Resolving SIMOTION HMI ##### Display Values: TCP/IP and S7Online

Problem Overview

When a SIMOTION controller is connected to a WinCC Flexible, TIA Portal WinCC, or third-party HMI, the HMI tags sometimes display literal hash marks (#####) instead of numeric values. The placeholder string appears in the configured output field regardless of whether the HMI is in simulation, online, or running against a real SIMOTION D4x5 / C240 PN / P320-3 controller. The same symptom occurs in the engineering station view of TIA Portal where HMI tags are mapped to SIMOTION variables.

The ##### string is the WinCC runtime's "value not available" indicator. It is not a SIMOTION fault and it is not a tag-format issue. It is a signal that the HMI tag has not received a valid value from the controller or from the engineering interface within the configured acquisition/refresh window. The most frequent cause in SIMOTION environments is a broken communication path between the HMI runtime, the S7ONLINE access point, and the SIMOTION CPU — particularly when the project is using the SIMOSIM virtual Ethernet adapter or when the PG/PC interface is set to TCPIP.AUTO with no real adapter bound to it.

This article walks through the diagnostic steps to isolate the cause, then provides a complete configuration sequence for Scout / TIA Portal / WinCC to eliminate the ##### indicator and establish a stable tag refresh.

Root Cause Analysis

The ##### indicator can be produced by five distinct failure modes. Each one must be ruled in or out systematically because the runtime cannot distinguish between them.

On SIMOTION systems, the S7ONLINE access point is the gateway through which both Scout and the HMI runtime reach the controller. WinCC and WinCC Flexible read the same registry value (S7ONLINE → AccessPoint) that Scout reads, so an incorrect access point setting affects both. The HMI will sit in the Connecting state and time out — at which point every numeric tag returns ##### because WinCC marks the entire connection as down.

Prerequisites

Before changing any setting, confirm that the following software and OS-level components are present and version-compatible.

1. SIMOTION Scout (V4.4 / V4.5 / V5.x) or TIA Portal with SIMOTION option package installed.
2. WinCC Comfort / Professional / Flexible 2008 SP5 or later on the engineering station.
3. Administrator privileges on the engineering PC (required to modify PG/PC interface and the S7ONLINE access point).
4. The Set PG/PC Interface applet visible in Windows Control Panel. On 64-bit systems use the 32-bit version under SysWOW64 if Scout is 32-bit.
5. Either a real Ethernet adapter with the controller on the same subnet, or the SIMOSIM virtual Ethernet adapter installed and started.
6. Windows firewall rules allowing TCP/UDP ports 102, 34964, 34965, 34966 (S7 / S7Plus / OPC UA discovery) for the engineering subnet.

Step 1 — Validate the S7ONLINE Access Point

Open Start → Siemens Automation → Communication Settings (or the legacy Set PG/PC Interface applet). The dialog lists installed access points on the left and the assigned interface parameter on the right.

1. Select S7ONLINE in the Access Point of the Application list.
2. On the right-hand Interface Parameter Assignment Used dropdown, set the entry to one of the following — in this order of preference:
   1. TCPIP → <your real Ethernet adapter> if the engineering PC is on the same physical network as the SIMOTION CPU.
   2. TCPIP → SIMOSIM Virtual Ethernet if you are running a SIMOSIM simulation.
   3. TCPIP.AUTO only as a last resort. TCPIP.AUTO binds to the first active TCP/IP adapter in the system and can silently re-bind after a Windows network change, which is a frequent source of intermittent ##### values.
3. Click OK. The change is written immediately to the registry at HKLM\SOFTWARE\Siemens\S7ONLINE\Options.

Step 2 — Configure the SIMOSIM Virtual Ethernet Adapter (Simulation Only)

If the SIMOTION project runs in SIMOSIM and the HMI is in the same engineering station, the SIMOSIM virtual Ethernet adapter must be installed and started before Scout or the HMI attempts to go online.

1. In Scout, open the project and select SIMOSIM → Start. The simulation taskbar icon turns green when the virtual controller is running.
2. Verify the virtual adapter is bound by opening ncpa.cpl. A network connection labelled SIMOSIM Virtual Ethernet must be present and enabled.
3. Right-click the SIMOSIM adapter, choose Properties → Internet Protocol Version 4, and set a static IP address. Conventionally the simulation adapter is given 192.168.0.1 / 255.255.255.0 and the SIMOTION CPU in the simulated project is configured with 192.168.0.2. The HMI runtime in TIA Portal uses 192.168.0.3 on the same adapter.
4. Confirm reachability with ping 192.168.0.2 from an elevated command prompt. If the ping fails, restart the SIMOSIM service: net stop "SIMOSIM" && net start "SIMOSIM".

Step 3 — Configure the SIMOTION Project in Scout

Open the SIMOTION project in Scout and verify the communication settings on the controller object.

1. Open Project → Properties → Communication. Confirm that the PROFINET interface or Ethernet interface is enabled, and that the IP address matches the address that the HMI will dial.
2. Right-click the SIMOTION device and select Target System → Select Target System → Accessible Nodes. The controller must appear in the list with its configured IP. If the list is empty, the access point is wrong (return to Step 1).
3. Compile the project (Project → Compile and Download Objects) and download it to the controller. The Download dialog must complete with status successful for every unit.

Step 4 — Configure the HMI Connection in TIA Portal

The HMI connection is the link most often misconfigured when ##### appears.

