Resolving S7-400H CPU STOP on SM326 Short Circuit Fault in ET200M

1. System Topology and Fault Context

The reported configuration is a Siemens SIMATIC S7-400H redundant controller with the following catalog-numbered hardware:

The CPU 412-3H ships with 768 KB of work memory (384 KB code / 384 KB data), 8 KB of bit memory, and three integrated interfaces: MPI/DP, DP master/slave, and PROFINET IO with a 2-port switch. It supports redundant operation only when paired with an identical partner CPU running the same firmware version. The IM 153-2BA02 is the redundant-capable PROFIBUS interface module for ET200M stations, accepting up to 12 S7-300 I/O modules and supporting runtime hot-swap. The SM 326 digital I/O modules are the failsafe-capable I/O family used here in non-safety redundant mode; both the DI 8-channel and DO 10-channel variants provide per-channel diagnostics including wire-break, short circuit, and overload detection.

Three concrete symptoms are reported:

1. After a STEP 7 program download, one CPU enters STOP mode with no informative diagnostic buffer entry.
2. When an output is forced from the CFC editor test mode (sim_I), both redundant channels energize correctly. Within 5 to 10 seconds the red fault LED illuminates on the affected output, and the diagnostic buffer logs a "short circuit" event.
3. The active CPU subsequently transitions to STOP after the channel fault, defeating the purpose of redundant I/O and CPU redundancy.

All three symptoms converge on the same root cause family: missing error OBs in the user program and inconsistent program distribution between the two H-CPUs. The remainder of this reference works through the underlying mechanics, the required OB library, and a verified commissioning procedure.

2. Why the CPU Transitions to STOP on a Channel Fault

An SM 326 DO 10x24 V DC/2 A module monitors each output channel continuously. When channel diagnostics is enabled in HW Config and the module detects a short circuit to ground, an overload, or a wire break (sensor side for DI), it raises a diagnostic interrupt on the PROFIBUS DP line. The interrupt is directed at a specific organization block on the active CPU:

The STEP 7 default for any of these OBs is: if the OB is not in the user program, the CPU transitions to STOP when the corresponding event occurs. In an H-system this triggers a failover to the standby CPU, but the original active CPU remains in STOP and the partner may eventually follow if the fault condition persists. To break this cycle the OBs must be loaded as part of the program image on both CPUs, with code that handles the fault rather than simply leaving the OB empty.

3. SM 326 Channel Diagnostics Configuration

Channel diagnostics on the SM 326 are configured per-channel in HW Config, not at runtime. For the 6ES7326-2BF10-0AB0 digital output module, the relevant settings are accessed by opening the module properties in the ET200M station, then drilling into Outputs > Channel n > Diagnostics:

For the 6ES7326-1BK02-0AB0 digital input module, enable diagnostic interrupt and wire break detection on each channel. With channel diagnostics enabled, the module writes a diagnostic data record (typically DS 0 and DS 1) that can be read via SFB 52 (RDREC) for granular per-channel fault identification.

The "short circuit" event logged in the diagnostic buffer is almost always one of three real-world conditions:

• Genuine wiring fault: insulation breakdown, pinched conductor, or a miswired terminal that shorts the 24 V output to PE/M.
• Inrush current above the 2 A limit: capacitive loads, DC solenoids without free-wheeling clamping, or incandescent lamp filaments briefly exceed the 2 A channel rating and trip the hardware short-circuit sensor. The trip time of the SM 326 sensor is typically 1–10 ms; peak inrush must be checked on an oscilloscope if the wiring proves clean.
• Cross-wiring between redundant channels: in true 1-out-of-2 redundancy, each redundant module drives the load through a separate contact path (diode-OR'd or contact-OR'd). If both modules are wired directly in parallel without the diode isolation, a healthy module back-feeds into the shorted channel and both modules flag "short circuit".

