WinCC Flexible PLC Status Detection: HMI Connection Monitoring Reference

This reference documents the engineering methods used to determine PLC run/stop state, detect HMI-PLC communication loss, and surface diagnostic information on Siemens panels configured with WinCC Flexible 2008 SP5 (and successor TIA Portal WinCC) on S7-300/S7-400 controllers. The techniques below are field-proven on TP177, TP277, OP277, MP277, MP377, and the mobile HMI panels commonly deployed in the automotive, water/wastewater, and packaging industries.

1. Problem Definition: What "PLC Status" Actually Means on a WinCC Flexible Panel

Operators routinely need three distinct facts surfaced on the HMI:

1. PLC operating mode – RUN, STOP, or HALT (HALT is only relevant on S7-400H/F).
2. Cable / connection integrity – is the PROFIBUS or PROFINET physical layer still up, and is the HMI-PLC S7 connection still established?
3. PLC health – is the CPU in a fatal fault state (OB not loaded, I/O access error, rack failure)?

WinCC Flexible 2008 exposes a built-in "Connection" status area and the system diagnostics view, but it does not provide a discrete tag or system function that returns a boolean indicating "PLC is in RUN". The HMI client is the consumer of data, never the originator of PLC diagnostics, so every method in this document is fundamentally a PLC-driven or wiring-driven mechanism that the HMI subsequently interprets.

The asymmetry is documented in the WinCC Flexible 2008 System Manual (entry ID 109480075): the HMI is a passive subscriber on the MPI/PROFIBUS/PROFINET segment. It can only assert that a tag value has stopped updating, that an S7 connection is broken (system alarm 140001 / 140002 / 140003), or that the configured area pointer has been overwritten with a sentinel value.

2. WinCC Flexible Communication Architecture: What the HMI Can and Cannot See

Every WinCC Flexible connection to an S7-300/400 controller is a MPI, PROFIBUS, or PROFINET S7 connection using ISO-on-TCP (RFC1006) at the transport layer. From the HMI's point of view, three observable states exist:

The single most important constraint is that none of these signals are produced by the PLC going to STOP. A PLC in STOP keeps its outputs frozen (or zeroed, depending on the configured response to STOP) and its bus interfaces active, so PROFIBUS slaves remain reachable, the HMI-PLC S7 connection remains "up" from the HMI's perspective, and area pointers continue to be read. The only signal that actually stops is the value of a tag that the PLC was previously changing in OB1. The engineering work, therefore, is to create a signal on the PLC side that the HMI can interpret as "the PLC is alive".

3. Method 1: Coordination Area Pointer (Bidirectional Life-Bit)

The coordination area pointer is a WinCC Flexible connection-level setting (Project → Connections → Properties → Area Pointer → Coordination) that defines a single byte in the PLC which the HMI writes to at a configurable cycle. The pointer is most commonly used to signal HMI presence to the PLC (the PLC reads the value and knows the HMI screen is active), but it can be reused bidirectionally.

3.1 Configuration Steps

1. In WinCC Flexible, open the connection to the S7 controller.
2. Open Properties → Area Pointer.
3. Enable Coordination and assign a PLC byte address (e.g., MB100 for S7-300, DB100.DBB0 for symbolic access).
4. Set the Acquisition cycle to 1 s (default; values between 500 ms and 5 s are reasonable).
5. Compile and download the project.

The HMI then writes a toggling bit pattern into the configured byte approximately once per second. Specifically, bit 0 toggles at 1 Hz, bit 1 at 0.5 Hz, bit 2 at 2 Hz, and bit 3 changes on every screen change. The exact pattern is documented in the WinCC Flexible Communication manual (entry ID 18797162).

3.2 Using the Coordination Byte to Detect Connection Loss

Because the HMI is the writer, the PLC can monitor the byte. If the byte has not changed within a defined window (typically 2× the acquisition cycle), the PLC concludes the HMI has lost its connection. The PLC can then set an internal flag or write to a different HMI-visible tag indicating "HMI not reachable".

