Monitoring TR CE65M Profibus Encoder Counts in Siemens S7 OB35

Application Overview

This technical reference documents the integration of a TR Electronic CE65M Profibus absolute rotary encoder with a Siemens SIMATIC S7-300/400 PLC for a machine lifting and lowering application. The encoder is wired to the PLC through Profibus DP, and the application uses the position value to track vertical travel. The engineering team needs a deterministic method to verify that the encoder counts being received by the PLC are valid, that the value is updating while motion is commanded, and that a frozen value due to a cable break, slave failure, or internal encoder fault is detected and annunciated before the machine is allowed to continue a lift.

The CE65M is a multi-turn absolute encoder with a maximum 25-bit output. The internal architecture is 13-bit single-turn (8192 increments per revolution) combined with 12-bit multi-turn (4096 revolutions). Because the encoder is absolute, the PLC does not need to count pulses, does not need to home at power-up, and does not lose position during a power cycle. The trade-off is that fault detection is a matter of validating the received value, not counting pulses.

Three layers of fault detection are appropriate for a lifting/lower application using an absolute Profibus encoder:

1. Encoder self-diagnostics via Profibus diagnostic interrupts (OB82) and station failure (OB86). The CE65M self-reports internal faults and the Profibus master reports a slave loss. This is the primary detection layer and the layer that should be the source of the safety stop signal.
2. Status word polling. The CE65M broadcasts a status word with the position value. Bits indicate position validity, scaling active, range overflow, battery warning (multi-turn gear), and Profibus fault. Polling the status word gives low-latency detection of partial faults that do not trigger a diagnostic interrupt.
3. OB35 snapshot comparison. A cyclic check in the S7 PLC that verifies the position value changes between consecutive 100 ms cycles when motion is commanded. This catches a frozen value where the encoder has stopped updating but the status word has not yet been cleared.

The original inquiry proposed the third layer as the only check. The correct architecture uses all three layers, with the snapshot comparison as a supplementary diagnostic rather than a primary fault detector.

TR Electronic CE65M Encoder Specifications

The CE65M is documented in the manufacturer datasheet. The electrical, mechanical, and resolution parameters relevant to PLC integration are summarized below. Confirm the values against the current revision of the datasheet for your specific CE65M variant before commissioning.

The full mechanical drawing, pin assignment, and GSD file are available from the manufacturer. The GSD file must be installed in SIMATIC Manager (HW Config) or TIA Portal (Device Repository) before the encoder can be added to the Profibus network.

Profibus DP Slave Integration

The CE65M is a Profibus DP slave. The PLC's Profibus master can be one of the following configurations:

• An S7-300 CPU with integrated Profibus DP interface (e.g., CPU 315-2 DP, CPU 317-2 DP)
• An S7-400 CPU with integrated Profibus DP interface (e.g., CPU 414-3 DP, CPU 416-3 DP)
• Any S7-300/400 CPU paired with a Profibus CP (e.g., CP 342-5, CP 443-5)
• An S7-1500 CPU with Profinet/Profibus gateway (CP 1542-5) for Profibus integration

The integration steps are:

1. Install the CE65M GSD file in the engineering tool. The GSD file name is typically TR_xxyy.GSD or similar; check the manufacturer download portal for the current GSD revision for the CE65M Profibus Class 2 variant.
2. Open the Profibus subnet in HW Config, drag the CE65M from the catalog to the bus, and assign a unique node address. The address must not conflict with any other slave on the bus and must match the DIP switch setting on the physical encoder.
3. Select the input module. The default CE65M module is "Input 8 bytes" providing 4 bytes of position and 2 bytes of status plus 2 bytes of scaling/extended status.
4. Assign the input bytes to a process image partition or to a data block. Most applications use a DB (e.g., DB100, symbolic name DATA_B) and read the input bytes into the DB using L PIW or via the process image update.
5. Compile and download the HW Config. The encoder should appear in the online Profibus diagnostics with a green status indicating data exchange.

The default slot assignment of the CE65M for the standard input module is:

For the Siemens S7 platform, the Profibus integration is documented in the Siemens Industry Online Support portal. The hardware configuration procedure and the meaning of diagnostic interrupts (OB82) and station failure (OB86) are described in the S7-300/S7-400 system manuals and the Step 7 programming reference.

