Resolving SR Flip-Flop Single-Scan Execution in S7 Ladder Logic

Overview: Why an SR Flip-Flop Appears to "Skip" a Cycle

Field engineers occasionally report that a Siemens SIMATIC S7 SR (Set-Dominant) or RS (Reset-Dominant) flip-flop in a ladder network appears to execute across two PLC scan cycles rather than one. A reset (R) input wired high plus a set (S) input wired low produces the expected dominant state, but the new flip-flop bit value is not visible to a downstream normally-closed contact placed in the same network. Instead, the bit update is observed only on the following scan.

This behavior is not a firmware bug, misbehaving CPU, or quirky runtime. It is the documented consequence of three combined factors:

1. The PLC scan cycle architecture (input image, program execution, output image).
2. Ladder network branch evaluation order: top-to-bottom, then left-to-right.
3. The semantic model of the SR / RS function blocks: they read at run time and commit at network end.

This reference explains each factor with the exact STEP 7 / TIA Portal mechanics behind it, shows how to read the cross-reference data to detect duplicate coil assignments, and provides correct rewrite patterns using S/R coil instructions instead of flip-flop boxes when single-scan determinism is required.

PLC Scan Cycle Architecture

A SIMATIC S7 CPU runs a real-time operating system that loops a fixed execution model. According to the standard PLC scan cycle diagram, four canonical phases occur per OB1 pass:

1. Process-image input update (PII). The CPU copies the physical input module states into an internal I/Q memory area, addressable as I / EI.
2. User program execution. OB1 (and any OB the program invokes) executes FBs, FCs, and the cyclic ladder / FBD / STL / SCL code. All reads from input and bit memory addresses use the process image; only direct peripheral reads via PE/PQW access the physical module.
3. Process-image output update (PIQ). At the end of OB1, the CPU copies the internal output image to the physical output modules.
4. Self-diagnostics and housekeeping. Communication, time-of-day, and error housekeeping run between cycles.

This model is documented in the SIMATIC S7-300 Programmable Controller System Manual and applies equally to S7-400, S7-1200, and S7-1500 with minor terminology differences (S7-1500 uses "process image" terminology and adds "input image partition" flexibility).

Within OB1, the engineer-visible scan runs from Network 1 to Network N, with each network executed top-to-bottom and (for parallel branches) left-to-right. The CPU maintains a single process image; a bit memory (M area) address like M384.1 is read consistently within a network unless an instruction explicitly bypasses the image (e.g., SET, direct := SCL assignment, or pointer arithmetic).

SR / RS Flip-Flop Execution Semantics

The Siemens SR and RS function blocks follow the IEC 61131-3 standard. The presence/dominance rules are:

The SR/RS block evaluates its inputs and computes the new state within the network. In the FBD/KOP ladder symbol, the output Q is a Boolean return value computed from the inputs. Siemens STEP 7's FBD implementation marks the block as a "flag" with implicit awareness; in KOP, the block occupies one or two contacts and the Q contact is rendered separately.

Branch Evaluation Order: Why "Red" and "Green" Differ

Consider two networks:

Network 1 (NW1):
  --[ M377.0 ]----+-------( SR   M384.1 )
                  |
                  +-------[/M384.1 ]------( M384.0 )

Network 2 (NW2 - control):
  --[ M377.0 ]----+-----( M384.0 )
                  |
                  +-----( M384.1 )

In NW1, the left rail powers both branches. The first branch energizes the SR block, which sets/resets M384.1 based on M377.0. The second branch reads the NO/NC contact of M384.1 and drives M384.0. Because the SR block is in branch 1 (leftmost in the FBD rung), branch 1 evaluates first. Therefore M384.1 is updated before branch 2 reads it. In a properly ordered rung the new state IS visible in the same scan.

In NW2, both rungs drive the coils directly. Two parallel branches each set a coil; the leftmost branch completes its write before the right branch reads-or-writes. Both coils observe the previous scan's writes plus the leftmost branch's result. This is the textbook "parallel branches with multiple coils" configuration.

The apparent two-scan effect arises when the engineer places the SR block to the right of the contact that monitors it, or when they put the downstream contact in a different network entirely. In that case, the downstream contact sees the PII/PQ-cached bit that was committed at end of network, but during the same scan, the SR block's output is fully evaluated only once and committed to the process image at the network boundary.

