Resolving S7-1500 TIA Portal Safety Program FB 32795 OB 123 STOP

Resolving S7-1500 TIA Portal Safety Program FB 32795 OB 123 STOP

The SIMATIC S7-1500F / S7-1500T-CPU family combines a standard user program with a fail-safe (F) program that runs in a dedicated, separately compiled safety partition. When a CPU is started in either the real PLC or in the S7-PLCSIM advanced / PLCSIM instance, the F-runtime monitors the consistency of the safety program. If the F-runtime detects an internal inconsistency during startup or during cyclic execution of the F-OB, the CPU transitions to STOP with a diagnostic buffer entry that points to a system F-block and to OB 123 (the F-program OB of the S7-1500F).

This article documents the most common root cause of the message "Programmed stop in FB 32795 preventing OB 123 from execution" observed in TIA Portal V17/V18/V19 during simulation, and the step-by-step procedure to recover the project without losing the F-program signature.

1. Problem Description

Symptom observed in TIA Portal with an S7-1500F CPU (e.g. 6ES7516-3FN02-0AB0, 6ES7518-4JP00-0AB0) or S7-1500T-CPU when the user clicks Run on the PLCSIM instance:

• CPU transitions to STOP within 1–3 seconds of RUN start.
• Diagnostic buffer shows: "Programmed stop in FB 32795 preventing OB 123 from execution".
• A second entry appears: "Safety program: internal CPU error" with the same timestamp.
• Compile output of the F-program shows 0 errors and 1 warning: "assigned tags are not in hardware" (German: "Zugewiesene Tags sind nicht in der Hardware").

FB 32795 is referenced as a system F-block by the F-runtime; it is not opened in the project tree and cannot be edited from the user program editor. The block belongs to the Siemens safety system library and is instantiated implicitly by the F-runtime when the F-program is generated.

2. Affected Hardware and Firmware

The issue is independent of the S7-PLCSIM advanced version because the failure originates in the F-runtime binary of the simulated CPU image. PLCSIM V17 Update 4 and later ship a patched F-runtime that delays the F-program signature check by 250 ms after RUN, but the root cause must still be fixed in the project.

3. Root Cause Analysis

The S7-1500F F-runtime performs a three-stage check at every cold/warm restart and at every online re-run of the simulation:

1. Block-consistency check – verifies that every F-FB and F-DB called by OB 123 is loaded and matches the compiled signature.
2. Tag-to-hardware mapping check – resolves every F-tag used in the F-program against the actual HW configuration (F-I/O, F-shared DB, F-DB-I/O).
3. Runtime self-test – executes the F-runtime diagnostic FB (the one that surfaces as FB 32795 in the diagnostic buffer) to verify watchdog, dual-channel clock comparison, and signature register.

If stage 2 fails — i.e. an F-tag is referenced by the F-program but no F-channel exists in the device configuration for the given slot and channel — the F-runtime cannot complete stage 3. It then calls FB 32795 to issue a programmed stop and writes the diagnostic event "Safety program: internal CPU error". Because the stop is issued from within the F-runtime, the OB 123 that called into the runtime never completes its scan; that is the meaning of "preventing OB 123 from execution" in the diagnostic buffer.

The single warning "assigned tags are not in hardware" shown in the TIA Portal compile output is therefore not benign: in an F-program every warning is treated as a fatal runtime condition by the F-signature checker.

4. Reading the Diagnostic Buffer

Open the diagnostic buffer of the simulated CPU (Online > Online & Diagnostics > Diagnostic buffer) and read the events in reverse chronological order. The relevant pattern is:

The block number 32795 is a system-internal index assigned by the F-runtime; it is not the same as the F-block number in the project tree. Do not attempt to navigate to FB 32795 in the program blocks — it does not exist there.

5. Step-by-Step Resolution

5.1 Prerequisites

• TIA Portal V17, V18 or V19 installed with the matching F-option package (STEP 7 Safety in TIA Portal).
• Read/write access to the offline project (the .ap17 / .ap18 / .ap19 file).
• Project archive backup. Create one before any change: Project > Archive > Project archive (with F-signature).
• Password for the F-program if one was set (the F-program is protected independently of the PLC password).

5.2 Identify the orphan F-tag

1. Right-click the Safety Administration editor and select Compile > Software (rebuild all blocks).
2. Open the Info > Compile pane and switch to the Warnings tab.
3. Locate the entry "assigned tags are not in hardware". Double-click it — TIA Portal jumps to the F-tag declaration in the F-shared DB or the F-DB where the orphan reference lives.
4. Note the absolute address (e.g. %IW4 of F-I/O slot 4) and the symbolic name (e.g. ESTOP1_Ch0).

