Master Control Relay (MCR) in Siemens S7 PLCs: Practical Use

Overview of the Master Control Relay (MCR) Instruction in Siemens S7

The Master Control Relay (MCR) instruction in Siemens SIMATIC S7-300, S7-400, and S7-200 controllers is a program-control function that conditionally enables or disables a defined zone of ladder logic. The MCR zone is delimited by a pair of instructions: MCRA / MCRD activate and deactivate the MCR mechanism, while MCR( and )MCR mark the start and end of a stack-nested sub-zone. Inside an active MCR zone, the RLO (Result of Logic Operation) is written to the MCR stack. When the MCR bit is FALSE, every assignment inside the zone is forced off, timers do not run, counters freeze, and jump-distribution outputs are reset.

Although the S7-Help describes MCR in detail, the instruction is rarely required in modern applications. The majority of control logic can be written by adding an explicit enable condition to the rung instead of relying on a global relay. This article consolidates the operational behavior, a working ladder example, the documented safety limitations, and the recommended alternatives.

MCR Stack Mechanics and the MCR Stack Pointer

The S7 CPU maintains a dedicated MCR stack that is one byte wide and up to eight levels deep. Every MCR( instruction pushes the current RLO of the master rung onto the stack; every )MCR pops the stack. The stack pointer increments with each MCRA / MCR( pair and decrements on MCRD / )MCR. Nesting depth is therefore limited to eight zones; exceeding this depth triggers a CPU fault (typically a "MCR stack overflow" diagnostic buffer entry on S7-300/400, OB121 priority-class error).

When the MCR bit (the RLO of the master control rung) is FALSE, the following rules apply inside the active zone:

• All = assignments write a 0 to the assigned bit, byte, word, or double word.
• All S (set) instructions are not executed; latched bits remain in their previous state.
• All R (reset) instructions are not executed; latched bits are not cleared.
• Timers (SP, SE, SD, SS, SF, SR) do not start; running timers stop counting but retain their current value.
• Counters (CU, CD, CUD) are inhibited; no count pulses are accepted.
• Jump functions (JMP to JMPN) inside the MCR zone are not executed.
• Master control relays do not affect FC/FB calls or arithmetic instructions; only memory assignments are masked.

Distinguishing the Program Instruction from the Hardware Master Control Relay

The hardware Master Control Relay is a discrete device defined in IEC 60204-1 as a hard-wired contactor that removes power from the machine actuators when the E-stop, guard interlock, or thermal overload trips. It is independent of the PLC; it sits in series with the motor contactors and is reset by deliberate operator action. The MCR is part of the IEC 60204 "Stop categories" taxonomy:

The software MCR instruction described in this article is a different artifact. It is a programming primitive that masks output writes, and it should never be confused with the hardware safety relay mandated by IEC 60204-1 clause 9.2.5.4.

Prerequisites for Using MCR in S7-300/400

1. STEP 7 V5.5 or TIA Portal V13 or later (MCR is available in both editors for S7-300/400 targets).
2. The block being edited (OB, FC, FB) must contain both MCRA and MCRD; without the activation pair, MCR( and )MCR are ignored.
3. CPU firmware must support the instruction set. All S7-300 CPUs (CPU 312 to CPU 319) and all S7-400 CPUs (CPU 412 to CPU 417) support MCR. S7-1500 CPUs do not support MCR; it has been removed from the TIA Portal instruction set for S7-1200/1500 targets.
4. Project compilation should be checked for "MCR nesting too deep" warnings (STEP 7 emits a warning at nine or more nested zones).

Step-by-Step Ladder Example (FBD/LAD)

The example below implements a permissive-controlled discharge station. Output Q 0.0 (Conveyor Run) and timer T1 (Dwell Time) operate only when both the main enable I 0.0 and the zone permission I 0.1 are TRUE. Loss of either signal freezes the outputs without resetting the latched "Cycle Complete" flag M 10.0.

Network 1 — Activate MCR and define master rung

|  MCRA   |   -- Activate MCR mechanism
|  I 0.0  |   -- Main enable (TRUE = MCR bit = 1)
|  I 0.1  |   -- Zone permission
|  MCR(   |   -- Open nested zone (pushes RLO onto MCR stack)

Network 2 — Standard MCR-masked output

|  I 0.2  |   -- Run request
|  T1     |   -- Dwell done
|  =  Q 0.0   -- Conveyor run, MCR-masked assignment

Network 3 — Timer that stops when MCR is FALSE

|  I 0.3  |   -- Start dwell
|  SP T1  |   -- Pulse timer, MCR-masked
|  T#5s   |
|  )MCR   |   -- Close nested zone (pop MCR stack)
|  MCRD   |   -- Deactivate MCR mechanism

If I 0.0 drops, the MCR bit becomes FALSE. Inside the zone Q 0.0 is forced to 0 on every cycle, T1 stops counting, and any set latches (S M 10.0) are left untouched. When the MCR bit returns to TRUE, normal program execution resumes from the current state of the latches and the frozen timer value.

