Detecting First-Off Signal on Siemens S7-300/S7-400 Machine Stop

When a Siemens SIMATIC S7-300 or S7-400 machine stops unexpectedly while the CPU remains in RUN, the root cause is almost always a single interlock condition that dropped for one or two OB1 scans among several hundred candidates. Manually stepping through 300+ boolean tags in a STEP 7 VAT (Variable Table) is impractical, especially when the fault only occurs once per shift. This technical reference covers integrated diagnostic buffer retrieval, edge-triggered first-off latching, bit-packing into diagnostic WORD groups, timestamp arbitration, and HMI visualization to capture the very first signal that dropped when the machine stopped.

1. Problem Definition and Symptoms

The reported symptom set is characteristic of a process interlock trip rather than a CPU fault:

• CPU status LED shows RUN steady green.
• Neither SF (Group Error / System Fault) nor BF (Bus Fault) LED is lit.
• The STOP key has not been pressed and the mode switch is not in MRES or STOP position.
• Outputs de-energize because a process condition in the user program (interlock, permissive, or safety chain) evaluated false.
• The fault window is shorter than the operator response time, so VAT inspection cannot catch the transient drop.
• The fault reoccurs only once per shift or once per day, ruling out a hard wiring failure.

Two diagnostic paths apply. Path A uses the integrated diagnostic buffer built into every S7-300/S7-400 CPU. Path B (and usually the only viable one when the dropped signal is a normal process I/O, not a CPU diagnostic event) uses user-program edge detection to latch the first falling edge.

2. CPU Variants and Diagnostic Buffer Capacity

The size of the CPU diagnostic buffer (in STEP 7 classic: PLC → Accessible Nodes → right-click CPU → System Information → Diagnostic Buffer; in TIA Portal: Online & Diagnostics → Diagnostics → Diagnostic buffer) depends on the CPU model. Use the table below to plan how much history is locally available before you retrieve it over MPI/PROFINET.

Always capture the buffer immediately after the fault event. The entry order is reverse chronological; the most recent event is at the top. Save the buffer as plain text via File → Save As for inclusion in the maintenance log. The official Siemens STEP 7 in TIA Portal landing page documents the buffer access path: STEP 7 in TIA Portal — Siemens official product page.

3. Edge Detection Theory in STEP 7

A falling-edge detector (negative edge / NEG) recognizes the OB1 scan in which a boolean tag transitions from 1 → 0. Latching this transition in a separate marker freezes the event so it remains visible after the cycle that produced it. Latching is essential because the original tag may transition back to 1 in the next scan as a consequence of upstream recovery logic.

Three implementation patterns are used in STEP 7 classic and TIA Portal:

3.1 Direct NEG / FP Instruction

In LAD or FBD, the NEG (negative edge) instruction on a single tag outputs a one-cycle pulse on the 1 → 0 transition. Feed the NEG output into an SR (Set-Dominant) flip-flop whose Set coil uses a retentive M-bit or DB-bit. The latched bit is read by the HMI or VAT. The flip-flop is reset by an explicit operator acknowledge, never by the NEG output, otherwise the latch clears itself every cycle.

3.2 Manual Edge with Edge Memory Bit

When working in STL or for clarity inside a function block:

// STL implementation — one rising-edge helper per channel
A    "i_Signal_001"          // process input
FP   "stat_EdgeMem_Sig001"   // edge memory bit (static VAR in FB)
=    "stat_Falling_Sig001"   // one-shot pulse on 1 -> 0

// Latch the pulse in a retentive flag
A    "stat_Falling_Sig001"
S    "stat_Latch_Sig001"     // latched first-off marker

// Manual reset requires operator action
A    "i_Operator_Reset"
R    "stat_Latch_Sig001"

3.3 First-Wins Arbitration

When more than one signal can drop in the same OB1 scan, an arbitration block compares timestamps of all latched first-off markers and surfaces only the earliest. A 32-bit system clock (SFC 64 TIME_TCK) provides monotonic millisecond timestamps; the lowest timestamp at scan N wins. This pattern is essential when the stop cause is a cascade: signal A drops, then signal B drops one cycle later as a consequence. Reporting both is correct; reporting only B misleads the operator toward a secondary symptom.

4. STEP 7 Function Block: First-Off Capture FB

The following FB consolidates edge capture for an array of 16 boolean tags packed into a single WORD. It is reusable across S7-300 and S7-400 and runs in OB1 with no special OB requirements. It also handles the bit-pack / word conversion pattern documented for S7-1200 in the official SIMATIC S7-1200 debugging and testing reference.

