a green check confirms the connection is established. Tap the connection line to view the error text, which usually states the failure code (e.g., "0x8000: Connection error").
3. Read the PLC diagnostic buffer. In TIA Portal, connect online to the S7-315, expand "Online & Diagnostics", and open "Diagnostic buffer". Look for events with ID "SF" (system fault), "BF" (bus fault on PROFINET), and "IO device failure". The timestamp correlates to the moment the ##### appeared and the cause is named explicitly (e.g., "PROFINET IO: Station failure").
4. Check the PROFINET accessible nodes. From TIA Portal, use "Online > Accessible nodes" on the same PROFINET subnet. The TP1200 and the S7-315 should both appear with their configured names and IPs. If only one is visible, the physical layer or addressing is broken between the two devices.
5. Validate HMI tag addresses. In the TIA Portal project tree, open "HMI Tags" and inspect the "Address" column. For DB tags, the entry must match an existing DB number, an existing offset, and a length that the PLC program actually supplies. If the DB has been recompiled with optimized block access, the symbolic address in the HMI tag must be used; absolute addresses will not resolve.
6. Read the WinCC Comfort runtime log. On the HMI, the active log files are written to \Storage Card SD\Logs\ (or \System\Logs\ on internal flash). The file SIMATIC_S7_PROTOCOL_SUITE_01.LOG captures S7 connection events. Each line begins with a time stamp and a status code. The Siemens Knowledge Base article "What do the entries in the WinCC diagnostics file 'SIMATIC_S7_PROTOCOL_SUITE_01.LOG' mean in the case of a connection fault?" maps every status code to its root cause (entry ID 16622456).
7. Check the I/O field display width. Tap the affected I/O field in the engineering view of TIA Portal. The "Appearance > Width" property combined with the configured format string determines the visible characters. A field of 6 characters displaying an INT value of 12345 will show 12345; a 4-character field displaying the same value will show ##### regardless of the actual tag value.

PROFINET Connection Verification

PROFINET failures on a S7-315 / TP1200 link almost always leave a fingerprint in three places: the diagnostic buffer, the switch (if any) port statistics, and the HMI's own connection log. Read all three before replacing any hardware.

On the S7-315-2 PN/DP, the X1 connector has two integrated LEDs labeled "LINK" and "RX/TX". A solid LINK with no RX/TX activity means the CPU is alive on the network but the HMI is not sending frames; this is typical of a wrong PROFINET device name on the HMI. A dark LINK means the physical layer is down (cable, switch port, or interface module fault). Force the PROFINET device name from TIA Portal using "Online > PROFINET device name assignment" to the exact string defined in the project; mismatches are case-sensitive.

On a managed SCALANCE switch, open the Information > Port Statistics page and look for "CRC/Alignment errors", "Fragments", "Jabbers", and "Late Collisions". Even a few percent of CRC errors over a long period indicate a damaged cable, an EMI source (variable frequency drive, welding inverter, unshielded motor lead routed next to the PROFINET cable), or a loose industrial RJ45 connector. Replace the suspect run with a Siemens IE FC TP Cable (6XV1840-2AH10) and an IE FC RJ45 Plug (6GK1901-1BB10-2AA0) using the industrial crimp tool; the standard factory crimp on commodity patch cables does not survive the vibration profile of a machine tool.

IP addressing must be unique on the subnet. The TP1200 default IP is 192.168.0.1, the S7-315 PN port is 192.168.0.2. If a maintenance laptop or a remote VPN router has been plugged into the same switch and assigned 192.168.0.1 by DHCP, the HMI and the laptop fight for the same address and the HMI silently disappears from the controller's connection table, producing ##### within seconds.

For deeper frame-level diagnosis, capture the PROFINET traffic with Wireshark and a managed switch mirror port. Apply the display filter pn_rt || pn_dcp. Frames with the "Station failure" opcode from the IO controller toward the HMI's slot confirm cause #1 directly; ARP requests without replies on the HMI's IP confirm an addressing or physical layer fault. The PROFINET specification splits the cycle into a real-time phase (RT, Class 1) for IO data and a non-real-time phase (NRT) for alarms and acyclic services; both must be visible during normal operation.

PLC Diagnostic Buffer Analysis

The S7-300 diagnostic buffer is a ring buffer in the CPU firmware that records every significant event, including PROFINET station failures, OB1 cycle time overruns, and stop-mode transitions. Open it from TIA Portal with the CPU online; the buffer survives power cycles and is the single most useful artifact when investigating intermittent ##### behavior.

Events of interest for this symptom class:

The event time stamps are in CPU local time; if the HMI was modified at 14:32 and ##### appeared at 14:35, the diagnostic buffer will show a 14:35 entry for the IO device with the matching slot. The slot number is the PROFINET device number assigned in the TIA Portal device configuration (HMI typically sits on slot 0 of the PROFINET IO system).

For a permanent connection monitor, the PLC can call the system block FB126 "S7_GET_AlarmData" or evaluate the system status list (SSL) with SFC51 "RDSYSST" to read the connection status of every S7 connection. The example SCL snippet below raises a flag whenever the HMI connection drops:

IF "HMI_Connection".Status = 0 THEN
  "AlarmBits".ConnectionLost := TRUE;
ELSE
  "AlarmBits".ConnectionLost := FALSE;
END_IF;

WinCC Comfort Runtime Logs

The Comfort Panel stores protocol logs in two places: on the active runtime storage (typically the SD card) and in a rotating set of files on the internal flash. The relevant file is named SIMATIC_S7_PROTOCOL_SUITE_01.LOG and grows to a configurable size before rolling. Each line follows the format:

The status field contains a Siemens-internal code. The Siemens Knowledge Base article 16622456 maps these codes to actionable root causes:

Open the log in Notepad on the HMI's service interface (Control Panel > Transfer > Services) or by extracting the SD card and reading it on a PC. For the case under discussion, look for the exact time the maintenance ended and the first ##### appeared; the first non-zero status line after that timestamp identifies the root cause.

