An S7-200 system powers up, but commissioning exposes unstable analog values, missed pulses, communication delays, address conflicts, or unexpected outputs in STOP. Treat these as configuration and architecture faults: establish the exact CPU and project baseline, prove each power budget, configure deterministic I/O behavior, and verify the complete signal path under operating conditions.
Project and CPU Baseline
Identify the engineering software and CPU hardware before changing the project. STEP 7-Micro/WIN V4.0 was specified for Windows 2000 SP3 or later, Windows XP Home, and Windows XP Professional. Operation on other operating systems was not covered by that specification.
Project compatibility is one-way. A newer Micro/WIN release can open projects created by an older release, but an older release cannot open or upload a project generated by V4.0. Micro/WIN V2.1 can act as a conversion bridge for older project files: open the old project, save it, and then open the saved copy in the newer software. A red invalid network after conversion can indicate that the selected PLC type or hardware version does not support an instruction. Change the configured CPU only when the installed hardware and program requirements justify it.
CPU22x order numbers ending in 6ES721x-xxx21-xxxx identify hardware version 21; numbers ending in 6ES721x-xxx22-xxxx identify version 22. Version 22 retains version 21 functions, removes intelligent-module position restrictions, and replaces the 300 and 600 baud free-port rates with 57,600 and 115,200 baud. The CPU processor data width is 32 bits, reflected by accumulators AC0 through AC3.
Check 1: expect the project to compile for the CPU type and hardware version printed on the installed unit, with no red invalid networks.
Power, Environment, and Retention
Read the CPU supply marking before landing conductors. Applying 220 VAC to a 24 VDC CPU, or to the CPU's 24 VDC sensor-supply output, can destroy the CPU.
The CPU supplies 5 VDC over the I/O bus to expansion modules. Add every module's 5 V load and compare the total with the selected CPU's stated capacity. An external 5 V supply cannot supplement an overloaded I/O bus. Separately total the loads on the CPU's 24 VDC sensor supply, including local inputs, expansion inputs, and expansion-module relay coils. If this total exceeds the CPU rating, supply the expansion loads from an external 24 VDC source using the required common-reference arrangement.
An EM277 does not inherently require the listed 24 VDC allocation; its requirement depends on the load powered through its communication port. Power used by a PC/PPI cable or TD 200 connected to a CPU communication port is already accounted for and does not need to be added again.
| Installation condition | Specified operating range |
|---|---|
| Standard S7-200, horizontal mounting | 0 to 55 degrees C |
| Standard S7-200, vertical mounting | 0 to 45 degrees C |
| Standard S7-200 humidity | 95% relative humidity, non-condensing |
| SIPLUS S7-200 | -25 to +70 degrees C |
| SIPLUS humidity | 98% at 55 degrees C; 45% at 70 degrees C |
Use the distinct SIPLUS order number when operation below 0 degrees C is required. Text and graphic display panels were not offered in the stated wide-temperature range.
Retention selections define which data survives a power interruption. The internal supercapacitor maintains selected data first; an installed battery or clock/battery card continues support after the capacitor discharges. If MB0-MB13 is configured as retentive, the CPU writes those 14 bytes to the corresponding EEPROM area during power-down. At startup, EEPROM replaces a retentive area only when capacitor or battery retention failed; non-retentive configured areas are initialized from EEPROM. CPU221 and CPU222 require a clock/battery card for a real-time clock, while CPU224, CPU226, and CPU226 XM contain one.
Check 2: expect both calculated supply totals to remain within their separate CPU ratings, the ambient conditions to match the selected product, and retained test data to return correctly after a controlled power cycle.
Module Addresses and Signal Wiring
Document the installed module order before assigning symbols. Analog I/O addresses advance in two-channel module increments. On a CPU224 XP, the first expansion analog input after the onboard analog I/O starts at AIW4; the first expansion analog output starts at AQW4, and AQW2 is unavailable.
Intelligent modules also consume process-image addresses for control, status, or mapped data. For example, CP243-2 uses IB/QB for control and status and uses AI/AQ for AS-Interface slave mapping. Use Micro/WIN Cross Reference after compilation to find duplicate or unintended address use and jump directly to each reference.
S7-200 digital input circuits accept sourcing or sinking sensor outputs when the input common is wired accordingly: connect either L+ or M to the common as required by the sensor polarity. Two-wire digital sensors are usable only when their static leakage current is below 1 mA. Digital and analog points are not bidirectional; an input cannot be reassigned as an output.
