Resolving S7-1200 Stuck Memory Bit: M-Area Overlap Diagnosis

1. Problem Summary

A field-proven fault on the Siemens S7-1200 CPU 1214C (DC/DC/DC and AC/DC/RLY variants both affected): a coil-flag in the Merker (M) area drives a physical output, but the flag refuses to return to logic 0 even when the visible rung logic clearly resets it. The engineer inspects the single network where the bit is set (--[ ]--( S )) and sees the SET input is FALSE, then inspects the RESET network and sees the --[ ]--( R ) input is TRUE. The bit should be low. It is not. The output it drives latches ON, often causing a machine stop, a valve held energized, or a permissive that prevents the line from re-starting.

Classic symptom pattern:

• Bit is set in one and only one network (cross-search confirms this).
• Bit is reset in one and only one network.
• Bit is also used as a coil in one and only one additional network.
• SET condition is FALSE, RESET condition is TRUE at the moment of observation, yet the bit reads 1 in the standard tag table or in a watch table.
• Forcing the bit off in the watch table works, but the next scan it returns to 1.

The user-visible workaround — relocating the flag to an adjacent bit (for example, moving from M69.2 to M69.3) — restores correct behavior, which is the most important diagnostic clue. The bit itself is healthy; something else is writing the word that contains the bit.

2. Affected Hardware, Firmware, and Software

Reference: SIMATIC S7-1200 Programmable Controller System Manual (entry ID 109814663).

3. Root Cause — M-Area Memory Overlap

The S7-1200 M-area is a flat byte array. The CPU does not enforce a "type" on an M-address; the same byte can be addressed as a boolean (%M69.2), a byte (%MB69), a word (%MW69), or a double word (%MD69). Any write to the wider type overwrites every bit in the same physical byte, word, or double word — including the bit you believe is independent.

For a bit at M69.2, the overlapping references are:

If any one of these overlapping symbols is written by an FB, FC, OB, HMI tag, motion control technology object, recipe function, or PID compact block, it can flip the bit back to 1 in the same scan cycle that your reset logic ran.

4. Secondary Cause — System Memory and Clock Memory Bits

The S7-1200 exposes two system-controlled bit ranges that are enabled in the CPU device configuration and that re-write on every scan:

1. System memory bytes (configurable start): %MB0–%MBn by default contains first-cycle, diagnostic, and run-state flags. If you set System Memory Byte to 100 in the device properties, bytes %MB100–%MB105 are reserved. A bit inside that range will be driven by the firmware.
2. Clock memory byte (configurable): a single byte at a user-chosen address whose bits toggle at fixed frequencies (10 Hz, 5 Hz, 2.5 Hz, 2 Hz, 1 Hz, 0.5 Hz, 0.625 Hz, 0.5 Hz). If the clock byte is configured at MB69, then M69.0–M69.7 are NOT free bits — they are the eight clock pulses.

Check both in Device configuration → Properties → System and clock memory. See the S7-1200 System Manual, section on system and clock memory bits.

5. Third Cause — Set/Reset "Last Call Wins" Scan Order

SR and RS flip-flops, like the ladder --[ ]--( S ) and --[ ]--( R ) coils, are not edge-triggered in STEP 7. They are evaluated every scan, and the order in which they are encountered inside OB1 (or inside the FBs/FCs that the cyclic OB calls) decides the result:

• If network 7 sets M69.2 and network 23 resets M69.2, network 23 wins (last write wins, and OB1 ends with the value just written).
• If a higher-priority OB (e.g. OB35 cyclic interrupt at 100 ms) also touches M69.2 via a word or DWord move, the OB1 reset can be overwritten on the next interrupt boundary.
• If an FB's STAT or TEMP variable is inadvertently pointing to %MW68 or %MD69 (a common mistake when symbol-table defaults are not pruned), that FB's := assignment clobbers the bit at the end of the FB's execution.

This is the most common cause of "the bit goes high after a reset, and the same bit goes low after a set" — the order of the SET and RESET in OB1 was wrong, or an interrupting OB is writing the same memory.

6. Diagnostic Procedure (Field-Proven)

Run the following seven steps before declaring a CPU replacement.

Step 1 — Online cross-reference, then binary search

In TIA Portal: right-click the tag → Go to → Cross-references. Confirm only three references (set, reset, coil). If you see more than three, the overlap is local — jump to Step 4.

