WinCC Flexible HMI Button Stuck Latched: Troubleshooting Guide

1. Problem Description

A recurring defect pattern on Siemens WinCC flexible 2008 / SP2-SP5 runtime panels (TP177, OP177, MP177, MP277, MP377, KTP400, KTP600, KTP1000, TP170, TP270) is an HMI control that visually remains in the pressed state after the operator releases it. The expectation for most push-to-make operator inputs is a momentary (spring-return) behavior: the visual indicator returns to its neutral state when the finger is lifted, and the associated PLC tag follows the contact's make/break timing.

When the control instead locks in the depressed position, two distinct symptoms are commonly reported in field service tickets:

• Visual lock — the button face remains shaded or "inset," and the operator must click the control a second time to release it.
• Tag lock — the bound PLC tag (e.g., DB10.DBX0.0 or M0.0) is set on press but never cleared on release, so the controlled output (motor contactor, valve, start flag) latches until toggled by other logic.

The two symptoms are often correlated, but they have independent root causes and must be diagnosed separately. Treating them as a single defect leads to repeated calls and failed hotfix deployments.

2. Root Cause: Component Selection, Not Press Logic

In the WinCC flexible graphics designer, the toolbox exposes several look-alike controls that are functionally distinct:

The defect pattern almost always traces to a control that was placed from the toolbox as a Switch (with text) — which renders with the same dimensions and face plate as a regular Button — and was then wired to a function the operator treats as momentary. Because the Switch object has no Release handler, releasing the finger on a touchscreen merely ends the contact cycle; the visual state, however, is held by the toggle's internal state bit until the next click event.

The second contributing factor is the tag direction:

• If the tag is configured as acquisition cycle < 1 s with continuous update, the panel polls the PLC for the tag's value and re-renders the switch position from PLC state.
• If the tag is configured as read-only on change, the panel only re-renders when a different event drives a refresh; a stray press can be displayed indefinitely.

3. Tag Latching on the PLC Side

Even when the HMI correctly releases its visual state, the underlying PLC bit can remain latched if the Release event is not programmed. This is the second half of the same defect family and is the cause of the Inductive-Automation-style report where a N/O bit on a PLC tag gets stuck high and feeds the rung downstream.

The HMI only writes to a tag when an event is executed. If you wire the Press event to SetBit but leave the Release event empty, the panel writes a 1 on touch-down and writes nothing on touch-up. The bit stays at 1 until the PLC's own logic clears it — which is rarely the case for a one-shot operator command.

3.1 Memory and Address Considerations

For S7-300 / S7-400 backplanes, momentary operator bits are conventionally placed in a Merker (M) area or in a dedicated HMI-input DB (e.g., DB100) with bit offsets documented in the tag list. For S7-200 (legacy PPI panel connection) the convention is the V area. Avoid binding operator momentary bits to outputs (Q or process-image-output) directly, because the S7 CPU's process image may overwrite the HMI's reset write in the same OB1 scan.

3.2 Why a "Reset on Press" Sometimes Works

A common field workaround is to program the Press event as ResetBit on the bit itself, followed by an immediate SetBit. This relies on the HMI sending both writes in the same event tick. While this masks the latching problem for a subset of operator inputs, it is fragile: a touch-and-hold gesture longer than 200 ms on a slow MP377 panel can produce a glitch where the ResetBit completes but the SetBit is delayed, leaving the bit low for one scan. The PLC then treats the low as a stop command. Use the explicit Press / Release event pair instead.

4. The WinCC flexible Event Model

Each input-capable HMI control exposes a fixed set of event slots in the Properties dialog. For a HMIButton (a true momentary control), the relevant slots are:

• Press — executed on contact-make (touch-down or mouse-down inside the control's bounding rectangle).
• Release — executed on contact-break (touch-up, mouse-up, or finger lift).
• Click — executed once per complete press/release cycle. Not a replacement for Press+Release when the PLC requires edge-sensitive control.

For a HMISwitch, only a single Change event exists. There is no concept of "pressed" or "released" — the event fires once each time the toggle state flips from 0 to 1 or 1 to 0.

4.1 The InvertBit Function

The default recommended function for a button bound to a boolean tag is InvertBit (German: Bit invertieren) in the function list, under the "Bit processing" group. InvertBit flips the current value of the tag in the PLC, but on a read-modify-write this introduces a race against any other writer (e.g., the PLC's own latching logic). For a clean momentary button, prefer SetBit on Press + ResetBit on Release.