CPU224 XP inputs I0.3, I0.4, and I0.5 can receive 5 VDC high-speed signals while other inputs receive 24 VDC signals when both supply commons connect to 1M and both signal groups use the same sourcing-or-sinking convention.
Check 3: expect every physical channel to have one unique address, the Cross Reference to show only intended reuse, and each input indication to follow its field signal without an off-state false ON condition.
STOP-State Output Configuration
Configure the output table before testing machinery. With Freeze output in last state selected, digital outputs retain their pre-STOP states and individual output-table selections no longer apply. Without freeze, selected digital points turn ON and unselected points turn OFF in STOP.
The analog rule is parallel: freeze retains each channel's last value, while disabling freeze makes the configured STOP value for each analog channel effective. Choose states from the machine's risk analysis, including brakes and critical valves; retaining motion merely because it is convenient during commissioning is wrong practice.
- De-energize or isolate actuators whose movement has not been validated.
- Configure digital and analog STOP behavior in the system block.
- Download the system block to the CPU.
- Command STOP and measure the physical outputs, not only the program status display.
Check 4: expect every digital output and analog channel to assume its documented STOP state when the CPU changes from RUN to STOP.
Digital Response and High-Speed Functions
Normal digital response contains input hardware delay, input-image refresh, program execution, output-image update, and output hardware delay. Field-device delays, such as an interposing relay's operating time, add to that total. Program scan time generally increases with program size and must be read online at PLC > Information after the program has run.
| Symptom | Likely mechanism | Action |
|---|---|---|
| Short pulse never appears in logic | Pulse is shorter than the configured input filter or scan-dependent sampling interval | Use pulse capture, a hardware interrupt, or a high-speed counter |
| Output changes too late | Scan and output hardware delays are included in the path | Use direct output or supported high-speed pulse output |
| Noisy input toggles | Filter is too short for the interference duration | Increase the filter and retest the required valid pulse |
| Online function block turns red |
ENO=0, repeated invocation while active, or a busy communication port |
Read PLC > Information and correct the call sequence or port contention |
CPU digital input filtering is selectable from 0.20 to 12.8 ms; the stated default is 6.4 ms. At 6.4 ms, a high or low state lasting less than 6.4 ms is ignored, while a longer state can be recognized. The setting affects input-image refresh, digital input interrupts, and pulse capture. An input assigned to an enabled high-speed counter bypasses this filter.
For sequence pulses, use the CPU's high-speed counter. For event-driven signals, use supported hardware input interrupts. Direct-read and direct-write instructions bypass process-image timing, while pulse capture retains a short event for program processing. The minimum periodic timed task is 1 ms, so it is not a substitute for dedicated hardware when the total response requirement is shorter.
CPU224 XP supports two high-speed outputs, Q0.0 and Q0.1, at up to 100 kHz on the DC/DC/DC model. They accept 5 to 24 VDC, but Q0.0-Q0.4 form one voltage group and must use the same voltage; 5 V on the high-speed points and 24 V on Q0.2-Q0.4 is not permitted. In high-speed input service, two channels reach 200 kHz for single-phase pulse input or 100 kHz for two-phase 90-degree quadrature input. A relay output used normally has a stated switching frequency of 1 Hz.
Check 5: expect a test pulse at the minimum valid width and maximum required rate to be counted once, with the measured physical output response inside the machine requirement.
Analog Scaling, Filtering, and Stability
Distinguish resolution from accuracy. S7-200 analog modules use 12-bit conversion, so one converter count represents 1/4096 of full scale. System accuracy also includes input noise, interference, drift, and analog front-end error and therefore cannot be inferred from resolution alone.
Scale raw values with Ov = [(Osh - Osl) * (Iv - Isl) / (Ish - Isl)] + Osl. Here, Iv is the raw input, Isl and Ish are its low and high limits, and Osl and Osh are the engineering-unit limits. S7-200 unipolar values span 0 to 32000; bipolar values span -32000 to +32000.
A module can accept current on one channel and voltage on another only when both ranges use the same module-wide DIP-switch setting. The cited compatible example is 0 to 5 V with 0 to 20 mA.
Analog filtering averages the configured number of samples before each scan. A new sample outside the deadband becomes the new value immediately and starts a new average, allowing large changes to pass rapidly. A deadband of zero averages every change. For a faster response, use a smaller sample count and set deadband near the largest expected disturbance; 320 counts equals 1% of a 32000-count span. Disable filtering for rapidly changing analog signals, analog channels carrying digital information, EM231 RTD, EM231 TC, and CP243-2. CPU224 XP onboard analog input responds in 250 ms and uses a different conversion method; its onboard analog channels do not use the expansion-module filter selection.
