Resolving S7-200 Latch Failures in a Box-Fill Conveyor Project

System Overview

This technical reference resolves a recurring beginner failure mode in Siemens S7-200 ladder logic: a Set/Reset (latch) output that will not stay latched inside a conveyor sort-and-box-fill station. The application counts 24 inspected products into a corrugated box, rejects faulty products with a pneumatic flapper, then indexes the full box out on a second belt. The plant I/O is intentionally small so the state machine can be reasoned about by inspection, but the same pattern scales to palletizers, case packers, and vial fillers.

The physical topology is fixed: products ride Conveyor #1 past Sensors S1 (entry), S2 (vision / quality check), and S3 (count trigger at the drop point), where they fall into a box waiting on Conveyor #2. Sensor S4 detects box presence at the fill position. The flapper is a 24 VDC solenoid-driven diverter that ejects faulty parts into a reject bin. The PLC has no analog I/O, no high-speed counters above 30 kHz, and no motion axis — only digital inputs, digital outputs, three on-delay timers, and one up-counter.

The reference implementation targets the SIMATIC S7-200 CPU 224 DC/DC/DC (6ES7214-1AD23-0XB0) programmed in STEP 7 Micro/WIN V4.0 SP9. The I/O addresses, timer/counter blocks, and timing values port unchanged to the S7-200 SMART ST20 (6ES7288-1ST20-0AA1) and to the S7-1200 CPU 1214C DC/DC/DC (6ES7214-1AG40-0XB0) running in TIA Portal V15.1 or later. On S7-1200 the only edits required are: rename CTU to CTUD if bi-directional counting is needed, enable symbolic addressing in the PLC tag table, and switch the IEC timer TON to the S7-1200 native TP or TON function block from the "Timers" folder under "Instructions".

I/O Assignment

Map every physical signal to a deterministic PLC address before writing a single rung. Symbolic addressing should be enabled (View → Symbolic Addressing) so that each network reads as English, not as I0.0 / Q0.0 codes. The table below is the canonical map for the project and is used verbatim in every ladder example in this article.

Output mapping note: the I/O table above uses Q0.x addressing for clarity in TIA Portal; in STEP 7 Micro/WIN the same outputs are written as Q1.1, Q1.2, Q1.3 (CPU 224 byte-offset convention). Either notation is acceptable — what matters is that every rung references a symbol, not a raw address, so that the same program reads correctly six months later.

Prerequisites

• STEP 7 Micro/WIN V4.0 SP9 (or TIA Portal V15.1+ for S7-1200) installed and licensed on the programming PC.
• USB/PPI multi-master cable (6ES7901-3DB30-0XA0) or Ethernet cable for SMART/S7-1200 CPUs.
• CPU 224 in STOP mode with program upload/download password cleared (default: clear, no password).
• All four sensors jumpered to 24 VDC and confirmed PNP NO on a multimeter before powering the PLC inputs.
• Contactor coils (K1, K2) and flapper solenoid (Y1) suppressed with 1N4007 flyback diodes across the 24 VDC coils.
• Stack light wired with red on Q0.3 and green on Q0.4; the green light indicates RUN_LATCH = 1 AND BOX_FULL_FLAG = 0.
• Program documentation convention: every Network 1..N has a Title, every address has a Symbol, and a separate Symbol Table file is exported to the project archive on every save.

Why Latches Fail: Eight Root Causes

The Set coil (S) and Reset coil (R) instructions in S7-200 ladder form an SR flip-flop: S drives the bit to 1 unconditionally for the rest of the scan, R drives it back to 0, and the dominant instruction in the same scan wins. In practice the flip-flop works, but eight conditions in the surrounding logic will make it look broken.

1. Insufficient timer count

A typical first attempt uses one timer (e.g., T2) for the entire sequence. The station actually requires at least three independent on-delay timers because three asynchronous events must time out without interfering with each other:

• T0_INSPECT, PT = 2.0 s: the dwell time at Sensor S2 while the vision system decides good/faulty. Conveyor #1 must stop for this entire interval.
• T1_FLAP_DWELL, PT = 2.0 s: the energized time of the flapper solenoid to deflect a faulty product off the belt. Flapper must run for the full interval regardless of the conveyor state.
• T2_BOX_INDEX, PT = 5.0 s: the time allowed for the full box to clear Sensor S4 and a new empty box to drop into position. Conveyor #2 must run for at least this long.

If only one timer exists, the latches appear to "not work" because the timer's done bit (T0) is being reset by other rungs that share the same timer instance. Allocate three separate timer tags with three separate preset values.

