S7-1200 to KTP400 HMI Connection Status Monitoring via PROFINET

Overview

Monitoring the link between a SIMATIC S7-1200 CPU and a KTP400 Basic Panel over PROFINET is a recurring requirement when an HMI screen must react to a lost PLC connection, alarm windows must remain visible, or an operator must be locked out of an HMI whose controller is unreachable. The SIMATIC KTP400 (2nd generation) integrates as a Basic Panel under TIA Portal and uses S7 Communication or PROFINET IO, so two distinct diagnostic paths exist:

• PLC-side detection — the CPU determines whether the HMI is still polling the controller (Life-Bit, also called a heartbeat or watchdog bit).
• HMI-side detection — the panel determines whether the controller is still reachable (Coordination area pointer, tag quality codes, system events).

Both paths are valid and frequently combined. The approach you choose depends on which side must drive the resulting behavior. If the PLC must hold a process when the HMI disappears, use a Life-Bit in the PLC. If the HMI must change screens, lock input, or keep an alarm banner visible when the PLC disappears, use the Coordination area pointer plus a persistent system alarm display.

Connection Architecture and Diagnostic Paths

The S7-1200 G2 family supports PROFINET communications connections to HMIs in line, star, or ring topologies using the integrated PROFINET interface of the CPU. The S7-1200 G2 HMI-to-PLC communication reference in the TIA documentation set lists the required port assignments, TSAP routing, and connection-resource limits that apply.

Prerequisites

1. Engineering software: TIA Portal V17 or later (V18 or V19 recommended for S7-1200 G2 CPUs). KTP400 Basic PN (2nd generation, 6AV2 124-1DC01-0AX0) requires TIA Portal V14 SP1 or later; current firmware (>= V16) is recommended.
2. PLC firmware: S7-1200 CPU firmware V4.4 or later (V4.5/V4.6 for F-CPUs). S7-1200 G2 CPUs (6AG2 121-1AD25-5XB0, 6AG2 121-1AE25-5XB0, etc.) ship with the PROFINET stack documented in the Siemens Industry Online Support portal.
3. HMI firmware: KTP400 Basic PN image V16.0.0.0 or later so that the Coordination area pointer is exposed as a discrete connection-state flag.
4. Configured connection: An HMI connection in TIA Portal project tree under Devices & Networks > HMI Connection using PROFINET, with the S7-1200 selected as the partner. The S7-1200 G2 reference clarifies the connection-resource table: G2 CPUs support up to 8 PROFINET IO controllers and additional HMI/PG connections through the integrated interface.
5. Tags and DBs: At least one BOOL tag on the PLC (Life-Bit) and one DB or PLC tag for the Coordination pointer to write to.

Method 1: PLC-Side Detection Using a Life-Bit (Heartbeat)

The Life-Bit technique is a tag whose value toggles on a fixed cadence in the PLC scan. The HMI reads it and the PLC, by observing that the HMI has stopped toggling the corresponding return bit, infers that the panel is offline. This is the most common way for the PLC to know whether the HMI is alive because the PLC does not natively expose a per-connection "HMI connected" bit.

Step-by-step implementation

1. Open TIA Portal and the S7-1200 project. Create a Global DB named DB_HMI_LifeBit.
2. Add the following tags:

   // DB_HMI_LifeBit
   TAG     PLC_Heartbeat   : BOOL;   // toggled by PLC OB1
   TAG     HMI_Ack         : BOOL;   // toggled by HMI, mirrored back

3. In OB1 "Main", generate the heartbeat with a 500 ms clock:

   // 500 ms heartbeat, IEC timer
   IF "Clock_500ms" THEN
       "DB_HMI_LifeBit".PLC_Heartbeat := NOT "DB_HMI_LifeBit".PLC_Heartbeat";
   END_IF;

   The clock flag can come from a hardware time-of-day interrupt (OB35 at 500 ms), a hardware pulse generator, or a TON-based pulse generator. For S7-1200 the recommended approach is an OB200/OB35 cyclic interrupt or a hardware-clock OB.
4. Configure the HMI to read PLC_Heartbeat on its Acquisition cycle (250 ms typical) and write the inverse value back to HMI_Ack on the same cycle. In TIA Portal: HMI Tags > [new tag] > Acquisition mode = Cyclic continuous, 250 ms.
5. On the PLC, monitor the elapsed time since PLC_Heartbeat last changed using a TON instance. If the elapsed time exceeds (2 × cycle) + 250 ms grace, declare HMI_Online := FALSE.
6. Use HMI_Online to drive process-level behavior: turn outputs off, freeze valves, latch an alarm, or write to a status DB.

