Siemens S7-1200 AI 8x13bit HMI Value Jumping: Root Cause and Fix

Problem Overview

An S7-1200 system with two SM 1231 AI 8x13bit analog input modules reads 4-20 mA 3-wire level sensors on non-linear tanks. The raw input range observed on the PLC is 0-27684 counts, scaled correctly in the application code to engineering units (liters). When the scaled value is displayed on a Siemens HMI through an I/O field and a level bar, the value is stable for approximately 10 seconds, then jumps up or down for about 1 second, then returns. Online monitoring in TIA Portal shows the source tag is rock-stable, and a trend view on the HMI shows the value as #### (out-of-range marker) while the I/O field updates normally with the spillage expected from a turbulent tank surface.

Symptom fingerprint: stable raw input + stable engineering value in the PLC watch table + stable online monitor + unstable HMI display. This fingerprint localizes the fault to the HMI tag path, the HMI update cycle, or the HMI/PLC communication buffer, not the field wiring or analog signal.

Affected Hardware and Topology

Reference configuration from the field report:

• SIMATIC S7-1200 CPU (any 12xx DC/DC/DC or DC/DC/RLY variant with PROFINET interface).
• 2x SM 1231 AI 8x13bit signal modules plugged on the right-side I/O bus.
• 4-20 mA 3-wire level sensors (powered by the SM 1231 sensor supply or by an external 24 VDC loop supply).
• Non-linear scaling in the PLC using a multi-point linearization or a polynomial block matched to the tank strapping table.
• Comfort Panel or Basic Panel HMI on the same PROFINET subnet, polling tags from the PLC.

For module characteristics see the SIMATIC S7-1200 Programmable Controller System Manual and the SM 1231 Analog Input Module Device Manual.

Root Cause Analysis

Five distinct root causes have produced this exact symptom pattern on S7-1200 sites. Eliminate them in the order listed, because #1 is by far the most common in the field and #2 is the second most common.

1. HMI tag overlap on a shared memory area

Most S7-1200 + Comfort Panel integrations poll a marker word (for example MW100) that the application code only partially uses. If any other code path writes a single byte inside the polled range - for example MB101 - the HMI sees a corrupted raw value between writes. The PLC side stays consistent because the analog scaling block reads the source word IW64 directly, not the marker. The HMI sees a corrupted tag.

Diagnostic: place a cross-reference on the polled HMI tag (right-click the tag in the HMI tag table in TIA Portal and select "Cross-reference"). Any write to a byte inside the tag's word is the smoking gun. Move the HMI tag to a dedicated data block (DB) with non-optimized access, or split the polled word into a DInt/Real in a separate DB and read with absolute addressing only.

2. Insufficient analog input filtering

13-bit modules with a fast integration time (3.2 kHz, 6.4 kHz, or above) are very susceptible to mains noise and to the noise of a 24 VDC loop supply switching a 3-wire sensor's output transistor. The PLC monitor will look "stable enough" because the human eye averages visually, but the HMI updates on a fixed cycle and exposes the per-sample variation. Pairing 4-20 mA with a 50 Hz or 60 Hz integration time and increasing the number of averaged values eliminates this without losing update responsiveness.

3. HMI acquisition cycle too fast

A Comfort Panel default acquisition cycle of 1 s is fine, but a 100 ms or 200 ms cycle combined with a non-bursting tag will produce visible jitter. The acquisition cycle must be longer than the PLC's analog update cycle multiplied by 2-3x as a rule of thumb. If the analog value updates every 80 ms, an HMI acquisition of 100 ms will race the analog update and produce intermittent reads.

4. PROFINET cable or switch issue

A marginal PROFINET cable, a switch port in error-disable, or a duplex mismatch will cause the HMI to time out a single read, then read a stale or buffer-overrun value. Check the CPU's PROFINET diagnostic buffer for "Port down", "Link down", and "Station failure" entries. Replace the patch cable, force the port to 100 Mbps full duplex, and disable energy-efficient Ethernet (EEE) on the switch port.

5. Non-linear scaling overflow or NaN propagation

If the non-linear scaling block uses a divide-by-delta-Volume / delta-Height interpolation and the input falls exactly on a table boundary, a divide-by-zero can produce +Inf, -Inf, or NaN in the Real output. NaN propagates as a "random" number on the HMI. Check the scaling block's edge cases and the tank strapping table for duplicate or zero-slope segments.