2. Set/Reset dominant both high in the same scan

If a single network contains --[S]--RUN_LATCH and a second network contains --[R]--RUN_LATCH, and both contacts are true during the same scan, the instruction physically lower in the program (higher network number) wins. A latched bit that appears to be "missing" is often a Reset coil located two rungs below the Set coil, with both contacts closed. Move the Reset to an output branch (e.g., on STOP_PB) that is guaranteed to be open during normal run.

3. Counter needs a pulsing trigger

Counter CTU in STEP 7 Micro/WIN requires a one-scan rising edge on its CU input. Wiring the counter's CU terminal to a constant-true contact, or directly to a sensor that stays latched for the full product transit, will count exactly once and then freeze. The trigger must come from a contact that transitions from 0→1→0 between scans:

Network 8 — Count product on S3 leading edge
|--[ S3_COUNT ]--[ P ]--[ /CV1_RUN ]--( CU C0 )--|
|                                                |
|                                                +--( R C0 )--|
|                                                              |
|--[ BOX_FULL_FLAG ]---------------------------------------------|

The P contact is the Siemens Positive Transition instruction (EU in older S7-200 nomenclature, P_TRIG in S7-1200). It generates a single-scan pulse on the 0→1 edge of S3_COUNT, which is exactly the event needed to advance the counter by one. The reset branch is driven by BOX_FULL_FLAG, not by a sensor input directly — a sensor alone cannot tell the program that the box has been moved and a new one has been indexed into place.

4. S4 alone cannot detect "full box left + new box arrived"

Sensor S4 rising-edge is "a box is now in position." Sensor S4 falling-edge is "the box left the sensor." Neither is "the full box left and a new empty box arrived." That state is the conjunction of three signals over time:

1. S4_BOX_POS transitions 1→0 (full box moves downstream on Conveyor #2).
2. CV2_RUN = 1 (Conveyor #2 was actually running; the box didn't fall off).
3. S4_BOX_POS transitions 0→1 again (new empty box indexed into fill position).

Implement this as a one-shot bit MOVE_BOX (M0.2) that is Set on the 1→0 edge of S4 while CV2_RUN is true, and Reset on the 0→1 edge of S4. The Counter Reset then keys off MOVE_BOX & BOX_FULL_FLAG, not off S4 directly.

5. State diagram with hidden states

A six-state diagram ("Idle, Running, Sorting, Counting, Full, Dumping") is incomplete for this station. The minimum state set is at least 10 states because S4's two transitions are independent of C0's transitions:

Any state not represented in the diagram is a gap. The most common gap in a beginner diagram is the S4 ON→OFF→ON detection (states 8 and 9). Without those two states, the counter never resets and the box fill oscillates between 0 and 24 forever.

6. Using count-down instead of count-up for "fill"

Siemens' default CTD (count down) starts at the preset and decrements toward zero. Counting 24 good products into a box is far more readable as a count-up from zero to 24: an operator reading the HMI sees CV = 5 meaning "5 products in the box," not "19 products to go." Use CTU with PV = 24, and let the done bit C0 drive BOX_FULL_FLAG.

7. Set/Reset bloat

Every (S) and (R) pair adds two rungs. For a ten-state machine a pure Set/Reset implementation easily exceeds 30 rungs. Where a state is naturally a single input → single output function (e.g., flapper on while T1 is timing), prefer a self-sealing coil --[ FLAPPER ]-- wired as a normal output driven by the timer run bit. Reserve Set/Reset for the two bits that must persist across multiple scans: RUN_LATCH and BOX_FULL_FLAG.

8. Forgetting the box-ready interlock

Conveyor #1 must not restart after a REJECT cycle unless both of the following are true: S4_BOX_POS = 1 (a box is under the drop point) and CV1_RUN was previously off. This prevents a stream of products from being launched into empty air when the previous box was removed and the new box has not yet arrived. Implement with a single AND of S4 and the INSPECT_FLAG reset edge.

State Diagram Completion

Timer and Counter Design

Time-base selection matters: the S7-200 TON instruction in Micro/WIN multiplies the preset word by 1 ms, 10 ms, or 100 ms depending on the timer number. Timers T0 and T64 are 1 ms; T1–T4 and T65–T68 are 10 ms; T5–T31 and T69–T95 are 100 ms. Use the 100 ms base for human-scale dwell times (2.0 s, 5.0 s) to keep the preset word readable. In TIA Portal this restriction does not apply; the IEC TON block takes a TIME typed PT of T#2s or T#5s directly.