When forcing via CFC test mode, both channels are energized simultaneously. This is the worst-case stress for the diagnostic logic, which is precisely why the fault appeared 5–10 seconds after the force: inrush settling or the SM 326 averaging filter recognizing a sustained fault, not a transient.

4. The Error OB Library Required for H-Systems

For a redundant S7-400H, the minimum OB library covers all the events in the table above plus the H-specific OBs. The OBs to import (from the STEP 7 Standard Library > S7 Program > Organization Blocks) are:

• OB 70 – I/O redundancy loss (fires when a redundant I/O module drops out)
• OB 72 – CPU redundancy loss (fires on standby-to-master transition)
• OB 73 – Communication loss of redundancy (H-system specific)
• OB 80 – Time error
• OB 81 – Power supply fault
• OB 82 – Diagnostic interrupt (the OB the SM 326 actually calls)
• OB 83 – Insert/remove module
• OB 84 – CPU hardware fault
• OB 85 – Priority class error (covers "OB not loaded" scenarios)
• OB 86 – Rack / DP slave failure
• OB 87 – Communication error
• OB 121 – Programming error
• OB 122 – I/O access error

For PCS 7 projects these are inserted automatically from the master data library when the S7 program is compiled. For S7 (non-PCS 7) projects they must be imported manually. To import them:

1. Open the S7 project in STEP 7 (V5.5 or TIA Portal as applicable).
2. Open the Standard Library > S7 Program > Organization Blocks folder.
3. Drag OB 70, OB 72, OB 73, OB 80, OB 81, OB 82, OB 83, OB 84, OB 85, OB 86, OB 87, OB 121, OB 122 into the project's Blocks container.
4. Inside each OB, add minimal fault-handling code (see Section 5) – an empty OB is sufficient to prevent STOP, but a populated OB provides diagnostic visibility.
5. Save and recompile the program.
6. Download the blocks to both AS 1 and AS 2 (Section 6).

5. Step-by-Step Recovery: Loading Error OBs into the H-CPU Pair

1. Open the S7 program in STEP 7 on the engineering station. Confirm the project target is S7-400H (not PCS 7) so the chart auto-generation question from the discussion thread does not apply.
2. Import the OB library from the Standard Library as listed in Section 4. The default STEP 7 OB sources include a stub handler that just calls SFC 6 (STP) or returns – for production code replace this with logging.
3. Populate OB 82 with diagnostic capture. A minimal handler that retains the OB execution without forcing a STOP looks like:
   

   
   // OB82 - Diagnostic Interrupt
   // Local variables provided by the system:
   //   OB82_EV_CLASS, OB82_FLT_ID, OB82_PRIORITY,
   //   OB82_OB_NUMBER, OB82_RESERVED_1, OB82_IO_FLAG,
   //   OB82_MDL_ADDR, OB82_INT_FAULT, OB82_OUT_FAULT,
   //   OB82_FLT_DATE, OB82_FLT_TIME
   //
   L     #OB82_MDL_ADDR          // logical base address of faulty module
   T     DB100.DBD  0            // store in operator-visible DB
   L     #OB82_INT_FAULT         // input-side fault bitfield
   T     DB100.DBD   4
   L     #OB82_OUT_FAULT         // output-side fault bitfield
   T     DB100.DBD   8
   SET
   SAVE
   BE
   

   The bitfields returned in OB82_INT_FAULT and OB82_OUT_FAULT map 1:1 to channel diagnostic bits; bit 0 = channel 0, bit 7 = channel 7 for the DI module and bit 0 = channel 0, bit 9 = channel 9 for the DO module. Bit 5 of OB82_OUT_FAULT is the short-circuit-to-ground flag for the DO module and is the bit that lights the red fault LED on the channel.
4. Populate OB 70 and OB 72 with similar capture to DB100. The redundant-specific OBs give visibility into which channel pair lost redundancy; this is essential when troubleshooting a fault on one leg only.
5. Compile the S7 program (Menu: Program > Compile All). Verify that the chart generation step (CFC: Chart > Compile) is run after the OBs are present so that the CFC compiler can resolve any OB references in the generated blocks.
6. Download to both AS stations using the procedure in Section 6.
7. Verify on the online view that the OBs appear in the online block list of both CPUs. A missing OB on the partner CPU is itself a redundancy hole.

