Resolving Sticky Button Tag Faults in Siemens WinCC HMI

Problem Statement

On Siemens WinCC HMI projects (WinCC V6, WinCC V7, WinCC Professional / TIA Portal HMI), operators occasionally report that a momentary push button configured as PressLeft = 1 / ReleaseLeft = 0 remains latched at logic 1 after the operator has released the physical key, mouse button, or touch input. The tag continues to drive the downstream PLC logic, and only an operator intervention through the WinCC tag table (right-click → Modify → set to 0) clears the fault.

Symptoms observed in the field:

• Boolean tag (BOOL) shows state 1 on the HMI status line and on the connected PLC input.
• No operator feedback (button is shown released; no alarm is raised).
• Intermittent — the failure rate is typically below 1 in 200 presses, which is why standard bench validation rarely catches it.
• Failure correlates with fast operator keystrokes or mouse drags across multiple buttons.

WinCC Event Model: PressLeft vs ReleaseLeft

Every WinCC button object exposes an event pair that fires on the rising and falling edges of the user's input device. For a mouse or keyboard device:

The critical, easily missed WinCC behavior is that ReleaseLeft is gated by the cursor-inside-button-rectangle test. If the OS-level mouse-up event occurs with the pointer outside the button's hit region, WinCC never dispatches ReleaseLeft to the C/VB action or the direct tag connection. The tag remains at whatever value the PressLeft action wrote.

Root Cause: Off-Object Mouse Release

The dominant root cause is operator mouse handling:

1. Operator presses the left mouse button while the cursor is on the button — PressLeft fires, tag = 1.
2. Operator drags the cursor a few pixels (or several centimetres) off the button before releasing the button.
3. Operating system issues a mouse-up event with the cursor outside the button rectangle.
4. WinCC's hit-test returns false — ReleaseLeft is suppressed.
5. Tag stays at 1 indefinitely until next press or external intervention.

Secondary root causes that produce the same symptom:

• Touchscreen jitter: On 6"–22" panels, a finger swipe can drift the contact point outside the button after the press is registered.
• Keyboard focus loss: Tab navigation to another control between PressLeft and release of Space/Enter orphans the release event.
• Process coupling stalls: If the tag is connected to a slow OPC channel or PROFIBUS/PROFINET update, the WinCC action queue can drop the release event during heavy HMI load.
• PLC-side write protection: The PLC program re-asserts the bit on every cycle (e.g., a self-holding rung), masking the WinCC release write.

SVG: Mouse Event State Machine

Reproduction Test Procedure

Use this 60-second bench test to confirm the hypothesis before changing code:

1. Open the WinCC project in Runtime (or load to a panel).
2. Add a temporary text field I/O field showing the raw value of the suspect tag in binary.
3. Press the button and while holding the mouse button down, drag the cursor at least 20 px away from the button's edge.
4. Release the mouse button while the cursor is still off the button.
5. Observe whether the tag returns to 0. If it does not, the diagnosis is confirmed.
6. Repeat 25 times — the failure rate is typically 5–15% per trial.

Solution 1: SetTagBitWait with Timeout Watchdog

The SetTagBitWait function (WinCC V6.0 SP4 and later, WinCC V7, WinCC Professional) accepts a user-supplied timeout that reasserts the bit to 0 if no matching release arrives. This is the cleanest in-HMI fix and does not require PLC code changes.

Function signature

BOOL SetTagBitWait(Tag TagName, BOOL Value, UINT TimeoutMs);

• TagName — the HMI tag (must be a connected tag, not an internal tag, if the PLC is to see the change).
• Value — 1 on PressLeft, 0 on ReleaseLeft.
• TimeoutMs — the watchdog: WinCC will write the opposite value after this many milliseconds of inactivity.
• Return — TRUE on success, FALSE on tag-error (channel down, address invalid).

C-Action example (WinCC V7)

// PressLeft event
DWORD dwPressStart = 0;
dwPressStart = GetTickCount();
SetTagBitWait("HMI_CMD_Start", TRUE, 1500);   // 1.5 s watchdog

// ReleaseLeft event
SetTagBitWait("HMI_CMD_Start", FALSE, 0);     // 0 = no timeout on release

VB-Action example (WinCC V6)

' PressLeft
SetTagBitWait "HMI_CMD_Start", True, 1500

' ReleaseLeft
SetTagBitWait "HMI_CMD_Start", False, 0

Parameter selection

Solution 2: PLC-Side Bit Reset with TON Timer

The most robust fix moves the watchdog into the PLC where execution is deterministic and survives HMI client crashes, network blips, and orphaned events. The pattern is: HMI sets the bit; PLC holds the bit only as long as the HMI keeps re-asserting it within N seconds.