Large unstable readings commonly come from an undefined common-mode reference. The analog module is non-isolated, common-mode voltage must not exceed 12 V, and the stated common-mode rejection at 60 Hz is 40 dB. Connect the sensor signal negative to module common M as the single connection between the two supply systems, after verifying that another bond does not already exist. Also inspect long cables and damaged insulation before masking the problem with filtering.
Check 6: expect the raw count to remain stable with the field input fixed, the scaled endpoints to match the configured range, and common-mode voltage to stay below 12 V.
Communication-Port Commissioning
The CPU ports are electrically RS-485 and default to PPI slave mode, address 2, at 9.6 kbit/s. Change address and rate under Communication Ports in the system block, then download the system block before expecting the new settings.
The ports support PPI, limited MPI operation as a slave, and user-defined free-port communication. Micro/WIN supplies USS functions for the listed Siemens drives and a Modbus RTU library. Two-port CPUs can run different modes and rates on each port, and the numerical port addresses may match because the attached devices form separate networks. The CPU does not bridge those networks.
A compliant S7-200 segment has a specified guaranteed length of 50 m. Add a repeater beyond 50 m; one repeater extends the network by another 50 m. A pair of repeaters may be separated by up to 1000 m when no S7-200 CPU station lies between them; an EM277 may lie in that interval. Because CPU ports are non-isolated, maintain equal port reference potentials and control cable, connector, termination, and electromagnetic conditions.
For token-passing performance, set the highest station address close to the actual highest address and assign master addresses contiguously. A larger gap-update factor reduces unnecessary searches but delays discovery of a new master.
Check 7: expect every station to communicate at its configured address and rate, with no retries or dropouts during maximum normal traffic and operation of nearby electrical loads.
Program, Security, and End-to-End Verification
Compile with PLC > Compile and read program and data-block size in the message window. Compilation errors prevent downloading; double-click an error to open its location. Runtime programming on version 23 CPUs consumes program memory on affected CPU models, so disable that feature when the full program area is required. Increasing background communication time makes online monitoring more responsive but lengthens the program scan.
After downloading a CPU password in the system block, break the existing trusted session before testing it: disconnect Micro/WIN for more than one minute, restart Micro/WIN, or power-cycle the CPU. Password protection still permits user-data access, CPU start/stop, and real-time-clock access. A level-three password prevents program reading or modification.
Clearing an unknown password erases the resident program. Available methods are PLC > Clear with all three blocks selected, wipeout.exe from the STEP 7-Micro/WIN installation media, or startup with an unencrypted external memory card that overwrites the protected program. Clearing CPU memory leaves the network address, baud rate, real-time clock, and external memory-card contents unchanged. Separately encrypted program organization units remain locked after download and upload but remain executable. A V4.0 project-file password accepts up to 16 case-sensitive letters or digits.
- Compile and clear every error.
- Confirm program size, data-block size, address cross-references, and online scan time.
- Cycle RUN to STOP and verify configured output behavior.
- Exercise each digital input, high-speed channel, analog endpoint, and communication path.
- Power-cycle the CPU and verify retention, clock behavior, port settings, and automatic restart behavior required by the application.
Check 8: expect no diagnostic error in PLC > Information, no unintended red online blocks, correct physical I/O operation, stable communications, and retained values matching the documented retention map.
Frequently Asked Questions
How do I stop an S7-200 from missing short input pulses?
Compare the pulse width with the 0.20 to 12.8 ms input-filter setting and the measured scan time. Use pulse capture, a hardware interrupt, or a high-speed counter when scan-based logic cannot sample the event reliably.
How do I connect NPN or PNP sensors to an S7-200?
Wire the input common to L+ or M to match the sensor's sourcing or sinking output. For a two-wire sensor, verify that static leakage current is below 1 mA.
How do I stabilize a fluctuating S7-200 analog input?
Measure the common-mode voltage, keep it below 12 V, and create one connection between sensor negative and module M when isolated supplies otherwise have no reference. Repair cable or insulation faults before applying analog filtering.
How do I clear an S7-200 CPU password?
Use PLC > Clear with all three blocks selected, wipeout.exe, or an unencrypted external memory card. The operation removes the CPU program, so retain a verified project backup before proceeding.
How do I prove an S7-200 is ready for service?
Run the final verification with field loads connected: expect correct RUN and STOP outputs, one count per test pulse, stable scaled analog endpoints, uninterrupted network traffic, and the documented data and clock state after a controlled power cycle.