Profibus Class 2 Parameterization

The CE65M supports acyclic read/write services via a Profibus Class 2 master. This allows the application to change the encoder's resolution, scaling, code direction, and other parameters at runtime without removing the encoder from the bus. In an S7-300/400 with a CP that supports Class 2 services, the acyclic services are accessed via SFB 52/53/54 (RDREC, WRREC, RDIAG) or the older SFC 58/59. In an S7-1500 with TIA Portal, the instruction set includes the same blocks under the same names.

Common acyclic parameters for the CE65M include:

Use the Class 2 services to set the engineering-unit scaling during commissioning. Once set, the encoder outputs the position in mm (or whatever unit is configured) and the PLC does not need to perform the unit conversion. The status word will indicate "scaling active" so the application can confirm the configuration was applied.

Siemens S7 Hardware Configuration

The HW Config steps specific to the S7-300 platform (CPU 315-2 DP) for the CE65M encoder are:

1. Open SIMATIC Manager and load the station.
2. Open HW Config.
3. From the catalog, expand "PROFIBUS DP" → "Encoders" → "TR Electronic" → select the CE65M Profibus Class 2 entry.
4. Drag the encoder to the Profibus subnet. Assign node address (e.g., 3) and confirm the bus parameters.
5. Double-click slot 1 and select the input module "8 bytes input" or the appropriate module from the GSD.
6. Note the input start address assigned by HW Config (e.g., IW 100). The corresponding bytes are IB 100-107.
7. Optionally assign the input bytes to a process image partition (PIP) for time-coherent reading in OB35. PIPs are configured in the CPU properties under "Process Image".
8. Save, compile, and download the HW Config to the CPU.

For S7-1500 with TIA Portal, the procedure is the same: device configuration → device catalog → encoders → TR Electronic → CE65M → drag to Profibus subnet → assign module → download. The input addresses appear under the device's I/O tags and can be referenced symbolically.

Siemens OB35 Cyclic Interrupt Configuration

OB35 is the cyclic interrupt OB for S7-300 CPUs. It is executed at a fixed interval configured in HW Config under the CPU properties → "Cyclic Interrups" tab. The default is 100 ms but the interval can be set to any value in the range supported by the CPU, typically 1 ms to 60 000 ms. OB35 has a watchdog; if the OB35 runtime exceeds the configured interval, the CPU enters STOP with a diagnostic buffer entry "Cyclic interrupt time exceeded".

For the encoder comparison logic, OB35 is the appropriate execution point because the check is time-based (verify that the position has changed in the last 100 ms if motion is commanded) and must run independently of the OB1 scan. The configuration steps are:

1. Open HW Config → select CPU → Properties → Cyclic Interrupts.
2. Set OB35's execution interval. For 100 ms detection latency, set 100 ms. For 50 ms latency, set 50 ms (verify the OB35 execution time is below 50 ms first).
3. Confirm the OB35 priority. Default is 12. If OB82 (diagnostic interrupt) or OB86 (station failure) have lower priorities, increase them; diagnostic handling should preempt the comparison logic.
4. In the S7 program, write the comparison logic in a function block (FB) called from OB35. Keep OB35 short — under 5 ms typical — to avoid watchdog trips.

OB35 is supported on all S7-300 CPUs and on S7-400 CPUs. On S7-1500, the equivalent is the cyclic interrupt OB (OB30-OB38) configured in the device properties under "Cyclic interrupt". The configuration parameters and behavior are identical to S7-300/400.

Snapshot Comparison Logic — Original Approach

The principle behind the original STL code is straightforward: when the machine is commanded to move (Q3.2 = machine lifting/lower), the program should verify that the encoder value changes between consecutive OB35 cycles. If the value does not change while motion is commanded, an alarm is raised.

