Setting and Resetting S7-1200 DB Bits from HMI and PLC

Problem Statement: The "Stuck ON" Bit

A common integration issue when a SIMATIC S7-1200 PLC is connected to an external system is the "stuck ON" handshake bit. The engineer writes a boolean to DB100.DBX10.0 from ladder logic, and an external client (a Visual Basic/.NET application, a WinCC HMI tag, an OPC UA subscriber, or a Modbus master) later tries to reset the same bit. The bit stays latched, the external system reports "command rejected" or "access denied," and the user concludes that the PLC is "ignoring" the reset. In reality, the PLC is faithfully executing the ladder rung every cycle, and as long as the rung's input condition is TRUE, the assignment coil (( )) re-asserts the bit before the external reset can take effect.

The fault mirrors the classic motor start/stop pattern from relay logic: a Start pushbutton (NO) wired in parallel with a Run contact holds the motor on after the button is released. In ladder logic, the assignment coil behaves like a Run contact wired directly to the output — the coil re-energises the bit on every scan, so no external instruction can ever turn it off. The fix is the same one used in relay logic: a Set coil ((S)) latches the bit only on a signal transition, and a separate Reset coil ((R)) — driven from a different rung, a different code block, or by HMI/VB code — releases the latch.

This article covers three production-ready techniques for solving the problem on a SIMATIC S7-1200 programmed in TIA Portal:

1. Positive or negative edge detection plus Set/Reset coils (recommended default).
2. Direct MOVE of 0 (or a mask) to the parent byte or word.
3. Two mutually exclusive bits (Start/Stop handshake) for cell-level communication.

Each technique is shown in Ladder (LAD), Function Block Diagram (FBD), and Structured Control Language (SCL) so the same logic can be dropped into an existing project without translation.

Root Cause: PLC Scan Cycle and Latching Behaviour

To understand why the bit will not release, you have to know the order the CPU executes your program in. On a SIMATIC S7-1200 (CPU firmware V4.0 and later), the OB1 main cycle reads inputs into the Process Image Input (PII), executes the user program from top to bottom in the order shown in the project tree, writes the results to the Process Image Output (PIQ), and only then updates the physical outputs. The cycle time is shown in the CPU's online diagnostics under "Cycle time," and typical values for a CPU 1214C/DC/DC/DC with a small program are 1–4 ms. A CPU 1215C or 1217C will be similar. A larger program or more I/O will push the cycle time toward the CPU's maximum monitored time (default 150 ms for a standard CPU).

Consider the following "bad" rung, which mimics the original symptom:

   M0.1                       M0.2
|----[/]-------------------( )---------------|
   "PLC wants VB action"    "Output_to_VB"

What happens at scan N:

1. Inputs are read. M0.1 is TRUE.
2. Rung evaluates. The NC contact is closed, so the assignment coil energises and sets M0.2.
3. VB code (running on a separate thread, or an HMI tag triggered by change-of-state) issues a Reset to M0.2.
4. At scan N+1, the ladder rung runs again. M0.1 is still TRUE, so the assignment coil re-asserts M0.2 within 1–4 ms.

The external reset did clear the bit, but the next scan restored it. From the VB application's point of view, the reset is "ignored." From the PLC's point of view, the program is doing exactly what it was told.

The HMI/PLC handshake problem is amplified when the HMI runs asynchronously. WinCC Comfort/Advanced and most third-party HMIs poll the PLC at 100–1000 ms, while a VB/.NET application using the S7comm, libnodave, S7net, or Snap7 driver typically polls at 50–200 ms. Both intervals are much longer than the PLC scan time, so the visible result is "the PLC bit comes back almost immediately after the HMI clears it." This is the diagnostic that points directly at the ladder logic, not at the network or the driver.

Bit Addressing in S7 Data Blocks

Before writing the fix, you need a firm grip on the three (or four) addressing modes that share the same physical memory location in a Data Block.

The byte offset is the index of the first byte the type occupies. DBW10 therefore covers bytes 10 and 11, and DBD10 covers bytes 10, 11, 12, and 13. TIA Portal displays this overlap graphically in the DB editor and rejects writes that would misalign a multi-byte type on an odd boundary.

The original failing bit, DB100.DBX10.0, is bit 0 of byte 10. The user attempted to "move a 0 into DB100.DBB10" to clear it. That is a legitimate instruction and is covered in Solution 2, but it has a side effect: it also clears bits DBX10.1 through DBX10.7 at the same time. For a handshake tag that occupies the entire byte, that is fine. For a byte shared with other status flags, it is a hidden bug.