Ladder Logic Implementation

The following ten networks are the minimum viable implementation. Each network is a single rung or a short parallel branch; symbolic addressing is assumed on. The Set/Reset coils appear exactly twice (RUN_LATCH, BOX_FULL_FLAG); everything else is combinational output.

Network 1 — Run/Stop Seal

|--[ START_PB ]--[ /STOP_PB ]--[/ E_STOP ]--[ /FAULT_LATCH ]--( RUN_LATCH )--|
|                                                                              |
|--[ RUN_LATCH ]-----------------------------------------------------------------|

Network 2 — Conveyor #1 Feed Condition

Conveyor #1 runs when the station is started, a box is in position, and we are not in the 2-second inspection window.

|--[ RUN_LATCH ]--[ S4_BOX_POS ]--[/ INSPECT_FLAG ]--[/ BOX_FULL_FLAG ]--( CV1_RUN )--|

Network 3 — Inspection Timer (T0)

|--[ S1_PROD_ENT ]--[ RUN_LATCH ]--[ S4_BOX_POS ]--( INSPECT_FLAG )--|
|                                                                    |
|--[ INSPECT_FLAG ]--( TON T0_INSPECT, PT := 20 )--[ ]--|
|                                                              |
|---[ T0_INSPECT ]---( INSPECT_DONE )---|

Network 4 — Good Product Path

On T0 done with S2 = 1, drop the inspection flag and let CV1_RUN restart from Network 2.

|--[ T0_INSPECT ]--[ S2_QUAL_CHK ]--( R INSPECT_FLAG )--|

Network 5 — Faulty Product Path (Flapper)

|--[ T0_INSPECT ]--[/ S2_QUAL_CHK ]--[ /FLAPPER ]--( S FLAP_PERMIT )--|
|                                                                      |
|--[ FLAP_PERMIT ]--( TON T1_FLAP_DWELL, PT := 20 )--[ ]--|
|                                                            |
|--[ FLAP_PERMIT ]--[ /T1_FLAP_DWELL ]--( FLAPPER )--|
|                                                       |
|--[ T1_FLAP_DWELL ]--( R FLAP_PERMIT, R INSPECT_FLAG )--|

Network 6 — Product Count on S3 Edge

|--[ S3_COUNT ]--[ P ]--[ /BOX_FULL_FLAG ]--( CU C0_BOX_COUNT )--|

Network 7 — Box Full Detect

|--[ C0_BOX_COUNT ]--( S BOX_FULL_FLAG )--|
|                                          |
|--[ BOX_FULL_FLAG ]--[ S4_BOX_POS ]--( CV2_RUN )--|

Network 8 — Box Index Timer T2

|--[ BOX_FULL_FLAG ]--[ CV2_RUN ]--( TON T2_BOX_INDEX, PT := 50 )--[ ]--|

Network 9 — S4 ON→OFF→ON Detection (MOVE_BOX)

|--[ /S4_BOX_POS ]--[ P ]--[ CV2_RUN ]--( S MOVE_BOX )--|
|                                                      |
|--[ MOVE_BOX ]--[ S4_BOX_POS ]--( CV2_RUN )--( R MOVE_BOX )--|

Network 10 — Counter Reset & Return to Feed

|--[ MOVE_BOX ]--[ BOX_FULL_FLAG ]--( R C0_BOX_COUNT, R BOX_FULL_FLAG )--|
|                                                                         |
|--[ BOX_FULL_FLAG ]--[ /S4_BOX_POS ]--[ P ]--( R CV2_RUN )--|

Network 11 — Stack Light

|--[ RUN_LATCH ]--[/ BOX_FULL_FLAG ]--[/ FAULT_LATCH ]--( TOWER_GRN )--|
|                                                                        |
|--[ FAULT_LATCH ]--[ /RUN_LATCH ]--[ BOX_FULL_FLAG ]--( TOWER_RED )--|

The Set/Reset count is two (Networks 1 and 7). Every other output is a normal energized coil or a self-sealing branch, which keeps the program readable and cuts the total rung count by roughly half compared with a Set/Reset-everything approach.

Throughput Sizing

Cycle time per good product is the sum of the inspection dwell and the conveyor transit time between S1 and S3:

Per-product time on the good path:

t_good = t_insp + t_tr = 2.0 s + 2.0 s = 4.0 s

Steady-state throughput on the good path:

rate = 1 / t_good = 0.25 products/s = 15 products/min

Time to fill one box of 24 good products:

T_box = 24 × t_good + t_box = 24 × 4.0 s + 5.0 s = 101 s ≈ 1 min 41 s

Hourly box rate (100% good):

boxes_per_hour = 3600 / T_box = 3600 / 101 ≈ 35.6 boxes/h

If the reject rate is 10%, the effective rate drops to 0.225 good/s, and the reject path adds 0.1 × 2.0 s of flapper dwell per inspected product, reducing the line to roughly 32 boxes/h. The counter preset of 24 is independent of throughput, so the only effect of a slower conveyor is a longer T_box; the PLC program requires no changes.

