KTP1200 Basic HMI: Detecting PLC Communication Loss Without VBS

Second-generation SIMATIC KTP1200 Basic panels (6AV2 123-2MB03-0AX0 and the wider KTP Basic 2nd family) intentionally exclude the VBScript runtime and the Comfort-class scheduler that normally drive PLC life-bit monitoring. The panel still ships the full PROFINET connection stack, the area-pointer engine, and the system-event dispatcher — so the connection can absolutely be evaluated, but the diagnostic path runs through different features than on a TP/Comfort panel. This reference shows the three working methods (System Event 140001, Coordination area pointer, and PLC-driven watchdog tag) and the constraints of each on Basic firmware.

1. Why Basic Panels Constrain the Standard Diagnostic Path

Comfort panels execute a VBScript environment that runs in the background. Typical Comfort code used to monitor the PLC connection looks like this:

' Comfort-panel VBS — NOT supported on Basic panels
If SmartTags("HMI_LifeBit_Heartbeat") = SmartTags("HMI_LifeBit_LastValue") Then
    SmartTags("CommState") = 1   ' connection lost
    SmartTags("LostTime") = SmartTags("LostTime") + 1
End If
SmartTags("HMI_LifeBit_LastValue") = SmartTags("HMI_LifeBit_Heartbeat")

The Basic runtime (WinCC RT for KTP Basic 2nd Generation) omits the scripting host. Per the official SIMATIC HMI HMI devices Basic Panels 2nd Generation operating instructions, the only programmable responses available in the Events tab of a screen object are limited to system functions (SetBit, ResetBit, SetValue, ActivateScreen, UpdateTag, Logoff, StopRuntime, etc.). The job scheduler and global scripts — features relied on by Comfort programmers — are absent on the Basic runtime image.

This forces the engineer to detect a lost connection using only:

• System events raised by the runtime itself (notably 140001 and 140000).
• Area pointer Coordination (the life bit, generated by the HMI for the PLC, but the inverse read is also possible via tag polling).
• PLC-driven watchdog tags that are refreshed by the controller and visibly decay on the screen when the link drops.

2. System Event 140001 — Connection Aborted

The Basic runtime logs a discrete system event the moment a configured connection to a PLC is torn down or fails to be established. The relevant event IDs (decimal) are:

On a Comfort panel, 140001 can be wired in the HMI Alarms > System Events editor to fire a function list that, for example, sets a tag and activates an error screen. On a Basic panel, the supported response in the same editor is restricted to the system function palette. Per the KTP Basic Manual the following functions are available on 140001:

• SetBit / ResetBit on an internal HMI tag
• SetValue on an internal HMI tag
• ActivateScreen (jump to a dedicated "No PLC Communication" screen)
• StopRuntime (use only on safety-relevant panels)

2.1 Wiring the Function on Event 140001

1. In the TIA Portal project tree open HMI Alarms &emdash System Events.
2. Locate event 140001 ("Connection to PLC aborted").
3. Right-click the row and choose Properties > Events > OnAppear.
4. Add the system function SetBit on the HMI-internal tag HMI_Comm_OK = 0 (false).
5. Add a second function ActivateScreen pointing to screen screen_ComLoss.
6. Repeat on event 140000 (OnAppear) and call ResetBit on HMI_Comm_OK and ActivateScreen to screen_Overview.

This is the cleanest method because it is driven by the runtime itself — no PLC cooperation is required. The trade-off is that HMI_Comm_OK only updates when the runtime actually re-evaluates the connection. If the panel is on a switch port that has been administratively shut, the event can take one polling cycle (default 1 s) to arrive.

3. Area Pointer Coordination and the Life Bit

The Coordination area pointer is a fixed bit-mapped word at a configurable address that the HMI updates on every acquisition cycle. The most commonly used bit (bit 0) is the HMI life bit. The PLC reads that bit to detect a dead panel, but the same word can be polled in the opposite direction using an additional tag to detect whether the HMI is still receiving new values from the PLC.

