Resolving ET200S IM-151 Loss That Stops the S7-300 CPU Run

An S7-300 station that has run for years can suddenly enter STOP the moment an ET200S IM-151 node loses power, even when OB82, OB83, and OB86 are all loaded in the CPU. The fault is almost always a combination of two issues: a missing OB85/OB122 and an improperly terminated final PROFIBUS drop. This guide consolidates the field procedure, STEP 7 code, and hardware changes required to keep the CPU in RUN, capture diagnostic data, and surface a clear alarm on the HMI.

1. Typical Affected Hardware

The pattern is consistent across the following configurations reported in the field. Confirm the part numbers against your bill of materials before applying the procedure.

Reference: Siemens SiePortal product search and the ET200S Distributed I/O System Manual on the Siemens Industry Online Support pages.

2. Symptoms Observed in the Field

• Powering down a remote IM-151 panel that sits on the end of the PROFIBUS segment forces the CPU into STOP.
• OB82, OB83, and OB86 are present in the S7 program but the CPU still stops, indicating the missing OB(s) are OB85 and/or OB122.
• Returning 24 V to the dropped node does not bring the CPU back to RUN; a power cycle of the CPU PSU is required.
• The diagnostic buffer contains a primary entry of type "OB not loaded" or "I/O access error" with hex fault IDs 16#35xx or 16#25xx, often preceded by a rack/DP-slave failure event 16#38xx/16#39xx.
• The same node arrangement worked for two years before the new IM151-1-HF was added as the final drop - a strong indicator of a termination problem caused by the new end-of-segment position.

3. Root Cause: Why the CPU Enters STOP

The CPU enters STOP because STEP 7 invokes an error OB and, if that OB is not loaded, the operating system transitions to STOP. The two missing OBs in this scenario are:

• OB85 - Program Sequence Error: Triggered when the priority class of an OB that has not been loaded is raised, or when a previous OB error leaves a class of event unfinished. The fault ID byte OB85_FLT_ID is 16#35xx with sub-codes 16#01 (OB not found), 16#02 (image update error), 16#03 (I/O error when updating the process image), and 16#04 (HMI / communication error).
• OB122 - I/O Access Error: Triggered when STEP 7 detects an access to an I/O module that is no longer reachable, e.g. a direct L PEW/T PAW to a slot under a failed IM-151. The fault ID OB122_SW_FLT carries hex 16#42..16#55 identifying the memory area and access type.

Coupled with these program-side triggers, the bus-physical layer contributes when the dropped node is the last on the segment. Powering it down removes the bus terminator that the slave's internal resistor provided, so the DP master sees an open-ended line and asserts bus errors continuously. The combination of a missing OB and a physical-layer error is what flips the CPU to STOP even though "all" error OBs appear to be loaded.

4. Required Error OB Set

For a PROFIBUS-based ET200S installation, the following OBs must be present and the project recompiled and downloaded. The block numbers below match the standard STEP 7 V5.x library. STEP 7 (TIA Portal) inserts the same OB numbers automatically when you add a new PLC and tick "Generate all error OBs" in the PLC properties.

Reference: S7-300 CPU 31xC and CPU 31x Manual: Operating Instructions and the STEP 7 Standard Software - System and Standard Functions reference manual.

5. UDT Definitions for Error OB Temporary Variables

The error OBs pass information in their VAR_TEMP interface. The cleanest engineering practice is to mirror that interface in a UDT so the OB body can copy the entire record into a global DB with a single assignment. The SCL declarations below correspond to the standard STEP 7 temporary variable names and bit positions.

