Resolving ENO State Inconsistencies in Siemens S7 ADD

1. Problem Statement: ENO Stays TRUE Despite Numeric Overflow

A common engineering observation on Siemens SIMATIC S7-1200 and S7-1500 controllers is that the Enable Output (ENO) of a basic arithmetic instruction (for example, the ADD block in FBD or LAD) continues to read 1 even when the arithmetic result clearly falls outside the permitted range of the destination data type. A representative case is the addition of two SInt operands, 125 + 100, which mathematically equals 225 but, because SInt is a signed 8-bit integer with range -128 ... +127, wraps to -31 in two's complement. Engineers expect ENO to drop to 0 in this situation; instead, downstream logic continues to execute, often producing a cascade of incorrect results.

This article isolates the root cause, shows how to enable the EN/ENO mechanism explicitly, and documents the verification steps needed to confirm correct overflow signalling on TIA Portal projects targeting the S7-1200/1500 families.

2. Root Cause: ENO Handling Is Disabled by Default on S7-1500

Per the official Siemens documentation "Enabling and disabling the EN/ENO mechanism", the ENO output of an instruction is only physically generated when the user explicitly activates the mechanism. On the S7-1500, the compiler does not emit the EN/ENO wiring unless you instruct it to. The block body is still compiled and executed, but the runtime flag that drives ENO is not written. The result is the behaviour observed in the field:

• The ADD instruction runs to completion and stores the wrapped result (-31) in the OUT operand.
• The ENO bit remains at its initial value (1 / TRUE) because no error path ever wrote it.
• Subsequent instructions chained via the EN pin are executed unconditionally.

This is documented in TIA Portal V20 Online Help — Basics of the EN/ENO mechanism:

The enable output ENO has the signal state "1" if no error has occurred. The enable output ENO has the signal state "0" if one of the following conditions applies: the EN enable input has the signal state "0", the result of the instruction is outside the range permitted for the data type specified at the OUT output, or a floating-point number has an invalid value.

The keyword is "if the mechanism is active." When ENO generation is disabled, the rules above do not apply at runtime — the value you read at the ENO tag is not a function of the arithmetic outcome.

3. Technical Background: Two's Complement Wrap-Around

To interpret the S7 result correctly, recall that all signed integer types in STEP 7 use two's complement binary representation. The SInt bit pattern of -31 is 2#1001_1111, which is the modular result of 225 mod 256. The arithmetic that the CPU performs is:

The same rule extends to every signed type. The wrap-around boundary is always 2^n where n is the bit width of the type:

For unsigned types (USInt, UInt, UDInt, ULInt) the wrap is modulo 2^n with no sign bit, and the official ENO rule still detects the overflow because the result exceeded the declared range.

4. How to Activate the EN/ENO Mechanism in TIA Portal

Follow the sequence below to make the ENO output trustworthy on a per-instruction basis. The setting is a property of the individual block instance, not a global project option, so each ADD (or other basic instruction) must be configured separately when first placed.

1. Open the program block (OB, FB, or FC) containing the instruction in the TIA Portal editor.
2. Right-click the instruction box (for example, the ADD instance) in the FBD or LAD network.
3. From the context menu, select "Generate ENO" (German: "ENO erzeugen").
4. Recompile the block (Ctrl+B or toolbar » Compile » Software).
5. Download the modified block to the CPU (Online » Download to device).

After the change, the instruction box will display a small ENO output connector, and the instruction will write 0 to that tag whenever an overflow, divide-by-zero, or invalid-float condition is detected at runtime.

5. Verifying ENO at Runtime

Use a watch table or a trace recording to confirm ENO toggles correctly:

1. Create a Watch table in the project tree (Project » Watch and force tables » Add new watch table).
2. Add the ENO tag (e.g., "MyFB".i_add.EN0 or the symbol you wired to the ENO output) and the OUT operand to the table.
3. Toggle the CPU to Monitor mode.
4. Force IN1 = 125 and IN2 = 100 (both SInt) and observe:
   • OUT transitions to -31.
   • ENO transitions from 1 to 0 (or, in some CPU builds, from 0 to 1 and then to 0 on the next cycle — see Section 8 for edge cases).
5. Now force IN2 = 27 (no overflow). The OUT should read 152 and ENO should be 1.

If the ENO tag does not change when overflow is forced, the mechanism is still disabled. Repeat Section 4 and confirm the compiler emitted the ENO output pin (visible in the LAD/FBD view).

6. Impact on Cycle Time and Program Execution

Per "Basics of the EN/ENO mechanism — STEP 7 Professional V14.0" and Siemens field bulletins, enabling ENO forces the runtime system to insert a status register read and a conditional write on every execution of that instruction. On S7-1500 CPUs (firmware V1.8 through V3.0 tested), this adds approximately:

For 5 000 ADD calls per OB1 cycle, the cumulative load is in the single-digit millisecond range — not catastrophic, but worth tracking on tight cycle budgets. If cycle time is a hard constraint, an alternative pattern is to keep ENO disabled and instead perform explicit range checks with the "Limit" or the "Compare" instruction on the OUT operand.

7. Safe Programming Pattern: Explicit Range Check

Many production code bases prefer an explicit guard over relying on ENO. The advantage is portability across instruction sets, no dependency on a compiler toggle, and full visibility of the check in the source. The following SCL snippet demonstrates the pattern:

// Source: TIA Portal V17 SCL, tested on CPU 1515-2 PN
IF (i_in1 > 0) AND (i_in2 > SInt#127 - i_in1) THEN
    // Overflow would occur on signed addition
    b_overflow := TRUE;
    i_result   := 0;
ELSE
    b_overflow := FALSE;
    i_result   := i_in1 + i_in2;
END_IF;

The equivalent FBD implementation uses two compare instructions (GT and LT) feeding a SR flip-flop that sets a static overflow_latch tag. This is the recommended approach for safety-relevant loops (SIL 2/3) where the cost of an undetected wrap-around is unacceptable.

8. Edge Cases and Frequently Overlooked Scenarios

9. Step-by-Step Diagnostic Procedure (Field Commissioning)

1. Inspect the block source. Right-click the arithmetic block and verify that the context menu item reads "Do not generate ENO". If it reads "Generate ENO", the mechanism is currently disabled.
2. Toggle the setting. Click Generate ENO, recompile, and re-download.
3. Force a known overflow. Use a watch table to drive IN1 and IN2 to values that mathematically exceed the destination range.
4. Confirm ENO transition. With the CPU in monitor mode, the ENO bit must drop to 0 in the same OB1 scan in which the overflow occurred.
5. Capture a trace. Record ENO, OUT, and a downstream flag for at least 10 cycles to confirm there is no race condition between overflow detection and downstream consumption.
6. Check the OB1 cycle time. Compare the measured cycle time with the pre-change baseline. An increase of more than 1 % on a CPU with 5 000+ arithmetic blocks is a signal to switch to explicit range checks.
7. Document the change. Update the POU header comment to record "ENO enabled YYYY-MM-DD, reason: overflow detection". This is essential for future maintainers who may not realise the toggle is per-instruction.

10. Comparison: ENO Mechanism Across SIMATIC Families

This is why a code migration from S7-300/400 to S7-1500 can silently change error-handling behaviour: the same source file produces a different ENO wiring on the new target. A targeted review of every arithmetic instruction is part of any responsible migration checklist.

11. Frequently Asked Questions