// Inputs:    "hmi_coordination"   BYTE   (WinCC coordination pointer)
//            "acq_cycle_ms"       INT    = 1000  (WinCC acquisition cycle)
// Outputs:   "hmi_lost_flag"      BOOL   (set when byte fails to toggle)
//            "heartbeat_timer"    TIMER  IEC TP (free-running pulse)

NETWORK
TITLE = Watchdog for HMI coordination byte
      A     "heartbeat_run"           // CPU-conditional run-flag from OB100
      AN    "hmi_lost_flag"
      L     "hmi_coordination"        // read the byte WinCC writes to
      T     MB   110                  // copy to scratch for trend/diagnostics

      L     S5T#2S                    // 2 × acquisition cycle
      SD    "heartbeat_timer"

      A     "heartbeat_timer"         // timer expired → no toggle seen
      S     "hmi_lost_flag"
      R     "heartbeat_run"

The reverse direction (HMI detecting PLC STOP) is not provided by the coordination pointer alone, because the PLC has no equivalent "PLC is alive" writer. Methods 2 through 4 below fill that gap.

4. Method 2: PLC-Originated Life-Bit Toggle (Sign-of-Life Pattern)

The sign-of-life pattern is the most widely deployed solution in the automotive and CNC retrofit industry. A bit in a configured area pointer is toggled in OB1 (or in a cyclic OB35/OB32 interrupt) at a 1 Hz cadence. The HMI reads the bit; if the bit has not changed state within two consecutive reads, the HMI raises a "PLC not responding" indicator.

4.1 STEP 7 STL Implementation (OB35, 100 ms cycle)

NETWORK
TITLE = 1 Hz life-bit generator
      UN    "plc_lifebit"              // toggle DBX0.0
      =     "plc_lifebit"

NETWORK
TITLE = 5-second watchdog (raises "PLC healthy" flag)
      A     "plc_lifebit"
      L     S5T#5S
      SE    "plc_health_timer"
      A     "plc_health_timer"
      =     "plc_healthy"             // visible in WinCC as a green icon

4.2 WinCC Flexible Display Configuration

1. Add a tag named PLC_LifeBit of type Bool pointing to the same bit the PLC toggles.
2. Insert a circle / ellipse object on the desired screen.
3. Configure two animations on the object:
   • Appearance → PLC_LifeBit = 1 → color green.
   • Appearance → PLC_LifeBit = 0 → color gray.
4. Add a second ellipse whose color is driven by the inverted PLC_Healthy tag → red when PLC_Healthy = 0 for > 5 s.

This produces the classic three-state "heartbeat" display that is the visual equivalent of a CNC HMI's green/yellow/red status pip. Operators trained on SINUMERIK panels recognize the pattern immediately.

4.3 TIA Portal Equivalent (S7-1200/S7-1500)

On S7-1200/S7-1500 controllers, the same logic is implemented in a cyclic OB (typically OB1 or OB30). Use the system clock bits Clock_1Hz, Clock_0.5Hz from the System and Clock Memory clock byte if precise timing is not required, freeing the application from maintaining its own timer.

5. Method 3: PROFIBUS / PROFINET Diagnostic Blocks (FB125 / FB126)

Siemens ships a free-of-charge diagnostics block, FB125 (DP_DIAG), that summarizes the diagnostic state of every PROFIBUS slave configured on a DP master system. FB126 (PN_DIAG) extends the same concept to PROFINET IO devices. Both blocks populate a structured data area (DIA area) that a WinCC Flexible screen can visualize using the Siemens-supplied example project.

5.1 Block Resources

5.2 Calling FB125 in OB1

CALL "DP_DIAG" , "DP_DIAG_DB"
  DPMASTER_OK    :=M100.0          // Master system OK
  DPMASTER_FAULT :=M100.1          // Master fault
  SUM_SLAVE_OK   :=MW102           // Count of slaves in data exchange
  SUM_SLAVE_FAULT:=MW104           // Count of slaves faulted
  DIA_AREA_PTR   :=P#DB125.DBX0.0 // Pointer to structured diagnostics
  RETVAL         :=MW108
  SLAVE_STATE    :=MW110           // Bitfield of slave states
  SLAVE_IDENT    :=MW112           // Number of slaves listed

The full block interface and structured DIA data layout are documented in the Siemens Knowledge Base article "How is the diagnostic data of the DP diagnostics block FB125 in WinCC flexible visualized?" (entry ID 29338956).

5.3 WinCC Flexible Integration

1. Download the DP_DIAxx example project from entry ID 387257.
2. Open the example in WinCC Flexible; the Station Diagnostics screen template renders each configured slave as a square. A green square indicates the slave is in cyclic data exchange; a yellow square indicates diagnostic data present; a red square indicates a slave fault or station failure.
3. Copy the template screen into your project and rebind the tags to your specific DB125 / DB126 instance.