Solution 1: Edge Detection Plus Set/Reset Coils (Recommended)

The textbook fix replaces the assignment coil with a positive or negative edge detector feeding a Set coil. The bit is now written only on the rising or falling edge of the input condition; subsequent scans leave it alone, and an external Reset coil (in another network, another block, or the HMI) can clear it at any time.

LAD (Ladder) implementation

Network 1 — Latch on falling edge of M0.1
  M0.1          M_edge1         "Output_to_VB_latch"
|----[/]--------|(P)------------(S)----------------------------|
   "PLC wants   "Edge of         DB100.DBX10.0
    VB action"  M0.1 (falling)"

Network 2 — External reset (HMI, VB, OPC UA)
  "HMI_Reset"             "Output_to_VB_latch"
|----[ ]------------------(R)------------------------------------|
   DB100.DBX20.0          DB100.DBX10.0

Network 3 — Mirror for diagnostics
  "Output_to_VB_latch"     "Output_to_VB_mirror"
|---[ ]----------------------( )----------------------------------|
   DB100.DBX10.0            DB100.DBX10.1

Network 1 latches Output_to_VB_latch on the falling edge of PLC_wants_VB_action — i.e., when the PLC request goes FALSE. Network 2 unconditionally clears the bit when the HMI issues a Reset. Because the Set coil in Network 1 only fires once per transition, the bit is "available" to be reset at any point after that. Network 3 publishes a mirrored copy of the latched bit in a separate address so the HMI can display it without polling the control bit itself.

FBD (Function Block Diagram) implementation

PLC_wants_VB_action --|/|--[P-edge]--(S)-- Output_to_VB_latch
                                         |
                                         +-- ( )-- Output_to_VB_mirror
HMI_Reset -------------------------------(R)-- Output_to_VB_latch

FBD places the edge detector as an inline block. The output of the P-edge box is the momentary TRUE that drives the Set coil. The optional Q output of the Set/Reset box is described in the official S7-1200 manual collection: Set and reset instructions.

SCL (Structured Control Language) implementation

// Detect falling edge of PLC_wants_VB_action
IF "PLC_wants_VB_action" = FALSE AND "PLC_wants_VB_action_old" = TRUE THEN
    "Output_to_VB_latch" := TRUE;
END_IF;
"PLC_wants_VB_action_old" := "PLC_wants_VB_action";

// External reset (HMI, VB, OPC UA)
IF "HMI_Reset" THEN
    "Output_to_VB_latch" := FALSE;
END_IF;

// Mirror for diagnostics
"Output_to_VB_mirror" := "Output_to_VB_latch";

SCL does not have a built-in P-edge instruction, so the edge is built from the comparison of the current value against the previous-cycle value. The previous-cycle value must be declared in a static area (FB instance DB) or in a separate global flag DB so it survives across OB1 scans. If the previous-cycle value is declared in TEMP (a temporary local), it will be re-initialised to 0 on every scan and the edge detector will fire on every cycle.

Why a negative edge instead of a positive edge?

The original problem statement uses an NC contact on M0.1 as the trigger — the bit is normally TRUE and goes FALSE to request action. A negative edge (N-edge, falling edge) is the correct edge to detect in that case. If your trigger is the opposite — a bit that goes TRUE to request action — use a positive edge (P-edge, rising edge) on a NO contact instead. TIA Portal exposes both edges as the P and N contact/box symbols in the bit-logic toolbox.

Optional: output Q on the Set/Reset box

The TIA Portal Set/Reset instruction lets you wire an INOUT tag (the bit that is set or reset) and an optional output Q that mirrors the current signal state of the INOUT address. Q is useful for diagnostics: it lets you evaluate the latched value in the same network that does the latching without re-reading the bit from the DB, and it can be wired directly to other logic in the same network. The official description in the S7-1200 manual collection states: "The INOUT tag assigns the bit address that is set or reset. The optional output Q follows the signal state of the INOUT address." See Set and reset instructions (S7-1200 manual) for the full parameter list, including the SR (set priority) and RS (reset priority) flip-flop variants.