Cadence rules:

• Update rate must be slower than the HMI acquisition cycle; 500 ms PLC toggle against a 250 ms HMI poll guarantees two consecutive reads of the same value if the panel dies.
• Two consecutive equal reads is the canonical "alive loss" detection criterion; one read can be a transient jitter on the Ethernet cable.

Method 2: Coordination Area Pointer (HMI-Side Detection)

The Coordination area pointer is a TIA Portal mechanism in which the HMI writes a byte/word to a PLC data area on each cycle. The byte contains a Coordination field whose bit 0 ("Coordination in operation") is set to 1 as long as the HMI runtime is online and at least one configured connection to the controller is established. When the panel loses its link to the PLC, the panel cannot write to the pointer, so the PLC can read the last latched value to know the HMI is offline; conversely, the HMI tracks connection state through its own runtime tag-quality flags.

For the KTP400 Basic, the Coordination pointer is configured in Devices & Networks > [HMI] > Connections > Area pointers. The pointer is mandatory on Basic Panels.

Step-by-step configuration

1. In TIA Portal project tree, expand the KTP400 device and open Connections.
2. Select the S7 connection to the S7-1200 and click Area pointers.
3. Enable Coordination; assign it to %DB5.DBX0.0 (PLC side). The pointer occupies 1 word in PLC memory.
4. Compile and download to the HMI.
5. On the HMI, use the tag mapped to %DB5.DBW0. The Coordination field is bit 0 of the LOW byte:

// Word layout returned by Coordination pointer
//   bit 0 = Coordination in operation (1 = HMI online, 0 = offline)
//   bit 1 = Coordination change picture in operation
//   bit 2 .. bit 15 = reserved / future use

The HMI can also detect PLC loss through the runtime variable Quality Code of any polled tag. When the connection to the CPU drops, every PLC tag on the panel returns Quality Code = Bad (0x0010) or BadCommunication (0x0014). Use the Quality Code Changed event in TIA Portal to trigger a screen change.

Trigger a screen change on connection loss

1. In HMI screens, create a screen named Screen_ConnectionLost with the message "Connection Lost - PLC Unreachable".
2. Open HMI Events > Connection > [S7 connection] > Quality Code Changed (or use the LifeBit timeout event on a polled PLC tag).
3. Add the ActivateScreen system function with screen number = Screen_ConnectionLost.
4. Set the screen's control elements to disable in the properties; the operator cannot navigate away until the connection is restored (combined with the persistent alarm banner below).

Method 3: Persistent System Alarm Display

By default, the HMI system alarm window appears when a connection error occurs and then closes itself after 3 to 5 seconds, leaving ### placeholders in any I/O field bound to a now-unreachable tag. To keep the window visible for the operator, modify the runtime alarm settings.

Configuration

1. In the TIA Portal project tree, select the KTP400.
2. Open Runtime settings > Alarms > System alarms.
3. Set Display duration = 0 seconds. The system alarm window will then stay on screen until an operator acknowledges it.
4. Set Single acknowledgment or Single-acknowledgment with "Confirm" per site convention.
5. Optionally set Order so the Connection Lost event appears first.

Combining the Three Methods for a Robust Implementation

For an industrial-grade solution, combine all three methods in the following layered architecture:

1. Layer 1 (PLC) — Life-Bit: PLC toggles PLC_Heartbeat every 500 ms. PLC watches HMI_Ack; if no transition for 1.5 s, set HMI_Online := FALSE internally and freeze critical outputs.
2. Layer 2 (HMI) — Coordination Pointer: HMI writes Coordination = 1 to %DB5.DBX0.0. If the panel loses its own connection, the PLC sees the Coordination bit latch at the last value; the panel detects the failure via its own Quality-Code events.
3. Layer 3 (HMI) — Persistent System Alarms: Runtime alarm Display duration = 0 s so the operator always sees the failure banner.
4. Layer 4 (HMI) — Screen Change on Quality Code Changed: Activates the dedicated Screen_ConnectionLost with all input controls disabled.

