Resolving Hash Symbols in TIA Portal HMI I/O Field Display

When a Siemens HMI panel or WinCC Runtime shows a string of hash characters (####) inside an I/O field during simulation or runtime, the operator screen is signaling that the configured tag cannot be presented in the allocated display area. The behavior is identical on Comfort Panels, TP/TP/KTP series, WinCC RT Advanced, and WinCC RT Professional, because the rendering routine in the HMI device firmware truncates any value whose formatted width exceeds the configured field length with a fill of '#' characters (ASCII 0x23).

This reference covers the four root causes that drive the hash fill on Siemens HMIs, with emphasis on TIA Portal V17–V18 projects using PLCSIM or the integrated HMI Tag Simulator. Each cause is mapped to the configuration path, the diagnostic evidence, and the corrective action required to restore the live numeric or string output.

1. Problem Description

Symptom cluster observed across reported cases:

• An I/O field displays #### instead of an integer, real, or string value.
• The PLC program and the connected CPU (S7-1200, S7-1500, ET 200SP, PLCSIM instance) execute correctly and update the tag in the watch table.
• The HMI is online (green dot in the TIA Portal project tree) but the field still renders hashes.
• Adjacent I/O fields bound to the same tag show the expected value, narrowing the fault to that single field.
• Trend views that read the same tag also collapse to a flat line because the underlying acquisition triggers on a value change that never arrives.

Because the HMI renders the hash in simulation-only mode (no physical PLC), the most common culprits are tag configuration, format string, and PLC-HMI connection mapping rather than physical wiring.

2. Root Cause Matrix

3. Bit/Byte Addressing Fundamentals

The single largest contributor to hash-fill conditions is addressing overlap. In TIA Portal, HMI tags of type Word, Int, DWord, DInt, and Real are always byte-aligned. If the PLC programmer references DB1.DBX0.3 as the source of a DInt HMI tag declared on DB1.DBD4, the runtime will read four bytes starting at byte 4, which may overlap with a different variable declared at byte 0. The PLC writes its local value but the HMI reads a conflicting block, and when the resulting value exceeds the configured display width, the field collapses to ####.

Engineering rules of thumb:

• Reserve an entire data block (DB) for HMI-visible variables to avoid collisions with internal flags.
• Never declare Bool tags inside a DB that also contains Int or Real tags unless the boolean occupies the last remaining bytes of a declared word.
• Use symbolic addressing (tag names in the PLC program) instead of absolute addresses; TIA Portal will warn about overlapping symbolic regions when you compile the project.
• For S7-1200/S7-1500, prefer the optimized block access so the compiler can re-arrange variable offsets and detect conflicts.

4. Step-by-Step Diagnostic Procedure

1. Confirm the runtime is online. In WinCC RT Advanced, open Diagnostics → Device Diagnostics and verify that the HMI connection icon is green. On a Comfort Panel, press the Control Panel → Transfer → Connections touch button.
2. Open the I/O field configuration. Select the field on the screen, navigate to Properties → General → Process value, and record the tag name (for example, HMI_Tag_1).
3. Inspect the HMI tag properties. Expand HMI Tags → Show all tags, right-click the tag, and select Properties. Compare the Data type (Int, DInt, Real, String) and the Length setting with the PLC source tag.
4. Inspect the PLC tag properties. Open the related DB in the PLC program. Under Properties → Attributes confirm that Accessible from HMI is enabled and that the Offset (for non-optimized blocks) matches the address bound on the HMI tag.
5. Watch the value live. Open Watch and force tables, add the same tag, and toggle the value. If the value updates in the watch table but the I/O field still shows ####, the cause is local to the field format or the connection.
6. Check the format pattern. In the I/O field properties → Appearance → Display format, the format string defines the maximum number of digits (for example, 999 allows three digits). Increase the width or change to 9999 if the value range exceeds the current width.
7. Verify the connection name. Open Devices & Networks, click the connection line between the PLC and the HMI, and confirm that the HMI tag is associated with that connection rather than a duplicate or offline partner.
8. Compile and check the output window. Right-click the HMI device and select Compile → Software (rebuild all). Errors in the output window that mention tag inconsistency or overflow confirm an addressing problem.

