S7-1200 Counter Displays # and Flashing 4 on KTP400 HMI: MW0 Fix

Problem Description

Symptom observed on a SIMATIC S7-1200 (firmware V4.x) coupled to a KTP400 Basic PN HMI, configured in TIA Portal V13:

• An up-counter (CTU) operating on a photo-electric sensor counts real production pieces correctly most of the time.
• The connected HMI tag, however, renders as a hash character (#), the digit 4, or any other non-monotonic value, and appears to flash or jump.
• A separate timer tag displayed on the same screen reads cleanly and is not affected.
• The counter program is implemented inside a Function Block (FB) with a single-instance Data Block; the HMI tag points to a default tag table address that is, in this case, %MW0.

The reported resolution was to move the counter from %MW0 to %MW500 (or %MW5000), after which the HMI value stabilised. The remainder of this article explains exactly why that worked, how to prove the same root cause in your own project, and how to prevent it from recurring.

Root Cause: Clock Memory and System Memory Overlap with %MW0

The S7-1200 provides two special bit ranges that the CPU owns and toggles automatically:

By default in TIA Portal V13 (and later), the Clock Memory Byte is enabled and assigned to MB0. The eight bits of MB0 then oscillate at the frequencies configured in the CPU properties dialog (typical defaults: M0.0 = 10 Hz, M0.1 = 5 Hz, M0.2 = 2.5 Hz, M0.3 = 2 Hz, M0.4 = 1.25 Hz, M0.5 = 1 Hz, M0.6 = 0.625 Hz, M0.7 = 0.5 Hz).

Memory layout that is colliding

Writing a CTU's CV output to %MW0 is therefore equivalent to letting the CPU and the clock generator share the same register, with the clock generator winning at every cycle. The visible flash is not random: it is the binary waveform of MB0 reinterpreted as a signed integer. Bit pattern 0000 0100 = decimal 4, 0010 0011 = decimal 35, etc., and pattern 0000 0000 simply shows as 0 on the HMI if a character is mapped for that.

Why a Separate Timer Did Not Show the Same Symptom

The user reported that the timer field rendered correctly. This is consistent with the timer tag being placed at a different address (for example %MW2, %MW4, or a tag in the instance DB) that does not overlap the clock byte. The corruption is purely a function of which physical byte range the offending tag references, not of the data type or block origin.

Pre-Fix Diagnostic Procedure

Use this checklist to confirm the same root cause in your project before changing any code.

1. Open the Watch and Force Tables folder of the S7-1200 device in the project tree and add a new table.
2. Add the exact address used by the HMI tag (e.g. %MW0). It must be the same address that the IO field on the KTP400 page references — symbolic tags can resolve to unexpected absolute addresses if the DB was recompiled.
3. Go online with the PLC and observe the value. If the displayed number wobbles between 0, 1, 2, 4, 8, 16, 32, 64, 128 (and combinations) and changes at a rate that matches the configured clock frequencies, the byte range is owned by the clock generator.
4. Open Device Configuration → Properties → System & Clock Memory. Read the Clock memory byte field. If it is set to 0, the colliding address is MB0.
5. For S7-1200 FW4.0+ and S7-1500 controllers, use the Traces function (Project tree → Traces) to record the counter's current value over time. A trace will show a staircase pattern chopped up by clock-bit transitions.

Step-by-Step Resolution

Option A — Move the counter into free memory (recommended)

1. In TIA Portal, change the CTU's CV (current value) output destination from %MW0 to a free address such as %MW500 or %MW5000. Reserve at least 50 MW of headroom in your naming scheme for future tags.
2. Update the HMI tag (or the symbolic reference) to point to the new address. If you are using a default tag table with an absolute address, change the address on the tag itself.
3. Compile the PLC project (Build → Compile) and then compile the HMI project.
4. Download both to the S7-1200 and the KTP400.
5. Cycle the photo-sensor input a few times and observe the HMI — the value should now increment monotonically and never display # or jump to unexpected values.

Option B — Disable or relocate the Clock Memory Byte

1. Open Device Configuration for the S7-1200 CPU.
2. Navigate to Properties → System & Clock Memory.
3. Either uncheck Enable clock memory byte (recommended if you do not actually use it in your logic), or change the byte to a non-conflicting value such as 100 (reserving MB100–MB101 from any other use).
4. Recompile and download.

Memory Map and Reservation Table

For a typical S7-1214C / S7-1215C station, allocate reserved regions in the bit-memory (M) area so that automatic CPU resources and application tags never collide.

