Resolving S7-PLCSIM OB33 OB80 Error 16#3502 Cyclic Interrupt

Problem Overview

When a working STEP 7 program is downloaded into S7-PLCSIM (versions 5.x for SIMATIC Manager, or S7-PLCSIM V13/V14/V15/V16 inside TIA Portal) the simulated CPU can drop into STOP mode on the first scan and emit a cluster of diagnostic-buffer events that all stem from a single cyclic-interrupt overflow. The typical diagnostic buffer sequence looks like this:

The accompanying coding word in the buffer entry is the standard Siemens 8-byte event structure:

Event 3: 16# 3502 1A50 C358 0000 1134 0A21
  Byte 0-1 : Event ID       = 16#3502  (OB request error)
  Byte 2-3 : Identifier 1   = 16#1A50  (no relevance for user / internal)
  Byte 4-5 : OB-number pkg  = 16#C358  (causing OB 33, prio 10)
  Byte 6   : Requested OB   = 16#34    (OB80 - Timing Error)
  Byte 7   : Prioclass req. = 16#0A    (priority 26 of OB80)

The full chain means: the simulated CPU attempted to start OB33 on its scheduled time, OB33 either was missing, took longer than its configured period, or threw an internal exception, and the operating system tried to call the timing-error OB (OB80) – which is also missing – so the CPU transitioned to STOP with priority-class error 16#4541. On a real S7-300/S7-400 CPU the same program typically runs because the real hardware scheduler and instruction timings differ from PLCSIM's cycle model.

Affected Products and Versions

The fault pattern has been observed on the following software/hardware combinations:

Reference: S7-PLCSIM V5.4 Manual (entry ID 54667828) and S7-PLCSIM Application Limitations (entry ID 36462014) in the Siemens Industry Online Support portal.

Root Cause Analysis

The 16#3502 event is a generic "OB request error" generated by the SIMATIC CPU operating system when it tries to start a system OB that the user program has not loaded. In the sequence above the operating system followed this decision tree:

1. The cyclic-interrupt clock generator for phase 4 (OB33) fired at its scheduled time.
2. OB33 either (a) was not present in the downloaded SDB, (b) ran longer than the configured phase time, or (c) raised a programming error that the OS escalated to OB80.
3. OB80 (timing error) was also not present in the project, so the OS entered the priority-class stop path.
4. The OB1 free-cycle watchdog detected the cascading OB failure and produced 16#4541.
5. The startup attempt was aborted with 16#530D – STOP request exists, warm restart required.

The decisive information is encoded in bytes 4-7 of the event-coding word:

1A 50 C3 58 00 00 11 34 0A 21
                ^----OB33,  ^--OB80, ^--Prio 26

Three sub-causes are typically responsible:

Sub-Cause 1 – OB33 Not Downloaded

If the cyclic-interrupt OB exists in the offline project but is not in the active SDB, or if a different cyclic OB (e.g., OB35) is referenced, the OS still tries to call OB33 because the cyclic-interrupt configuration in HW Config is fixed at build time. Verify with: STEP 7 → Blocks → right-click → Object Properties → "Download to target device".

Sub-Cause 2 – OB33 Exceeds Its Phase Time

Each cyclic-interrupt OB (OB30-OB38) has a fixed base period. The default values on an S7-300 CPU are:

If OB33 contains a heavy block, multiple SFB/SFC calls, indirect addressing, or a loop that scales with array size, its execution time can exceed 500 ms. PLCSIM's instruction-timing model is conservative; many blocks that complete in <100 ms on a real CPU 315-2 can exceed 500 ms in PLCSIM V5.4, which is exactly the OB33 phase budget.

Sub-Cause 3 – Missing OB80 (Timing-Error OB)

Even when the overrun is the real culprit, the user can keep the CPU in RUN by simply loading OB80 into the project. The default OB80 supplied by STEP 7 (Libraries → Standard Library → System Function Blocks → OB80) only acknowledges the time error and continues execution. This is the standard Siemens recommendation and the workaround that resolves the 16#3502/16#4541 cluster immediately.

Diagnostic Procedure

Follow this ordered procedure to isolate the OB33 / OB80 root cause.