FUNCTION_BLOCK FB 100 "First_Off_Capture"
VAR_INPUT
  i_Signals : WORD ;          // 16 process tags, packed
  i_Reset   : BOOL ;          // operator reset
END_VAR
VAR_OUTPUT
  o_Latch   : WORD ;          // latched first-off bitfield
  o_AnyTrip : BOOL ;          // OR of all latched bits
END_VAR
VAR
  stat_Edge : WORD ;          // previous scan i_Signals
END_VAR
VAR_TEMP
  t_InvNow  : WORD ;          // inverted current state
  t_InvPrev : WORD ;          // inverted previous state
  t_Delta   : WORD ;          // bits that fell this scan
  t_I       : INT ;           // loop index
END_VAR
BEGIN
  // 1 -> 0 transition = bits set in previous AND clear in current
  t_InvNow  := i_Signals XOR 16#FFFF;
  t_InvPrev := stat_Edge XOR 16#FFFF;
  t_Delta   := t_InvNow AND stat_Edge;     // bits that just went 0

  // Latch the falling edge into o_Latch (set-dominant)
  o_Latch := o_Latch OR t_Delta;

  // Store current state for next scan
  stat_Edge := i_Signals;

  // Reset on operator command
  IF i_Reset THEN
    o_Latch := 16#0000;
  END_IF;

  // OR-reduction for alarm generation
  o_AnyTrip := (o_Latch <> 16#0000);
END_FUNCTION_BLOCK

Call FB100 once per group of 16 signals. Pack each input into its group word by addressing I-area bits directly or by writing to a global DB through symbolic assignment. For mixed I and M sources, mirror the bits first into a DB so the pack is independent of input image partition boundaries.

5. Packing Booleans into Diagnostic Words

STEP 7 symbolic tag tables grow quickly. To keep the project readable, build a dedicated diagnostic DB (e.g., DB200) of type STRUCT ... END_STRUCT with one WORD per logical group. With 20 groups you cover 320 signals.

DATA_BLOCK DB 200
  STRUCT
    grp_LubeOk      : WORD ;    // .0 = Lube pressure, .1 = Lube level, ...
    grp_PowerOk     : WORD ;    // .0 = Main contactor, .1 = 24VDC OK, ...
    grp_SafetyOk    : WORD ;    // .0 = E-Stop, .1 = Guard 1, .2 = Guard 2, ...
    grp_ProcessOk   : WORD ;    // .0 = Material present, .1 = Temp OK, ...
    grp_DriveOk     : WORD ;    // .0 = VFD ready, .1 = Brake released, ...
    grp_AuxOk       : WORD ;    // .0 = Cooling, .1 = Compressor, ...
    grp_TickAtDrop  : ARRAY[1..20] OF DWORD ; // TIME_TCK at first-off
    // ... up to 20 groups for 320 signals
  END_STRUCT ;
END_DATA_BLOCK

Pack each boolean into its group WORD using bit-move logic or the standard BOOL_TO_WORD / WORD_TO_BOOL conversion helpers. On S7-300/400 there is no native BOOL-to-bit-position instruction; use a small helper that reads the bit, masks it, and shifts it into the target position, or use the symbolic absolute addressing (DB200.grp_LubeOk.X3) directly.

6. HMI Visualization with WinCC flexible / TIA WinCC

Once DB200 is populated, display each latched word on an HMI fault page. For each bit, configure a status display with two graphics: gray = OK, red = Latched first-off. Connect the symbol to DB200.grp_LubeOk.X0 through .X15. Operators can scroll the fault page and immediately identify which condition dropped first, without needing STEP 7 online access.

7. Alternative: Real-Time Trace Tools

Third-party real-time trace tools such as PLC Analyzer Pro capture every signal transition at the bus level without user-program modification. Set the trace on the suspected 300 tags with a sample time of 10 ms and a trigger on the machine-stop condition (e.g., MachineRunning going 1 → 0). The trace buffer holds the last N seconds; download it after the fault and identify the first tag to drop.

PLC Analyzer requires no PLC program change and works on S7-300/400 over MPI, PROFIBUS, or PROFINET. The trade-off is licensing cost and the need for a permanently connected engineering port or Ethernet tap. As a free alternative, use the S7-PCT (Port Configuration Tool) or the TIA Portal trace function available on S7-1500 / ET 200SP CPUs — note that S7-300/400 do not have on-board trace, which is one reason the user-program latching approach is preferred on those platforms.