Solution 2: Direct Bit, Byte, or Word Moves

If the entire byte is dedicated to the handshake tag, you can clear it with a single MOVE instruction. The instruction is simpler than edge detection, but it has no built-in latch — the byte stays at 0 only until the next ladder scan re-asserts it. Use this method when the trigger is a momentary event (one-shot from the HMI, an alarm acknowledgement, a recipe step complete) rather than a level signal.

Clearing the parent byte

  "HMI_Reset"            "PLC_wants_VB_action"
|---[ ]-------------------( MOVE )------------------------|
                       IN:  0   OUT: %DB100.DBB10

A MOVE box with IN = 0 and OUT = DB100.DBB10 writes 0x00 to the entire byte. The bit at DBX10.0 goes to 0, and so do the other seven bits. If those bits are in use (e.g., DBX10.1 = "VB action complete"), the MOVE will silently clear them too — that is the bug to watch for.

Clearing the parent word

  "HMI_Reset"            "PLC_wants_VB_action"
|---[ ]-------------------( MOVE )------------------------|
                       IN:  0   OUT: %DB100.DBW10

MOVE to DBW10 clears 16 bits at once. Useful for handshake tags that occupy a packed status word (e.g., one bit per device on a multi-drop RS-485 link). Dangerous if other bits in the word are diagnostic flags you do not want to wipe.

Setting multiple bits with one move

To set several bits at known positions, build the mask in a constant and MOVE it in. For example, to set bits 2 and 4 of MB10, the mask is 2^2 + 2^4 = 4 + 16 = 20 (decimal) or 0x14 (hex). The MOVE box is then IN = 20, OUT = MB10. To set bits 0, 2, and 7, the mask is 1 + 4 + 128 = 133 (decimal) or 0x85 (hex).

For the original failing pattern, MOVE 0 to the parent byte works, but it is only a momentary fix unless the ladder rung above has been changed to a Set coil. The PLC will re-assert the bit on the next scan if the rung's input condition is still TRUE.

Solution 3: Mutually Exclusive Start/Stop Bits

The two-bit handshake is the most explicit solution and the easiest to read in a code review. Two bits are used, never at the same time: bit A means "PLC has work for the external system" and bit B means "external system has finished." When the external system is done, it sets B; the PLC sees B, clears A, and the cycle restarts.

LAD pattern

Network 1 — PLC sets request, external clears request
  "PLC_wants_action"    "Ext_done"            "PLC_wants_action"
|---[ ]------------------[/]-------------------(R)---------------|

Network 2 — External sets done, PLC resets done
  "Ext_done"            "PLC_wants_action"    "Ext_done"
|---[ ]------------------[/]-------------------(S)---------------|

Network 3 — Mutual exclusion and heartbeat
  "Ext_done"            "PLC_wants_action"
|---[ ]------------------[ ]-------------------( MOVE 0 to MB20 )

Each bit has its own Set and Reset coil, and the two bits are wired so that setting one immediately resets the other. The risk of a "stuck ON" bit is structurally impossible because there is no continuous assignment coil anywhere in the rung.

Why this is sometimes preferred

Two-bit handshakes survive PLC-to-PLC communication over PROFINET, EtherNet/IP, or Modbus TCP without surprises, because every transition is explicit. The downside is that you double your tag count, and the "mutual exclusion" wiring is verbose. For a single motor start/stop it is overkill; for a cell controller talking to ten robots, an AS-i master, or a vision system, it is the standard pattern used in industry for decades.

Cross-Platform Reset: HMI, VB, OPC UA, Modbus

Once the PLC side is using a Set/Reset coil, the external system needs to issue a Reset the same way the PLC would: write 0 to the bit. Different transports have different mechanics.

WinCC / TIA Portal HMI

Wire the HMI button's "Press" event to the PLC tag's "SetValue" property with a value of 0 (not 1). In the HMI tag configuration in TIA Portal, open the tag's properties, switch to the "Events" tab, and bind the "Press" event of the button to a PLC tag write of 0. Alternatively, use the "InvertBit" function on a momentary button to toggle the bit from both sides, but only on a button with the "Momentary" press/release mode so the toggle is intentional.

WinCC Unified / OPC UA

An OPC UA client writes the Boolean value false to the node ns=4;s=|var|DATA_BLOCK_100.Output_to_VB_latch (or whatever the DB is named in the S7-1200 OPC UA server). The PLC sees the write, the assignment in the next scan reads the new value, and the Set coil is no longer active so the bit stays at 0. The S7-1200 OPC UA server is enabled in the CPU's properties under "OPC UA Server" and exposes each global DB as a folder of nodes.

libnodave / S7net / Snap7 (VB / .NET / Python)

These libraries expose a WriteBit(DBNumber, ByteOffset, BitOffset, value) method. The library call is synchronous from the application's point of view but, like the HMI write, is asynchronous relative to the PLC scan. As long as the PLC has been changed to a Set/Reset coil, the bit will stay at 0 after the write.