4.2 Direct Key / Hardware Key Tie-In

On operator panels with physical keys (OP177, OP277, MP377 with key extensions), the function key assignments expose the same Press/Release event model under the “Keyboard” tab of the HMI tag properties. If a function key appears to stay "stuck," verify that Set Bit on Key Press is configured, not Toggle Bit.

5. Step-by-Step Resolution Procedure

1. Identify the control type. Right-click the control on the screen in the WinCC flexible ES, choose Properties → General → Type. If the type is Switch, this is the cause; the control must be replaced (see step 3).
2. Inspect the event configuration. Open Properties → Events. Confirm a Press event is configured and a Release event is configured. An empty Release slot is the most common configuration defect.
3. Replace the switch with a button. If the control type is a Switch, drag a new Button from the toolbox over the existing control, copy the tag, label, and position attributes, then delete the Switch. Renaming the Switch in place does not convert it; the internal type persists.
4. Wire the Press event to SetBit(TagName) via the function list. The function-list path is Bit operations → SetBit.
5. Wire the Release event to ResetBit(TagName). Bit operations → ResetBit. Use the same tag, exactly, including the case-sensitive tag name (WinCC flexible tag names are case-insensitive at the ES but the generated runtime reference is case-preserved).
6. Verify the tag update direction. Open the project's Tag List (Connections → Tags), locate the tag, and set Acquisition mode to Cyclic continuous with a cycle of 1 s, and PLC write permission to Yes (so the HMI can write the ResetBit on release). If the tag is read-only by design, the ResetBit will be silently dropped.
7. Compile and download. From the ES menu, choose Project → Compiler → All (rebuild), then Transfer → Transfer with the target panel in Transfer mode (the panel's service menu or the auto-transfer MPI/PROFINET setting).
8. On the panel, perform a controlled power-cycle to clear any cached tag state in the runtime: Start → Service → Reboot, or a full disconnect/reconnect of the 24 V supply.

6. Known Defect Patterns and Hotfixes

Siemens has acknowledged two specific WinCC flexible defects that produce the "stuck button" symptom even when the event configuration is correct.

6.1 Defect: Stuck Pressed State on Switch Components

Symptom: A Switch (with text) control that has been working correctly for weeks suddenly remains in the pressed state across reboots. The PLC tag toggles correctly; only the visual state is wrong. This is a graphics-buffer defect in the older runtime images. Siemens shipped hotfixes via:

• WinCC flexible 2008 SP3 HF7 (runtime image 6Y15 for MP277/MP377)
• WinCC flexible 2008 SP4 HF2 (covers OP277 and TP277 10" panels)
• WinCC flexible 2008 SP5 (roll-up, with the defect fixed at base level)

Refer to the WinCC flexible 2008 Service Pack 3 release notes and the WinCC flexible 2008 SP5 readme for the full list of included hotfixes. Always note the panel's current runtime image version via Start → About → Runtime on the panel itself before contacting Siemens support.

6.2 Defect: V6 WinCC Graphical-Buffer Anomaly

An earlier regression in WinCC V6 (the predecessor of WinCC flexible) produced a similar visual lock when the runtime's video memory was exhausted. The recommended fix was a runtime image update and a reduction of concurrent animated objects on the screen. Although this is a different product line, migrated sites still run V6 panels alongside WinCC flexible panels, and the same root cause can mask the actual event misconfiguration.

6.3 Defect: Tag Acquisition Cycle > Press Duration

If the tag acquisition cycle is set to a value longer than the operator's typical press (e.g., 5 s with a 1 s tap), the panel's rendering thread can miss the PLC's response to the Release event and freeze the visual state at the last seen value. The fix is to set the acquisition cycle to 1 s or 500 ms, as the PLC scan rate allows.

7. Cross-Reference: TIA Portal Migration

WinCC flexible 2008 SP5 was the last release on the legacy ES. From TIA Portal V13 onward, the equivalent components live in the WinCC Comfort / Advanced / Professional toolboxes:

For migration guidance, see the SIMATIC WinCC flexible → TIA Portal migration cookbook and the TIA Portal WinCC engineering manual.

