Siemens KTP400 HMI Button Not Controlling S7-1200 in TIA Portal

1. Problem Statement

An S7-1200 CPU is programmed in TIA Portal (WinCC Basic, V11 SP2 or later) and downloaded successfully. A KTP 400 Basic mono panel is connected to the PLC over PROFINET, the HMI configuration is downloaded, and tags/connections appear valid. The fault pattern is asymmetric:

• PLC → HMI direction works: when an output or memory bit is set in the PLC (either by a wired input, by a forced value, or by the online monitor), the value displays correctly on the HMI screen (e.g., a lamp/indicator graphic turns on).
• HMI → PLC direction fails: pressing a button or toggle switch on the panel produces no reaction in the PLC. No bit is set, no output changes, and no value is written back to the tag.

The user has already verified IP address, MAC address, subnet mask, and the symbolic tag names. The fault is therefore not in the connection layer but in the configuration of the HMI control or in the tag access direction inside TIA Portal.

2. Affected Components

3. Root Cause Matrix

From the symptom "HMI sees PLC state but PLC does not see HMI state", nine causes account for essentially every field case. Work the matrix from top (most likely) to bottom.

4. Diagnostic Procedure

Use this ordered flow on every panel that exhibits the asymmetric read/write symptom. Do not skip steps; the cheapest check (cause #1) fixes roughly 70% of field cases.

4.1 Confirm the Directional Fault

1. Open TIA Portal, project view, and connect online to the S7-1200 (Online → Go online).
2. Open the HMI tag table; right-click a suspect tag → Monitor. The value updates as the PLC program runs.
3. In the PLC monitor (Watch table), force the same tag's underlying memory bit. Confirm the HMI updates. → Read direction works.
4. From the HMI's runtime (or the simulator), tap the button. In the watch table, observe the tag. It does not change. → Write direction fails.

4.2 Inspect the HMI Control

1. In the project tree, expand HMI_1 → Screens → [your screen] and double-click the screen.
2. Click once on the button (do not double-click, which would open events depending on version).
3. Open the Inspector window (View → Properties).
4. Go to Properties → Events.
5. Confirm that the Click, Press, or Change event row is present and contains a function.

5. Fix #1 — Configure the HMI Button Event (Most Common Cause)

A button on an HMI screen is a graphical object only until an Event is associated with it. If no event is defined, the button looks active in WinCC but does nothing in runtime. This is the dominant cause when "HMI displays PLC state but cannot change it".

5.1 For a Momentary Push-Button (Press → Set, Release → Reset)

1. Click the button on the screen.
2. Open Properties → Events.
3. On the Press event row, click the <Add function> field.
4. Select Edit bits → SetBit.
5. In the tag selector, pick the PLC tag (e.g., "Start" or "%DB1.DBX0.0"). When the variable is sourced from the S7-1200 directly, select it from PLC tags rather than from HMI tags.
6. On the Release event row, add Edit bits → ResetBit with the same tag.

5.2 For a Toggle Switch (Sticky Latching Behavior)

The Basic Panels support a dedicated "Switch" element, which is the correct object when you want a toggle that latches in the same position as the PLC bit.

1. Drag a Switch element onto the screen (Toolbox → Elements → Switch).
2. Click the switch, open Properties → General → Process value.
3. Bind it to the PLC BOOL tag (e.g., "Motor_On").
4. Open Properties → Events → Change.
5. Add the function Edit bits → InvertBit with the same tag.

5.3 For an Output Lamp / Indicator

An output element (circle, lamp, text field color animation) only needs a Process value; no Event is required because the value is read continuously.

1. Drag a Circle onto the screen.
2. Open Properties → Appearance → Animations → Add new animation → Appearance.
3. Bind the variable to the PLC BOOL.
4. Configure two states: value = 0 → gray; value = 1 → green.

6. Fix #2 — Verify HMI Tag Access Mode

When the HMI tag (or PLC tag referenced from the HMI) is set to read-only, every write from the panel is silently rejected by WinCC. The HMI still reads the value, so the directional fault persists.

1. Project tree → HMI_1 → HMI tags.
2. Open the tag table.
3. Click the tag used by the button (e.g., Start).
4. Open Properties → General.
5. Check the Access column. It must be <--> (read/write), not <-- (read only).
6. If access is read-only, set it to read/write and recompile.

7. Fix #3 — Bind to the PLC Tag, not the HMI Tag

A frequent beginner mistake is to create two tags with the same name — one in PLC tags and one in HMI tags — and to bind the button to the HMI one. The HMI tag is a local mirror and has no write path back to the S7-1200 unless its Connection property is set.