6. Re-Downloading Configuration to a Live S7-400H Pair

Program downloads to a live H-system require a specific sequence; partial or asynchronous downloads can leave one CPU in STOP and the partner in RUN, which the H firmware tolerates but which leaves the system one failover away from a full outage. The verified procedure is:

1. Backup the S7 project before any change. Use File > Archive or export the S7 program source.
2. Compile hardware configuration in HW Config and resolve any consistency errors. A system-generated chart with stale references will fail to download to one CPU only and leave the partner in an undefined state.
3. Compile the S7 program including all charts (CFC: Chart > Compile > Charts as Program). For a CFC-heavy project, delete the system-generated chart blocks before re-download if a previous compile produced an inconsistent block set. The discussion thread's "delete all system-generated charts then recompile" step addresses a known PCS 7/CFC edge case where a partial regenerate leaves type mismatches in the generated FBs.
4. Download hardware configuration to both AS 1 and AS 2. Use PLC > Download to Target System > ... and select each AS station individually, or use the H-system download dialog that pushes the same HWCNF to both CPUs. The two HWCNF blocks must be byte-identical; the H firmware compares them during link-up.
5. Download user program blocks to AS 1 first, wait for synchronization, then download to AS 2 (or use the unified S7-400H download). The blocks must appear identically on both CPUs; verify with PLC > Compare Blocks.
6. Run RUN/STOP toggle sequence only if required: STOP on AS 1, download, RUN on AS 1, then STOP on AS 2, download, RUN on AS 2. In a healthy H-system, S7-400H handles live downloads with both CPUs in RUN, but a STOP/RUN toggle guarantees a clean restart of all error OBs.
7. Verify link-up on the H-system status display (LEDs: LINK, ACTIVE, STANDBY, FAULT on each CPU). LINK-UP OK on both CPUs confirms redundant operation. The SFC 90 (H_CTRL) call from the user program or the diagnostic view in STEP 7 confirms the redundancy status programmatically.

7. Verifying Channel-Level Redundancy and Forced Output Behavior

After error OBs are loaded and HW Config has channel diagnostics enabled, verify the redundancy behavior end-to-end:

1. Force a single output via CFC test mode (CFC > Chart > Test Mode > sim_I on the output block). Both redundant DO channels must energize within one PROFIBUS cycle (typically 5–10 ms at 1.5 Mbps, longer at slower baud rates).
2. Monitor the redundant channel status via the S7-400H system function blocks. SFB 101 (RDSYSST with SSL_ID W#16#0132) returns the redundant I/O state; channel-discrepancy flags surface here when one leg of the redundancy pair diverges from the other.
3. Introduce a known short circuit on one channel (with the system in maintenance state and safe shutdown acknowledged). Confirm:
   - The faulty channel's red LED illuminates within 100 ms.
   - OB 82 is called on the active CPU; the diagnostic buffer now shows the slot, channel, and fault code.
   - The CPU remains in RUN because OB 82 is loaded and exits with BE.
   - The partner DO module continues to drive the load.
4. Remove the short. The red LED clears within one OB 82 cycle. The diagnostic buffer retains the entry until manually cleared.
5. Repeat for a single-channel failure by removing one DO module from the ET200M station. OB 83 (Insert/Remove Module) must be loaded; without it the CPU enters STOP. With OB 83 loaded, the H-system continues on the remaining leg and OB 70 logs the I/O redundancy loss.