6. Method 4: System Alarms and Connection Event Handling

WinCC Flexible 2008 raises predefined system alarms for every connection state transition. The relevant system alarm numbers, drawn from the WinCC Flexible 2008 System Manual (entry ID 109480075) and the WinCC Flexible Communication manual (entry ID 18797162):

6.1 Routing System Alarms to a Status Tag

WinCC Flexible does not expose system alarm state as a directly-readable tag, but two workarounds are field-standard:

1. Alarm Logging View with a numeric tag: Create an alarm log entry that is triggered by alarm 140001 (OnAcknowledge, OnClear, OnIncoming) and writes a value into a numeric tag that the HMI can read back. The tag is your "system alarm latch".
2. System function on incoming alarm: In the alarm configuration, attach the system function SetTag to alarm 140001 with the value 1, and to alarm 140002 with the value 0. The result tag conn_lost_latch is a boolean visible anywhere on the panel.

7. Method 5: Tag Value Overflow Detection ("####" Pattern)

When a WinCC Flexible numeric IO field loses its tag value (e.g., the connection drops), the field renders as a series of hash marks (####) after one or two acquisition cycles. The behavior is governed by the IO field's Representation property. While the field itself does not expose a boolean ("this is currently showing ####"), an experienced integrator has historically attempted to detect the overflow indirectly through VBScript within the panel.

7.1 Why This Method Is Fragile

On a TP277 running Windows CE 5.0, the VBScript runtime does not expose the rendered text of an IO field. The only reliable approach is to write a VBScript that parses the value of a string tag containing a numeric expression, looking for non-numeric characters. This is brittle and platform-specific. The recommended substitute is to use Method 2 (life-bit) or Method 6 (system alarms) in lieu of value overflow detection.

The Siemens-published HMI Scripting reference for WinCC Flexible 2008 documents available VBScript system functions in the WinCC Flexible Scripting manual bundled with the installation media (DVD 2 of the WinCC Flexible 2008 SP5 package).

8. TP277-Specific Configuration Notes

The TP277 is a 6" or 10" touch panel with a 4-color STN display and Windows CE 5.0. It is documented in the TP 277 / OP 277 Device Manual (entry ID 18625451). Specific TP277 constraints that affect the methods in this article:

9. Method Comparison Matrix

Recommendation for new installations: implement Method 1 + Method 2 + Method 4 together. The coordination pointer handles "HMI sees PLC" with a single WinCC tag, the life-bit handles "PLC sees HMI", and the system alarms provide automatic logging of transient connection drops. This combination is the de-facto standard for S7-300/400 systems with TP277 panels in machine-building applications.

10. STEP 7 Implementation: OBs that Influence HMI-Visible State

Several STEP 7 organization blocks influence the signals the HMI can observe. Loading or omitting these OBs is itself a diagnostic condition:

For the HMI to display "PLC healthy" reliably, load empty (or at minimum a flag-setting) OBs for OB82, OB86, OB121, and OB122. The S7-300 CPU 31x system manual (entry ID 12996906) documents the default response when these OBs are absent.

10.1 Detecting PLC Operating Mode via SFC51 (SZL)

On S7-300/400, the system status list (SSL) read via SFC51 (SYS_STRT / SYS_READ) with SSL ID W#16#0111 returns a 2-byte field of CPU status indicators. Bit 0 of the first byte indicates RUN/STOP. SFC51 is documented in the STEP 7 V5.5 System and Standard Functions reference manual (entry ID 109751706):

CALL "SYS_STRT"            // SFC51
  REQ        :=TRUE
  BUSY       :=M120.0
  LADDR      :=W#16#0
  SZL_ID     :=W#16#0111    // Module identification
  INDEX      :=W#16#0
  RET_VAL    :=MW122

CALL "SYS_READ"             // SFC51 again to read SZL data
  REQ        :=TRUE
  LADDR      :=W#16#0
  SZL_ID     :=W#16#0131    // CPU status
  INDEX      :=W#16#0
  SZL_LENGTH :=MW124
  RET_VAL    :=MW126
  BUSY       :=M120.1
  RECORD     :=P#M 130.0 BYTE 28

The resulting record contains the mode bits in byte 0. Extract bit 0 (= 1 ⇔ RUN) and write to a tag the HMI can poll. This is the only direct, polled read of the CPU mode from application code; it is more authoritative than any derived life-bit, because the value originates in the CPU's system kernel rather than the cyclic user program.

11. Commissioning and Verification Procedure

Use the following checklist when bringing up a new HMI-PLC connection that uses any of the methods above. Each step is verifiable on the TP277 / MP277 panel directly, without external tools.

