yeah, I just figured out how to do this on my pages. here's the general idea: PHP scripts execute immediately then dump out HTML which is displayed to the user... so by the time someone is sitting for 20 minutes without doing anything, that's about 20 minutes longer than PHP has even been operarting. so PHP can't really check the timeout.
instead what you need is a nice META refresh tag at the top fo each of your pages that says "after 20 minutes, point them to the logout.php" page. and logout.php kills the session, zaps the cookies, wipes the floor, locks the door and calls it a day.
hope that helps
eric