Common Misconceptions

Three misreadings account for most reported "single-scan anomaly" tickets:

1. "The SR block executes asynchronously." False. The block is purely synchronous: inputs are sampled at network entry, output is committed at network exit. No event-driven or interrupt-driven behavior occurs unless the block sits inside an OB other than OB1.
2. "Duplicate coil addresses mean the PLC is broken." False. STEP 7 / TIA Portal allows coils to be assigned multiple times in the same network or across networks; the last assignment wins at network end. This is documented in the SIMATIC S7-300/400 Programming Manual under "Ladder Logic / Coil Duplication." Cross-reference displays all assignments.
3. "Set/Reset is a trigger." A trigger in Siemens documentation is an edge detector (positive/negative edge, P/N contacts or the FP/FN functions). The SR/RS box is a bistable flip-flop, internally implemented as an assignment to a static flag. Mixing terminology produces incorrect mental models.

Root Cause Analysis Checklist

Use the following matrix to localize the cause of an apparent two-scan SR/flip-flop anomaly:

Diagnostic Procedure

Follow this stepwise procedure to confirm whether your symptom is scan-cycle order, duplicate coils, or HMI contention.

1. Open STEP 7 V5.x (or TIA Portal) and navigate to the project. Verify the CPU's firmware version using PLC → Module Information → Firmware. Document the catalog number (e.g., 6ES7 315-2EH14-0AB0, firmware V3.3 for S7-300 CPU 315-2 PN/DP).
2. Open the cross-reference editor. In STEP 7, choose Options → Reference Data → Display. In TIA Portal, select the CPU and open Cross-references from the project tree. Filter on M384.1. Note every usage, including those from HMI tags configured in WinCC Flexible / TIA WinCC.
3. Identify HMI/SCADA access. Each variable used by an HMI panel (TP/MTP) or by a SCADA tag list (WinCC, PCS 7) appears in the cross-reference. The HMI writes back to the same M-bit when an operator presses a button, creating a duplicate writer.
4. Temporarily disconnect the HMI. Right-click the online connection in WinCC Flexible and select Stop Runtime, or for TIA WinCC, switch the project to offline simulation. Repeat the test sequence. If the anomaly disappears, the HMI write-back was the cause.
5. Use a status trigger. Insert a status (cross-reference/dependent test) on M384.1 in every network that references it. In STEP 7 V5.x, use Debug → Monitor/Modify and enable the ladder status. In TIA Portal, enable Monitoring & Control with online connection.
6. Trace execution. Place a one-shot edge trigger (FP block) on M377.0. The first time M377.0 rises, capture the OB1 scan time from the diagnostic buffer. Compare the scan time before and after the test pulse.
7. Confirm the duplicate coil pattern. If M384.1 is used in two networks as a coil set (S) or as a flip-flop output, the second assignment wins. Open each network's structure and confirm a single writer.
8. Check OB1 priority and OBs. Confirm that the network executes inside OB1 (priority class 1) and not inside an OB with higher priority (e.g., OB35 cyclic interrupt, OB82 diagnostic interrupt). Higher-priority OBs can pre-empt and reset the bit between two halves of a network; this is rare but documented.

Correct Rewrite Patterns

When single-scan determinism is mandatory (e.g., safety chains, fast interlocks), replace the SR box with an explicit coil pair.

Pattern A: Set/Reset Coil Pair (Equivalent to RS)

Network 1:
  --[ M377.0 ]--------( S    M384.1 )
  --[ /ResetAck ]-----( R    M384.1 )

The S coil sets M384.1 when M377.0 is true. The R coil resets M384.1 when ResetAck (NC contact) is true. With a parallel arrangement, the leftmost branch completes first; reset-dominance is achieved by placing the R branch first.

Network 1 (reset-dominant, parallel):
  --[ M377.0 ]--+----( S    M384.1 )
  --[ ResetAck ]+
                 +----( R    M384.1 )

Pattern B: SR Box, Monitored Same-Network

Network 1:
  --[ M377.0 ]--+---------( SR   M384.1 )
                |
                +--[ M384.1 ]----( Q_active )

Because the SR block is left of the contact, the new state is written before the contact is read. Q_active tracks the SR output within the same scan, eliminating the apparent one-cycle delay.