8. Timestamp Discipline with SFC 64 (TIME_TCK)

To capture the order of multiple simultaneous drops, record a 32-bit timestamp from SFC 64 TIME_TCK at the moment each latch is set. TIME_TCK returns a monotonic counter at the CPU cycle-tick rate (10 ms on most S7-300 CPUs, 1 ms on S7-400 high-end CPUs). Save the minimum timestamp per group in DB200 and surface the value on the HMI for accurate root-cause analysis.

CALL SFC 64 // TIME_TCK
RET_VAL := "stat_NowTick"   // DWORD, milliseconds since last CPU restart

// In FB100, when t_Delta <> 0:
//   "stat_TickAtDrop" := stat_NowTick

Note that TIME_TCK wraps after 2^32 ticks. At 10 ms tick that is roughly 497 days; at 1 ms tick roughly 49.7 days. For long-running systems convert to wall-clock time via SFC 1 READ_CLK on the same cycle the tick is captured.

9. Implementation Sequence

1. Inventory all candidate signals: open the STEP 7 Symbol Table and filter on the OB1 segment that drives MachineStop. Tag each as lubrication, power, safety, process, drive, aux.
2. Create DB200 with one WORD per logical group (max 16 signals per WORD) plus a timestamp array.
3. Implement FB100 First_Off_Capture. Place one instance (multi-instance or DB-instance) per group.
4. Insert the edge-capture wiring in OB1 BEFORE the interlock logic that drives the machine stop; this guarantees you see the input drop before the program suppresses it.
5. Build an HMI faceplate per group showing 16 colored bits + a timestamp + a reset button.
6. Add an HMI reset button (write to i_Reset per group) to clear the latches after acknowledgment.
7. Enable non-volatile storage on the S7-400 CPU (battery-backed RAM) so latches survive power cycles; on S7-300, latches are RAM-only and require UPS if you must survive power loss.
8. Document the wiring on the operator's first-shift checklist and add a maintenance procedure to read DB200 weekly.
9. Perform the verification tests in Section 10 before returning the machine to production.

10. Verification and Commissioning Tests

11. Troubleshooting Matrix

12. Field-Commissioning Caveats

On S7-300, the OB1 scan time commonly sits between 5 ms and 50 ms. A mechanical switch bounce or a noisy 24 V signal that pulses for less than one OB1 scan will be missed by edge detection. Either debounce in hardware (RC filter on the input) or use the S7-300/400 onboard input filter, configurable per channel in HW Config → Properties → Inputs → Input filter with typical values 0.8 ms, 3.2 ms, and 12.8 ms.

On S7-400, OB1 partial restarts and OB85 / OB122 error OBs can rewrite I-area values. Verify that no OB is masking the channel of interest during the fault window. Where the input is read in OB35 (cyclic interrupt), the capture block must also live in OB35; do not assume OB1 sees the same value.

For PROFIsafe or PROFIBUS-PROFIsafe inputs, latching must occur AFTER the F-driver block, not before; otherwise the latched bit may reflect the safe-state coupling rather than the process signal and produce a misleading root cause.

When connecting via PROFINET, observe that the S7-300 CPU update time for distributed I on PROFINET is typically 1–4 ms; the OB1 capture must run faster than that update or the edge can be missed between two PROFINET update cycles. In that case move capture to OB35 at the same period as the PROFINET update time.

13. Performance and Scan-Time Impact

Each FB100 instance adds roughly 12 µs per OB1 scan on a CPU 315-2 DP and 6 µs on a CPU 416-3 PN/DP. With 20 instances covering 320 signals, total overhead is approximately 240 µs on the S7-300 and 120 µs on the S7-400 — well under 1% of typical OB1 scan budget. Timestamp capture with SFC 64 adds another 8–15 µs per call; call it once per OB1 and pass the result to all FB100 instances via a shared variable rather than calling SFC 64 inside each instance.

14. Summary

Identifying the dropped signal among hundreds of candidates on Siemens S7-300/S7-400 requires two complementary techniques: use the integrated diagnostic buffer for any CPU-level events (I/O faults, bus faults, OB errors), and implement user-program edge detection with a Set-Dominant latch for process interlock trips. Pack the booleans into WORD groups, latch the first 1 → 0 transition per group, capture a TIME_TCK timestamp at the moment of drop, and visualize on WinCC flexible / TIA WinCC for operator-side root-cause identification. The pattern scales to several hundred signals per machine and adds less than 1 ms to the OB1 scan when implemented in compact FB form.