Detecting S7-1500 PLC Stop on Siemens TP1200 Comfort HMI

Overview

When a Siemens TP1200 Comfort Panel is networked with an S7-1500 CPU such as the 6ES7513-1AM02-0AB0 (CPU 1513-1 PN), detecting whether the controller is in RUN, has switched to STOP, or has lost power entirely from the HMI side is not automatic. WinCC Advanced V15 only renders a small connection-interrupted indicator at the bottom of the active screen; it does not pop up an alarm view, change screens, or trigger an audible warning on its own. For most operator-facing panels this is insufficient: a stopped or dead PLC must produce an unmistakable, full-screen alarm within seconds of the event.

This article documents five field-proven methods that close the direction PLC to HMI (i.e., the panel learning the state of the CPU), covering custom heartbeats, the built-in connection error event, the System Diagnostics View control, the S7-1500 System Status List, and WinCC scheduled tasks driving a popup screen. Configuration is shown for TIA Portal V15.1 with WinCC Advanced V15.1 on a TP1200 Comfort (6AV2 124-1MC01-0AX0) talking to a CPU 1513-1 PN. All methods work from TIA V14 SP1 onward unless otherwise noted.

Prerequisites

• PLC: SIMATIC S7-1500 CPU (e.g., 6ES7513-1AM02-0AB0 CPU 1513-1 PN), firmware V2.0 or later. TIA Portal V15 supports S7-1500 firmware V1.8 onward.
• HMI: SIMATIC TP1200 Comfort (6AV2 124-1MC01-0AX0) or other Comfort / Comfort PRO panel running WinCC Advanced V15 (or later) runtime.
• Engineering: TIA Portal V15.1 or V15.5 with matching HSP for CPU firmware; WinCC Advanced is part of the TIA Portal install on a license-bearing engineering station.
• Network: The HMI and PLC must be reachable on the same PROFINET subnet; both devices configured under "Devices & Networks" with an HMI connection of type "S7 connection".
• Firmware compatibility: S7-1500 firmware V2.6 / V2.8 requires TIA Portal V15.1 with the matching HSP. Firmware V2.9 / V2.10 requires TIA V16 or later. TP1200 Comfort firmware V15.x supports TIA V15.1 projects.
• Licensing: WinCC Advanced runtime on a Comfort Panel is included with the panel firmware; no separate runtime license is needed for system diagnostics, alarm logging, or scheduled tasks on TP1200 Comfort.

Before implementing any detection method, confirm the basic HMI connection is healthy: download both projects, watch the HMI's connection status icon turn green at runtime, and verify the PLC's online diagnostics under Online & Diagnostics → Status report no errors. Tag errors in the HMI compile output must be resolved before continuing.

Detection Methods Compared

For most operator-warning use cases, the custom heartbeat (Method 1) or the built-in connection error event (Method 2) is sufficient. Use the System Diagnostics View (Method 3) when you want full event logging with timestamps and acknowledgment. Use SFC 51 (Method 4) when the PLC project must know its own operating mode for interlocking logic, not just the HMI.

Method 1 - PLC Heartbeat (Life Bit) Tag

The heartbeat is a counter or bit in the PLC that toggles continuously while the CPU is in RUN. The HMI reads the tag and raises an alarm if the value stops changing within a defined window. This is the most field-proven and least version-sensitive technique.

Step 1 - Create the heartbeat tag in the PLC

In the S7-1500 project, open a global DB (e.g., DB_HMI_Interface) and create the following members. The DB must have the HMI-accessible attribute set if any optimized-block attribute is in use; non-optimized blocks are accessible by default.

Use DINT instead of INT to avoid wrap-around at 32767 increments. At a 10 ms OB1 cycle the counter reaches INT max in roughly five minutes; DINT reaches the equivalent in just over 24 years.

Step 2 - Drive the heartbeat in OB1

In OB1 (Main), add the following code. The counter increments every scan; the bit toggles via a TON timer. Declare HMI_LifeBit_Toggle as a global TON instance or use the IEC_TIMER block from the "Timers" catalog.

// Free-running counter (DINT)
"DB_HMI_Interface".HMI_Heartbeat := "DB_HMI_Interface".HMI_Heartbeat + 1;

// 500 ms toggle for the life bit
"HMI_LifeBit_Toggle"(
    IN := TRUE,
    PT := T#500ms
);
IF "HMI_LifeBit_Toggle".Q THEN
    "DB_HMI_Interface".HMI_LifeBit := NOT "DB_HMI_Interface".HMI_LifeBit;
END_IF;

Alternative: enable S7-1500 clock memory in the CPU properties under System & Clock Memory. With byte 100 set as the clock byte, bit M101.3 toggles at 0.5 Hz. This requires no user code at all and uses no DB.