Diagnostic Procedure

Use this ordered checklist to localize the fault to a single root cause within 10 minutes.

1. Open TIA Portal, connect online to the CPU, and add the analog input word (e.g. IW64) and the scaled engineering value to a watch table. Force a refresh rate of 250 ms.
2. Add the HMI tag (e.g. MW100 or the HMI tag pointing to the DB Real) to the same watch table. Compare the two every 100 ms for 60 seconds. If the source analog value is rock-stable and the marker word flips wildly, the HMI tag is being overwritten by another code path. This is root cause #1.
3. Trigger a trend on the HMI bound to the same tag. If the trend shows #### for the value range, the value is going out of the configured Y-axis. Increase the Y-axis range to cover the full Real range and the tag will display. If the trend still shows #### with the full range, the tag is being read as a different data type than the source.
4. In the SM 1231 device configuration (Properties > Analog inputs > Channels), change the integration time of the affected channel to 50 Hz (or 60 Hz) and set "Smoothing" to "Strong" or use a custom number of averaged values. Observe the HMI for 5 minutes. If the jumps disappear, root cause #2 is confirmed.
5. Set the HMI tag's acquisition cycle to 1 s. If the jumps become less frequent but do not vanish, root cause #3 is the primary contributor.
6. Open the CPU's diagnostic buffer (Online > Online & Diagnostics > Diagnostic buffer). Filter for "Communication" and "PROFINET" events from the last 24 hours. Any "Link down" or "Station failure" entry is root cause #4.
7. In a watch table, monitor the scaled value for at least 30 minutes. If the scaled value ever becomes +NaN, -NaN, or +Inf, root cause #5 is confirmed and the scaling block must be hardened.

Step-by-Step Resolution in TIA Portal V18

Step 1 - Replace shared markers with a dedicated data block

In the project tree, add a new data block (Program blocks > Add new block > Data block). Name it HMI_Interface. Disable "Optimized block access" in the block's properties so the tags can be addressed absolutely from the HMI. Declare the tags needed for the HMI as Real in the static area, for example TankLevel_L at offset 0.0. In your application code, copy the scaled engineering value to "HMI_Interface".TankLevel_L every scan or on a 100 ms cyclic interrupt. Delete the HMI tag pointing to the old marker.

Step 2 - Update the HMI tag list

Open the HMI tag table in TIA Portal. Replace the HMI tag's PLC address with %DB20:0 (where 20 is the DB number of the new HMI_Interface DB and 0 is the byte offset of TankLevel_L). Set the data type to Real. Set the acquisition cycle to 1 s for slow-changing levels. Recompile and download to the HMI.

Step 3 - Reconfigure SM 1231 input filtering

Open Devices & Networks, select the SM 1231 module, and open Properties > Analog inputs. For the channels with the level sensors, set:

• Measurement type: Current (4-20 mA)
• Measuring range: 4-20 mA
• Integration time: 50 Hz (or 60 Hz for 60 Hz mains regions)
• Noise suppression / Smoothing: Strong (or set "Number of values to be averaged" to 10-20)
• Diagnostics: enable "Wire break" (only valid for 4-20 mA)

Compile and download to the CPU. Cycle power on the analog module or run the module's "Reset to factory settings" diagnostic function only if the diagnostic bits are stuck.

Step 4 - Configure the HMI trend properly

Open the HMI screen with the trend. In the trend view's properties, set "Source / Trend request" to the new tag. Set the Y-axis "Upper limit" to the maximum real engineering value (e.g. 5000 L) and "Lower limit" to 0. Set the time axis to show 60 seconds of data. Enable "Show ruler" for diagnostic purposes. The #### marker is removed once the value fits the configured range and the tag type matches.

Step 5 - Add PLC-side bounds checking

In the cyclic interrupt OB or the main OB, before writing the scaled value to the HMI_Interface DB, clamp the value to a known-good range and filter NaN:

IF "HMI_Interface".TankLevel_L < 0.0 THEN
    "HMI_Interface".TankLevel_L := 0.0;
END_IF;
IF "HMI_Interface".TankLevel_L > 5000.0 THEN
    "HMI_Interface".TankLevel_L := 5000.0;
END_IF;
IF NOT_IS_VALID_REAL("HMI_Interface".TankLevel_L) OR "HMI_Interface".TankLevel_L = 0.0 / 0.0 THEN
    "HMI_Interface".TankLevel_L := 0.0;
END_IF;

The NOT_IS_VALID_REAL instruction is available in the S7-1200 extended instructions and returns TRUE for NaN, +Inf, and -Inf. The check guards against NaN propagation that would otherwise produce garbage on the HMI.