8. Verification Procedure

After applying the fix, validate that the control behaves as a true momentary input on the live panel.

1. Online tag watch. Open the ES and connect online to the PLC. Add the operator bit (e.g., M0.0 or DB100.DBX0.0) to a VAT table. Press the HMI button for 1 s; the bit must go 0→1 on press and 1→0 within 50 ms of release.
2. Visual verification. Confirm that the button face returns to its neutral state on release, with no residual inset shading. On panels with persistence issues, a forced full-screen refresh (open a new screen, then return) should clear the artifact if the underlying events are correct.
3. Edge case — touch-and-hold. Press and hold the button for 10 s. The PLC bit must stay 1 for the entire 10 s and return to 0 within 50 ms of release. A misconfigured Click event used in place of Press will fail this test.
4. Edge case — rapid double-tap. Tap the button twice in 200 ms. The PLC bit must show two 0→1→0→1→0 transitions. If the bit shows only one transition, the Release event is firing too late and the panel is debouncing incorrectly.
5. Edge case — network blip. Briefly disconnect the PROFINET or MPI cable between the panel and the PLC. The button should remain operable; any queued events should be sent on reconnect. Confirm by reading the panel's diagnostic buffer: Start → Service → Diagnostic buffer.

9. Edge Cases and Related Patterns

9.1 Authorization-Level Sticky Bit

If the control is configured with an authorization (e.g., Operator ≥ 4), an insufficiently authorized press will be silently rejected and the tag will not change. Some operators interpret this rejection as the button being "stuck." Confirm the authorization level in Project → User administration.

9.2 Area Pointer and Bit-Pointer Mismatch

On S7-300/400 panels, the area pointer for Date/time, Coordination, and Screen number must be configured in both the panel and the PLC's DB. A misaligned coordination pointer can cause the panel to misread the screen lifecycle and re-enter a screen while the operator's last-press state is preserved across the transition. This is a secondary cause of "phantom" stuck presses.

9.3 Pointer-Event Buttons on Multi-Touch

On KTP1200 and MP377 panels, multi-touch can produce two simultaneous Press events for the same control. The first Release will not clear the state if the second touch is still active. This is a panel firmware issue; the workaround is to keep the multi-touch feature disabled for screens with operator-critical momentary buttons.

9.4 Recipe-View and Screen-Object Stale State

If the button is on a recipe view, the recipe synchronization sequence can write the recipe's value back to the tag, overwriting the HMI's ResetBit on Release. The fix is to disable Synchronize recipe to PLC on screen change in the recipe properties, or to re-issue the ResetBit on the screen's Loaded event.

10. Defect Diagnosis Flowchart

The following decision tree consolidates the troubleshooting logic for field use:

[Button stays pressed]
        |
        v
[Inspect control type in Properties → General]
        |
        +-- Switch (with text / without text) --> REPLACE with Button
        |
        +-- Button / RoundButton
                |
                v
        [Inspect Events tab]
                |
                +-- Press configured, Release EMPTY --> ADD ResetBit on Release
                |
                +-- Press and Release both configured
                        |
                        v
                [Check tag acquisition cycle]
                        |
                        +-- Cycle > 2 s --> SET to 1 s, retest
                        |
                        +-- Cycle <= 1 s
                                |
                                v
                        [Check PLC write permission on tag]
                                |
                                +-- Read-only --> ENABLE PLC write permission
                                |
                                +-- Writable
                                        |
                                        v
                                [Check PLC-side latching in user program]
                                        |
                                        +-- PLC latches the bit --> ADD release
                                        |    logic in PLC, or change tag to a
                                        |    momentary-only flag
                                        |
                                        +-- PLC does not latch
                                                |
                                                v
                                        [Apply hotfix or update runtime image]

11. Quick-Reference Event Configuration

For an operator button intended as a true momentary input bound to a boolean tag, use the following canonical configuration. Replace MyTag with the actual HMI tag name from the project tag list.

Tag properties:

• PLC: any S7-300/400/1200/1500 with PROFINET or MPI connection to the panel.
• Address: e.g., DB100.DBX0.0 (data block) or M0.0 (Merker).
• Acquisition mode: Cyclic continuous, 1 s.
• PLC write permission: Yes.
• Update of the PLC tag on the panel: Active (checkbox on the tag's Properties → Update tab).

12. Frequently Asked Questions