PLC Over-Engineering: S7-1200 CPU Load and Maintainability Fixes

1. Overview: The Over-Engineering Problem in Industrial Automation

Special-machine automation routinely produces programs that double the estimated engineering time, tax the controller CPU, and become unmaintainable the moment the original author moves on. The pattern repeats across OEMs, system integrators, and in-house automation groups: a competent programmer invests in custom function blocks (FBs), intricate monitoring, and optimization paths that solve problems the production line does not have. The result is a "Swiss clock" that the maintenance electricians cannot read, the project manager cannot accept, and a replacement CPU cannot accommodate without a re-spec.

This reference documents the field-proven boundaries between disciplined engineering and self-indulgent programming on the SIMATIC S7-1200 platform. It pairs the soft skills of program ownership (tag naming, structure, documentation) with the hard numbers (work memory percentage, cycle time, OB priority) that determine whether a CPU swap or a re-write is needed.

2. CPU and Memory Impact: Quantifying the Damage on S7-1200

The S7-1200 family is structured around a fixed work-memory budget and a deterministic OB1 scan. Both are easy to overrun when scope creeps. Three S7-1200 data points matter most for this discussion:

Source: S7-1200 Programmable Controller System Manual (09/2023).

The figure quoted in the field case (a built-in FTP client consuming 50% of the S7-1200 work memory) is realistic. The FTP_CMD / FTP_CONNECT blocks in the Siemens "Communication with FTP" library pull a TLS stack, a TCP/IP state machine, and a sizeable buffer for file transfer. On an S7-1211C, that single library can take a 30 KB program budget to ~18 KB free, which is the boundary below which TIA Portal will refuse to compile new logic without flagging the resource exhaustion.

2.1 When to move FTP off the PLC

If the only requirement is to move a CSV or trace file from the machine to a network share, the PLC should not be the FTP server. Replace the in-PLC FTP with one of the following patterns, ordered by preference:

1. PC-side script: A small VB.NET, PowerShell, or Python service on the HMI IPC reads the S7-1200 tags over S7 communication (PUT/GET or OPC UA) and writes the file via the OS FTP client. PLC memory impact: 0 KB. Cycle impact: 0 µs.
2. WinCC Comfort/Advanced script: Use the HMI's built-in VBScript to dump tag values to a USB or network share. The script runs on the panel, not the CPU.
3. SIMATIC IOT2050 / IPC227G: A node at the cell level that polls the PLC and handles file transfer, MQTT, and email independently.

3. Standard Library Blocks vs Custom Function Blocks

Every S7-1200 project pulls from the same global library set under Project > Libraries > Global Libraries > Standard Library. The temptation to re-invent these is the most common over-engineering vector.

The standard block is not just shorter code; it is also shorter time-to-diagnose. When a maintenance electrician sees TON with a 5 s PT input, they recognize it. When they see a custom FB named MySmartDelay_V3_DoNotUse, the diagnostic clock starts.

4. Ladder Logic for Maintainability: The 75-Rung vs 50-Rung Trade

A consistent finding across OEM programs is that a maintainable ladder program will use 50% more rungs than a "clever" sequencer, SFC, or function-block implementation of the same machine. The cost is in rung count; the benefit is in mean time to repair (MTTR).

4.1 The maintenance-driven write style

Three rules keep ladder diagnostic-friendly:

1. One rung, one decision. A rung that sets three outputs makes a hunting fault impossible to trace. Split it.
2. Tag names describe the asset, not the function. Conveyor_3_Run beats Bit_M45_0. Maintainers talk about the conveyor, not about M45.0.
3. Sequential order matches physical order. Power flow runs left-to-right, top-to-bottom. Align the scan with the process flow so the maintenance technician can read the program in the same order as the machine layout.

4.2 When SFC / GRAPH is justified

Use SFC (or S7-GRAPH) only when the machine has ≥ 30 sequential steps and the step transitions are the primary diagnostic indicator. A typical 3-station rotary indexer is better in ladder; a 12-station assembly dial with 80 steps, alternate paths, and manual mode belongs in SFC. Reference: S7-GRAPH V5.5 / TIA Portal Programming Manual.