STEP 7 ladder (S7-300 / S7-400 / S7-1500)

Network 1: HMI request latches
     HMI_CMD_Start (E0.0 / %I0.0)  ----+---( S )--- Q_Start_Held (M100.0)
                                       |
                                       +---( TON )---
                                            IN = E0.0
                                            PT = T#2s
                                            Q = M100.1 (Watchdog_Trip)

Network 2: Auto-reset if no re-assertion within 2 s
     Q_Start_Held (M100.0)  --+--(
                                R )--- Q_Start_Held
                              |
     Watchdog_Trip (M100.1) --+

Network 3: Output to actuator
     Q_Start_Held (M100.0)  --------( )--- Q_Actuator (%Q0.0)

SCL equivalent (TIA Portal S7-1200 / S7-1500)

// FB_HMI_Start - PLC-side watchdog for HMI push button
VAR
  bHMI_Request   : BOOL;   // from HMI tag
  bHeld          : BOOL;   // internal latch
  tonWatchdog    : TON;    // IEC timer
  tWatchdog_PT   : TIME := T#2s;
END_VAR

BEGIN
  IF bHMI_Request THEN
    bHeld := TRUE;
    tonWatchdog(IN := TRUE, PT := tWatchdog_PT);
  ELSIF tonWatchdog.Q THEN
    bHeld := FALSE;
    tonWatchdog(IN := FALSE);
  END_IF;
END_FUNCTION_BLOCK

PLC tag mapping (WinCC ↔ PLC)

Wire PLC_Start_Held back to the WinCC button's background colour so the operator can see when the PLC has dropped the request.

Solution 3: Operator Workflow Discipline

Process changes that materially reduce the off-object release rate:

• Train operators to keep the pointer stationary while clicking — no drag.
• Increase the button's visible hit area by 10–15 px beyond the drawn rectangle. In WinCC this is done by enlarging the object frame (Properties → Geometry → Hit Area) without resizing the visible graphic.
• On touch panels, enable WinCC → Properties → Miscellaneous → Acknowledge on Release.
• Replace fast-finger buttons with toggle/confirm dialogs for infrequent but critical actions.

WinCC v6.0 SP4 Patch and Upgrade Path (KB 25869221)

Siemens has published a cumulative patch for WinCC V6 that includes event-queue corrections. The relevant entry is in the Siemens Industry Online Support: support.industry.siemens.com with ID 25869221. The patch is referenced as WinCC V6.0 SP4 Hotfix — Event dispatch under high load.

Affected versions

Before deploying the hotfix to a running plant, validate on a test project that mimics the production cycle count (recommended > 10,000 simulated events using the WinCC Tag Simulator).

Event Configuration Best Practices

Prefer Click for simple latching

If the button only needs to toggle a bit, use the Click event with a C-Action that flips the current value rather than separate press/release handlers. This eliminates the orphan-release class entirely:

// Click event
BOOL bCurrent = 0;
GetTagBit("HMI_CMD_Start", &bCurrent);
SetTagBit("HMI_CMD_Start", !bCurrent);

Disable visual press-state on momentary buttons

WinCC's default momentary button faceplate will look pressed while the tag is 1. If the HMI design shows a stuck-pressed face, operators tend to assume the system is hung rather than a tag fault. Configure the appearance as flat or as a 200 ms flash on press instead of a latched-down look.

Channel-coupled tags

For S7-1200/1500 connections via S7OPT, ensure the Acquisition cycle is 100 ms or faster and Limit/Max deadband is set to 0 for boolean tags. A non-zero deadband can drop the falling-edge write to the PLC.

Verification and Field Test Procedure

1. With the patch and watchdog applied, restart WinCC Runtime.
2. Open WinCC Tag Management and confirm the suspect tag has Acquisition = 100 ms, Limit = 0.
3. Force the tag to 1 from the WinCC side and verify the PLC bHeld bit goes to 1 within 200 ms.
4. Disconnect the HMI client (simulate orphan) and measure the time until Q_Actuator falls. Expected: TimeoutMs + 1 PLC scan + 1 communication cycle.
5. Reconnect the HMI client and perform 100 button presses, 10 of which intentionally drag off the button. Confirm 100% of releases are recognized.
6. On a Comfort Panel (TP700 / TP1200 / TP1900), repeat the test with finger contact and confirm the same pass rate.
7. Document results in the plant's HMI Validation Log and reference the patch KB ID 25869221.

Extended Diagnostics: Tag State Logging

For intermittent faults that survive the watchdog, enable WinCC Tag Logging on the suspect tag with a 50 ms cycle. Export the resulting CSV after the fault and correlate the timestamp with:

• PLC scan-counter (S7 OB1_CYCLIC bytes 24/25) for dropped events.
• HMI load average (WinCC Performance monitor → WinCC diag counter EventQueueOverflow).
• Network capture (Wireshark on port 102 for S7, port 49152+ for OPC UA) to spot retransmits.

Cross-Platform Notes

Troubleshooting Matrix

FAQ