Resolving KP300 #### Display for Real Variables on S7-1200 CPUs

Problem Overview

A Siemens SIMATIC KTP300 Basic panel (also referenced in field reports as KP300) connected to a S7-1200 CPU 1214C DC/DC/DC displays the string #### in an output field instead of the numeric value of a PLC tag declared as Real (IEEE 754 32-bit floating point). The system was working for approximately two months after initial commissioning, then began showing the placeholder character set on both panels wired to the same PLC. The PLC remained online, both load cells were returning valid weights in the engineering tool, and the Ethernet connections were physically intact. The failure is silent: no diagnostic buffer entries appear on the CPU side, and no system alarms are queued on the HMI side.

The #### pattern in WinCC (TIA Portal) for Basic Panels is the conventional rendering of a value that is either (a) too large to fit the configured display width in the chosen format, (b) of a data type that the field cannot represent, or (c) corrupted / not refreshed because the HMI-PLC link lost the variable pointer. The interesting case discussed here is the third, where the engineering project itself becomes internally inconsistent and the only remediation is a project upgrade and re-download.

Affected Components and Version Matrix

Field experience and Siemens release notes identify the following combination as a known trigger for the symptom:

Root Cause Analysis

Five distinct mechanisms can produce the #### rendering. They are presented in order from most to least likely for the configuration described in the source case.

1. TIA Portal V13 SP0 Update 5 Compiler Regression (Most Likely)

The WinCC Basic Panels compiler included in TIA Portal V13 SP0 Update 5 mishandles the pointer table for Real tags whose PLC address falls inside a non-optimized DB on S7-1200 firmware V4.x. The compiled HMI image loads, the connection establishes, but the polling request is issued with an incorrect length and the panel substitutes #### for any value it cannot decode. Both panels on the same project show the same defect because they were compiled from the same broken project database. Upgrading to V13 SP0 Update 6 (final SP0 build) or to the V13 SP1 branch recompiles the pointer table correctly.

2. Project / Download Inconsistency

If the PLC portion of the project was edited (a new tag added, a DB reshuffled, an HMI-relevant variable renamed) and only the PLC was re-downloaded, the HMI retains the old pointer offsets. WinCC for Basic Panels does not warn about a stale pointer; it simply stops refreshing the affected tag and renders ####. This is silent because the connection itself remains established at the S7Comm layer.

3. IO-Field Width and Format Pattern

The output field is dimensioned in pixels, but its character capacity is governed by the configured Display Format and the Field Length property. A Real value of 12345.678 formatted with pattern 999 (3 integer digits, no decimals) does not fit. The same value formatted as 999.999 requires 7 characters plus a sign. Negative Real values (e.g., a tare-induced negative weight) cost an additional character. If the IO-Field's character capacity is below what the format pattern would emit, WinCC Basic substitutes ####.

4. Out-of-Range Source Value

A weighing application can transiently produce Real values outside the panel's renderable range, for example due to a damaged load cell or a miscalibrated SIWAREX module. The Basic Panels Real range is approximately ±3.4e38 (IEEE 754 single precision), so the actual numeric overflow is rare, but a corrupted pointer that points into a different tag area can deliver values that fail the format conversion. The reported case verified with the Online & Diagnostic watch table that the value in the PLC was valid; the corruption was in the HMI image, not in the source tag.

5. Bootloader / Image Mismatch

Bootloader 1.41 with image 12.00.00 is the only combination Siemens issued for the KTP300 mono PN on TIA Portal V13. A bootloader downgrade or a manually flashed image can leave the panel in a state where only standard tags refresh; Real tags remain static and eventually show ####. This is rare and only applies to panels that have been field-flashed outside the engineering tool.

Pre-Diagnostic: Confirm Connection and Data Integrity

Before assuming a software regression, isolate whether the panel is actually receiving the value. The diagnostic sequence below is the standard Siemens escalation path; it does not require any firmware change.

1. Open Online & Diagnostic Tools in TIA Portal against the S7-1200 and place the Real tag in a Watch Table. Verify the value updates in real time. This proves the PLC side is healthy. See the official S7-1200 manual collection for the procedure: Monitoring and modifying values in the CPU.
2. Add a test screen on the HMI with a discrete bit (M0.0 or a Bool DB tag) wired to a lamp or a second IO-Field. Toggle the bit from the PLC and verify that the HMI reflects the change. If the bit refreshes but the Real does not, the HMI-PLC link is intact; the defect is tag-specific.
3. Insert an Alarm View control on the test screen and enable system alarms. Connection loss events, pointer errors, and license issues are logged there. A clean Alarm View with the Real still showing #### confirms an IO-Field or project-corrupt condition rather than a link failure.
4. Check the IO-Field configuration: open the field's properties and confirm the connected tag is still the same Real tag, that the data type is Real (not Int or DInt), and that the Display Format pattern provides at least one more character of headroom than the largest expected value.

Primary Solution: TIA Portal Project Upgrade and Re-Download

The remediation that resolved the field case and that Siemens release notes identify as the canonical fix is to upgrade the engineering tool to a build that does not contain the regression, then upgrade the project in place, then re-download the PLC and the HMI.