1. Open the diagnostic buffer. In SIMATIC Manager: PLC → Diagnostic/Setting → Diagnostic Buffer. In TIA Portal: Online → Diagnostics → Diagnostic buffer. Note the order of events, not just the latest one.
2. Read the event-coding word. Bytes 6-7 of the 16#3502 entry identify the requested OB and its priority. Here: 16#34 = OB80, priority 16#1A = 26. Confirm OB80 is absent from the project offline.
3. List all cyclic OBs in the offline project. In SIMATIC Manager: Blocks → right-click → Show → OB. Verify whether OB30-OB38 exist and which are loaded in the SDB.
4. Measure the cycle time of OB33 in PLCSIM. In OB33, insert:
   L #OB33_EXC_FREQ // load configured time base in ms
L #OB33_TIME_LOAD // load actual measured time
-D
T #DB_CYCLE_SLACK // store delta
   With OB33_STARTTIME, OB33_EXC_FREQ, OB33_PHS_OFFSET, and the SFC78 OB_RT / SFC79 SET_OB_RT you can profile the time. The relevant temporary variables are exposed automatically in the OB's interface declaration.
5. Run the same program on a physical CPU. Connect a CPU 315-2 DP, place it in RUN, and watch the diagnostic buffer. If 16#3502 does not appear, the issue is PLCSIM-specific and you can use the real PLC to verify the fix.
6. Check for unsupported constructs. PLCSIM does not execute encrypted S7-Block Privacy blocks, SFC109 / SFC110 protection calls, or some SFCs that depend on hardware (SFC51, SFC52, SFC187). See S7-PLCSIM application limitations.

Solution Path A – Load OB80 (Quick Mitigation)

This is the fastest fix and is appropriate when the overrun is benign (e.g., known loop bounded by data size). Steps:

1. Open SIMATIC Manager and the S7 project.
2. Insert a new OB: Blocks → right-click → Insert New Object → Organization Block.
3. In the dialog, change the type to OB80 – Time-of-Day Error / Timing Error.
4. Open the OB and copy the standard content from Libraries → Standard Library → System Function Blocks → OB80 (BF-AW). The default body simply sets the OB80_RESERVED field and returns; that is all that is required.
5. Save and download: PLC → Download.
6. Perform a CPU restart: PLC → Operating Mode → Complete Restart or power-cycle PLCSIM.
7. Verify: the diagnostic buffer should now show OB80 start events instead of 16#3502 OB-request errors.

If OB80 fires repeatedly, the simulator is still running OB33 over its budget – move to Path B.

Solution Path B – Re-Architect Cyclic Logic

Spread the heavy workload across multiple cyclic OBs and the free cycle so no single OB exceeds its phase time.

Workload Distribution Example

Inside the OBs – Best-Practice Skeleton

// OB35 – 100 ms control loop
CALL  "CTRL_PID" , DB100       // PID with background self-tune
      I_IN   := IW512
      SETPNT := MD200
      I_OUT  := QW512

// Edge-trigger guard against overrun
      L     #OB35_TIME_LOAD     // accumulated OB35 runtime
      L     80                  // 80% of 100 ms budget
      >I
      JC    OVER                // jump if overrun risk

      // ...normal logic...
OVER: SET                          // set internal flag
      SAVE                        // for OB1 to log later

Use SFC79 SET_OB_RT to query the time remaining in the current OB, and SFC78 OB_RT to obtain the configured time base. Sample call inside OB33:

CALL  SFC 79                 // SET_OB_RT
      OB_NR     := 33
      RET_VAL   := MW240         // ms remaining or error code

      L     MW240
      L     200                 // 200 ms headroom
      <I
      JC    BUSY                // skip slow work this cycle
      // ...slow path...

Solution Path C – Adjust Cyclic Phase in HW Config

Sometimes the OB33 phase time is simply too tight for the project. Increase it in HW Config:

1. Open HW Config.
2. Select the CPU (e.g., CPU 317-2 PN/DP).
3. Open Properties → Cyclic Interrupts tab.
4. Change the OB33 phase to 1000 ms or 2000 ms (or whatever the logic actually needs).
5. Recompile the hardware (Station → Save and Compile).
6. Download the new SDB to PLCSIM.

Solution Path D – Substitute or Bypass PLCSIM

When the project cannot be simplified (encrypted blocks, motion libraries, custom SFBs), evaluate alternatives:

For S7-1500 targets, PLCSIM Advanced improves several limitations (virtual PROFINET, OPC UA server, web server) but still has the same OB execution-time discrepancy for very large cyclic OBs. For S7-300/S7-400, the only 100%-accurate option is a real CPU.

Verification Steps

After applying the fix, perform these checks in order:

1. Diagnostic buffer clean. Power-cycle PLCSIM and watch the first 60 seconds of diagnostic events. The 16#3502/16#4541 cluster should be replaced by normal OB1 free-cycle start/stop entries (event ID 16#4381, 16#4382) or no events at all.
2. OB33 cycle time check. In OB33, evaluate:
   L #OB33_EXC_FREQ
L #OB33_TIME_LOAD
/R
T MD300 // ratio = load / phase
L 0.8
>R
JC WARN
   If the ratio stays below 0.8 for a 30-minute test, the OB is healthy.
3. OB80 presence test. In TIA Portal or SIMATIC Manager, open the online block list and confirm OB80 is online with the same timestamp as the rest of the project.
4. Watchdog test. Force a deliberate OB33 overrun by inserting a 2-second delay loop. OB80 should fire, log a timing error, and the CPU should remain in RUN.
5. Cross-check on physical CPU. Download to a real CPU 315-2 or CPU 317-2 and confirm the same diagnostic buffer pattern.
6. Watchdog parameter audit. Open CPU Properties → Cycle/Clock Memory. Verify OB1 cycle monitoring time is 150 ms (default) or higher; 100 ms is too tight for many real projects.