// C# example using S7net
plc.WriteBit(DataType.DataBlock, 100, 10, 0, false);

// Python example using python-snap7
client.db_write(100, 10, bytearray([0x00]))   # clears entire byte
client.db_write(100, 10, bytearray([0xFE]))   # clears bit 0 only

Modbus TCP / Modbus RTU

Map the DBX bit into a holding register or a coil. For example, with DB100.DBW10 mapped to Modbus register 40011 (offset 10), a Modbus master can write a single register with value 0xFFFE (all bits 1 except bit 0) to clear just the handshake bit, or value 0x0000 to clear the whole word. If you need bit-level precision, use function code 0x06 (write single register) with a precomputed mask rather than 0x05 (write single coil), because 0x05 on a Siemens gateway is sometimes silently remapped to the bit-write area and can affect the wrong bit on older firmware.

Working Code: LAD, FBD, and SCL Examples

Below is a complete, compilable example for a CPU 1214C with a single global DB "Handshake_DB" that contains the boolean Output_to_VB_latch at address DBX10.0.

FC1 in LAD

Network 1: Latch on falling edge of PLC_wants_VB_action
  PLC_wants_VB_action  M_edge1         Output_to_VB_latch
|---[/]----------------(P)------------(S)----------------------------|
   %M0.1              %M0.3            "Handshake_DB".Output_to_VB_latch

Network 2: External reset
  HMI_Reset                       Output_to_VB_latch
|---[ ]-----------------------------(R)------------------------------------|
   "Handshake_DB".HMI_Reset         "Handshake_DB".Output_to_VB_latch

Network 3: Mirror for diagnostics
  Output_to_VB_latch      Output_to_VB_mirror
|---[ ]----------------------( )----------------------------------|
   "Handshake_DB".Output_to_VB_latch  "Handshake_DB".Output_to_VB_mirror

FC1 in SCL

// Detect falling edge of PLC_wants_VB_action
IF "PLC_wants_VB_action" = FALSE AND "PLC_wants_VB_action_old" = TRUE THEN
    "Output_to_VB_latch" := TRUE;
END_IF;
"PLC_wants_VB_action_old" := "PLC_wants_VB_action";

// External reset (HMI, VB, OPC UA)
IF "HMI_Reset" THEN
    "Output_to_VB_latch" := FALSE;
END_IF;

// Mirror for diagnostics
"Output_to_VB_mirror" := "Output_to_VB_latch";

FC1 in FBD

PLC_wants_VB_action --|/|--[P-edge]--(S)-- Output_to_VB_latch
                                         |
                                         +-- ( )-- Output_to_VB_mirror
HMI_Reset -------------------------------(R)-- Output_to_VB_latch

All three languages compile to the same MC7 code; TIA Portal's compiler is documented in the S7-1200 system manual, available in the Siemens Industry Online Support portal for the specific firmware version installed on your CPU.

Mapping HMI Tags to PLC Bits in TIA Portal

For the HMI reset to actually reach the PLC, the tag must be defined in the HMI's connection list with the "Access" mode set to Read/Write, and the PLC DB must have the bit declared as a separate variable (not just a part of a packed byte constant).

1. In the TIA Portal project tree, expand the PLC and open "PLC tags" (or the DB itself if the tag is a DB variable).
2. Add a new tag Output_to_VB_latch of type Bool with address %DB100.DBX10.0. Make sure the symbol is accessible from the HMI connection — TIA Portal restricts access to symbols that are not in a "know-how protected" block by default.
3. Open the HMI device configuration and add a new connection to the PLC. The default connection is a PROFINET or EtherNet/IP connection; for an HMI panel on the same subnet, the S7-1200's integrated PROFINET interface is sufficient.
4. Open the HMI tag table and add a tag that points to the same PLC tag (TIA Portal will accept a drag-and-drop from the PLC tag list into the HMI tag table).
5. On the HMI screen, drop a "Button" object. In the "Events" tab for the "Press" event, choose "SetValue" and set the value to 0. Alternatively, choose "InvertBit" so a single button can both set and reset.
6. Compile and download both the PLC and the HMI project. The download order matters — compile the PLC first, then the HMI, so the HMI picks up the latest symbol table.