The original STL code (preserved here for reference) implements the comparison:

A  Q 3.2    // Machine lifting/lower command
FP M 6.1    // Edge bit
R  M 6.0    // Reset ENCODER_FROZEN on rising edge of motion
JU P1

P1: A  Q 3.2
    JCN P2                       // Skip if not in motion
    L  "DATA_B".encoder_value    // Read current encoder value
    L  "DATA_B".cyclic_check     // Read previous snapshot
    <>D                         // Compare (32-bit integer)
    JC  K1                       // If different, update snapshot
    S  M 6.0                     // If equal, set ENCODER_FROZEN alarm
    BE                           // Block end

K1: L  "DATA_B".encoder_value
    T  "DATA_B".cyclic_check     // Store new snapshot

P2: NOP 0

The code is logically correct in that it detects a frozen value while motion is commanded. It has the following limitations, which the enhanced logic in the next section addresses:

• It does not check the encoder's status word for internal diagnostics or Profibus faults.
• It does not check the diagnostic bits from OB82 or the station failure from OB86.
• It uses a 32-bit integer comparison (<>D) which only detects a value that has not changed by even one count. A 13-bit encoder at low RPM may legitimately change by only a few counts in 100 ms; if the change is zero counts because the speed is at the minimum that the resolution supports, the alarm will trigger even though the encoder is healthy.
• It does not validate the direction (up vs. down). A counter that decrements while Q3.2 is asserted as "lifting" is also a fault, but the simple equality check does not catch it.
• It does not handle the case where the OB35 cycle is the first after motion start — the snapshot from the previous non-motion state will trigger a false alarm on the first cycle.

Enhanced Comparison Logic

The improved logic wraps the original check in an FB and adds status validation, direction check, edge initialization, and a debounce counter. STL version:

A  "MACHINE_LIFTING_LOWERING"
FP "LIFT_EDGE"
R  "ENCODER_FROZEN"
S  "DEBOUNCE_RESET"           // Reset debounce counter on motion start

// Status word: bit 0 = position valid, bit 15 = Profibus fault
L  "DATA_B".encoder_status
L  W#16#0001                  // Mask position-valid bit
<>I
JC  STATUS_FAIL

L  "DATA_B".encoder_status
L  W#16#8000                  // Mask Profibus-fault bit
<>I
JC  STATUS_FAIL

JU MOTION_CHECK

STATUS_FAIL: S "ENCODER_FROZEN"
              BEU

MOTION_CHECK: A "MACHINE_LIFTING_LOWERING"
              JCN P2

              // Direction: Q3.3 = lift, Q3.4 = lower (example)
              A  "DIR_LIFT"
              JCN DIR_LOWER
              // Lifting: encoder must increment
              L  "DATA_B".encoder_value
              L  "DATA_B".cyclic_check
              <=D                  // Must be greater than previous
              JC  DIR_FAULT
              JU  UPDATE

DIR_LOWER:    L  "DATA_B".encoder_value
              L  "DATA_B".cyclic_check
              >=D                  // Must be less than previous
              JC  DIR_FAULT
              JU  UPDATE

DIR_FAULT:    L  "DEBOUNCE_CNT"
              L  3                  // Debounce: 3 cycles = 300 ms
              >=I
              S  "ENCODER_FROZEN"
              JU  P2

UPDATE:       L  "DATA_B".encoder_value
              T  "DATA_B".cyclic_check
              L  0
              T  "DEBOUNCE_CNT"

P2:           NOP 0

SCL equivalent for clarity and easier maintenance:

// Reset on motion start
IF "MACHINE_LIFTING_LOWERING" AND NOT "LIFT_EDGE_OLD" THEN
    "ENCODER_FROZEN" := FALSE;
    "DEBOUNCE_CNT"   := 0;
END_IF;
"LIFT_EDGE_OLD" := "MACHINE_LIFTING_LOWERING";

// Status word check
IF ("DATA_B".encoder_status AND 16#0001) = 0 THEN
    "ENCODER_FROZEN" := TRUE;       // Position invalid
    RETURN;
END_IF;
IF ("DATA_B".encoder_status AND 16#8000) <> 0 THEN
    "ENCODER_FROZEN" := TRUE;       // Profibus fault
    RETURN;
END_IF;

// Snapshot comparison only when motion is active
IF "MACHINE_LIFTING_LOWERING" THEN
    IF "DATA_B".encoder_value = "DATA_B".cyclic_check THEN
        "DEBOUNCE_CNT" := "DEBOUNCE_CNT" + 1;
        IF "DEBOUNCE_CNT" >= 3 THEN
            "ENCODER_FROZEN" := TRUE;   // 3 cycles = 300 ms of no change
        END_IF;
    ELSE
        "DEBOUNCE_CNT" := 0;
        "DATA_B".cyclic_check := "DATA_B".encoder_value;
    END_IF;
ELSE
    "DATA_B".cyclic_check := "DATA_B".encoder_value;
    "DEBOUNCE_CNT" := 0;
END_IF;

Wrap the logic in a function block (FB) with a multi-instance DB so the same code can be reused for additional encoders (e.g., a second encoder on a different axis of the same machine). The FB interface takes the encoder DB reference, the motion command, and the direction bit, and returns the alarm bit.

