Fix an HMI numeric input handshake the PLC never completes

The sequence the panel expects

1. The operator enters a value. The panel writes it to the write tag and turns on its notification bit.
2. The panel holds the keypad open and waits for the handshake bit.
3. The ladder sees the notification bit and answers by turning on the handshake bit.
4. The panel reads the handshake bit on its own update cycle, sees the answer, and closes the keypad.

The bit names C1 and C2 are placeholders for the notification and handshake bits in a typical write-up of this sequence. Use whatever addresses your object and your ladder actually assign; the sequence works the same on any bit pair.

The two failure modes sit at steps 3 and 4. A wrong address in the ladder stops the answer at step 3. A pulse too short for the panel's read cycle fails at step 4, and from the keypad the two faults are indistinguishable: the entry hangs either way.

Symptoms and what each points to

Watch the two addresses in the PLC's online data view while you make one entry. What you see sorts the fault:

• The notification bit never turns on. The panel is writing to a different address, or it has stopped talking to the PLC altogether. If nothing on that screen updates, treat the link as the fault; fix an HMI communication timeout when outputs hold state walks that path.
• Notification on, handshake off. The request reached the PLC. The response rung reads a different address, has a permissive that is false, or drives a coil the panel never watches.
• Handshake turns on but the keypad stays open. The ladder answers, then clears the answer before the panel's next read. This is the pulse fault, and it is the most common one once the tags match.
• The entry completes now and then, roughly one try in ten. Same pulse fault with a longer hold: the panel's read occasionally lands inside the ON window.
• Both bits move, but out of order or on their own. A second panel, a data collector, or a rung left from commissioning is writing one of the addresses. Trace every writer of both bits.

Check both addresses online

1. Open the numeric input object's configuration and write down the notification tag and the handshake tag exactly as assigned.
2. Find the same two addresses in the ladder. The response rung must read the notification address and drive the handshake address.
3. Put the panel and the PLC online together and watch both addresses in a data view.
4. Enter a test value at the keypad and record the order and the timing of what you see.
5. Match what you saw against the symptom list above and take that path.

One diagnostic shortcut: forcing the handshake bit on for a single entry closes the keypad immediately, and that tells you the panel's read path is alive. Do it with the machine idle, watch the write tag to see the value land, and remove the force when the entry is done.

Time the pulse before you change anything

Put a trend on the handshake address and make one entry. Note how long the bit stays on and convert it to scans: a pulse that lasts one full scan gives the panel a window of one scan time to catch it.

Small PLCs finish their entire logic in 1 to 10 ms per scan, and a brick-style controller with a few hundred rungs sits near the middle of that range, so a one-scan answer is on the wire for a few milliseconds. The panel reads on its own update cycle, which runs on the panel's clock, not on the PLC's scan. For the first test, hold the handshake with a timer set to 100 ms. That is one scan with a wide margin, and it catches update cycles in the tens of milliseconds. If entries still hang at 100 ms, the panel's cycle is slower than your hold, and the fix below removes the guesswork.

Pulse length in scans converts to real time through the scan period; how many PLC scans an HMI momentary button bit stays on works the same conversion for a bit the panel drives.

Example: a 5 ms answer against a 1000 ms read

Say the ladder sets the handshake in one scan and a reset rung clears it at the end of the next, so the bit is on for one scan, about 5 ms at the scan speed above. Data-collection clients reading the same PLC pull values on their own cycle, and 1000 ms, once per second, is the interval most platforms use. The panel's read then has a 5 ms window in every 1000 ms cycle to land on the answer: 5 / 1000 = 0.5 percent, which is one completed entry in 200 tries.

Lengthen the hold to 100 ms and the window becomes 100 / 1000 = 10 percent, one entry in 10. If your keypad completes roughly one entry in ten tries, the arithmetic and the symptom agree, and the fault is confirmed as pulse length. A hold that works sometimes is still a timing fault. The working design holds the answer until the panel closes the keypad, whatever the cycle turns out to be.

The fix: hold the handshake until the keypad closes

Build the response in the ladder as a held answer with a watchdog:

1. Detect the notification bit turning on and set the handshake bit in the same scan.
2. Start an on-delay timer on the notification bit, with the preset from the timing check.
3. Hold the handshake on while the timer runs, and keep it on until the notification bit drops. The notification dropping is the panel closing the keypad, which is the acknowledgment.
4. Add a watchdog: if the notification bit stays on for more than 5 s, clear the handshake and the request and set an alarm bit. A disconnected panel then cannot hold the response on forever.
5. Make sure the timer resets between entries, so every new value gets a full hold and a fresh watchdog window.

With the answer held until the keypad closes, the hold time is the panel's real update cycle, measured entry by entry, and entries complete at any poll rate the site throws at it. The timer preset still matters: it is the minimum hold, and the watchdog bounds the maximum.

Recommendation: Watch both addresses online before changing anything, because a mapping fault and a pulse fault look the same from the keypad. When the two addresses match, hold the handshake with a timer, start at the 100 ms test value, and if any entry still hangs, hold the handshake until the notification bit drops, with a watchdog on the request. Change one thing at a time and make ten real keypad entries before you call the job closed.

Check the repair

• Enter a value at the keypad. The notification address goes on, the handshake follows, the keypad closes, and the write tag now holds the value you typed.
• Repeat ten entries in a row. A repair that passes once and fails on the eleventh is still the pulse fault; lengthen the minimum hold.
• Remove any force or test rung added during diagnosis, and compare the ladder against your saved copy so nothing temporary survives.
• Record the two addresses, the timer preset, and the watchdog time in the project notes. The sequence, not the addresses, is what the next change has to preserve.

Questions