STL (Statement List) Equivalent

      A     I 0.0        // Main enable
      A     I 0.1        // Zone permission
      MCRA               // Activate MCR
      MCR(               // Open nested zone (RLO pushed)
      A     I 0.2        // Run request
      A     T1           // Dwell done
      =     Q 0.0        // Conveyor run (MCR-masked)
      A     I 0.3        // Start dwell
      L     S5T#5S       // 5 second pulse
      SP    T1           // Pulse timer (MCR-masked)
      )MCR               // Close nested zone
      MCRD               // Deactivate MCR

Why MCR Is Considered Misleading in Service Situations

Field experience, particularly on S7-300 systems commissioned in the late 1990s and early 2000s, has highlighted several operational issues that make MCR undesirable for service technicians:

• Hidden enable state: A rung whose conditions are all TRUE may still not set the output because the enclosing MCR is FALSE. The logic appears correct in the editor but behaves contrary to the visible inputs.
• Asymmetric handling of set and reset: While = writes are forced to 0, S and R are inhibited, so latched bits do not follow the masked behavior. Engineers expect a "relay off" to clear latched bits; MCR does not.
• No visibility in cross-reference: The MCR bit is typically held in a single shared flag (for example, M 0.0). Standard cross-reference tools do not propagate that flag into the affected rungs, so the impact of a faulty MCR is non-local.
• Stack corruption from block boundaries: If MCRA is in OB1 and MCRD is inside a called FC, the stack is left dirty when the FC returns. This produces intermittent "MCR stack overflow" faults in the diagnostic buffer that are difficult to reproduce.
• Defensive program scan cost: Each MCR( pushes an entry that the CPU must monitor on every scan, increasing execution time on larger zones.

Modern Alternatives to MCR

For S7-300/400 projects that have not yet been migrated, and for new S7-1200/1500 developments, the following patterns replace MCR cleanly:

Safety Architecture: Why E-Stop Must Not Use MCR

1. Single-channel dependence: MCR is software-only; a CPU fault, a memory corruption event, or a watchdog reset can leave the MCR bit in an undefined state.
2. Common-cause failures: The same CPU, backplane, and program that run production also evaluate the MCR. A short circuit, a programming error, or a firmware bug disables the safety function in parallel with the controlled process.
3. Diagnostic coverage: A standard PLC does not perform cross-checking of its own I/O, its program flow, and its memory. Safety-integrated CPUs (S7-1500F, S7-300F, ET 200S F-modules) execute a second, diverse program on a redundant channel and detect discrepancies within the required proof-test interval.
4. Reset semantics: IEC 60204-1 clause 9.2.5.8 requires that the reset of a safety stop shall not initiate a restart. MCR does not prevent a downstream rung from restarting the machine when the MCR bit returns to TRUE.

The accepted architecture is to install a hardware E-stop relay (for example, a Pilz PNOZ s4, Sick UE10, or Siemens Sirius 3SK1) that physically interrupts the contactor coils. For larger installations with many E-stops, a dedicated safety PLC such as the Siemens SIMATIC F-CPU (S7-1500F), a Sick Flexi Soft, or a Pilz PMCprotego S-Link exchanges safety telegrams over PROFINET/PROFIsafe or PROFIsafe-over-PROFIBUS with the standard CPU. Two-channel E-stop contacts are wired directly to the safety inputs of the safety PLC, and a single PROFIsafe bit is then published to the standard program for indication. This eliminates the daisy-chain wiring of E-stops and gives the safety controller full diagnostics of each device.

Field Commissioning Checklist for MCR Zones

If MCR is retained in a legacy S7-300/400 project, verify the following during commissioning:

1. Confirm MCRA / MCRD are paired within the same block; cross-check the cross-reference for unbalanced pairs.
2. Watch the diagnostic buffer online with STEP 7 "Monitor/Modify" and verify there are no MCR-stack overflow entries (event ID 0x2542 on S7-300, 0x4570 on S7-400).
3. Force the MCR bit FALSE and verify every masked output, timer, and counter behaves as expected. Document the results in the commissioning report.
4. Verify that the MCR bit is not derived from any safety-relevant input (E-stop, guard interlock, two-hand control, muting lamp). If it is, redesign the safety chain.
5. Confirm the nesting depth never exceeds 8, including the implicit level created by MCRA.
6. Ensure latched bits inside the zone are explicitly reset on the MCR recovery transition, otherwise production will resume with stale state.

Troubleshooting Matrix for MCR-Related Faults

Migration Path: S7-300/400 to S7-1500

When an S7-300/400 program is ported to an S7-1500 (or any S7-1200) target, TIA Portal flags every MCRA / MCRD / MCR( / )MCR as "instruction not available". The conversion tool offers no automatic replacement. The recommended migration pattern is:

1. Search for MCRA / MCRD with the cross-reference tool; mark every MCR zone in the source project.
2. For each zone, identify the MCR enable bit and add it as a series contact on every affected rung, or move the gated logic to a separate FC that is called conditionally.
3. Convert SP/SE/SD/SS timers inside the zone to the new IEC timer TP / TON / TOF with an explicit enable input.
4. Replace CU/CD/CUD counters with CTU/CTD/CTUD IEC blocks that take the same enable condition.
5. Run the TIA Portal "Consistency Check" and download to the new CPU; verify against the original commissioning report.

Reference to Official Documentation

The MCR instruction is described in the STEP 7 "Programming with STEP 7" manual and the S7-300/400 system manuals. For SIMATIC controllers and the Rockwell FactoryTalk Design Studio instruction set, the public reference page is Master Control Reset (MCR) in FactoryTalk Design Studio which documents the equivalent MCR concept for Allen-Bradley Logix Designer. The functional-safety perspective is documented in the IEC 60204-1 "Safety of machinery — Electrical equipment of machines" standard, available from IEC, and in Siemens application notes for the S7-1500F / ET 200SP F modules.

FAQ