// UDT_OB82 - Diagnostic interrupt
TYPE UDT_OB82
STRUCT
   OB82_EV_CLASS   : BYTE;        // 16#39 = event entering state
   OB82_FLT_ID     : BYTE;        // 16#XX fault identification code
   OB82_PRIORITY   : BYTE;        // priority of OB execution
   OB82_OB_NUMBR   : BYTE;        // 82
   OB82_RESERVED_1 : BYTE;
   OB82_IO_FLAG    : BYTE;        // 16#54 input, 16#55 output
   OB82_MDL_ADDR   : WORD;        // base address of faulty module
   OB82_MDL_DEFECT  : BOOL;       // module defective
   OB82_INT_FAULT   : BOOL;       // internal fault
   OB82_EXT_FAULT   : BOOL;       // external fault
   OB82_PNT_INFO    : BOOL;       // channel information available
   OB82_EXT_VOLTAGE : BOOL;       // 24 V missing
   OB82_FLD_CONNCTR : BOOL;       // front connector missing
   OB82_NO_CONFIG   : BOOL;       // module has no configuration
   OB82_CONFIG_ERR  : BOOL;       // configuration mismatch
   OB82_MDL_TYPE    : BYTE;       // module class
   OB82_SUB_MDL_ERR : BOOL;       // sub-module error
   OB82_COMM_FAULT  : BOOL;       // communication fault
   OB82_MDL_STOP    : BOOL;       // module stopped
   OB82_WTCH_DOG_FLT: BOOL;       // watchdog timeout
   OB82_INT_PS_FLT  : BOOL;       // internal PSU fault
   OB82_PRIM_BATT_FLT: BOOL;      // primary battery fault
   OB82_BCKUP_BATT_FLT:BOOL;      // backup battery fault
   OB82_RESERVED_2  : BOOL;
   OB82_RACK_FLT    : BOOL;       // rack fault (IM only)
   OB82_PROC_FLT    : BOOL;       // processor fault
   OB82_EPROM_FLT   : BOOL;       // EPROM fault
   OB82_RAM_FLT     : BOOL;       // RAM fault
   OB82_ADU_FLT     : BOOL;       // ADU fault
   OB82_FUSE_FLT    : BOOL;       // fuse blown
   OB82_HW_INTR_FLT : BOOL;       // hardware interrupt fault
   OB82_RESERVED_3  : BOOL;
   OB82_DATE_TIME   : DATE_AND_TIME;
END_STRUCT
END_TYPE

// UDT_OB85 - Program sequence error
TYPE UDT_OB85
STRUCT
   OB85_EV_CLASS    : BYTE;       // 16#35
   OB85_FLT_ID      : BYTE;       // 16#A1..16#A4 typical
   OB85_PRIORITY    : BYTE;
   OB85_OB_NUMBR    : BYTE;       // 85
   OB85_RESERVED_1  : BYTE;
   OB85_RESERVED_2  : BYTE;
   OB85_RESERVED_3  : INT;
   OB85_ERR_EV_CLASS: BYTE;       // class of event that caused the error
   OB85_ERR_EV_NUM  : BYTE;       // event number
   OB85_OB_PRIOR    : BYTE;       // priority of causing OB
   OB85_OB_NUM      : BYTE;       // number of causing OB
   OB85_DATE_TIME   : DATE_AND_TIME;
END_STRUCT
END_TYPE

// UDT_OB86 - Rack / DP slave failure
TYPE UDT_OB86
STRUCT
   OB86_EV_CLASS    : BYTE;       // 16#38 incoming, 16#39 outgoing
   OB86_FLT_ID      : BYTE;       // 16#C1, 16#C4, 16#C5
   OB86_PRIORITY    : BYTE;
   OB86_OB_NUMBR    : BYTE;       // 86
   OB86_RESERVED_1  : BYTE;
   OB86_RESERVED_2  : BYTE;
   OB86_MDL_ADDR    : WORD;       // base address of failed IM
   OB86_RACKS_FLTD  : ARRAY[0..31] OF BOOL;  // bit per rack / DP station
   OB86_DATE_TIME   : DATE_AND_TIME;
END_STRUCT
END_TYPE

// UDT_OB121 - Programming error
TYPE UDT_OB121
STRUCT
   OB121_EV_CLASS  : BYTE;       // 16#25
   OB121_SW_FLT    : BYTE;       // 16#XX software fault code
   OB121_PRIORITY  : BYTE;
   OB121_OB_NUMBR  : BYTE;       // 121
   OB121_BLK_TYPE  : BYTE;       // 16#88 / 8A / 8B / 8C / 8E
   OB121_RESERVED_1: BYTE;
   OB121_FLT_REG   : WORD;       // register that caused the fault
   OB121_BLK_NUM   : WORD;       // block number
   OB121_PRG_ADDR  : WORD;       // address in block
   OB121_DATE_TIME : DATE_AND_TIME;
END_STRUCT
END_TYPE

// UDT_OB122 - I/O access error
TYPE UDT_OB122
STRUCT
   OB122_EV_CLASS  : BYTE;       // 16#25
   OB122_SW_FLT    : BYTE;       // 16#XX
   OB122_PRIORITY  : BYTE;
   OB122_OB_NUMBR  : BYTE;       // 122
   OB122_BLK_TYPE  : BYTE;
   OB122_MEM_AREA  : BYTE;       // memory area and access type
   OB122_MEM_ADDR  : WORD;       // memory address
   OB122_BLK_NUM   : WORD;       // block in which error occurred
   OB122_PRG_ADDR  : WORD;       // program address in block
   OB122_DATE_TIME : DATE_AND_TIME;
END_STRUCT
END_TYPE

6. Global Data Block for OB Snapshots

Create a single DB (SAVE_OB) that holds one UDT instance per error OB. The body of each error OB then performs a single structure assignment from its VAR_TEMP into the matching slot. The DB can be retained so the last fault survives a warm restart, or made non-retained if the CPU should clear diagnostics on STOP->RUN.

