KTP900 Basic HMI Activity Timeout Using Screen Number Pointer

Problem Definition and Goal

SIMATIC HMI panels - including the KTP900 Basic - do not expose a single public "screen touched" boolean that engineering code on the controller can read. The runtime internally tracks user activity to dim the backlight, drive the screensaver, and enforce user-administration logoff timers, but those internal values are not published as a system bit or system tag. Consequently, applications that want to "return to the root screen after N minutes of operator inactivity" cannot poll a dedicated signal. The activity must be reconstructed from data the panel does publish.

For the KTP900 Basic driven by TIA Portal V15.1 and WinCC Advanced, the cleanest deterministic signal is the Screen Number area pointer. Word 4 of the 5-word pointer is the current field number - the index of the I/O field, button, or symbolic field that most recently received focus on the active screen. By comparing that word to its previous value inside the PLC, every operator touch (and every screen change) generates a single-cycle edge. A TON timer driven by that edge becomes the inactivity watchdog, and an HMI tag bound to the timer output fires the ActivateScreen event for the root screen.

The procedure below assumes an S7-1200 (or S7-1500) controller on PROFINET, a KTP900 Basic PN panel (article number 6AV2 123-1MB03-0AX0), TIA Portal V15.1 Update 4 or later with WinCC Advanced V15.1, and panel firmware image V15.x. Variations for S7-300/400 controllers, PROFIBUS, or older TIA releases are noted where parameter assignment diverges.

KTP900 Basic Hardware Profile

The "not supported" entry for scripts is the central constraint of this article: a Basic Panel cannot run VBS, C, or JavaScript behind an event, so any inactivity watchdog has to live on the controller side and use the limited public data interface between PLC and HMI.

Why the HMI Has No Native "In-Use" Bit

Three different activity signals exist in WinCC but none of them is a single system bit reachable from the PLC:

1. Backlight / screensaver timer - configured per panel under Runtime Settings > Screen saver. The value is held internally; it cannot be read out, and it is not propagated to the controller.
2. User-administration logoff timer - configured per user group. When the timeout elapses, the panel fires an internal "user changed" event and logs the current user out. The new (empty) user name is readable in the User View area pointer, but the timestamp is not. There is also no event that fires before the logoff to give the controller advance warning.
3. Touch / key event log - logged in the alarm buffer only when explicitly enabled, and not available as a tag for cyclic polling.

The only deterministic, PLC-side read of operator activity is therefore the Screen Number area pointer, which the panel refreshes every acquisition cycle. Because the pointer holds both the screen number and the focused-field number, a single area pointer provides enough information to derive an activity edge.

Screen Number Area Pointer Layout

The Screen Number area pointer occupies five consecutive 16-bit words starting at the configured DB / MW address. The word layout is fixed by WinCC and cannot be reordered:

Word 4 changes whenever the operator taps any input-capable element or when a screen change occurs (because the field-number sequence restarts on the new screen). It is therefore a strictly monotonic activity indicator from the controller's perspective: if Word 4 is the same this scan as it was last scan, the operator did nothing in between.

Prerequisites and Project Setup

• TIA Portal V15.1 Update 4 or newer with WinCC Advanced V15.1 installed.
• S7-1200 firmware V4.2 or newer, or S7-1500 firmware V1.8 or newer. The IEC timers used below (TON, CTU) require at least S7-1200 V4.0.
• KTP900 Basic PN, article number 6AV2 123-1MB03-0AX0, firmware V15.1. A mismatch between project firmware and panel firmware prevents download.
• Configured HMI connection in the project tree under HMI > Connections, bound to the S7-1200 PROFINET interface. Without a configured connection the area pointer cannot be assigned.
• An HMI tag of BOOL type that the controller will set when timeout elapses; the tag's Value Change event must trigger ActivateScreen > RootScreen.
• A globally unique DB on the controller (e.g. DB_HMI_Activity) with the tags listed in the next section.

HMI and PLC Tag Configuration

Step 1 - Enable the Screen Number area pointer

1. In the project tree, open HMI_1 [KTP900 Basic] > Connections and double-click the S7-1200 connection.
2. In the connection editor, switch to Area pointers.
3. Tick Screen number. The default length is fixed at 5 words; the offset and DB address are user-configurable.
4. Assign the pointer to DB_HMI_Activity.ScrnPtr, declared as ARRAY[0..4] OF WORD. A separate start address in MW memory works equally well but reduces symbol clarity.

Step 2 - Declare PLC-side tags

Create a globally accessible DB with the following tags. All tags except the pointer are user-defined; the pointer is the area pointer you assigned above.

Step 3 - Create the HMI "GoHome" tag

1. In HMI Tags, add a new BOOL tag named GoHome connected to DB_HMI_Activity.bReturnToRoot.
2. Open the tag's Properties > Events and add Value change.
3. Set the function list to ActivateScreen and choose RootScreen. Only one function can be configured per value-change event on a Basic Panel.
4. Open Properties > Settings on the same tag and set Acquisition mode to Cyclic continuous with Acquisition cycle = 100 ms. This is the fastest cycle WinCC Advanced allows for an HMI tag and is what guarantees the area pointer refresh matches the controller scan.

Ladder Logic for Activity Timeout

The core of the application is four networks in OB1 (or a cyclic OB of appropriate priority). The example uses IEC timers and a positive-edge flag. Equivalent SCL is shown at the end of the section.