Verification and Commissioning

1. Force I/O off, then on. Open STEP 7 Micro/WIN Debug → Program Status. Force I0.0 (START_PB) on, then verify M0.0 RUN_LATCH stays 1 after the force is released. If it drops, the self-seal branch in Network 1 is missing.
2. Cycle the box-present input alone. Manually toggle I0.5 (S4) on and off while watching M0.2 MOVE_BOX. MOVE_BOX should Set on the falling edge of S4 only when Q0.1 CV2_RUN is on, and Reset on the rising edge of S4.
3. Step the counter. Use Debug → Modify → Variable to write C0_BOX_COUNT.CV := 23. Drop one more product through S3 and confirm M0.1 BOX_FULL_FLAG sets, Q0.1 CV2_RUN energizes, and T2 starts.
4. Watch the timer presets. With Program Status on, right-click each TON and confirm the running bit and the elapsed time ET reach the preset PT value. A timer that never reaches PT indicates its enable rung is not seeing a true contact for long enough.
5. Endurance cycle. Set CV = 0, place a real empty box at S4, and run 100 box cycles from the HMI Run button. Log any SF (system fault), BL (battery low), or PLC hardware error in the diagnostic buffer. The S7-200 SF LED should remain off; if it lights, the CPU has logged a programming error, typically an indirect-addressing range fault or a TON used with a too-large PT.
6. Fault latching test. Pull the E-Stop chain. M_FAULT should set, all outputs should drop, and the red tower should illuminate. Releasing E-Stop should not auto-restart; an operator Reset key (Network 1, manual reset variant) must clear M_FAULT.
7. Save and archive. File → Export → Symbol Table to a CSV in the project folder, and File → Save As with a date-stamped filename. Upload the program to the CPU with PLC → Upload to verify the on-line image matches the source.

Troubleshooting Matrix

Field-Proven Caveats

Photo-eye dark-on vs. light-on. A PNP NO photo-eye (SICK W4-3, Banner SM312) outputs 24 V when the beam is unblocked by default — a "light-on" device. If the sensor is wired dark-on (output on when blocked), the entire state machine inverts. Always confirm with a piece of scrap material held under the eye: the input LED on the PLC must toggle. This single wiring choice explains more "the sensor doesn't see the box" tickets than any software bug.

Counter CV vs. PV. In STEP 7 Micro/WIN the up-counter exposes C0 as the bit, CV as the current integer value, and PV as the preset. The HMI must read CV and animate a fill bar; reading the bit shows only "full / not full" and is useless for trending. In TIA Portal the equivalent IEC counter is an instance DB with tags CV, PV, Q, CU, CD, R, LD.

Scan time vs. dwell time. The S7-200 default scan time on a CPU 224 with this program size is approximately 3 to 5 ms. The shortest timer dwell in this project is 2.0 s = 2,000,000 scans at the worst case; the dwell is never at risk of being missed by the scan. If you shrink the flapper dwell below 20 ms for a high-speed reject, you must use a hardware off-delay timer or a high-speed output, not the PLC scan.

Retentive vs. non-retentive. Timers T0-T31 on the CPU 224 are non-retentive (they reset on power loss). The counter C0-C255 is retentive in the default ranges. For a box fill that must survive an E-Stop without losing the count, the counter is fine but the run latch is not — if power is removed mid-fill, the count is preserved but RUN_LATCH drops, so the next START will see C0 = 17 and immediately fire BOX_FULL_FLAG. Add a power-up routine (SBR_0 in Micro/WIN, OB100 in S7-1200) that explicitly clears C0 and BOX_FULL_FLAG on cold start, or alarm-out the inconsistent state.

E-Stop category. The E-Stop chain shown in Network 1 is Category 1 (controlled stop with maintained power removal). For Category 0 (uncontrolled, immediate power removal) per ISO 13850, the contactor K1 and K2 must drop simultaneously with the E-Stop pushbutton, not through a PLC output. The PLC's role is supervisory only; the safety contactors wire directly to the E-Stop safety relay (e.g., Pilz PNOZ s4, Sick FX3-XTIO).

Frequently Asked Questions