1. Open the TIA Portal project that contains the HMI device (e.g. a KTP1200 Comfort or a WinCC Runtime Professional).
2. Select the HMI device and open Connections. Add a new SIMOTION S7 connection.
3. Set Partner (SIMOTION CPU) to the configured IP. If the HMI runs on the same PC as Scout and SIMOSIM, set the partner IP to 192.168.0.2 (the SIMOSIM target). If the HMI runs on a separate panel, set the partner IP to the physical CPU IP.
4. Set Local Interface to the HMI panel's Ethernet port, and assign a static IP in the same subnet (e.g. 192.168.0.10 / 24).
5. Set Connection Mechanism to S7 Communication with active partner and leave the rack/slot at 0 / 0 (SIMOTION behaves as a single slot from the HMI's point of view).
6. Compile the HMI project and download to the panel or to the WinCC Runtime.

After download, the HMI runtime should leave the Connecting state and switch to Connected (online). The connection status is visible in the HMI system diagnostics screen. If the connection status remains red, the partner IP or local interface is the next thing to check.

Step 5 — Map HMI Tags to SIMOTION Variables Correctly

Tag mapping errors produce ##### in a perfectly healthy connection when the symbolic name does not exist on the SIMOTION side.

1. In TIA Portal, open the HMI tag table. Confirm each tag is configured with Connection = <the SIMOTION connection created in Step 4>.
2. For each tag, set Address to the symbolic SIMOTION name, e.g. MyAxis.Position or MyIO.OutputWord1. The path must match the symbol exactly as it appears in the SIMOTION symbol browser.
3. Set Acquisition mode to Cyclic in operation with a 1 s cycle, and Update to the same value. Avoid On demand for tags used in animations, because WinCC will not poll on demand tags and the value remains initial.
4. If a tag is connected to a SIMOTION structure (e.g. a TO axis or a user-defined UDT), select the entire structure under Symbol and let the import wizard generate the member tags. Hand-typing the path is the most common source of ##### for axis tags.

Step 6 — Configure Symbol Access Rights on SIMOTION

SIMOTION controls symbol access through the Web server / OPC UA / symbol access rights. When symbol access is denied, the HMI receives an error response and the tag remains in the BadComm quality state.

1. In Scout, open the device's Properties → Symbol Browser (or Symbol Configuration in TIA Portal).
2. Enable the Symbol browser / S7 symbol access checkbox. This is required for HMI tag polling.
3. If the project uses access protection, grant the HMI connection partner the Read right on the relevant symbol set.

Verification

After completing the steps above, validate the connection with the following checks before declaring the fault cleared.

1. Open the HMI runtime's System Diagnostics → Connection Status. The SIMOTION connection must show Connected (green).
2. Open a screen with a numeric I/O field bound to a SIMOTION variable (e.g. MyAxis.ActualPosition). The field should display a real numeric value, not #####. Force the value to a known constant from Scout and confirm the HMI updates within one cycle.
3. Open the HMI log and confirm that no Connection failure events (system event 140001) have been logged since the last configuration change.
4. From a Windows command prompt on the engineering PC, run ping <SIMOTION IP> and confirm sub-millisecond round-trip time. High latency is acceptable; packet loss is not.
5. If the HMI is a Comfort Panel, the panel's Control Panel → Transfer screen will show the current connection state. Re-enter the Control Panel to force a refresh of the S7 connection state if it has been suspended.

Troubleshooting Matrix

Advanced Diagnostics

When the steps above do not eliminate the placeholder, the following advanced checks isolate the failing layer.

Wireshark Capture on the Engineering Port

Start a Wireshark capture on the adapter bound to S7ONLINE. Filter on tpkt.port == 102. The HMI runtime will attempt to open an S7 connection to the SIMOTION CPU; capture the request and response. The following patterns are diagnostic:

• No traffic at all — the HMI is not even attempting to connect. The access point is wrong, or the HMI runtime has not enabled the connection.
• SYN with no SYN-ACK — the partner IP is wrong, the partner firewall is blocking TCP/102, or the controller is not on the network.
• S7 Communication Setup (0xF0) followed by an S7 negative acknowledgement (0x32 / 0x05) — the partner refused the connection. This usually indicates that the SIMOTION symbol browser has symbol access disabled.

Scout Online Diagnostics

From Scout, Target System → Online → Diagnostics provides the live state of the SIMOTION communication stack. The PROFINET interface field should show the configured IP and a Running state. The Connections tab lists every active S7 communication partner. The HMI must appear in the list with state Established; if it does not, the HMI never reached the CPU.

Windows Event Log

Open eventvwr.msc and inspect Applications and Services Logs → Siemens Automation. The S7 driver writes connection establishment and failure events here with event IDs in the 0x7000 range. A repeated Connection attempt failed (0x7101) event combined with a HMI showing ##### confirms a network-layer fault, not a tag-mapping fault.

Preventive Configuration

Apply the following to reduce the chance of recurrence once the immediate problem is fixed.

• Always assign S7ONLINE to a specific TCPIP adapter, never TCPIP.AUTO.
• Document the engineering PC's adapter order. Windows may reorder adapters after driver updates or VPN installs, which silently breaks TCPIP.AUTO bindings.
• Use static IP addresses on the engineering PC, the HMI panel, and the SIMOTION CPU. DHCP leases changing after a router reboot is a frequent cause of intermittent ##### values.
• Add a comment in the Scout project indicating the IP and adapter expected for S7ONLINE. This reduces debugging time on multi-NIC engineering stations.
• For SIMOSIM, always start SIMOSIM before opening the HMI runtime. If the HMI opens first it will not find the virtual adapter and will sit in the Connecting state.

FAQ