Resolving KTP600 Basic I/O Field Showing '####' with S7-1200

The KTP600 Basic color PN panel (6th-generation SIMATIC Basic Panel) configured in TIA Portal with WinCC Basic / Comfort is known to display the placeholder string #### in an I/O field under specific runtime conditions when paired with an S7-1200 CPU 1215C. After the placeholder appears, the field no longer updates and the operator cannot write back a value until the panel is power-cycled. This article documents the verified root causes, the diagnostic path, and the field-proven remediation procedure including the ProSave Operating System (OS) recovery sequence referenced in the Siemens support knowledge base.

1. Affected Hardware and Software Baseline

Reference the official Siemens Basic Panels operating instructions and the SIMATIC S7-1200 programmable controller system manual for environmental and electrical ratings.

2. Why '####' Appears: Five Root Cause Classes

The four-hash placeholder is rendered by the runtime when the value cannot be represented. On a KTP600 Basic, it can be triggered by any of the following conditions:

1. Format / field-length overflow. The numeric value's string representation is wider than the configured display length in characters. Example: tag is declared INT (range -32768 to +32767) but the field length is 4 characters, and the live value is 12345 (5 digits, sign optional). The runtime cannot format the value without truncation, so it substitutes ####.
2. Acquisition-cycle corruption. With "Cyclic continuous" acquisition, the panel polls the tag at the configured update interval. If the PLC cycle is slower than the HMI update, transient values such as initialization values (0, -1, 32767) can be displayed before settling. When the tag's quality flag is briefly "bad" during a code-pass change in the PLC, the runtime writes ####.
3. Connection-loss / quality-bad event. A transient PROFINET loss forces the HMI to mark the tag quality as "bad." The runtime replaces the value with ####. Recovery normally occurs when the connection is re-established, but on certain firmware versions the internal tag-status table is not cleared, and the field remains in the bad state until the panel restarts.
4. Symbolic / absolute addressing mismatch on the DB. When a DB tag is configured with symbolic access on the HMI side and the S7-1200 DB has "optimized block access" disabled, the compiler-resolved offset may shift after a project recompile. The tag pointer no longer matches the variable, and the HMI returns "value not available." This is the most common cause when the configuration is rebuilt across multiple TIA versions.
5. Firmware / image-state drift. The runtime image stored on the panel is older than the engineering project (or vice versa). The mismatch produces a known exception in the WinCC Basic tag manager that surfaces as #### on multiple fields, not just one. The forum-confirmed fix is a full OS recovery using ProSave.

3. Diagnostic Procedure: Eliminate Causes in Order

3.1 Verify I/O Field Length and Format

Open the screen in TIA Portal, select the I/O field, and inspect the Properties > General > Display > "Field length" and "Format pattern" entries. The format pattern must support the worst-case value plus sign plus decimal separator.

For a Real tag with format 9999.9 (5 visible digits) the runtime needs a minimum field length of 6 characters including the sign. If the field length is shorter than the formatted string, the placeholder appears. Increase the field length first; this is the lowest-risk change.

3.2 Verify Connection Status and Tag Quality

Open Online > Accessible devices in TIA Portal, navigate to the panel, and use the Diagnostics view. Check the Connection status indicator and the per-tag Quality code column. Codes that produce ####:

If the quality code is 0x00, 0x04, 0x08, 0x0C, or 0x18, the connection is the cause, not the format. Continue to section 4.

3.3 Confirm Tag Acquisition Mode

Open the HMI tag editor and review the Acquisition mode column. The four modes available in WinCC Basic are:

• Cyclic continuous - polled at the configured update interval, even if the value is unchanged. Best for rapidly changing process values.
• Cyclic on use - polled only while the tag is currently visible on the active screen. Lowest network load.
• On demand - polled only when a script or function explicitly reads the tag.
• On value change - polled continuously, but only displayed when the value differs from the previous sample. Not supported for all data types.

When 10 or more tags share the Cyclic continuous mode, total HMI-to-PLC request rate can exceed 50 requests / 100 ms, which is the PROFINET baseline for the Basic Panel connection. Symptoms include intermittent #### and slow screen changeover. Reduce the count of Cyclic continuous tags, lower the update interval, or move slow-changing tags to Cyclic on use.

4. Symbolic vs Absolute Addressing on DB Variables

The original poster asked whether DB variables can be switched from symbolic to absolute addressing. The short answer: yes, on the HMI side, but you must keep the PLC-side declaration consistent. Procedure:

1. Open the S7-1200 project, select the DB, and open its Properties. Uncheck "Optimized block access". The DB becomes a non-optimized block with fixed offsets. Recompile the PLC program.
2. In the HMI tag list, open the affected tag. Change the Address field from symbolic to absolute, e.g. DB10.DBD4 for a DInt at offset 4, or DB10.DBX6.0 for a Bool at byte 6 bit 0.
3. Confirm the DB number matches the actual PLC DB, and the offset matches the variable's position in the non-optimized DB layout.
4. Recompile the HMI project, transfer to the panel, and monitor the field for one hour.

For M variables (bit memory), the same logic applies. M0.0 to M1023.7 is always absolute, so the switch on M tags is purely a display-side change. DB variables require the PLC-side change described above.

5. PROFINET Connection and Cable Verification

The PROFINET interface on the KTP600 Basic color PN is the only data path. A single damaged connector or marginal link will produce exactly the symptom cluster described: intermittent ####, recovery on PLC power-off, and the last-value flicker.