5. PC-Based Alternatives for Non-Control Functions

The 50% work-memory figure for the S7-1200 FTP case is not a bug; it is the correct cost of fitting a general-purpose TLS/TCP stack on a controller without a memory management unit. The PLC has higher-value work to do. Push non-deterministic tasks off the controller.

5.1 VB.NET data logger against an S7-1200

A minimal VB.NET example using the Sharp7 library (open-source, MIT-licensed) reads tags over ISO-on-TCP and writes to a CSV. This is the recommended replacement for the in-PLC FTP scenario.

' Add NuGet package: Sharp7
Imports Sharp7

Module PlcDataLogger
    Sub Main()
        Dim client As New S7Client()
        Dim result = client.ConnectTo("192.168.0.1", 0, 1, 0)
        If result <> 0 Then
            Console.WriteLine($"Connect failed: {result}")
            Return
        End If

        Dim buffer(19) As Byte
        Dim tagNames = {"DB1.DBD0", "DB1.DBD4", "DB1.DBD8"}
        Dim sw = IO.StreamWriter("C:\Logs\S71200_data.csv", True)
        sw.WriteLine("Timestamp,Pressure_kPa,Flow_Lpm,Temp_C")

        While True
            client.DBRead(1, 0, 20, buffer)
            Dim pressure = BitConverter.ToSingle(buffer, 0)
            Dim flow     = BitConverter.ToSingle(buffer, 4)
            Dim temp     = BitConverter.ToSingle(buffer, 8)
            sw.WriteLine($"{DateTime.Now:o},{pressure:F2},{flow:F2},{temp:F2}")
            Threading.Thread.Sleep(1000)
        End While
    End Sub
End Module

The PLC side requires PUT/GET to be enabled under CPU Properties > Protection > Permit access with PUT/GET or, for production, an explicit OPC UA server on the S7-1215C with firmware 4.4+. Either way, the in-PLC work memory cost is zero.

6. Standards and Code Consistency: OEM Templates vs One-Off Style

Automotive-tier OEMs run a separate "standard control" function that audits every program in PLCSIM before it is allowed near the line. The audit checks tag naming, FB structure, and approved material lists. Smaller OEMs and system integrators cannot afford that headcount, but they can adopt the same artifacts.

6.1 A minimal project standard for S7-1200

Document the standard in a single Engineering Standard.docx checked into the project folder. Two pages is enough. Reference: TIA Portal Programming and Operating Manual.

6.2 Code review checklist before release

1. Every FB has a single, documented purpose in its header comment.
2. No magic numbers; constants live in a Constants DB.
3. No unused instance DBs (TIA Portal will not warn; you have to look).
4. No ANY pointers unless the team has signed off on the dereferencing.
5. All alarms are in a single HMI_Alarms DB with consistent structure.
6. Cross-references generated and saved to PDF with the project archive.

7. Cycle Time Optimization: Reading the Diagnostic Buffer

Cycle time is the silent killer. A clean S7-1200 program on a 1214C runs OB1 in 5-10 ms. A program that "monitors every possible event" with high-frequency tasks, alarms on every transition, and trace blocks can push OB1 to 30-50 ms. For a machine with a 200 ms cycle budget, that 30 ms overhead is a 15% throughput loss.

7.1 Where to look in TIA Portal

1. Open the online project and the device view of the CPU.
2. Navigate to Online & Diagnostics > Diagnostic buffer. Cycle time overruns show as Time error OB80 entries.
3. Right-click the CPU in the project tree and select Online & Diagnostics > Cycle time / Memory. The current, minimum, and maximum OB1 time are displayed.

7.2 Reduction patterns

• Move slow logic out of OB1. Anything with a 100 ms+ period belongs in a cyclic OB (e.g., OB30 at 100 ms) or a hardware interrupt (OB40).
• Replace index-based loops with explicit copy. A FOR loop over 200 array elements adds scan overhead per element. If the array is fixed, copy the operations as explicit rungs.
• Eliminate the ANY variant. Block moves with BLK_MOV / MOVE_BLK are faster than generic pointer copies.
• Profile with the S7-1200 trace. Use Traces > Configuration > Trigger on OB1.start to capture the longest single-scan time over 1000 cycles.