Code example: combined PLC logic

// OB1 - HMI connection supervision
IF "Clock_500ms" THEN
    "DB_HMI_LifeBit".PLC_Heartbeat := NOT "DB_HMI_LifeBit".PLC_Heartbeat";
END_IF;

// Watchdog: HMI must echo PLC_Heartbeat inverted within 1.5 s
"DB_HMI_LifeBit".HMI_Watchdog(IN := TRUE,
                               PT := T#1.5s);

IF "DB_HMI_LifeBit".HMI_Watchdog.Q THEN
    "DB_HMI_LifeBit".HMI_Online := FALSE;
ELSE
    "DB_HMI_LifeBit".HMI_Online := TRUE;
END_IF;

// Coordination pointer mirror: read DB5.DBW0
"DB_HMI_LifeBit".Coordination_Word := "DB_Coordination".coord_word;

// Combined decision flag
"DB_HMI_LifeBit".Connection_OK := "DB_HMI_LifeBit".HMI_Online
                                   AND ("DB_HMI_LifeBit".Coordination_Word AND 16#0001) > 0;

Verification and Commissioning Steps

1. Download the project to the S7-1200 and the KTP400.
2. Go online with TIA Portal. Watch DB_HMI_LifeBit.PLC_Heartbeat in the watch table — it must toggle every 500 ms.
3. On the HMI, force a connection loss by unplugging the PROFINET patch cord between the CPU and the panel.
4. Confirm within 1.5 s that:

• PLC sets HMI_Online := FALSE.
• The HMI shows the system alarm window and it does NOT auto-close.
• The HMI changes to Screen_ConnectionLost and disables all controls.
• I/O fields show ### placeholders (expected; not a bug).

5. Reconnect the patch cord. Confirm:

• HMI re-acquires tags and clears ### placeholders within the configured reconnection time (default 3 s).
• PLC HMI_Online returns to TRUE within 2 s.
• Operator can acknowledge the system alarm and return to normal screens.

6. Repeat with the panel powered off rather than the cable disconnected, to validate that HMI_Ack stops toggling.

Troubleshooting Matrix

Firmware and Version Notes

• KTP400 Basic PN (1st gen, 6AV2 124-1DC01-0AX0): Compatible with TIA Portal V13 SP1 or later. The Coordination pointer is supported but uses the original 1-word format.
• KTP400 Basic PN (2nd gen, 6AV2 124-1DC01-0AX3): Default firmware V16 supports the documented Coordination pointer layout, and the Quality-Code-Changed event is available on every HMI tag without additional licensing.
• S7-1200 V4.x CPUs: All diagnostic functionality described in this article is available from firmware V4.0; V4.4 or later is recommended for stable PROFINET reconnection after a port bounce.
• S7-1200 G2 CPUs (e.g., CPU 1211G2 DC/DC/DC, 6AG2 121-1AD25-5XB0): Use the connection-resource table documented under S7-1200 G2 HMI-to-PLC communication. G2 firmware preserves a higher number of simultaneous HMI/PG/OPC UA connections than the V4.x series.
• TSAP and routing: When the HMI and PLC sit on the same PROFINET subnet (line topology typical for a single KTP400), default TSAP 03.01 on the CPU is acceptable. For routed connections, the CPU must allow PUT/GET (PLC properties > Protection > Permit access with PUT/GET).

Field-Proven Tips

• Keep the heartbeat cadence slower than the HMI tag acquisition cycle. With a 250 ms HMI cycle, a 500 ms PLC toggle is a safe default.
• Reserve a single DB for all HMI-handshake tags so future audits can find them quickly: DB_HMI_LifeBit.
• Do not rely on the PLC's built-in "HMI connection status" alone; S7-1200 V4.x does not expose a per-connection alive bit. The Life-Bit is the documented, supported technique.
• When adding a second HMI, give each panel its own heartbeat and its own watchdog instance — do not multiplex a single bit across panels.
• For ring topologies (MRP), a topology change is not the same as a panel loss; verify the panel's Quality Code Changed event fires only on real PLC unreachability and not on MRP reconfiguration.