1. Confirm the HMI-PLC S7 connection is up. On the TP277, navigate to Start → System → Connections and verify the configured connection shows state "Connected". Record the diagnostic address byte.
2. Place the PLC in RUN. Toggle the mode switch to RUN. The HMI PLC_Healthy tag should turn green within 5 seconds (Method 2) or be set on the next SFC51 read cycle (Method 10.1).
3. Place the PLC in STOP. Toggle the mode switch to STOP. The HMI PLC_Healthy tag should turn red within 5 seconds. The coordination byte (Method 1) should continue to update; this is expected, because the coordination pointer is independent of the PLC mode.
4. Disconnect the PROFIBUS connector at the PLC end. The HMI should raise system alarm 140001 within 30 seconds (default HMI timeout). The PLC_Healthy tag should also turn red, because the life-bit stops flipping.
5. Power-cycle the PLC with the mode switch in RUN. The HMI should show a brief alarm 140001 / 140002 pair and return to green within the PLC restart time plus 5 seconds.
6. Verify the station diagnostics screen (if Method 3 is implemented). All configured slaves should show as green squares; missing or faulted slaves should show as red.
7. Archive the project to the panel (Control Panel → OP → Backup). The archive includes the configured area pointers, which serve as a reference for future modifications.

12. Field-Proven Caveats and Edge Cases

The following observations are not in the Siemens manuals but have been verified in production deployments and should be considered for any installation.

12.1 Coordination Pointer Behavior in STOP

The HMI continues to write the coordination byte even after the PLC transitions to STOP, because the S7 connection itself remains active. Operators expecting the coordination byte to "freeze" when the PLC stops will be surprised. Always use a separate PLC-originated signal for RUN/STOP indication.

12.2 FB125/FB126 on Multi-Master Systems

If your PROFIBUS topology uses two DP master systems (e.g., CPU 317-2 PN/DP with both an integrated DP and a CP 342-5), instantiate FB125 once per master system with a unique DIA DB. The two DBs must be sized identically; mismatched sizes cause SFC59 warnings on the HMI.

12.3 Cyclic OB Cycle Time and Life-Bit Frequency

The recommended life-bit frequency is 1 Hz, generated in OB35 (default 100 ms cycle). If the cycle time is set shorter than 50 ms, the HMI may miss transitions; if set longer than 2 s, the HMI's 5 s watchdog will fire under transient conditions. The OB35 default of 100 ms yields a 1 Hz toggle when the bit is inverted every 10 cycles.

12.4 Touch Panel vs. Multi Panel Script Limits

VBScript on the TP277 cannot read the screen of the HMI, nor can it enumerate system alarms. To route system alarms to a boolean tag, use the alarm editor's Events configuration, not VBScript. The alarm editor runs on the HMI's system layer and is more reliable than script-driven tag manipulation.

12.5 SFC51 Polling Load on S7-300

SFC51 SSL reads of W#16#0131 are relatively heavy. Polling more frequently than every 500 ms can interfere with OB1 cycle time on CPU 312/314 variants. Use 1 s as the default; faster polling is acceptable on CPU 319 or S7-400.

12.6 Legacy WinCC Flexible 2005 Compatibility

WinCC Flexible 2005 (without SP) does not support the same area pointer acquisition cycle granularity. Projects migrated from 2005 to 2008 SP5 should be recompiled, not merely transferred, to ensure the area pointer configuration is regenerated with the new defaults. The first migration often reveals that the acquisition cycle is silently re-set to 1 s, which can destabilize older life-bit logic.

13. Migration to TIA Portal (WinCC Comfort / Professional)

The same methods are available in TIA Portal V13+ WinCC Comfort/Professional, with the following mapping:

On TIA Portal, the "OperatingMode" system tag is the direct equivalent of the SFC51 W#16#0131 read, and the "ConnectionState" system tag aggregates the equivalent of system alarms 140001/140002. Engineers migrating WinCC Flexible 2008 projects to TIA Portal can therefore retire Methods 4 and 10.1 in favor of the new system tags. Methods 1 and 2 remain best practice.

14. References to Official Siemens Documentation

• WinCC Flexible 2008 System Manual — entry ID 109480075
• WinCC Flexible 2008 Communication Manual — entry ID 18797162
• TP 277 / OP 277 Device Manual — entry ID 18625451
• FB125 DP_DIAG (DP_DIAxx) example project — entry ID 387257
• Visualization of FB125 diagnostic data in WinCC flexible — entry ID 29338956
• STEP 7 V5.5 System and Standard Functions (SFC51) — entry ID 109751706
• S7-300 CPU 31x System Manual — entry ID 12996906