Resolving Siemens S7-200 HSC Input Interrupt Minor Fault on CPU 224XP

The Siemens SIMATIC S7-200 product line uses fixed-point input sharing between high-speed counter (HSC) resources and edge-triggered hardware interrupts. When an application assigns the same physical input to both functions, the CPU raises a deterministic, non-fatal error string "Input interrupt to a point already assigned to an HSC" and writes a code 0002h into the special memory word SMW22 / SMB22-related fault word, with the offending event referenced through the program block in which the ATCH call lives. This article documents the failure mechanism for a 224XP REL 02.01 in a dosing system, the interrupt event table it operates against, the HSC input allocation matrix that creates the conflict, and the verified remediation patterns that clear the non-fatal fault without disturbing pulse counting integrity.

1. Problem Statement and Field Context

Reported configuration:

• CPU: SIMATIC S7-200 224XP, order number 6ES7 214-2BD23-0XB0 (24 V DC, 14 DI / 10 DO relay variant) or 6ES7 214-2AD23-0XB0 (24 V DC source output variant).
• Firmware: REL 02.01 on-board.
• Programming software: STEP 7 Micro/WIN V4.0 SP9.
• Application: dosing skid that reads an incremental encoder on I0.1 for both position and speed; the controller triggers dosing on selected encoder events.
• Observed fault: SF LED on, minor fault descriptor "Input interrupt to a point already assigned to an HSC" pointing to Network 4 of the INTERRUPTS subroutine.
• Side effect: ENO on the ATCH in question evaluates to 0, so the attached interrupt routine is not invoked.

Because the fault string is generated by the S7-200 firmware and is identical across revisions, the procedure documented here applies to all S7-21x CPUs that share the same HSC/Interrupt resource map: 221, 222, 224, 224XP, 226, and 226XM.

2. S7-200 Interrupt Event Table

The S7-200 reserves fixed hardware interrupt numbers that are bound to physical inputs at the silicon level. A subset of that table is the operative surface for this fault:

Two facts drive the entire failure. First, events 2 and 3 are the only interrupt events that can fire on the silicon input that also serves as the HSC3 clock. Second, the ATCH instruction requires that the source event is currently free; if the firmware detects that the underlying input is owned by an HSC resource, the bind is refused and the error string above is generated.

3. HSC Input Allocation on the 224XP

The 224XP integrates six high-speed counters (HSC0 through HSC5). The hardware channels they consume on the 224XP are:

4. Root Cause: Why "Network 4" Is Named

The S7-200 firmware scans the program for ATCH instructions and, on a STOP-to-RUN transition or first scan (SM0.1 = 1), validates each event assignment against the HSC configuration block written by HDEF. When a conflict is detected:

1. The firmware writes a 0002h diagnostic into the minor fault word associated with the program block in which the first offending ATCH appears.
2. The error message in the programming software is generated from the symbol table cross-reference of the offending event to the HSC mode register.
3. The non-fatal fault bit is latched in SMB31 / SMW22 (fault byte references vary by manual edition, but SMB22 / SMW22 / SMB200-style diagnostic bytes are the read points).

Network 4 of the INTERRUPTS routine is named in the message simply because it is the first ATCH call site that targets event 2 (or event 3) on I0.1 while HSC0 or HSC3 is already bound to that input. If the offending ATCH is deleted, the next conflicting site is reported, which is how the diagnostic advances if the program is partially fixed.

The companion observation in the source program that ATCH event 12 and event 32 appear twice in the project is unrelated. The firmware rule for that case is "one event cannot be concurrently attached to multiple interrupt routines"; the second attachment simply re-binds the event to the second routine. The HSC conflict is the only one that yields the specific error string quoted.

5. ATCH / DTCH / HDEF Instruction Semantics

For the S7-200 ladder, the three instructions that participate in this fault are:

Re-routing ATCH from event 2 to a different event with a different physical source is the corrective action. The dosing sketch below illustrates the offending network in shape only; the user is responsible for substituting actual tags:

// --- INTERRUPTS sub (SBR 0) ---
// Network 4: offending ATCH
//        ATCH  INT_0,    2    // event 2 = rising edge of I0.1
//                            // FAULT: I0.1 already owned by HSC3 (HDEF 3, 0)
//
// Corrected network 4:
        ATCH  INT_0,    12    // event 12 = HSC0 CV=PV (counts against HSC0 preset)
        // If HSC3 is the primary counter, use event 32 (HSC3 CV=PV)
        // instead. Both events are HSC-internal and do not consume the input pin.