HMI Tag Validation and Simulation

Beyond the runtime log, the Comfort Panel exposes a built-in tag simulator that lets you inject test values without affecting the PLC. Open Control Panel > Service > HMI Tag Simulator and select a tag from the project list. If the tag accepts the simulated value and the I/O field displays it correctly, the tag binding is valid and the problem lies in the update path (causes #1 or #5). If the simulator reports "Address not valid", the root cause is a tag binding error (cause #2).

In TIA Portal, the HMI tag table has a status column that turns green when the address is valid for the configured PLC, yellow when the address resolves but the data type does not match, and red when the address is unreachable. To see this, project-right the HMI, choose "Compile > Software (rebuild all)", then open "HMI Tags". Online, right-click and select "Read tag values"; the same colors are emitted into the diagnostic buffer of the runtime for later review.

For I/O field width issues (cause #3), the WinCC Comfort editor surfaces a warning in the screen view when the configured format string cannot represent the value range of the bound tag. A INT tag with format string "999" (3 digits) will produce a compile warning if any code path can write a value >= 1000 into the tag. Address the warning by either expanding the format string ("9999" for 4 digits) or by adding range enforcement in the PLC program.

Common Field Scenarios

After hardware intervention or a remote-access session, certain patterns repeat. Treat them as heuristics; the diagnostic steps above still apply.

Scenario A: Remote VPN access by the manufacturer

When a manufacturer connects via VPN to perform diagnostics, their tool often pushes a temporary IP address to the HMI or to a routing device on the same subnet. After the session ends, the HMI may be left with the wrong default gateway or the device name may have been overwritten. Symptoms: HMI shows ##### immediately after VPN disconnect. Fix: open TIA Portal online, navigate to the HMI device > Properties > PROFINET interface, restore the configured IP and device name, then download the configuration back to the HMI.

Scenario B: Hardware replacement or repair on the machine

Replacing a sensor, valve island, or drive on the same PROFINET ring can change the topology. If the new device has a default device name (e.g., "et200sp") that conflicts with the configuration, the IO controller logs a station failure and the HMI loses access to that subnet's tags. Fix: assign the correct PROFINET name from TIA Portal using the Topology Editor or the PROFINET device name assignment tool.

Scenario C: Terminating resistor toggled off after PROFIBUS maintenance

Even on a PROFINET-only cell, the S7-315-2 PN/DP exposes a PROFIBUS DP master (X2). If a maintenance engineer opens the cabinet, services a DP device, and forgets to re-engage the terminator on the last DP node, the DP master logs a bus fault. The HMI shows ##### on any tag that is mapped to DP-side inputs. Fix: re-engage the terminator; the HMI recovers within one acquisition cycle.

Scenario D: PLC program reset to factory defaults

A "reset to factory" on the CPU erases the user program, the DBs, and the system data blocks that the HMI depends on. The HMI tags still point to DB100.DB0, but DB100 no longer exists. Symptom: ##### on every tag whose source is a deleted DB. Fix: re-download the project to the CPU from the TIA Portal project archive.

Scenario E: HMI in offline or simulation mode

Pressing the "Stop Runtime" button or entering the loader puts the HMI in offline mode. Every I/O field shows ##### by design. Fix: return to runtime from the loader.

Resolution by Root Cause

Verification and Validation

After applying a fix, validate that ##### is gone and that the panel is reading live data, not stale substitute values.

1. Open the affected screen on the HMI. Every I/O field must show a numeric value consistent with the PLC state (e.g., a temperature tag shows 23.5, not 0, not #####).
2. Force a value change in the PLC (set a tag to 100.0 in the watch table) and confirm the HMI updates within one configured acquisition cycle.
3. Open the HMI's Connections system screen and confirm the S7 connection is green.
4. Open the PLC's diagnostic buffer and confirm no new IO station failure events have been logged since the fix.
5. Tail the SIMATIC_S7_PROTOCOL_SUITE_01.LOG on the SD card and confirm no new 0x0014 or 0x8000 entries appear.
6. Cycle power to the HMI and confirm the values reappear within 30 seconds of reboot.

Preventive Best Practices

• Always use Siemens IE FC TP Cable (6XV1840-2AH10) and IE FC RJ45 Plugs (6GK1901-1BB10-2AA0) for the PROFINET segment; commodity patch cables fail mechanically in industrial environments.
• Reserve a fixed IP and PROFINET device name for every device and document them in the project header. Use the TIA Portal "Project documentation" function to export the assignment list.
• Lock the loader password on the HMI to prevent accidental transfer mode entry.
• Maintain a project archive (TIA Portal > Project > Archive). After every program change, archive the project. A factory reset of the CPU is recoverable in minutes if the archive exists.
• Use a managed PROFINET switch (SCALANCE XC-200 or higher) and enable the "Port statistics" alarms. A rising CRC error rate is an early indicator of a failing cable before it brings down the connection.
• For remote access, prefer the SINEMA Remote Connect solution over generic VPN; it does not push IP addresses to the local subnet.
• Define the HMI acquisition cycle at 2x the PLC OB1 scan time. A 50 ms OB1 supports a 100 ms acquisition cycle; 1 s OB1 supports a 2 s cycle.

Frequently Asked Questions