FM 458-1 DP: Diagnosing User STOP Exception Buffer Entry 54

Overview: FM 458-1 DP Diagnostic Architecture

The SIMATIC FM 458-1 DP (Siemens article numbers 6DD1607-0AA1, with variants 6DD1607-0AA2, -0CA1, -0CA2 for the -1 DP and EXM 448 expansion) is a high-performance application module for closed-loop control and technology tasks in SIMATIC S7-400 automation systems. It executes user programs created with CFC (Continuous Function Chart) inside the D7-SYS engineering tool. Unlike standard S7-400 CPUs, the FM 458-1 DP maintains its own diagnostic structure that is reported back to the host CPU in tabular form rather than as a sequential diagnostic buffer in the classic S7 sense.

Field engineers frequently encounter a recurring entry in this structure: ID: #4 USER with Supplementary ID: 54 (User STOP triggered on this CPU). This is one of the most common diagnostic events reported on machines that have been in service for several years, and it is consistently misread as a hardware fault. The entry is informational; it tells the engineer that the FM 458-1 DP transitioned to the STOP operating state on the indicated date and time because of a deliberate, software-driven request — not because of an internal exception.

Official documentation is available in the Siemens Industry Online Support portal under the entry "Application Module FM 458-1 DP" (FM458-1_DP_e.pdf), and the behavior of the EXM 448 expansion module is described in the same manual set.

Decoding the Exception Buffer Entry

The FM 458-1 DP writes a fixed-format record whenever its runtime system transitions between operating states, encounters an internal error, or receives an external stop request. The record format is:

Supplementary ID 54 sits in the USER category (ID #4). The full ID #4 USER range covers user-program stop requests, mode-selector changes, and CFC-driven operating-mode commands. Sub-IDs in this range are summarized below based on Siemens documentation patterns for FM 458-1 DP / D7-SYS:

Reading the SYS_ERR and INIT_ERR Diagnostic Panels

The FM 458-1 DP runtime exposes two summary panels for the technician. Both are reset to zero on a clean restart:

SYS_ERR Panel

Task Manager Error Registers

The task manager controls the cyclic, time-driven, and interrupt task classes on the FM 458-1 DP. Each register is an 8-bit mask:

A value of 0x00 in every register confirms the runtime is healthy and the task manager is servicing all tasks. A non-zero bit indicates a task overrun, a watchdog trip, or a memory allocation failure for that task class.

HW Monitoring and Communication Errors

• HW monitoring error (32-bit): 0x00000000 = healthy. Non-zero values indicate that the FM 458-1 DP firmware detected a hardware anomaly (RAM, flash, or FPGA fault).
• User error (16-bit): 0x0000 = no application-level fault. The CFC application program can write a non-zero value via the "USR_ERR" block family to signal application-detected anomalies.
• Communication error: "no error registered" confirms that the backplane, PROFIBUS DP, and PROFINET (if equipped) segments are clean.

Root Cause Analysis: Why "User STOP" Appears Without Operator Action

Most FM 458-1 DP field reports of Supp ID 54 fall into one of three categories. Each must be ruled out in order.

1. Cascade from the Host S7-400 CPU

When the host S7-400 CPU transitions to STOP, the FM 458-1 DP records ID #4 USER / Supp ID 54 because it is configured by default to follow the host. This is correct behavior. The real cause is on the host CPU side:

1. Open the host S7-400 CPU in SIMATIC Manager.
2. Select PLC > Module Information > Diagnostic Buffer.
3. Look for events such as "STOP due to STOP instruction in OB1", "STOP due to programming error (OB not loaded)", "STOP due to module failure", or "STOP due to communication error".
4. Resolve the host CPU fault; the FM 458-1 DP will start automatically once the host returns to RUN.

2. PROFIBUS DP Master STOP

If the FM 458-1 DP is operated as a DP slave, the DP master can issue a FREEZE / STOP that cascades into the FM 458-1 DP's own STOP state. The supplementary ID is identical (54), but the SYS_ERR / INIT_ERR panels will not show a fault. Confirm by inspecting the DP master diagnostic buffer in STEP 7.

3. CFC Block "CPU-Operating Mode-Stop" Triggered by Application Logic

The CFC library FM458_LIB (shipped with D7-SYS) contains the block CPU_OPMODE and the sub-block CPU_OPMODE_STOP. When wired into the CFC chart, the block can call the FM 458-1 DP runtime to request a STOP based on an application condition. Typical uses include safe-state transitions, watchdog timeouts, and operator-initiated emergency stops. If the chart executes the block, the FM 458-1 DP records Supp ID 54 with the timestamp of the call.