Network 1 - Mirror the pointer and compute the activity edge

// Mirror current field number from area pointer
L     DB_HMI_Activity.ScrnPtr[4]          // Word 4 = current field number
T     DB_HMI_Activity.CurrFieldNo        // Keep for diagnosis

Network 2 - Edge when the field number changes

A(                                      // Compare current vs stored
L     DB_HMI_Activity.ScrnPtr[4]         // Word 4 - current field number
L     DB_HMI_Activity.OldFieldNo         // Word 4 - previous scan value
<>I                                    // TRUE if different
)
FP                                    // Test positive edge
JCN   NOACT                              // Skip the set if no edge

SET
S     DB_HMI_Activity.EdgeActivity       // Single-scan pulse
L     DB_HMI_Activity.ScrnPtr[4]
T     DB_HMI_Activity.OldFieldNo         // Update stored value
JU    END1

NOACT:                                  // No edge this scan
CLR
=     DB_HMI_Activity.EdgeActivity       // Keep coil FALSE

END1: NOP 0

Network 3 - TON watchdog with auto-reset on activity

// Reset the timer on every activity edge
A     DB_HMI_Activity.EdgeActivity
R     DB_HMI_Activity.TON_Inactivity      // Reset IEC timer instance

// Drive the timer continuously
A     TRUE
L     DB_HMI_Activity.TimeoutPreset       // E.g. T#10m from HMI
SD    DB_HMI_Activity.TON_Inactivity      // Start as on-delay

Network 4 - Trigger return-to-root and self-clear

A     DB_HMI_Activity.TON_Inactivity.Q    // Q = TRUE when PT elapsed
S     DB_HMI_Activity.bReturnToRoot       // Pulse the HMI GoHome tag

// Auto-clear so next value-change event can re-fire
A     DB_HMI_Activity.bReturnToRoot
L     T#200ms
SD    T_PulseClear                         // Short off-delay
A     T_PulseClear.Q
R     DB_HMI_Activity.bReturnToRoot        // Reset ~200 ms after set

The same logic in SCL form, for projects that prefer structured text:

IF DB_HMI_Activity.ScrnPtr[4] <> DB_HMI_Activity.OldFieldNo THEN
    DB_HMI_Activity.OldFieldNo := DB_HMI_Activity.ScrnPtr[4];
    DB_HMI_Activity.EdgeActivity := TRUE;
ELSE
    DB_HMI_Activity.EdgeActivity := FALSE;
END_IF;

IF DB_HMI_Activity.EdgeActivity THEN
    "TON_Inactivity"(IN := FALSE, PT := DB_HMI_Activity.TimeoutPreset);
END_IF;

"TON_Inactivity"(IN := TRUE, PT := DB_HMI_Activity.TimeoutPreset);

IF "TON_Inactivity".Q THEN
    DB_HMI_Activity.bReturnToRoot := TRUE;
    "T_PulseClear"(IN := TRUE, PT := T#200ms);
END_IF;
IF "T_PulseClear".Q THEN
    DB_HMI_Activity.bReturnToRoot := FALSE;
END_IF;

Acquisition Cycle and Timing Considerations

The responsiveness of the watchdog is bounded by three independent cycles that must be aligned:

The combined worst-case detection latency is therefore tag cycle + 1 PLC cycle, i.e. ~120 ms - well below any human-perceptible delay. The TON preset is the only value that should be left editable from the HMI for an operator-facing application; expose it through an I/O field bound to TimeoutPreset and add a bounds check (e.g. 30 s <= t <= 60 min) before writing it back to the DB.

Basic Panel Edge Cases

Because the KTP900 Basic cannot run scripts, several edge cases that Comfort Panel or Runtime Advanced users take for granted must be handled explicitly in the controller:

The cleanest production pattern is to gate the TON with an enabled BOOL: only count time when the operator is on a screen that should auto-return. Whitelist screens by their number in a small constant list, or invert the logic and freeze the timer whenever the current screen is a "long-view" screen (alarm / trend / recipe).

Alternative via User Administration Auto-Logoff

For applications where operator identity matters - GMP, FDA, or any audited environment - the user administration feature on the KTP900 Basic is more appropriate than a generic watchdog. Configure Automatic logoff after in the user group properties (typically 5 - 30 minutes). At expiry the panel clears the user name; the change is observable in the User View area pointer (5 words, similar layout to Screen Number):

Monitor Word 0 in the controller; when it transitions from non-zero to 0, fire the same GoHome tag. This approach is auditable, survives screen-less interactions, and matches the documented behavior of the panel.

Drawback: the controller cannot know how much time remains before the logoff, so it cannot warn the operator. A common hybrid is to run both - the watchdog returns to the root screen after, say, 9 minutes, and the user-administration logoff fires at 10 minutes, with the audit log recording both events.

Verification Procedure

1. Download the project to the PLC and the HMI. Use a watch table on DB_HMI_Activity with the pointer visible to confirm Word 4 is changing on every operator tap.
2. Open the root screen and start the HMI runtime. Touch any button - the pointer's Word 4 should change within one acquisition cycle (100 ms). The EdgeActivity tag should pulse TRUE for a single OB1 cycle.
3. Set TimeoutPreset to a short value (e.g. T#30s) for the test. Leave the panel untouched. After 30 s the panel should switch to the root screen automatically.
4. Restore TimeoutPreset to the desired production value (T#10m is typical for operator-facing HMI; T#2m for safety-relevant HMIs).
5. Open a recipe screen and confirm the watchdog freezes there (if you implemented the whitelist). Tap any field - the watchdog should remain frozen if the field is on the long-view screen, unless you opted to allow it.
6. Verify that pressing the manual Home button on every screen also navigates to the root screen - the watchdog should not interfere with explicit navigation. Test by tapping the button and confirming the root screen appears immediately and that the watchdog timer resets.

Troubleshooting Matrix

Frequently Asked Questions