5.3 Reconcile HW configuration

1. Open Device & Networks and switch to the Device view of the F-CPU.
2. Compare the F-modules listed in the rack with the F-tags used in the F-shared DB (open via Program blocks > System blocks > F-shared DB).
3. Two legitimate fixes exist:
   • Add the missing F-module: drag the correct F-I/O (e.g. 6ES7526-2BF00-0AB0, 6ES7531-7NF00-0AB0) from the hardware catalog to the slot where the orphan tag expects it. Re-assign the PROFIsafe address in the F-module properties (default F-destination address range: 1–1023).
   • Remove the orphan F-tag: if the F-module was decommissioned on purpose, delete the F-tag from the F-shared DB, then recompile the safety program.
4. Save and recompile.

5.4 Recompile the F-program cleanly

1. Right-click Safety Administration > Compile.
2. Verify the compile output is 0 errors and 0 warnings. The F-signature at the bottom of the Safety Administration editor will change; record the new F-runtime signature and F-program signature.
3. If a single warning remains, treat it as fatal. Do not start the simulation.

5.5 Reset the F-signature state of the PLCSIM instance

The PLCSIM instance caches the last loaded F-signature. A stale cache can re-trigger the FB 32795 stop even after the project compiles cleanly.

1. Stop the PLCSIM instance.
2. Delete the PLCSIM working directory: %LOCALAPPDATA%\Siemens\PLCSIM\<instance-id> (Windows) or ~/Library/Application Support/Siemens/PLCSIM/<instance-id> (macOS PLCSIM Advanced).
3. Restart PLCSIM and download the project (Online > Download to device) — not just Run.
4. Click Run. The F-CPU should now start and remain in RUN.

6. Verifying the F-Program is Healthy

After the simulation stays in RUN for at least 5 minutes, run the following verification checks:

1. Diagnostic buffer audit: confirm no event IDs 0x430E, 0x39B4 or 0x35A2 appear.
2. F-signature comparison: compare the collected F-signature (Safety Administration > Compare) with the compiled F-signature. They must match exactly.
3. F-I/O passivation status: open Online & Diagnostics > F-I/O. Every F-channel should show status 0x00 (passivated, OK) or 0x80 (valid, running). Any channel showing 0xFF (communication error) indicates a PROFIsafe address mismatch that must be re-checked.
4. F-monitoring time: confirm the F-monitoring time in the F-CPU properties (default 150 ms) is greater than the maximum F-runtime cycle time observed in the trace (visible in Trace > Safety diagnostics).

7. Downloading the Corrected F-Program to a Real F-CPU

The PLCSIM verification is necessary but not sufficient. When downloading to a physical S7-1500F CPU:

1. Bring the CPU to STOP.
2. Online > Download to device. Accept the dialog "Download safety program — the F-signature will change".
3. Perform a safety acceptance test per IEC 61511 / IEC 62061. Record the new F-signature in the safety logbook (mandatory for the TÜV / UL audit trail).
4. Switch to RUN. Monitor the F-monitoring time in the first 60 seconds to catch any sporadic passivation events that the simulation may have masked.

8. Common Pitfalls and False Leads

9. Preventive Measures

1. Enable "Treat warnings as errors" in the Safety Administration: Properties > Settings > Compile options > Warnings as errors. This forces the F-runtime signature check to fail in the compile step rather than at simulation start.
2. Run PLCSIM regression on every F-program change before downloading to the real CPU. Add a script to TIA Portal's command-line interface (via the TIA Portal Openness API) that starts the PLCSIM instance, waits 30 s, and reads the operating mode.
3. Archive with F-signature: Project > Archive > ... > Include F-signature. The signed archive is the only legally admissible artifact for a safety-relevant change.
4. Track F-signature changes in the change log. Each F-signature must be linked to a documented change request.

10. Related Errors You May Hit Next

• 0x39B1 — F-monitoring time exceeded: increase the F-monitoring time, or shorten the F-program cycle by moving logic to the standard program.
• 0x39B5 — PROFIsafe address conflict: two F-modules share the same F-destination address; reassign.
• 0x4350 — F-shared DB inconsistent: the F-shared DB was deleted or renamed outside the F-editor; restore from the last signed archive.
• 0xE002 — Safety program not loaded: the F-program was not included in the download; check Download to device > Options > Include safety program.

For the complete list of F-runtime diagnostic event IDs refer to the SIMATIC S7-1500F / S7-1500T-CPU Function Manual (entry ID 109751608), section "Diagnostic events of the F-CPU".

11. Field-Commissioning Checklist

Use this checklist the next time you bring an S7-1500F back into service after an FB 32795 stop:

• [ ] Archived the project with F-signature before any edit.
• [ ] Recorded current F-runtime and F-program signatures.
• [ ] Re-built the offline HW configuration from scratch.
• [ ] Re-mapped every F-tag in the F-shared DB to a physical F-channel.
• [ ] Recompiled the safety program — 0 errors, 0 warnings.
• [ ] Cleared the PLCSIM working directory.
• [ ] Ran the simulation for at least 5 minutes; checked diagnostic buffer.
• [ ] Compared compiled vs. collected F-signature.
• [ ] Downloaded to the real F-CPU, captured new signatures.
• [ ] Performed the safety acceptance test; signed off in the safety logbook.

FAQ