Search the CFC chart in D7-SYS for any instance of CPU_OPMODE or CPU_OPMODE_STOP and trace the enable input back to its source. The most common root cause in customer installations is a latched operator pushbutton or a safety relay contact that is interpreted as a stop request by the CFC logic.

Step-by-Step Verification in SIMATIC Manager

Use this procedure to confirm that the exception buffer entry is the only anomaly and that the FM 458-1 DP is otherwise healthy.

1. Open SIMATIC Manager and navigate to the S7-400 station that contains the FM 458-1 DP.
2. Right-click the FM 458-1 DP symbol and choose PLC > Module Information.
3. Read the "Module Information" tab. Verify that the operating state shown is RUN or STOP, and that the diagnostic LEDs on the physical module (INTF, EXTF, BUSF, IFM1F, IFM2F, WD, FRCE) are off with the exception of the "RUN" or "STOP" indicator.
4. Open the "Diagnostic Buffer" tab of the host S7-400 CPU. Cross-reference the timestamp of the Supp ID 54 entry to a host CPU event. The host CPU event that matches the timestamp is the real root cause.
5. Open the "Performance Data" tab and verify the task configuration matches the engineering data.
6. Open the FM 458-1 DP's own "Diagnostic Buffer" tab — the same panel referenced in the SYS_ERR / INIT_ERR report above.
7. Confirm that all values are 0x0000 except for the user-class event ID #4 USER / Supp ID 54.
8. Optionally use D7-SYS to connect online to the FM 458-1 DP and read the CFC chart in test mode; this confirms the running task state matches the offline chart.

AF06 / AF0C / AF03 Diagnostic Event Sequence

When asked to look in Module Information for events with the IDs AF06, AF0C, and AF03, this is what to expect on a properly functioning FM 458-1 DP that has been re-initialized after a STOP-RUN transition:

The presence of AF06 / AF0C / AF03 in chronological order, with no intermediate event, confirms a clean restart of the FM 458-1 DP following a stop command. The sequence is the expected pattern after any host-CPU-initiated stop, and on its own it is not a fault.

Distinguishing Planned Stops from Genuine Faults

Use the following matrix to classify the entry:

A clean row on the left side and clean front-panel LEDs confirm that the FM 458-1 DP is healthy and that the ID #4 USER / Supp ID 54 entry is purely informational.

Preventative Measures and Long-Term Monitoring

To reduce diagnostic noise in the FM 458-1 DP exception buffer:

• Add a CFC tag named FM458_LAST_STOP_CAUSE that latches the most recent stop request source (host CPU / CFC block / DP master / mode selector). The block writes the cause code to a retentive tag that survives STOP-RUN transitions.
• Wire the output of any CPU_OPMODE_STOP instance to a WinCC alarm tag so that operators see the stop request in the HMI before the FM 458-1 DP transitions.
• Configure the host S7-400 CPU's diagnostic buffer to retain at least 100 entries so that the original cause is preserved across multiple cycles.
• If the host CPU is in a multi-CPU rack, set the FM 458-1 DP's "Cascade behaviour on host CPU STOP" parameter to "Continue running" (where the application permits) to avoid recording Supp ID 54 on every host CPU restart.
• Schedule periodic backup of the FM 458-1 DP diagnostic buffer via the SIMATIC Manager "Save Diagnostic Buffer" function. The buffer is volatile and is lost on a hard power cycle.

For installations that are part of a safety-related system, the FM 458-1 DP must not be used as a SIL-rated controller. Safety functions belong on an F-CPU, configured and programmed in accordance with SIMATIC Safety. Configuring and programming of an F-CPU is documented in the official SIMATIC Safety manual (Configuring an F-CPU). Treat any stop request that originates from a safety I/O as a planned stop; the FM 458-1 DP will simply record the consequence.

When the Entry is Not Just "User STOP"

If the FM 458-1 DP exception buffer shows any of the following, escalate beyond the Supp ID 54 interpretation:

• INIT_ERR <> 0x0000 with bits set in the "Missing reply from the C bus" or "Missing reply from the L bus" fields. This indicates a backplane or EXM 448 communication fault.
• HW monitoring error <> 0x00000000. The firmware has detected an internal hardware anomaly. Replace the module.
• Task manager error bits set in T1..T5. This indicates a task overrun; the cyclic task period is too short for the configured chart size. Increase the T1..T5 period in D7-SYS or split the chart.
• User error <> 0x0000 set by CFC logic. Trace the application-level error back to the CFC chart.
• Multiple ID #4 USER entries with different supplementary IDs in a short time window. This is symptomatic of an unstable DP master, a flapping host CPU, or a faulty backplane connector.

FAQ