Profibus Built-In Diagnostics

An absolute Profibus encoder provides several layers of internal diagnostics that the application should consume rather than reinvent. The CE65M is no exception.

Diagnostic interrupt — OB82

The CE65M raises a Profibus diagnostic interrupt when an internal fault is detected: parameterization error, position invalid, EEPROM fault, multi-turn battery low, range overflow, or similar. The application must implement OB82 in the S7 program. OB82 receives the logical base address of the affected slave and the diagnostic event structure. Inside OB82, call SFC 59 (SFB 52 in newer Step 7) to read the full diagnostic record and store it in a diagnostic DB.

OB82 should:

1. Read the incoming event (enter or leave).
2. Call SFC 13 / SFB 52 to read the diagnostic data.
3. Set a global "encoder_diag" bit, log the diagnostic data with a time stamp, and trigger a stop if the event is an entering event.
4. Clear the encoder_diag bit on a leaving event after the diagnostic is cleared by the encoder.

Station failure — OB86

If the Profibus slave drops off the bus entirely (cable break, power loss, node failure), OB86 fires. The application should monitor the encoder's presence and trigger an immediate stop if the encoder is lost during motion. OB86 is the most reliable indicator of a physical Profibus problem; do not rely on the OB35 snapshot comparison for this.

Status word polling

The status word is updated every Profibus cycle (typically 1-10 ms at 1.5 Mbit/s, longer at lower baud rates). Polling the status word in OB1 or OB35 gives low-latency detection of partial faults that do not trigger a diagnostic interrupt. The relevant bits for the CE65M are listed in the status word mapping table earlier in this document.

Layered architecture

The proper architecture treats the three detection layers as complementary:

The OB35 snapshot comparison is the only one of the four that catches a frozen value with a valid status word and an intact Profibus connection. It is therefore a useful supplementary check, not a redundant one.

Absolute vs Incremental Encoder Strategies

The discussion in the source compared absolute and incremental encoders for this application. The table below summarizes the fault-detection strategy for each type.

For a rotary encoder, the resolution is measured in pulses per revolution (PPR), also called "line count". A 2000 PPR encoder has twice the resolution of a 1000 PPR encoder. The resolution must be selected to give enough counts per engineering unit at the application level.

For the lifting/lower application, calculate the counts per mm of lift:

counts_per_mm = (PPR × gear_ratio) / lead_screw_pitch_mm

For example, with a 2048 PPR encoder, a 1:1 direct coupling, and a 20 mm pitch lead screw, the encoder produces 2048/20 = 102.4 counts per mm of lift. The absolute CE65M's 8192 increments/rev would give 8192/20 = 409.6 counts per mm with the same mechanics. The application must account for the fractional count in the scaling: with 409.6 counts per mm, a 1 mm movement is 410 counts rounded, and a 0.1 mm movement is 41 counts. The OB35 comparison should be tolerant of one or two counts of jitter; a strict equality check (<>D) will false-alarm on the rounding boundary.

For an incremental encoder, the PLC must count pulses using a high-speed counter module (e.g., FM 350-1, FM 450-1, ET 200S 1Count, or an S7-1500 onboard HSC). The Z (zero) channel gives one pulse per revolution and can be wired to a digital input to verify the encoder is operating mechanically. A frozen incremental encoder is detected when the HSC count does not change while motion is commanded, similar to the absolute case, but the application must also handle the loss of the Z pulse, which indicates a mechanical failure of the encoder disc.

Signal Scaling and Engineering Units

The CE65M can be configured to output the position directly in engineering units (mm, deg, in). The configuration is done via the Profibus Class 2 acyclic services. Once the scaling is active, the position value is the actual physical position at the encoder shaft, and the PLC does not need to apply a scaling factor.