If the HMI is a third-party panel (Red Lion, Beijer, Maple Systems, AutomationDirect C-more) connecting via Modbus TCP or EtherNet/IP, the mapping table is built into the panel's configuration software. The panel imports a CSV or XML export of the PLC tag list and presents each bit as a discrete or coil address. See the panel's documentation for the exact import procedure; Red Lion's Crimson 3 and Beijer iX Developer are the most common in this category.

Verification: Watch Tables, Force, and PLCSIM

After the change, verify the bit really can be reset from the external system. Use the following procedure:

1. Open the project in TIA Portal, go online with the PLC, and open a Watch Table that contains "PLC_wants_VB_action", "HMI_Reset", and "Output_to_VB_latch" at addresses %M0.1, DB100.DBX20.0, and DB100.DBX10.0 respectively.
2. Force "PLC_wants_VB_action" to TRUE and observe "Output_to_VB_latch" stays FALSE (because the edge is on the falling edge of M0.1).
3. Force "PLC_wants_VB_action" to FALSE. The bit at DBX10.0 should latch to TRUE within one scan cycle.
4. From the VB application or HMI, issue a reset to DBX10.0. The bit should drop to FALSE and stay there until the next falling edge of M0.1.
5. Repeat steps 3 and 4 fifty times. If the bit ever re-asserts without a new falling edge, the rung is still using a continuous assignment coil or there is a second network that re-sets the bit.
6. Disconnect the HMI/VB client and force "HMI_Reset" from the watch table. The bit should still clear, proving the reset is a property of the ladder and not of the external client.

For offline verification, use S7-PLCSIM (the PLC simulator that ships with TIA Portal). PLCSIM lets you run the entire PLC program on a PC and connect a real HMI or VB application to it over the local network. This catches transport-layer bugs (wrong DB number, wrong byte offset, endian mismatch) before the code is downloaded to a real CPU. PLCSIM V15 and later supports most of the S7-1200 instruction set; the simulator cannot run a real PROFINET or EtherNet/IP network, but it can run the integrated PROFINET interface as a virtual switch.

Troubleshooting Matrix

Best Practices and Engineering Guidelines

• Always use a Set/Reset coil pair for handshake bits that must be controlled from more than one code source (ladder, HMI, OPC UA, Modbus). A continuous assignment coil is for outputs that are a pure function of their rung condition.
• Drive the Set coil from a positive or negative edge, never from a level. The edge makes the Set action a one-shot, which is exactly what the external Reset needs.
• Keep the bit in a globally accessible DB (not a multi-instance DB of an FB) so the HMI and external applications can bind to it without reaching into instance data.
• Reserve a dedicated "mirror" bit in the same byte so the HMI can display the latched state separately from the control bit. This avoids the HMI "seeing" the bit pulse at scan rate.
• Document the bit in the DB's comments. Future maintainers need to know which code sources are allowed to set, reset, and read the bit.
• If the bit drives a physical output, route it through a safety-rated logic path (F-CPU, contactor monitoring) and never rely on the HMI as the sole reset mechanism.
• Test the handshake under the worst-case HMI poll rate. WinCC Comfort Panels default to 1000 ms; some SCADA packages default to 5000 ms. A 5-second poll rate can mask a 1 ms PLC pulse if the design depends on level signals.
• Use PLCSIM with a simulated HMI before downloading to a real CPU. The first 30 minutes of PLCSIM testing will save a full day of on-site debug.
• Prefer the SR flip-flop variant when set should win in a simultaneous set/reset race; use the RS variant when reset should win. The default in TIA Portal is the SR variant.
• Where possible, replace ad-hoc bit handshakes with standard S7 communication mechanisms: PUT/GET for peer-to-peer, BSEND/BRCV for large data, or OPC UA Pub/Sub for many-to-many. Handshake bits are appropriate for discrete events, not for bulk data.

For a complete reference on the Set/Reset instruction in TIA Portal, including the INOUT tag, the optional Q output, the difference between SR and RS flip-flops, and the relationship to the latching relay, see the official S7-1200 manual collection: Set and reset instructions (S7-1200). The S7-1200 system manual and the TIA Portal programming guide are also available in the Siemens Industry Online Support portal for the specific firmware version installed on your CPU.

FAQ