Check the link LED on the panel and the PLC. If either LED is amber or off, replace the patch cable. The Siemens-recommended cable is 6XV1 870-3AH10 (PROFINET Type C, Cat 5, twisted pair, up to 100 m). For harsh environments use 6XV1 840-2AH10 (Type C, trailing, PUR jacket).

6. Firmware and Image Recovery via ProSave

When format, addressing, and connection have been ruled out, the last-resort fix documented in the Siemens support knowledge base is to reset the panel to factory settings and re-flash the operating system image. This addresses the firmware-state-drift class of faults and is the procedure referenced as "update of the image with the operating system" in the field report.

6.1 Prerequisites

• PC with TIA Portal installed (V15.1 or later).
• Ethernet connection from the PC directly to the panel's PROFINET port (no switch).
• OS image file matching the panel: KTP600_Basic_color_PN_IM.ima for the color variant, or the equivalent _mono_ file for the monochrome variant.
• ProSave utility - installed automatically with TIA Portal under Siemens\Automation\SIMATIC\ProSave.

6.2 Reset to Factory Settings

1. Launch ProSave from the Start menu or the TIA Portal installation folder.
2. Select Device type > KTP600 Basic color PN.
3. Set Connection > Ethernet, then enter the panel IP (default 192.168.0.10) and the PG/PC IP (e.g. 192.168.0.100). The PC must be in the same subnet.
4. Click "Connect". If the connection fails, verify the cable and that the panel is in Transfer mode (touch the Transfer button in the panel's control panel or hold the lower-left area during boot to enter the loader menu).
5. Switch to the OS Update tab and select the .ima file.
6. Check the box "Reset to factory settings".
7. Click "Update OS". The panel will reboot twice and the loader will report "Update successful".

6.3 Re-Transfer the Project

1. In TIA Portal, select the HMI device in the project tree.
2. Right-click > Compile > Software (rebuild all).
3. Drag-and-drop the compiled .tia image onto the panel node, or use Online > Extended download to device.
4. After the transfer, the panel restarts and loads the new runtime. Test all I/O fields for 24 hours.

7. Verification and Long-Term Stability

After applying the corrective action, validate as follows:

1. Tag audit. For every I/O field on every screen, confirm: tag type, format pattern, field length, and acquisition mode match the table in section 3.1.
2. Quality sweep. With TIA Portal online, watch the Quality code column for at least 10 minutes of normal operation. No tag should drop to 0x00, 0x04, 0x08, 0x0C, or 0x18.
3. Load test. Force the PLC to write the worst-case value (INT: -32768, DINT: -2147483648, REAL: -3.4e+38) to each tag. Confirm the I/O field shows the value, not ####. This is the definitive test for the format / length class of fault.
4. Communication test. Unplug the PROFINET cable for 5 seconds, then reconnect. The fields should recover automatically within 2 acquisition cycles. If they do not, the connection-loss recovery class is still active.
5. Stress test. Cycle through every screen repeatedly for 30 minutes. The original report indicated the panel ran for 10 days incident-free after the OS update; a sustained 24-hour stress run is the practical minimum to confirm the fix.

8. Preventive Design Rules

Once the immediate fault is cleared, apply the following rules in new HMI projects targeting the KTP600 Basic color PN:

• Default acquisition mode: Cyclic on use unless the tag drives a trend or a value that must update off-screen.
• Update interval: 1 s for process values, 500 ms for alarms, 100 ms only for critical interlocks. The Basic Panel can sustain a maximum of ~250 ms aggregate cycle for 100 tags before the connection queue saturates.
• Field length: always size to the worst-case formatted string + 1, never less.
• DB access: keep PLC DBs optimized unless a legacy or non-Siemens client requires absolute offsets. Symbolic access survives recompiles.
• Image version pinning: lock the panel image version to the TIA Portal version used to compile the project. A panel on image V16 cannot run a project compiled for V18 reliably.
• Watchdog tag: configure a heartbeat tag (e.g. MB100 toggling at 1 Hz) and display it on the home screen. If the field shows ####, the operator immediately knows the link is the issue, not the field configuration.

9. When to Escalate

If the #### symptom persists after all five root cause classes have been addressed and the ProSave OS recovery has been performed twice, escalate via a Siemens Technical Support request. Provide:

• Diagnostic buffer extract from the S7-1200 (TIA Portal > Online > Diagnostics > Buffer).
• ProSave diagnostic log (Tools > Options > Save log).
• Panel firmware version (read from the loader menu).
• TIA Portal project version and installed HSPs.

Reference the official SIMATIC Basic Panels operating instructions and the TIA Portal I/O field documentation when filing the request.

10. Related I/O Field Behavior in WinCC Unified

Engineers migrating from WinCC Basic to WinCC Unified should be aware of a separate, well-documented issue: when multiple I/O fields configured as output fields with a transparent background share a screen, the transparent area of one field can overlap the adjacent field and the touch event is delivered to the wrong tag. The full behavior and workaround is documented in the WinCC Unified V21 I/O field reference. Although this is a Unified-specific behavior, it is mentioned here because the symptom - a field that stops responding to operator input - is sometimes confused with the #### fault described above. Confirm the symptom precisely before applying either fix path.

11. FAQ