Example: the encoder is mounted on the lift lead screw, which has a 20 mm pitch. The encoder's 8192 increments/rev must be scaled so that one revolution equals 20 mm of lift. The scaling parameters are set via acyclic write to slot 0:

• Resolution per rev: 8192
• Total measuring range: 4096 × 8192 = 33,554,432 counts (full multi-turn range)
• Physical unit: mm
• Counts per unit: 409.6 (calculated as 8192 counts/rev / 20 mm/rev)

With this scaling, the encoder value reads directly in mm with 0.0024 mm resolution. The status word indicates "scaling active". If the application reads a value of 12345, the lift is at 12345 × 0.0024 = 30.02 mm.

If the scaling is not configured, the PLC must apply the scaling factor in software. This is done as a floating-point conversion in OB1 or in the FB that uses the position:

// Unscaled count to mm
lift_mm := INT_TO_REAL("DATA_B".encoder_value) / 409.6;

For an S7-1500 application in TIA Portal, the conversion is identical. SCL handles the integer-to-real conversion natively.

S7-1500 and TIA Portal Alternative

If the application is being designed for an S7-1500 platform using TIA Portal, the same logic applies with the following platform-specific differences:

• OB35 is replaced by OB30-OB38 (cyclic interrupt OBs) configured in the device properties. The behavior is identical to S7-300/400.
• Symbolic addressing is preferred over absolute addressing. The encoder input bytes are referenced as "Encoder_DB".encoder_value after a move block in the device's I/O mapping.
• Diagnostic OBs are OB82 (diagnostic interrupt) and OB86 (rack/station failure), same as S7-300/400.
• SFB 52/53/54 (RDREC, WRREC, RDIAG) are the same instructions; in TIA Portal they appear in the "Extended Instructions" palette under "Diagnostics".
• Process image partitions are configured in the device properties under "Process image"; the cyclic OB is assigned to a PIP in the OB's properties.

The CE65M's GSD file is supported in TIA Portal V13 and later. The encoder appears in the device catalog under "Other field devices" → "PROFIBUS DP" → "Encoders" → "TR Electronic" after the GSD is installed.

Commissioning and Verification

Before the application logic is loaded, verify the encoder is correctly integrated with the PLC. The sequence is:

1. Install the GSD file for the CE65M in Step 7 / TIA Portal and restart the engineering tool.
2. Add the encoder to the Profibus network, assign a unique node address, and select the standard input module (typically "Input 8 bytes").
3. Compile and download the HW Config. The encoder should appear online in the Profibus diagnostics view with a green status indicating data exchange.
4. Force the encoder to a known mechanical position and read the value in a VAT (variable table). Verify the value matches the expected angle/multi-turn count.
5. Rotate the encoder manually and confirm the value changes in the expected direction. CW rotation should increment (or decrement, per the configured code direction) the lower 13 bits. Rotate the encoder multiple revolutions and confirm the upper 12 bits increment (or decrement) accordingly.
6. Set up OB82 and OB86 with the encoder's diagnostic address. Trigger a test fault (e.g., disconnect the Profibus connector) and confirm OB86 fires and the diagnostic buffer records the loss.
7. Reconnect the connector, confirm OB82 fires on reconnection (or a diagnostic event indicating the slave is back), and confirm the encoder returns to data exchange.
8. Load the OB35 comparison logic and run the lifting/lower motion at low speed. Verify in the VAT that encoder_value updates every Profibus cycle and that cyclic_check follows it within 100 ms.
9. With the encoder held mechanically fixed (e.g., by blocking the drive or the mechanical brake), command motion and confirm that ENCODER_FROZEN sets within the OB35 interval plus the debounce (e.g., 100 ms + 300 ms = 400 ms with the 3-cycle debounce).
10. Disconnect the Profibus cable during motion. Confirm OB86 fires and the stop is triggered independently of the OB35 logic. This verifies that the primary detection layer works as expected.

Documentation for the Step 7 / TIA Portal diagnostic interrupt OBs and the SFC/SFB instructions for reading diagnostic data is available in the Siemens Industry Online Support portal. Search for "OB82 S7-300" or "Diagnostic interrupt S7-1500" to find the relevant system manuals and application examples.

Troubleshooting Matrix

Related Manuals and References

• TR Electronic — CE65M Profibus Product Page
• Siemens Industry Online Support
• PROFIBUS & PROFINET International (PI)
• Encoders Explained — AutomationDirect Library

FAQ