Step-by-Step Procedure

1. Confirm the installed TIA Portal version: Help → About in TIA Portal. If the version reports V13 SP0 Update 5 the project is on the defective branch.
2. Install TIA Portal V13 SP1 Update 1 (or later) as a side-by-side install. The V13 SP0 branch's final release is SP0 Update 6; the V13 SP1 branch's releases reach SP1 Update 5. Both corrected branches are safe.
3. Open the project in the new TIA Portal. The portal will prompt to upgrade the project database. Accept. Wait for the project upgrade to complete; this rewrites the HMI compilation tables.
4. Recompile the HMI: right-click the KTP300 device → Compile → Software (rebuild all). This step regenerates the pointer tables for every tag.
5. Download the PLC first (online → Download to device). This re-establishes the DB layout in the CPU.
6. Download the HMI immediately afterwards. Do not skip this step; the HMI needs the new pointer offsets that match the recompiled project.
7. Cycle power on the panel after the transfer completes. The new image needs a full cold start to overwrite the in-RAM tag cache.
8. Verify the Real tag renders in the live display.

Secondary Solution: IO-Field Format Correction

If upgrading the engineering tool is not feasible, the secondary mitigation is to relax the format pattern on the affected IO-Field so that any value the PLC can produce fits within the field width. This is a workaround for cases 3 and 4 only; it does not address the V13 SP0 Update 5 compiler defect.

Configuration Procedure

1. Select the IO-Field in the HMI screen editor.
2. Open Properties → General and verify the Tag field points to the same DB / address as the PLC's Real variable.
3. Open Properties → Appearance → Display Format. Choose the format pattern. Avoid patterns that omit decimal places if the value carries fractional data.
4. Resize the field to a width that holds the chosen pattern plus a sign character. For a 99999.99 pattern, size for at least 10 characters.
5. Set the Limits under Properties → General → Limits to the physical range of the scale.
6. Recompile and re-download the HMI only.

Alternative Path: Project Rebuild From Source

If the project upgrade does not clear the symptom (case 1 plus stale downloads), perform a clean rebuild:

1. Archive the current project. Note the PLC station configuration, HMI connections, and tag database.
2. Create a new TIA Portal project at the same target version (V13 SP1 Update 1 or later).
3. Re-add the S7-1200 CPU and configure it identically. Re-import the DBs and tag table.
4. Re-add the KTP300, recreate the connection, and reconnect every IO-Field manually. Do not copy screens from the old project; copy the underlying tag references only.
5. Compile both devices, download PLC then HMI, then power cycle the panel.

This path is more expensive but eliminates any chance of carrying residual corruption from the V13 SP0 Update 5 build into the new image.

Firmware and Image Compatibility

Verification Procedure

1. With the panel in normal display mode, observe the IO-Field bound to the Real tag. Confirm a numeric value (including decimal point) is shown.
2. Force the Real value in the PLC via the watch table: write 0.0, -1.0, 1234.56, and a value near the upper limit. Confirm the panel reflects each in turn.
3. Power cycle the panel. Confirm the value is restored without a download prompt (image persists).
4. Disconnect and reconnect the Ethernet cable to the panel. Confirm the HMI re-establishes the S7Comm connection within 5-10 seconds and the Real reappears.
5. Check the HMI's Diagnostic view (if available) or Alarm View for any unacknowledged system events. A clean log is the final confirmation.

Prevention and Best Practices

• Pin the engineering build. Document the exact TIA Portal version (including SP and Update level) in the project header. Avoid the V13 SP0 Update 5 build entirely.
• Download PLC and HMI as a pair. Any PLC change that affects a tag visible on the HMI must be followed by an HMI re-download. Make this a checklist item in the change management workflow.
• Reserve one extra character in IO-Field width. Tare, drift, or sensor faults can produce negative or out-of-band values; reserve at least one sign character beyond the largest expected positive value.
• Use Limits to clamp display. Configure Low and High limits on every Real IO-Field bound to a process value. This prevents transient bad values from rendering as ####.
• Validate load cells and analog front ends. In weighing applications, a damaged load cell can return garbage Real values. Add a range-check in the PLC that substitutes a known invalid sentinel (e.g., -1.0) if the raw value is outside the physical envelope.
• Document image version on the panel. At commissioning, record the panel's image version and bootloader. This accelerates future fault correlation.

Troubleshooting Matrix

Field-Proven Caveats

• The CPU 1214C DC/DC/DC with firmware V4.0 supports Real tags without optimization issues; the failure point is the HMI compile, not the CPU.
• KTP300 Basic mono PN image 12.00.00 is the only image that runs with bootloader 1.41. There is no newer image that resolves the regression; the regression lives in the engineering compile, not the panel runtime.
• Re-downloading the HMI without upgrading the project does not clear the symptom in the V13 SP0 Update 5 case, because the defective image is regenerated every time.
• Multiple panels connected to the same PLC will all show the defect because the same defective image is deployed to all of them.
• Online & diagnostic watch tables on the PLC side will always show the correct value, which can mislead the engineer into thinking the HMI side is at fault when in fact the HMI image is the corrupted artifact.