6. Diagnostic Workflow Without Editing Code

Before changing program logic, prove the conflict hypothesis with the following steps in STEP 7 Micro/WIN. These do not modify the running program and are safe to execute on a live system as long as the CPU is left in RUN.

1. Open System Block > Input Filters and confirm the input filter bank assigned to I0.0-I0.3. HSC inputs must remain in the 0.2 us / 0.2 us / 0.2 us / 6.4 ms grouping or the count will silently miss pulses.
2. Open Status Chart (Watch Table) and force SMB22, SMB23, SMB24, SMB25 to be visible. SMB22 is the system error / non-fatal fault byte; 0002h inside the encoded field confirms an ATCH validation fault.
3. Add a contact to the ladder using SM0.0 (always on) and a MOVW that writes SMW22 to a free V memory word, for example VW200. This preserves the fault word for later analysis without losing it on a power cycle.
4. Open Program Editor > Cross Reference, filter to I0.1, and list every reference. Each program block that uses I0.1 must be inspected. HSC references show up as HDEF arguments in MAIN; interrupt references show up as ATCH arguments in INTERRUPTS.
5. Read SMB37 (HSC0 control), SMB47 (HSC1), SMB57 (HSC2), SMB137 (HSC3), SMB147 (HSC4), and SMB157 (HSC5) to read the live control byte of each counter. Bit 0 (active level) and bit 3 (direction) are useful to confirm which HSCs are armed and which modes are in effect.
6. Connect Micro/WIN via RS-485 PPI cable (PC/PPI cable 6ES7 901-3DB30-0XA0 for USB, 6ES7 901-3CB30-0XA0 for serial) at 187.5 kbaud (default) or 9.6 kbaud for legacy modules, and capture a PLC > Information snapshot. The minor fault line will display the exact error string and the program block cross-reference.

7. Resolution Path Selection

There are three valid remediations. Choose based on available free inputs, encoder type, and the role of the rising-edge event.

7.1 Move the rising-edge interrupt to a free input

If a free digital input exists on the 224XP, the cleanest fix is to parallel the encoder signal into the second input and change the ATCH argument. Encoders with line-driver outputs can source two 24 V loads without a buffer. Encoders with open-collector outputs typically require a single 24 V pull-up shared between the two input points; the 224XP's integral 24 V input bias can serve both inputs as long as total current per group stays below the input bank rating.

1. Wire the encoder A channel to I0.1 (HSC clock) and a parallel tap to a free input (I0.2, I0.4, or I0.5 are commonly free on a 224XP).
2. Change the offending ATCH from event 2 to the event number that matches the new input: event 4 (I0.2 rising) or event 8 (I0.3 rising), depending on the destination.
3. Validate that the destination input is not in turn owned by an HSC mode. I0.2 is the reset for HSC0/HSC4; I0.3 is the clock for HSC4; I0.4 is the clock for HSC5. Use I0.5 (HSC5 reset) or any I1.x (free of HSC conflict on HSC1/HSC2 clocks, though HSC1/HSC2 do not use I1.5 as a clock) only after the specific mode is verified.

7.2 Replace the rising-edge interrupt with an HSC-internal CV=PV event

If the rising-edge event is being used as a "count equals preset" trigger, it is the wrong tool. The HSC subsystem has native events for that purpose. Configure the preset, set the HSC mode, and attach the routine to event 12 (HSC0 CV=PV), event 13 (HSC1 CV=PV), event 16 (HSC2 CV=PV), event 29 (HSC4 CV=PV), or event 32 (HSC3 CV=PV). The HSC-internal event does not consume an input pin and does not collide with edge interrupts.

// HSC3 mode 0, count up to preset 1000, attach INT_0 to CV=PV event
        HDEF  3,   0     // HSC3, mode 0 (single-phase, internal direction)
        MOVD  1000, SMD138   // HSC3 new preset (SMD138, double word)
        MOVD  0,    SMD142   // HSC3 current value (SMD142, double word)
        HSC    3           // commit HSC3 configuration
        ATCH  INT_0,  32   // event 32 = HSC3 CV=PV
        ENI                // enable global interrupt processing

7.3 Re-architect to use HSC0 quadrature and a free I0.x for the edge

If the application needs the encoder in quadrature (which is what a position-and-speed dosing loop typically uses), declare HSC0 with HDEF 0, 9 (quadrature 4x, no reset, internal direction) and re-route the application. Quadrature on HSC0 keeps I0.0 and I0.1 both owned, so an I0.1 rising-edge event is still impossible. Move the edge event to I0.5 or I1.2 with the considerations above.