DATA_BLOCK SAVE_OB
STRUCT
   OB82vars  : UDT_OB82;
   OB85vars  : UDT_OB85;
   OB86vars  : UDT_OB86;
   OB121vars : UDT_OB121;
   OB122vars : UDT_OB122;
   OB85_ProgSeqErr : BOOL;       // flag latched by OB85 body
END_STRUCT
BEGIN
END_DATA_BLOCK

7. Error OB Bodies

Each OB body is intentionally short. The diagnostic information is already inside the temporary variables; the body only needs to copy the record and, for OB85 and OB122, latch a flag that the cyclic program can poll. The examples below use the SCL view because the assignment is self-documenting, but the equivalent STL is a single L / T block-copy on the corresponding byte ranges.

// OB82 - diagnostic interrupt
ORGANIZATION_BLOCK OB82
   VAR_TEMP v : UDT_OB82; END_VAR
   SAVE_OB.OB82vars := v;
END_ORGANIZATION_BLOCK

// OB85 - program sequence error
ORGANIZATION_BLOCK OB85
   VAR_TEMP v : UDT_OB85; END_VAR
   SAVE_OB.OB85vars := v;
   SAVE_OB.OB85_ProgSeqErr := TRUE;
END_ORGANIZATION_BLOCK

// OB86 - rack / DP slave failure
ORGANIZATION_BLOCK OB86
   VAR_TEMP v : UDT_OB86; END_VAR
   SAVE_OB.OB86vars := v;
END_ORGANIZATION_BLOCK

// OB121 - programming error
ORGANIZATION_BLOCK OB121
   VAR_TEMP v : UDT_OB121; END_VAR
   SAVE_OB.OB121vars := v;
END_ORGANIZATION_BLOCK

// OB122 - I/O access error
ORGANIZATION_BLOCK OB122
   VAR_TEMP v : UDT_OB122; END_VAR
   SAVE_OB.OB122vars := v;
END_ORGANIZATION_BLOCK

8. Active PROFIBUS Terminator on the Final Node

An IM-151-1 supplies bus termination through its 9-pin D-sub when the switch is set to ON. The switch is internal to the module and only active while the module is powered. When the panel is de-energised, the termination disappears with the module, and the PROFIBUS segment is left open-ended. The DP master then sees continuous framing errors and escalates to a bus fault.

Two robust solutions are documented by Siemens:

1. Replace the passive terminator with an active PROFIBUS terminator (e.g. 6ES7 972-0DA00-0AA0 or 6ES7 972-0BA12-0XA0). The active terminator is powered independently and is always in-circuit, regardless of whether the last node is energised.
2. Insert a PROFIBUS repeater (e.g. 6ES7 972-0AA01-0XA0) immediately upstream of the final node. The repeater regenerates the segment and isolates the bus from the on/off transitions of the end node.

Reference: SIMATIC NET PROFIBUS Networks Manual, chapter on bus termination. The hand-out titled "3B_812_6727-10a_Terminator.pdf" in the SiePortal document archive describes the recommended active-terminator wiring in detail.

9. Latch and Reset of Fault Flags

The flag set inside OB85 (OB85_ProgSeqErr) is consumed by the cyclic OB1 so that an HMI alarm is generated exactly once. Use a falling-edge reset to clear the flag from the operator side, so the operator can acknowledge the message without losing the snapshot stored in SAVE_OB.

// OB1 fragment in STL
// "AlarmAck" is an HMI tag (BOOL) toggled by the Ack button on the WinCC flexible / TIA WinCC screen.
A     SAVE_OB.OB85_ProgSeqErr    // first latch: OB85 fired
AN    "AlarmAck"                 // not yet acknowledged
=     "HMI_OB85_Active"          // drives the banner on the mimic

A     "AlarmAck"
FP    "AckEdge"
R     SAVE_OB.OB85_ProgSeqErr    // reset on rising edge of acknowledge
// Snapshot in SAVE_OB.OB85vars remains intact for post-mortem analysis

10. Detecting Loss of Slave with SFC51

SFC51 RDSYSST with SSL_ID = W#16#0174 returns the DP-slave diagnostic list. Cyclically polling it in OB1 is the standard way to derive a clear "Loss of slave" HMI message without depending on OB86 firing. The block of code below is the canonical pattern; the resulting wStatus word can also be cross-referenced with OB86_MDL_ADDR in the snapshot to confirm that the slave indicated by OB86 is the one that physically dropped.