8. CPU Sizing: Avoid the "Throw Hardware at It" Anti-Pattern

A common budgetary anti-pattern is to step up to a higher-CPU tier (e.g., S7-1215C to S7-1511) because the engineer cannot get OB1 under the cycle budget. The hardware is more expensive (often 2,000 EUR and up for the controller alone) and the symptom persists because the program is the bottleneck, not the silicon.

8.1 Sizing formula

For a deterministic cell with OB1 scan T_scan, IO count N_io, and target cycle time T_cycle:

T_scan_max = 0.5 * T_cycle        # leave 50% headroom for diagnostics, alarms
T_scan_max >= N_io * t_bit         # where t_bit is bit-instruction time (0.08 µs on 1214C)

For a 1,000-bit program on a 1214C, N_io * t_bit = 80 µs, well under any reasonable T_scan. The CPU has headroom; the program is the problem.

8.2 Decision matrix

9. Maintenance Handoff: Designing for the Aftermarket

A program that the original author finds readable is not the same as a program that a maintenance technician finds readable. The benchmark is not "can I read it"; it is "can a Level-2 electrician with no TIA Portal access on the line troubleshoot it in 30 minutes."

9.1 The 30-minute diagnostic target

Field data from OEMs that have moved from custom SFC to plain ladder shows downtime dropping from ~20 hours per week to ~2.5 hours per week on machines of similar complexity. The reduction is not because the ladder is more capable; it is because the technician can locate the failed step on a printout without launching TIA Portal.

9.2 Handoff artifacts

1. Cross-reference printout: Project tree > Program blocks > right-click > Cross-references > Print to PDF.
2. Bit-mapped HMI alarm screen: a single screen listing every active input, output, and tag in a 30-cell grid that the technician can read at a glance.
3. Tag-name legend: a laminated legend at the panel mapping every tag prefix to the asset it represents.
4. Backup archive: Project > Archive > Save As > .zap14 on the cabinet-mounted USB drive, dated.

10. Team Workflow: When to Go Rogue, When to Follow

The healthy boundary for an individual contributor is:

• Follow the standard when the standard exists, the requirement fits, and the project is on a deadline.
• Propose a change when the standard has measurable friction (e.g., tag prefix collision, OB1 scan growth). Bring numbers, not opinions.
• Build a proof of concept when the team needs data to choose. A 2-day spike that demonstrates a 30% scan-time reduction is a legitimate team investment; a 3-day deep-dive on FTP alternatives is not, when the production line does not have an FTP requirement.
• Never ship custom code that only you understand. The maintainability test is: can a colleague debug this on a Saturday at 2 AM?

11. Verification Procedure Before Release

Run this checklist on every program before it ships to commissioning:

1. Compile clean. TIA Portal > Compile > Software (rebuild all). No warnings, no errors.
2. Resource check. Online > CPU > Properties > Resource. Work memory used < 70% of total. Load memory < 80%.
3. Cycle check. Run for 1 hour in PLCSIM with simulated I/O. Verify OB1 max scan < 50% of cycle budget. Zero OB80 entries in diagnostic buffer.
4. Fault injection. Force each E-stop, light curtain, and safety gate; verify HMI alarm and proper shutdown state.
5. Power-cycle test. Cycle power 3 times. Verify retentive tags recover, non-retentive reset, and the program returns to the same step as before power loss.
6. Maintenance dry run. Hand the HMI and the ladder printout to a maintenance technician unfamiliar with the project. Time the diagnostic for a forced fault. Target: < 30 minutes to identify the root cause and reset.
7. Cross-reference diff. Compare the shipped program against the last archived version. Every block change must have a code-review comment.

12. Failure Modes and Field Symptoms

13. References Used in This Article

• SIMATIC S7-1200 Programmable Controller System Manual
• S7-1200 Module Data Manual (09/2023)
• STEP 7 / TIA Portal Programming and Operating Manual
• S7-GRAPH V5.5 / TIA Portal Programming Manual
• S7 Communication (PUT/GET) Application Examples