8. Step-by-Step Fix Procedure

Procedure for the dosing system using the 224XP REL 02.01. Assumes the encoder is wired to I0.1 and the rising edge is used as a generic index pulse.

1. Open the project in STEP 7 Micro/WIN V4.0 SP9 and connect to the CPU in STOP mode to download the change safely.
2. In System Block > Input Filters, ensure I0.0-I0.3 use the 0.2 us filter setting (default for HSC0). The 6.4 ms filter is for non-HSC inputs.
3. Locate the ATCH in Network 4 of the INTERRUPTS sub. Read the event argument; in the source case it is event 2.
4. Replace the event number with the HSC-internal event that matches the counter in use. For HSC3, use event 32. For HSC0, use event 12.
5. Remove any DTCH that follows the corrected ATCH, unless the detach is intentional. ATCH to the same event re-binds; no detach is required.
6. Verify the HSC configuration is loaded with an HSC n instruction in the first scan. SM0.1 contact is the conventional trigger.
7. Add a RETI at the end of the interrupt routine. The S7-200 family does not require RETI to be physically last, but it is required inside the routine to return cleanly.
8. Compile the project, fix any range or symbol errors, and download to the CPU.
9. Place the CPU in RUN, then verify the SF LED is off and that SMW22 no longer reads 0002h.

9. Verification and Validation

After the program change, run the following checks in order. Each is a single ladder read or status chart add and adds no risk to the running system.

1. Fault clear - Open PLC > Information. Minor fault descriptor should be empty. SMB22 should be 00h.
2. ATCH success - Add a coil driven by the ENO of the corrected ATCH. The coil should energize; a dropped coil indicates that the bind still failed.
3. HSC count - In Status Chart, add SMD138 (HSC3 new preset, double word) and SMD142 (HSC3 current value). Rotate the encoder by hand; the current value should increment.
4. CV=PV event - Set the preset to 5 in SMD138, hand-rotate to exceed it, and confirm that INT_0 is called. The simplest indicator is a memory bit toggled in INT_0 that is then latched visible in the Status Chart.
5. Pulse frequency - For 224XP, run the encoder at the maximum expected field speed. The HSC subsystem can sustain 200 kHz single-phase; confirm with an oscilloscope on the encoder line that no pulses are skipped at the 1.6 s sample window used by Micro/WIN status polling.

10. Firmware 02.01-Specific Notes

CPU 224XP REL 02.01 is the production firmware for the 6ES7 214-2xx23-0XB0 hardware revision. The HSC subsystem implementation is identical to REL 02.00 and REL 02.02, so the error string and resolution are stable across this revision range. Earlier REL 01.x firmware (legacy 6ES7 214-2xx21-0XB0 hardware) has a slightly different minor-fault byte map; the conflict string is the same, but SMB22 is sometimes shifted to SMB23. Always cross-check the system manual page for the specific firmware.

For the S7-200 SMART successor, the equivalent HSC configuration is handled by the wizard in STEP 7 Micro/WIN SMART V2.5 and the rules in the SIMATIC S7-200 SMART System Manual. The SMART CPU ST60 and ST40 are typical drop-in replacements that add HSC events 14-15 (HSC0 direction/reset) and keep the same silicon input routing, so the same fix procedure applies directly.

11. Migration Considerations to S7-1200 and S7-1500

When porting the same dosing logic to a S7-1200, the HSC instruction is replaced by the CTRL_HSC function block and the configuration is held in the device configuration rather than in HDEF. Edge interrupts are now hardware interrupt OBs, and the conflict surface is now in the hardware interrupt OB assignment under the HSC event configuration. The S7-1200 manual describes the configuration in the section on interrupt events on TIA Portal cloud documentation and in the equivalent pages on SiePortal. The same physical rule applies: an input pin wired for HSC use cannot simultaneously be the source of a hardware interrupt OB, and the TIA Portal compiler will reject the configuration at compile time, not at run time.

12. Troubleshooting Matrix

13. FAQ