// STL: call SFC51 once per cycle to refresh slave diagnostic list
CALL  SFC51
      REQ      := TRUE                       // read every cycle
      SSL_ID   := W#16#0174                  // SSL partial list - DP slave diag
      INDEX    := W#16#0000
      RET_VAL  := "SFC51_retVal"             // any non-zero = error
      BUSY     := "SFC51_busy"
      SZL_HEADER := "SFC51_header"
      DR       := "SFC51_dataArea"           // pointer to ANY BYTE area

// Evaluate DR result in subsequent network:
//    If a slave bit transitions from 1 -> 0 in the SZL, set
//    "HMI_LossOfSlave" = TRUE and write the index of the
//    failed station into "HMI_FailedDPAddr".

Reference: STEP 7 - System and Standard Functions, SFC51 chapter.

11. HMI Alarm Strategy on MP277 / Comfort Panels

When the dropped node is part of the safety-relevant control path, the HMI must surface the failure as a top-of-screen banner rather than a row in the alarm log. The original installation reported used WinCC flexible on an MP277; the same pattern is supported on Comfort Panels via TIA Portal:

1. Create a discrete alarm with the category Error and the text PROFIBUS slave <DP_ADDR> lost - system cannot run.
2. Trigger the alarm on the rising edge of the loss-of-slave bit derived from SFC51.
3. Force a 50 mm red banner at the top of every screen, not just the process screen. Operators in this application were previously missing the message because it appeared in the alarm line only.
4. Wire the HMI acknowledgement tag to AlarmAck described in the previous section.

12. Step-by-Step Commissioning Procedure

1. Capture baseline. Before any change, archive the S7 project and read the diagnostic buffer of the CPU. Note the cycle time, number of slaves configured vs. reachable, and the bus terminator status of every node.
2. Add missing error OBs. In STEP 7, right-click the Blocks folder, choose Insert New Object > Organization Block for OB85, OB121, and OB122. Add the SCL body that copies the VAR_TEMP into SAVE_OB as shown in section 7.
3. Compile and download. Use online Download, not the simulator. After the download, perform a STOP -> RUN. The diagnostic buffer should now show the new OB numbers being called and the CPU should remain in RUN.
4. Re-test the powered-down case. With the line in a safe state, isolate the IM-151 panel main isolator and time the response. The CPU should stay in RUN; the HMI should raise the loss-of-slave banner; SAVE_OB.OB86vars.OB86_MDL_ADDR should match the dropped slave's configured address.
5. Install the active PROFIBUS terminator. Power the active terminator from a separate 24 V supply (not the IM-151 panel MCB) so the terminator survives the panel power-down. Repeat step 4. The bus diagnostic counters on the CPU's PROFIBUS > Bus Statistics view should show zero new framing errors after the change.
6. Sign off. Update the cause-and-effect matrix, mark the slave's drop-out state in the FMEA, and brief the operator on the new banner and acknowledgement workflow.

13. Verification Checklist

14. Common Pitfalls and Field Notes

• OB82, OB83, OB86 alone are not enough. The single most common reason for the recurring STOP is a missing OB85, often combined with missing OB122.
• Setting the IM-151-1 switch to OFF on the final node defeats the on-board terminator; the segment is then unterminated. If the new node is added as the final drop, move the terminator switch on the previous last node to OFF and the new last node to ON - or use an active terminator.
• An IM151-1 Basic is software-compatible with an IM151-1 High Feature only if the GSD file is updated. Mismatched GSDs are a common cause of OB86 with FLT_ID 16#C4 on the first power-up after a swap.
• Do not use a powered-down node to derive the bus terminator on a moving plant where the node is started and stopped during production. Active termination is mandatory in that case.
• Whenever the CPU has been in STOP for any reason, the diagnostic buffer is the first place to look. Open PLC > Diagnostic/Setting > Diagnostic Buffer in STEP 7 and read the most recent entries from the top down.
• Retain the SAVE_OB data block. A retained DB preserves the last fault after a warm restart, which is often the only way to identify an intermittent bus problem after a weekend of intermittent panel power-downs.

15. Frequently Asked Questions