Extended Troubleshooting Matrix

Why Real CPUs Hide the Problem

The S7-300/S7-400 CPUs use a deterministic priority-class scheduler driven by the hardware clock. PLCSIM V5.4 emulates the scheduler with the host-PC tick, but the host OS (Windows) preempts the simulator thread at irregular intervals. This makes PLCSIM more sensitive to long OBs than the physical PLC, and explains the symptom: "program runs on CPU, fails in PLCSIM." The real CPU's instruction execution is also faster – the 317-2's bit-execution time is 0.025 µs vs. PLCSIM's modelled 1-3 µs. If the OB33 logic is <300 ms on a real 317-2 it may push 600-800 ms in PLCSIM, exceeding the 500 ms phase.

Prevention Checklist for Future Projects

1. Always load OB80, OB81, OB82, OB83, OB84, OB85, OB86, OB87, OB121, OB122 – the ten standard error OBs. They turn fatal errors into logged events and let the CPU stay in RUN.
2. Configure IEC check in the offline program: STEP 7 → Options → Customise → LAD/FBD/STL → STL → Enable IEC check. This catches area-crossing errors at compile time.
3. Set the OB1 cycle monitoring time to a value > 2× the measured worst-case OB1 runtime. Default 150 ms is often too low for projects with array processing.
4. Use SFC79 SET_OB_RT inside cyclic OBs to query remaining time and skip slow work on the same cycle.
5. When migrating from S7-PLCSIM V5.4 to TIA Portal PLCSIM V16/V17, retest every cyclic OB; the underlying execution model changed with the TIA simulator.
6. Document the OB33 time budget in the project README. If the budget is < 200 ms, mark the project as "PLCSIM-incompatible."
7. Prefer OB35 (100 ms) over OB33 (500 ms) for PID loops – the more frequent interrupt averages out jitter better and stays well below the typical PLCSIM sensitivity.

Related Siemens Documentation

For further reference, the following Siemens Industry Online Support entries are relevant. They are linked as the manufacturer documentation and should be used for verification against the latest firmware:

• S7-PLCSIM V5.4 Manual – entry ID 54667828
• S7-PLCSIM Application Limitations – entry ID 36462014
• S7-300 CPU 31xC and CPU 31x Manual – entry ID 44239976
• S7-300/400 System Software System and Standard Functions Reference – entry ID 1117740
• Diagnostic Buffer of S7-300/S7-400 CPUs – entry ID 90885040
• PLCSIM Advanced V3.0 Function Manual

Field-Proven Caveats

• Some users have reported that OB80 loaded but the simulator still drops to STOP because OB33 contained a DB_ANY variant that PLCSIM V5.4 mishandles. The fix is to use an explicit DB number rather than a DB opened by SFC7 DB_TEST in OB33.
• When the OB33 body calls SFB41 CONT_C (PID) with the "background self-tune" option, PLCSIM may take 2-3× longer than a real CPU. Disable self-tune for the simulation branch.
• Do not use SFC36 / SFC37 MSK_FLT / DMSK_FLT in PLCSIM to mask synchronous errors globally – the simulator's error model diverges from the hardware, and a masked error can still cause OB80 to fire repeatedly.
• Encrypted S7-Block Privacy blocks are not executable in PLCSIM V5.4 SP5 and earlier. Trying to download them produces a follow-on 16#3582 diagnostic event. Use the unencrypted source project for simulation and the encrypted binary for the real CPU.

Summary of the Fix

For a project that runs on a real S7-300/400 CPU but emits 16#3502 / 16#4541 / 16#530D in PLCSIM, the canonical fix is a two-part change:

1. Insert OB80 (Timing Error) with the default library body. This turns a fatal OB33 overflow into a logged event and keeps the CPU in RUN.
2. Profile OB33 cycle time with SFC78/SFC79 or with the local temporary #OB33_TIME_LOAD. If the OB approaches or exceeds its 500 ms phase, redistribute work to other cyclic OBs (OB30-OB38) and to the free cycle (OB1).

Both changes must be saved into the SDB and downloaded together. After a complete restart of PLCSIM the diagnostic buffer should show only normal start events, and OB80 (if it still fires) will confirm that the scheduler is operating within budget.