1. Click the button → Properties → General → Process value (or Variable in newer versions).
2. In the tag picker, expand PLC tags → [PLC name] → [tag group] and select the PLC tag directly.
3. Avoid selecting from HMI tags unless the HMI tag is explicitly configured with the S7-1200 connection.

8. Fix #4 — Enable HMI Accessibility of PLC Tags (S7-1200 V4.x and later)

From firmware V4.0 onward, every PLC tag has an explicit accessibility flag. If the flag is off, the HMI cannot see the tag at all — though TIA will silently bind to a default address, producing the same fault.

1. Project tree → PLC_1 → PLC tags → [tag group].
2. Click the tag (e.g., Start).
3. Inspector → Properties → Attributes.
4. Tick Accessible from HMI/OPC UA.
5. Tick Writable from HMI/OPC UA (only if the HMI must write the value).
6. Compile the PLC project, download to the S7-1200, and then recompile + download the HMI.

9. Fix #5 — Verify the HMI Connection and Area Pointers

1. Project tree → HMI_1 → Connections.
2. Open the existing S7-1200 connection.
3. Confirm the IP of the PLC matches the actual CPU (e.g., 192.168.0.1). Mismatched subnets silently break write direction even when reads appear to work because the panel can still poll the PLC.
4. Open the Area pointers tab.
5. Ensure the Coordination area pointer is enabled. It is required for life-sign handshake between HMI and PLC. Default DB number and byte offset can be left at the auto-assigned values.

10. Compile, Download, and Verify

1. Right-click PLC_1 → Compile → Software (rebuild all).
2. Download to the S7-1200.
3. Right-click HMI_1 → Compile → Software (rebuild all). TIA will surface any unresolved tag references; fix them.
4. Right-click HMI_1 → Download to device → Software (all).
5. When the transfer dialog opens, tick Overwrite all on the HMI to ensure the new project replaces the old one. The KTP400 Basic will restart automatically.
6. Run the project on the panel.

10.1 On-Panel Verification

11. Diagnostic Flowchart

12. Common Field Pitfalls

13. Working Sample — Minimal "Start/Stop with Indicator" Project

The following describes a complete, test-ready TIA Portal setup that demonstrates correct HMI-to-PLC control. After loading, touching Start on the KTP400 must turn on the indicator light in the HMI; touching Stop must turn it off.

13.1 PLC Tags (S7-1200)

13.2 PLC Program (Ladder, FB/OB1)

Network 1:      Start     Stop      Motor_On     Motor_On
                 ─┤ ├──────┬─────────┤ ├───────────┤ ├───( )─
                          │
                          │
                          └──┤/├──── Stop (N/C contact)

This is a standard seal-in (latching) circuit. Start and Stop are operator inputs from the HMI; Motor_On is the held output. The HMI's Start button momentarily sets Start = TRUE, the seal-in contact holds Motor_On = TRUE, and the Stop button breaks the seal.

13.3 HMI Screen Configuration

14. Versions and Compatibility

The procedure is identical across the following engineering versions, with menu/label drift only:

15. Related Settings Worth Verifying Once

• PG/PC interface: must be set to the NIC connected to the S7-1200 / KTP400 subnet, not Wi-Fi or a virtual adapter.
• Subnet in the HMI connection: must match the S7-1200's PROFINET subnet. Different subnets cause intermittent read with failed write.
• Time synchronization: the "Date/Time PLC" area pointer should be enabled if the HMI displays the PLC time; this is unrelated to button control but is a frequent audit finding.
• User administration: if a button is grayed out at runtime, check Runtime security → Users → Authorizations. The button may be assigned to an authorization level the current user does not have.

16. Quick Diagnostic Checklist

1. Button has at least one Event configured (Press, Click, or Change).
2. Event function targets a SetBit/ResetBit/InvertBit on the correct tag.
3. Tag is the PLC tag, not a local HMI tag.
4. HMI tag access is <--> read/write.
5. PLC tag "Accessible from HMI" is enabled.
6. PLC tag "Writable from HMI" is enabled (if the HMI must change it).
7. HMI connection has correct IP and subnet of the S7-1200.
8. Coordination area pointer is enabled.
9. HMI project was compiled (rebuild all) and downloaded to the panel after the last PLC change.
10. PG/PC interface is set to the wired NIC.

Working through the checklist above resolves the asymmetric HMI-to-PLC control symptom in nearly every case. The remaining unrecoverable cases usually point to a corrupted HMI image — reflash the panel via ProSave or by formatting the panel's storage card and retransferring the compiled HMI runtime.