Step 6 - Harden the PROFINET port

On the CPU's PROFINET interface (Properties > Ethernet addresses), force the port to 100 Mbps full duplex, disable autonegotiation if the connected device is a known fixed-speed switch, and disable PROFINET energy-efficient features. On the switch, disable EEE (IEEE 802.3az) on the port the HMI and the CPU use. Replace any PROFINET patch cable longer than 80 m with a certified PROFINET cable, or use a fiber media converter for longer runs.

Analog Input Filtering Deep Dive

The SM 1231 AI 8x13bit offers nine integration times that correspond to the A/D converter's oversampling factor. The integration time is set in device configuration per channel group of 4 channels (channels 0-3 share one group, channels 4-7 share a second group on the 8-channel module). The 13-bit value is a signed 16-bit word in the input image, with the upper bits as sign extension.

For tank level on 3-wire 4-20 mA loops, the recommended settings are 50 Hz integration and at least 10 samples averaged. This produces a stable display with a per-channel update period of ~200 ms which is far slower than the HMI's 1 s acquisition, eliminating the racing effect described in root cause #3.

HMI Tag Configuration Best Practices

Three rules eliminate the majority of "value jumping on HMI" cases on S7-1200 / Comfort Panel / Basic Panel integrations.

1. Never point an HMI tag at a marker word that is also written by application code other than the value intended for the HMI. Use a dedicated data block with non-optimized access and write the HMI-facing value in a single location in a known scan. This prevents the byte-level overwrite pattern described in the field report.
2. Match the HMI tag data type to the source data type. If the source is a Real, the HMI tag must be Real. If the source is an Int, the HMI tag must be Int. Mismatches cause the HMI to interpret the bits as the wrong type, producing value changes that look "random".
3. Set the HMI acquisition cycle to 1 s for slow-changing process values. Tank level changes at the rate of fill/drain, which is on the order of seconds to minutes. A 1 s cycle gives 1 sample per second, which is more than enough for the human eye on a level bar.

For panel configuration details see the SIMATIC HMI Panels Comfort Panel Operating Instructions and the TIA Portal help on "HMI tags".

Trend View "####" Diagnosis

The #### string in a Siemens HMI trend view means the value to be displayed exceeds the configured Y-axis range. This is a string of literal hash characters - not a data error. Two cases produce it.

1. The engineering value is outside the trend's configured lower and upper limits. Solution: increase the upper limit to the engineering maximum (e.g. tank full).
2. The HMI tag is connected to a different DB offset than intended, or the data type is mismatched. The HMI interpreter reads a Real as an Int (or vice versa) and the bit pattern decodes to a value out of range. Solution: re-check the tag's address and type in the HMI tag table.

If the value is genuinely above the configured maximum and the HMI should clamp, configure the HMI tag's limits (Properties > Limits) with "Upper limit" set to the engineering maximum and the HMI variable's "Upper limit" behavior set to "Use substitute value" with a sensible fallback.

Verification and Commissioning Checks

Run these checks after applying the resolution, in order.

1. Force a known analog value by applying a precision current calibrator (4.000 mA, 12.000 mA, 20.000 mA) to the affected channel. Verify the engineering value on the HMI matches the expected liters within the calculated sensor error band.
2. Monitor the CPU's diagnostic buffer for 1 hour of normal operation. No "Link down", "Station failure", or "Channel value status invalid" entries should appear.
3. Run the CPU's "Online & Diagnostics > Diagnostics > Analog input status" check for the SM 1231. All channels should report "OK".
4. Leave the HMI running overnight. Capture a trend export and verify that the value trace has no single-sample excursions exceeding the expected tank dynamics.
5. Trigger a CPU STOP/RUN transition. Verify that the HMI recovers automatically and shows the new value within 5 seconds without operator intervention.

Field Commissioning Checklist

Use this checklist during initial commissioning or after a hardware change.

Troubleshooting Matrix

FAQ