Step 3 - Create the HMI tags

In the HMI project, open HMI Tags and add:

Step 4 - Configure a scheduled task to evaluate the heartbeat

Under Scheduled Tasks on the HMI, create a task named PLC_Liveness_Check with cycle 1 minute. In the event, call a VBScript function that:

1. Reads the previously stored counter value.
2. Compares the current value to the previous.
3. Increments a debounce counter if equal; resets it on change.
4. Sets the PLC_Offline_Alarm tag after two consecutive equal reads.

Dim prev, curr
prev = SmartTags("Heartbeat_prev")
curr = SmartTags("Heartbeat_counter")

If curr = prev Then
    SmartTags("PLC_Offline_Counter") = SmartTags("PLC_Offline_Counter") + 1
    If SmartTags("PLC_Offline_Counter") >= 2 Then
        SmartTags("PLC_Offline_Alarm") = True
    End If
Else
    SmartTags("PLC_Offline_Counter") = 0
    SmartTags("PLC_Offline_Alarm") = False
End If

SmartTags("Heartbeat_prev") = curr

Reduce the cycle to 1 second if a faster reaction is required. The trade-off is slightly higher HMI CPU load; TP1200 Comfort handles a 1-second scheduled task with negligible performance impact.

Step 5 - Display a popup screen

On the PLC_Offline_Alarm tag, configure a Value Change event. Add the system function ActivateScreen with the target screen ConnectionLost. The screen contains a red banner, the PLC name, and instructions for the operator ("Check 24 V supply, check PROFINET cable, contact maintenance").

Method 2 - Built-in Connection Error Event

WinCC Advanced already monitors the S7 connection state at runtime. When the connection drops, a system event of class "Connection" is generated. The simplest method requires no PLC code and no tags.

Steps

1. In the TIA Portal HMI project, open the HMI device configuration.
2. Navigate to Runtime Settings → Services.
3. Confirm the system diagnostic service is enabled (default since V14 SP1).
4. The "Errors and warnings" event log populates with entries such as Connection to PLC disrupted and Connection to PLC restored.
5. Add an Alarm View control to the desired screens and bind it to the "Connection" event class.

To fire a popup on connection loss without writing VBScript, attach the ActivateScreen system function to the value-change event of the system's @ConnectionState tag (available from V15.1 onward). For older versions, use Method 1.

Method 3 - System Diagnostic View and @DiagnosticIndicatorTag

@DiagnosticIndicatorTag is a system tag added to the HMI's tag list automatically when you insert a System Diagnostics View or enable system diagnostics. It returns a 16-bit status word with bits that indicate pending diagnostic events.

Steps

1. Drag System Diagnostics View from the toolbox onto a screen.
2. In the control's properties, set the connection to the S7-1500 CPU.
3. The system tag @DiagnosticIndicatorTag appears under "Show all tags" in the HMI tag table.
4. Bind the tag to a Symbolic IO Field or evaluate it in VBScript to drive a status indicator.
5. Optional: bind a Value Change event on the tag to a popup screen.

The System Diagnostics View displays live events including:

• CPU operating mode transitions (RUN → STOP, STOP → RUN, STARTUP).
• PROFINET IO faults and station failure.
• Module diagnostics (channel faults, wire break, short circuit).
• Power events on the CPU / interface modules.

The view updates automatically and does not require a custom heartbeat. Operator acknowledgment can be enabled or disabled per the application's needs.

Method 4 - PLC Operating Mode from S7-1500 System Status List

There is no TIA area pointer that exposes the CPU's current operating mode in the direction PLC → HMI for read-only access. However, the S7-1500 exposes the operating mode through the System Status List (SSL). Read it in the PLC and expose it as a regular HMI tag.

Step 1 - Use SFC 51 to read SSL partial list 0x0121

In OB1 (or a cyclic OB such as OB30 at 100 ms), call SFC 51 "RDSYSST" with:

• SSL_ID = W#16#0121 (CPU status information)
• INDEX = W#16#0000
• SZL_HEADER and DR pointing to a DB of sufficient length (at least 34 bytes)

// Call SFC 51 once per second via rising edge
"Clock_1Hz"(CLK := "Clock_Memory_1Hz", RETAIN := FALSE);
IF "Clock_1Hz".Q THEN
    "DB_Status".Busy := TRUE;
    "RDSYSST_DB"(REQ := TRUE,
                 SSL_ID := W#16#0121,
                 INDEX := W#16#0000,
                 SZL_HEADER := "DB_Status".SSL_Header,
                 DR := "DB_Status".SSL_DR,
                 BUSY => "DB_Status".Busy,
                 DONE => "DB_Status".Done,
                 ERROR => "DB_Status".Error);
    IF "DB_Status".Done AND NOT "DB_Status".Error THEN
        // First data record byte = operating mode
        "DB_Status".OperatingMode := "DB_Status".SSL_DR[0];
    END_IF;
END_IF;

Operating mode byte values:

Step 2 - Expose as HMI tag

Map the OperatingMode byte to the HMI tag table as a USINT. On the HMI side, evaluate the value with VBScript and update a Symbolic IO Field showing "RUN" / "STOP" / "STARTUP" or drive a colored status bar.