8. Field-Proven Diagnostics: SFC/SFB Calls and Buffer Analysis

When an intermittent short circuit appears during forced-output testing and disappears during bench-testing, the diagnostic data records from the SM 326 are the only ground truth. Read them programmatically:

A diagnostic readout from SFB 54 inside OB 82 returns the auxiliary structure RALRM with fields including the channel number, the fault ID (per Siemens "Channel Error Types" table: 0x01 wire break, 0x02 short circuit to ground, 0x03 overload, 0x04 overtemperature, 0x05 parameter error, 0x06 sensor supply short circuit), and the module logical base address. Cross-reference the base address with the HW Config slot table to identify the physical module in the ET200M station.

For the IM 153-2BA02 redundancy status, the SSL_ID W#16#0x74 (H-system specific) returns the redundant link state. Combine this with SFB 101 (RDSYSST with SSL_ID W#16#0132) to get the redundant I/O health on each channel pair.

9. Edge Cases: Wiring, Inrush, and Intermittent Short-Circuit Detection

Field experience shows the "short circuit" event logged during the forced output test in this topology most often traces to one of four wiring issues, even when the bench test shows the circuit clean:

• Back-EMF on inductive loads without clamping. A 24 V DC relay coil with no free-wheeling diode or with a degraded TVS generates a reverse EMF that exceeds the SM 326's sensor threshold when the contact opens. Add a 1N4007 or bidirectional TVS across the coil.
• Capacitive load inrush. A long shielded cable to a sensor with significant capacitance draws peak current above the 2 A limit for several ms. The SM 326 short-circuit sensor trips in 1–10 ms; the symptom looks identical to a hard short. Insert a 10–47 Ω inrush resistor or use a current-limited pre-charge path.
• Cross-wired redundant legs. Two SM 326 DO modules driving a common load without diode isolation will each report "short circuit" when one leg faults. Standard wiring uses either a separate contactor per leg with mechanical OR'ing, or diode-OR'd outputs with a 1 A Schottky per leg. Verify with the wiring diagram.
• PE vs M distinction. The SM 326 reports "short circuit to ground (M)" – this is the module's 24 V reference, not protective earth. A short to chassis ground at the field terminal shows up as a "short to M" only if the chassis and M are bonded. If the cabinet separates PE and M, check for inadvertent chassis contact at the field device.

10. Quick Reference Matrix: Error OB vs Fault Source

11. Maintenance Mode and CPU STOP Behavior in H-Systems

In an S7-400H, when the active CPU enters STOP, the H firmware triggers a redundancy takeover and the standby CPU becomes active. This is by design and is one of the primary value propositions of an H-system. However, two practical limitations apply:

• The originally-active CPU stays in STOP until manually restarted. An operator must clear the fault and switch the CPU back to RUN via the mode selector. If the fault is on the standby CPU, the active CPU remains active and the standby stays in STOP; this does not affect process operation but does reduce the redundancy margin.
• If the same fault occurs on both CPUs (for example, a wiring fault that the standby CPU also sees when it takes over and energizes the output), both CPUs can enter STOP sequentially and the system halts. The fix is to isolate the field wiring before swapping roles. The OB 70 and OB 72 handlers must include logic to disable the affected output pair until the field fault is cleared.

For commissioning in maintenance mode, force the suspect output at the lowest possible duty cycle and use a clamp-on ammeter to look for inrush above 2 A on a known-good wiring path. The SM 326 trips its sensor within a few ms; if no trip occurs on a clean wiring path, the module is healthy and the issue is external.

12. References to Official Documentation

For complete OB specifications and module parameter ranges, consult the Siemens SIMATIC S7-400H manuals on the Siemens Support portal:

• SIMATIC S7-400H Fault-tolerant Systems Manual – covers redundancy modes, link-up, and error OBs.
• S7-400H Commissioning and Operation Guide – step-by-step H-system startup.
• SM 326 F Digital Input Module Manual – channel diagnostics for the 6ES7326-1BK02-0AB0.
• SM 326 F Digital Output Module Manual – channel diagnostics and short-circuit detection for the 6ES7326-2BF10-0AB0.
• IM 153-2 Manual – ET200M redundant interface module behavior.
• STEP 7 S7-400H Programming Guide – OB library and H-system blocks.