3.1 Configuration in TIA Portal

1. Open the HMI device configuration, select Connections > <PLC> > Area Pointers.
2. Activate Coordination. Assign the PLC tag DB_HMI_Coord.DBW0 (or a flag word such as MW100).
3. Confirm that the acquisition mode is set to Cyclic continuous (the default).
4. Build and download the project.

3.2 Bit Layout of the Coordination Word

Bits 0–7 are written by the panel. The Basic runtime does not itself monitor bits 8–15, so the symmetric watchdog must be implemented as a regular HMI tag polled from the PLC. That tag is the foundation of the next method.

4. Configuring a PLC-Driven Watchdog Tag

The workhorse for Basic panels is a single bit (or a free-running counter) in the PLC that toggles faster than the HMI acquisition cycle. When the HMI stops seeing that value change, the panel's copy of the tag simply freezes, which can be used as a visible dead-link indicator.

4.1 S7-1200 / S7-1500 Ladder Snippet

// OB1 - Cyclic heartbeat from the PLC to the HMI
// Symbol: "HMI_Heartbeat" BOOL, located at %DB20.DBX0.0
// Acquisition cycle on the HMI = 500 ms, so toggle every 250 ms

A   "SysClock_1Hz"           // System clock, 1 Hz, 50 % duty
=   "HMI_Heartbeat"          // BOOL visible to the HMI

For a free-running counter instead of a bit, use the standard IEC timer pattern:

// Counter toggling 0..255, cycle 2.55 s at 100 ms tick
// Symbol: "HMI_Heartbeat_Cnt" BYTE @ %DB20.DBB1

CALL "TON_TIME" , DB_Ton_100ms
      IN  := TRUE
      PT  := T#100ms
      Q   := #pulse

A    #pulse
FP   #edge
JC   incr

incr: L   "HMI_Heartbeat_Cnt"
      +   1
      T   "HMI_Heartbeat_Cnt"
      NOP 0

4.2 HMI-Side Tag Setup

1. Open the HMI tag table and add HMI_Heartbeat (BOOL) or HMI_Heartbeat_Cnt (BYTE). Point it to the matching PLC address (e.g. %DB20.DBX0.0 or %DB20.DBB1).
2. Set Acquisition mode = Cyclic continuous and Acquisition cycle = 500 ms.
3. Create an internal HMI tag HMI_Heartbeat_Last (BOOL or BYTE) of the same type.
4. On a screen, place an animation that compares the two tags.

5. Detecting Loss on the HMI Without Scripts

Because Basic panels do not run a script, the comparison has to be expressed as a single-tag animation that is driven by a small PLC-side dead-band computation. The PLC detects the freeze and writes a dedicated comm_OK bit. The HMI then animates a graphics object (icon, lamp, screen background) off that bit.

5.1 PLC-Side Dead-Band Logic

// DB20 - Heartbeat watchdog
// HMI_Heartbeat_Cnt : BYTE  (live, counter from HMI_Heartbeat_Cnt above)
// HMI_Comm_OK       : BOOL  (true = OK, false = dead)
// t_Watchdog        : TIME  (10 s timeout)

A   "HMI_Heartbeat_Cnt"     // trigger on each new value
   <> "HMI_LastCount"        // did the value change?
=   "edge_new"

// Block: Edge detection + TON (SCL, FB "HMI_LinkWatchdog")
IF "HMI_Heartbeat_Cnt" <> "HMI_LastCount" THEN
    "HMI_Comm_OK" := TRUE;          // link is alive
    "HMI_LastCount" := "HMI_Heartbeat_Cnt";
    "HMI_LinkTimer".TON(IN := FALSE);
ELSE
    "HMI_LinkTimer".TON(IN := TRUE, PT := T#10s);
    IF "HMI_LinkTimer".Q THEN
        "HMI_Comm_OK" := FALSE;     // link declared dead
    END_IF;
END_IF;

Pick the timer preset so that PT > 2 × HMI acquisition cycle — for a 500 ms cycle that means at least T#1.5s, but T#10s is recommended to ride out normal PROFINET reconfiguration after a controller restart.