Alternative - Use T_DIAG for PROFINET connection diagnostics

For PROFINET connection diagnostics, the S7-1500 instruction library includes T_DIAG. Use it when the HMI may itself be the cause of the connection failure (e.g., panel frozen) rather than the PLC.

"iGet_Connection_Status_DB".REQ := "Clock_1Hz";
"iGet_Connection_Status_DB".CONNECTION_ID := 1;
"iGet_Connection_Status_DB".STATUS := "DB_Status".Connection_Status_Word;

Refer to the SIMATIC S7-1500 Automation System system manual for the exact status word layout of T_DIAG.

Method 5 - WinCC Scheduled Tasks and Popup Logic

This is the display mechanism used after any of the detection methods above. For low-latency detection, bind a Value Change event directly to the heartbeat counter tag rather than relying solely on a scheduled task.

Scheduled-task configuration

1. Open Scheduled Tasks on the HMI.
2. Create a new task named PLC_Monitoring.
3. Set the cycle to 1 second (or shorter).
4. In the event, add a VBScript function that reads the heartbeat and either does nothing or calls ActivateScreen.

Tag change event

For sub-second reaction, also bind a Change Value event to the Heartbeat_counter tag. Inside the event, check that the counter has incremented and call ActivateScreen if not. The combined approach gives you redundant detection paths.

Step-by-Step Implementation Guide

The following ordered procedure combines Methods 1 and 2 for the recommended production setup.

Phase 1 - PLC Configuration

1. Open the S7-1500 project in TIA Portal V15.x.
2. Create a new global DB DB_HMI_Interface with: HMI_Heartbeat (DINT, start 0), HMI_LifeBit (BOOL, start FALSE). Tick "Accessible from HMI" if the DB is optimized.
3. In OB1, add a TON timer HMI_LifeBit_Toggle with PT = T#500ms. Toggle the BOOL on each Q edge.
4. Increment HMI_Heartbeat each OB1 cycle.
5. Compile and download to the CPU. Verify in the watch table that the BOOL toggles and the INT/DINT increments.

Phase 2 - HMI Tag Configuration

1. Open the TP1200 Comfort project.
2. Add a connection of type "S7 connection" pointing to the CPU 1513 if not already present. Note the connection ID for Method 4.
3. Under HMI Tags, add: Heartbeat_counter → DB_HMI_Interface.HMI_Heartbeat (DINT), 500 ms cycle; HMI_LifeBit → DB_HMI_Interface.HMI_LifeBit (BOOL), 250 ms cycle.
4. Add internal tags: PLC_Offline_Alarm (BOOL), PLC_Offline_Counter (INT), Heartbeat_prev (DINT).
5. Compile the HMI project. Resolve any tag errors before continuing.

Phase 3 - HMI Logic

1. Create a VBScript function CheckPLCConnection with the code shown in Method 1.
2. Add a scheduled task PLC_Monitoring with 1-second cycle calling this function.
3. Optionally, add a Value Change event on Heartbeat_counter that calls the same function directly.

Phase 4 - Popup Screen

1. Create screen ConnectionLost.
2. Add a text field reading "PLC Connection Lost - Check CPU 1513".
3. Add a button "Acknowledge" with the system function SetBit to PLC_Offline_Alarm_Ack.
4. In PLC_Offline_Alarm tag's Change Value event, call ActivateScreen → ConnectionLost.

Phase 5 - Verification

1. Download both PLC and HMI programs.
2. Switch PLC to RUN. Verify the heartbeat counter increments in the watch table and on the HMI.
3. Switch PLC to STOP via the programming device. Confirm the ConnectionLost screen appears within one scheduled-task cycle plus debounce.
4. Pull the PROFINET cable. Confirm same behavior with the "Connection disrupted" system event also firing.
5. Power off the PLC. Confirm the HMI raises both the system event and the heartbeat-based alarm.
6. Restore RUN. Verify the screen clears automatically on the next counter change.

Verification Procedures

To shorten detection time below the 1-second scheduled-task cycle, use a 100 ms acquisition cycle on the heartbeat tag and a 100 ms scheduled task. Detection latency drops to roughly 200-300 ms. Trade-off: more HMI panel CPU load. TP1200 Comfort handles a 100 ms cycle with up to 200 polled tags without measurable slowdown.

Troubleshooting Matrix

For S7-1500 communication details, refer to the SIMATIC S7-1500 Communication function manual. For Comfort Panel runtime limits and tag counts, refer to the SIMATIC HMI Devices Comfort Panels operating instructions.