Step 2 — Watch the word and the byte, not the bit

Open a Watch table with the following four rows and force cyclic monitoring at 500 ms:

WatchRow  |  Address        |  Display format
1         |  %M69.2         |  BOOL
2         |  %MB69          |  BIN+ (B#16#)
3         |  %MW68          |  BIN+ (W#16#)
4         |  %MD66          |  BIN+ (DW#16#)

Watch what else changes in MB69/MW68/MD66 at the exact moment M69.2 flips back to 1. The non-M69.2 bits that change are the smoking gun: they reveal which code path is writing the wider reference.

Step 3 — Disable user code in half-blocks

Use the Call environment view (TIA Portal → Project tree → PLC → Call environment). Starting with the largest FB (often a machine sequencer), temporarily skip the call by routing it through a --[ FALSE ]-- CALCULATE gate. Re-test the bit. If M69.2 now resets correctly, the disabled block contains the offending write.

Step 4 — Search the entire project for byte/word/dword collisions

Use Search in project → "68" "69"* and filter to M-area addresses. The collision often hides behind a symbolic name. Example: a programmer's DB has "MachineState" : WORD; at offset that maps to %MW68 because the DB was assigned to the M-area for a technology object.

Step 5 — Check HMI tag list

WinCC Comfort/Advanced on a 1214C often polls the M-area cyclically. An HMI tag with Acquisition mode = Cyclic continuous at %MW68 will NOT write the bit, but a tag at %MD66 with Update value on operator input will. Inspect HMI tags → Connection → Address.

Step 6 — Check PID_Compact, Motion Control, and recipe blocks

Each of the following technology objects reserves a block of M-area for instance DB by default. If the start address was left at 0, they can land anywhere.

• PID_Compact background DB
• TO_Axis_PTO / TO_PositioningAxis technology DBs
• RecipeGet / RecipePut temporary buffers

Step 7 — Use a diagnostic helper bit

Add a single dedicated diagnostic tag in a reserved, un-overlapped region (recommend %M2000.0 as a project convention). Copy the SET/RESET logic to the new bit in parallel. If the new bit also fails, the problem is in the driving logic. If the new bit works and the old bit fails, the problem is M-area overlap at the original address.

|  a_flag_old          a_flag_new
|------|------(S)       ------(S)
|      |
|  b_reset             b_reset
|------|------(R)       ------(R)

Wire the diagnostic bit to a non-essential lamp on the HMI. Several plants keep a small "diagnostic mirror" panel reserved for these probes; the cost is two M-bits and one HMI tag, the benefit is minutes-versus-hours fault-finding.

7. Resolution and Workarounds

Reference: SIMATIC S7-1200 Automation System Function Manual (entry ID 109751799), section "Bit memory (M) area" and "System memory and clock memory bits".

8. Verification Procedure

After the fix, prove the change with all of the following:

1. Watch-table trace: monitor %M69.2, %MB69, %MW68, %MD66 for 10 minutes of normal operation. All four must remain at zero where expected.
2. Cross-reference sweep: with the project offline, search the entire TIA Portal project for the literal text M69.2 and the symbolic tag name. The result count must equal 3 (set, reset, coil) — never more, never less, unless the addition is a documented diagnostic mirror.
3. Force / release test: from the watch table, force the bit ON, then release. It must return to OFF on the next scan and remain OFF.
4. Cold restart: power cycle the CPU. The bit must come up in its initialized state (BOOL default = 0 unless the tag's Retain is set and the prior value was 1). If retain is enabled, perform an MRES and confirm.
5. HMI round-trip: trigger the SET condition from a button on the HMI, then trigger the RESET. Confirm via the HMI indicator that the bit transitions 0→1→0 cleanly.
6. Cycle-time sanity: open Online & diagnostics → Cycle time. The OB1 cycle time must not have changed by more than 1 ms; an FB inadvertently moved into the M-area will sometimes drag in a large block.

9. Preventive Coding Practices

Adopt the following four rules in every S7-1200 project to make the M69.2 class of fault structurally impossible:

1. Reserve the M-area by band. Use the high band (%M2000.0–%M2047.7) for "free user bits". Reserve %M0–%M199 for clock/system. Reserve %M200–%M1999 for HMI polling only. Document the band map in the project header.
2. Never alias a multi-byte variable onto the M-area. Use a global DB with a typed UDT. If a sequencer requires a 32-bit state word, declare StateWord : DWORD; in DB_State, not in the M-area.
3. Use SR/RS flip-flop blocks for any bit that is both set and reset in different networks. The block evaluates once per scan and guarantees a deterministic result. See the SR and RS instructions in the S7-1200 function manual.
4. Add a startup OB (OB100) reset sweep for any non-retain bit you depend on. This guarantees a defined power-up state and makes cold-restart faults easier to isolate.

10. Troubleshooting Matrix

11. Frequently Asked Questions