5.2 HMI Animation Recipe

1. Insert a circle object on the start screen.
2. Open Properties > Appearance > Visibility and bind the expression to {HMI_Comm_OK} = 0 (Basic panels use WinCC flexible-style expression syntax).
3. Bind the Background color of a second lamp to {HMI_Comm_OK}: green for 1, red for 0.
4. Add a text field bound to the same tag, with two text lists ("Connection OK" / "No PLC Communication").

This delivers a clearly visible warning the moment the heartbeat stops moving, without any VBScript.

6. HMI Tag Polling and the Acquisition Cycle

Several of the methods above rely on the HMI acquisition cycle. The KTP Basic 2nd Generation supports cycles between 100 ms and 5 s. Sub-100 ms cycles are not supported; the system silently rounds down. Recommended values:

7. PROFINET Network Prerequisites

For the diagnostics to mean anything the underlying PROFINET connection must be physically and logically healthy. Before commissioning the watchdog logic, verify the following points (per the TIA Portal HMI-to-PLC communication documentation):

1. The HMI and PLC IP addresses are on the same subnet. Default for a KTP1200 Basic is 192.168.0.1, but a static address out of the project range is required for production use.
2. The PROFINET device name is assigned and matches the configured name in the HMI connection editor.
3. The PLC and HMI are online in the same TIA Portal project — TIA will refuse to download a connection to a device whose device name does not match.
4. The S7-1200/S7-1500 Protection settings allow PUT/GET communication from the HMI (CPU properties > Protection > Permit access with PUT/GET). Without this flag the KTP1200 cannot read or write the data blocks that drive the watchdog.
5. Any managed switch between the panel and the CPU forwards LLDP frames — the KTP1200 Basic 2nd Generation uses LLDP for neighbour detection.

8. Verification Procedure After Download

1. Download the PLC project first, then the HMI project. Order matters because the HMI checks partner reachability at startup.
2. Power-cycle the HMI and confirm that the start screen shows HMI_Comm_OK = 1 (green lamp).
3. Disconnect the PROFINET cable at the CPU side. Within two acquisition cycles the green lamp must turn red and the comm-loss screen must appear.
4. Reconnect the cable. Confirm that the lamp returns to green within three acquisition cycles (PROFINET re-establishment + HMI re-sync).
5. Stop the CPU (toggle the S7-1200 mode switch to STOP). The lamp must turn red. Switch back to RUN — the lamp must return to green within 5 s.
6. Open HMI Alarms > System Events in the HMI runtime buffer (Control Panel > System > Event Log) and confirm that event 140001 was raised exactly once during the cable disconnect, and 140000 exactly once on reconnect.

9. Troubleshooting Matrix

10. Field-Proven Caveats

• Firmware V14 vs V15/V16: On V14 the Events tab for system events is hidden by default; you must enable Show all alarms in the toolbar of the HMI Alarms editor. V15 onward shows the Events tab on every line.
• Multiple connections: If the HMI has two PLCs configured, the Coordination area pointer is per connection, but 140001 is a global system event. Check the connection name in the alarm text to disambiguate.
• StopRuntime on 140001: Calling StopRuntime from 140001 will shut the panel down, which is rarely what is wanted on a Basic panel that is the only operator interface for the cell. Prefer ActivateScreen + a sticky comm-loss bit.
• S7-200 / LOGO! compatibility: KTP Basic panels can also connect to S7-200 and LOGO! 8 controllers. The Coordination area pointer is supported, but the watchdog SCL snippet above assumes S7-1200/1500 syntax. Translate the counter block to ladder for the older families.

11. Quick Reference — Recommended Implementation

For a production cell, combine the System Event 140001 path with the PLC-driven watchdog. They cover complementary failure modes: 140001 catches network-level drops (cable, switch, name mismatch) while the watchdog catches a frozen or scan-overrun CPU where PROFINET stays nominally up but the data is stale.

FAQ