This is a convention, not a Siemens requirement — but it eliminates the entire class of clock-memory aliasing bugs.

Edge-Trigger Hygiene: Avoiding False Counts

A second, independent cause of the user's report was a counter that incremented on every PLC scan, not on every piece. Even after fixing the MW0 overlap, verify that the counter input is conditioned with a positive edge:

// SCL example for S7-1200
IF "PhotoSensor" AND NOT "SensorPrev" THEN
    "DB_Counter".CTU_DB.CV := "DB_Counter".CTU_DB.CV + 1;
END_IF;
"SensorPrev" := "PhotoSensor";

Or, equivalently in LAD/FBD, place a normally-open contact of "PhotoSensor" in series with a P (edge-detect) coil, and feed that pulse into the CTU's CU input. The TIA Portal online help on the CTU block explicitly states that the current value is updated only on a rising edge of CU and that, for the IEC counter implementation, the value ranges from 0 to 32 767 for an INT and from -2 147 483 648 to 2 147 483 647 for a DINT.

INT vs DINT Overflow Behaviour

For a piece counter on a packaging line, DINT is almost always the correct choice. Convert the CTU's CV from INT to DINT in the FB static section, and update the HMI tag data type accordingly.

HMI-Side Checks on the KTP400

Even with a clean PLC tag, the HMI itself can produce the # glyph if the configured display cannot render the value:

1. Open the IO field properties on the affected screen in the KTP400 configuration.
2. Confirm the Display format matches the tag data type (Decimal for INT/DINT, Float for REAL). A binary or BCD format will render bits as on/off rather than as a number.
3. Verify the field width: an IO field configured for 5 characters that suddenly receives a 6-digit number will often render # rather than truncate.
4. Open Animations on the IO field and remove any visibility, appearance, or motion animation that may be toggling at a high rate.
5. Confirm the HMI connection is to the correct PLC and the correct DB; an HMI tag that is bound to a non-existent or wrong DB will display # when the runtime cannot resolve the symbol.

Symbolic vs Absolute Addressing on the HMI

TIA Portal V13 supports both symbolic and absolute addressing for HMI tags. A common source of "the value used to work, then it went wrong" complaints is the loss of a symbolic link after a project edit:

If the user's counter tag had been symbolic, the symptom of MW0 aliasing would have been the same — the data type and address would not have changed — but the troubleshooting path would have led directly back to the PLC program rather than to "the HMI shows a number I did not set".

Verification Procedure After the Fix

1. Open the watch table created earlier and confirm the value of the new MW address (e.g. %MW500) increments by exactly 1 per sensed piece.
2. Check MB0 in the same watch table. If Clock Memory is still enabled, MB0 should still toggle, but the counter tag should no longer reference it.
3. From the TIA Portal Online & Diagnostics view, run a Trace on the new MW and the sensor input simultaneously. You should see clean 1-step increments aligned to the rising edge of the sensor.
4. Power-cycle the CPU to confirm the counter behaves correctly from a cold start (watch for any uninitialised-memory effects on the instance DB).
5. Force a value via the watch table above the INT ceiling and confirm the expected wrap (or that your DINT conversion prevents the wrap).

Recommended Project Hygiene

• Document the M area. Maintain a single memory-map document or PLC data block comment header that lists every reserved byte, including the clock memory byte, system memory byte, retentive areas, and HMI tag regions.
• Avoid M0.0 – M1.7 for any user tag unless you have explicitly turned Clock Memory off and never use the System Memory Byte either.
• Use DINT for production counters. Even if the line will never produce 32 767 pieces, DINT removes a class of future bug.
• Prefer symbolic HMI tags. Symbolic links in TIA Portal V13+ survive DB renumbering and refactoring better than absolute addresses.
• Always condition counter inputs with a positive-edge evaluation; never feed a raw level into a CTU's CU input.

Troubleshooting Matrix

Reference Material

• SIMATIC S7-1200 Programmable Controller — System Manual (entry ID 109751706): support.industry.siemens.com — S7-1200 System Manual
• SIMATIC S7-1200 / S7-1500 — Clock Memory and System Memory Bytes (entry ID 87603991): support.industry.siemens.com — System & Clock Memory
• SIMATIC KTP400 Basic — Operating Instructions (entry ID 21859050): support.industry.siemens.com — KTP400 Basic PN
• TIA Portal V13 — Programming and Operating Manual (entry ID 109751706, sections on CTU, edge detection, and tag binding)
• S7-1200 CPU 1214C DC/DC/DC — Device Manual (entry ID 106474690): support.industry.siemens.com — S7-1200 CPU 1214C