5. Configuration Reference: I/O Field Display Formats

When the runtime attempts to write a value whose formatted length exceeds the configured width, the HMI substitutes # characters for every character that does not fit. This is documented in the WinCC Comfort/Advanced system manual under "I/O field — Representation of values that are too long".

6. PLC-HMI Connection Verification

A common oversight during simulation-only projects is forgetting to assign an HMI connection between the PLCSIM instance and the WinCC runtime. When the connection is missing, the HMI tag quality code is Bad and the I/O field renders hashes regardless of the format pattern.

6.1 Configuration Path

1. Open Devices & Networks.
2. Select the S7-PLC/HMI connection line; if no line exists, drag from the PLC Device view to the HMI Device view.
3. Confirm the Connection name matches the one referenced by each HMI tag.
4. In the connection properties, verify that Access point (for S7-1200/S7-1500) and the rack/slot configuration match the PLCSIM instance.

6.2 PLCSIM-Specific Notes

• PLCSIM V15 and later uses a Softbus interface; the HMI connection must be routed through the same Softbus channel.
• PLCSIM Advanced V3+ supports multiple instances; assign each instance a unique IP address (for example 192.168.0.10 and 192.168.0.11) so the WinCC runtime can resolve the partner.
• When the HMI is started before PLCSIM is online, the I/O field shows #### until the connection is established; this is a transient state and should clear once the PLC goes to RUN.

7. HMI Tag Simulator for HMI-Only Simulation

If the project runs as an HMI-only simulation (no PLC logic), the HMI Tag Simulator provides a built-in source of tag values. Open it from Online → Simulation → Tag Simulator (or the toolbar icon). For each simulated tag:

• Set the Simulation mode to Sine, Ramp, Random, or Constant.
• Adjust the Min, Max, and Increment values so the simulated range does not exceed the I/O field width.
• Confirm that the Update cycle is shorter than the I/O field acquisition cycle, otherwise the value appears to "freeze".

8. Verification Checklist

After applying the corrective action, confirm each item below before signing off the panel:

1. I/O field renders the expected value (numeric or text) instead of ####.
2. Increasing the simulated value to the maximum of its range still renders correctly — no truncation.
3. The trend view bound to the same tag traces a curve instead of a flat line.
4. The alarms / alert system that read related tags populate and clear as expected.
5. Project compilation completes with zero warnings in the TIA Portal Output window.
6. HMI connection state is green in Diagnostics → Connections.
7. Watch table on the PLC side and the HMI tag value stay synchronized within one acquisition cycle.

9. Advanced Diagnostics with Quality Codes

Each HMI tag carries a quality code that the runtime exposes through the property Quality. Bind an auxiliary I/O field or a status bar element to <TagName>.Quality to surface the diagnostic code at runtime:

Reading these codes is the fastest way to isolate the root cause without rebooting the runtime.

10. Common Field-Proven Pitfalls

• Sub-blocks inside optimized DBs: When the PLC programmer places tags inside an AREA (UDT instance), the offset calculated by TIA Portal can shift between project versions. Always re-compile the HMI after upgrading the PLC program.
• Multi-instance DBs: Tags declared inside a multi-instance FB inherit the parent FB's ID; do not reference them by absolute address from the HMI.
• STRING versus WSTRING: Mixing a PLC-side STRING[10] tag with an HMI-side WString tag causes a configuration error and the I/O field shows #### together with a red border.
• Length field reset: When a STRING tag's length field is not initialized, the runtime may report a length of zero and render the field as ####. Use BLKMOV or MOVE_BLK in OB100 to pre-initialize the string length.
• PLC data block attributes: If the DB attribute Read-only is set, the HMI write attempt fails silently and the field collapses to hashes after the first failed write cycle.
• Panel scaling: On Comfort Panels the I/O field width is scaled with the screen resolution. When porting a project from a 7" to a 10" panel, the absolute pixel width remains the same but the visible characters per field change.

11. Frequently Asked Questions