Pattern C: Edge-Triggered One-Shot (when a pulse is needed)

Network 1:
  --[ M377.0 ]--[ FP M0.0 ]--+----( SR   M384.1 )
                              |
                              +--[/M384.1 ]----( pulse )

The FP instruction (positive edge detector) converts the level to a one-cycle pulse; the SR block latches the result. This pattern is common for "push-on / push-off" toggle buttons where the operator expects immediate feedback. Edge-triggered behavior is documented in the STEP 7 Ladder Logic Reference Manual under Bit Logic Instructions.

Verification

After applying a fix, verify behavior with both offline simulation and online test:

1. Offline PLCSIM test. In STEP 7 V5.x, launch S7-PLCSIM. Force M377.0 ON for two scans, OFF for two scans. Observe M384.1 via the simulated variable table. It must follow the dominant-input rule exactly.
2. Online trace. In TIA Portal, use Trace (S7-1500) or Online → Monitor (S7-1200). Record the bit transitions of M384.1 and M384.0 for at least 10 full OB1 cycles.
3. HMI regression. Re-enable the HMI/SCADA. Verify the operator button still produces the expected set/reset and that no "ghost" write-back flips the bit unexpectedly. Add explicit acknowledgment in the HMI logic to avoid two-writer races.
4. Diagnostic buffer audit. Confirm no OB1 cycle-time overrun, OB82 diagnostic interrupt, or stop events are recorded. The diagnostic buffer path is the same in STEP 7 V5.x and TIA Portal: Online → Diagnostics → Diagnostic Buffer.
5. Reference-data audit. Regenerate reference data and confirm each coil has a single writer. The cross-reference screenshot saved in Options → Reference Data → Display serves as the formal sign-off artifact.

Edge Cases and Field-Proven Caveats

Edge Case 1: SR block inside an FB called twice per cycle

If the SR block is declared in an FB (function block) and the FB is invoked twice in OB1 (e.g., once for "east" mode, once for "west" mode), the static instance flags back up into the bit memory because the FB instance DB shares memory with the global M area. The result is two sequential writes. Use IEC_TIMER/IEC_FLIPFLOP from the standard library or wrap the SR with a DBX-backed instance to ensure isolation.

Edge Case 2: SR block inside OB35 (Cyclic Interrupt)

OB35 in S7-300/400 defaults to a 100 ms cyclic interrupt. If the SR box is inside OB35, the bit updates every 100 ms independent of OB1. Downstream contacts in OB1 read the previous OB35 value until the next interrupt fires. To synchronize, ensure the SR block lives in the same OB that consumes its output, or use SET_PI/GET_PI to manually refresh the process image partition.

Edge Case 3: HMI writes a value-tag instead of a button

Some HMI panels expose "value" tags that are written continuously when the operator changes a numeric field. If M384.1 is bound to a value tag and the HMI writes 1 every polling cycle, the SR block will be jammed high regardless of the reset signal. Replace the HMI tag binding with a discrete button or use the WinCC "Toggle" function with explicit acknowledgment.

Edge Case 4: Firmware differences

S7-300 CPU firmware V2.x implements SR/RS blocks as direct FBD calls; S7-1500 CPU firmware V2.9+ implements them as optimized IEC 61131-3 timers with stricter type checking. If a project is ported from S7-300 to S7-1500, the behavior is identical, but the symbol table may renumber M addresses to %M global DB bits. Re-cross-reference after the port.

Edge Case 5: Pointers into instance DBs

A poorly written pointer loop can write to M384.1 via a TAK/LAW/TAR pointer sequence that the cross-reference misses. To audit, Search → All occurrences of operand for the bit address. If still nothing, search for the byte or word as a numeric literal (e.g., 16#0180 for M384.0).

Standards and Documentation References

The scan cycle model described is part of IEC 61131-3 and is operationalized in the following Siemens manuals:

• SIMATIC S7-300 CPU 31xC and CPU 31x: Operating Instructions (CPU 315-2 PN/DP) - canonical scan cycle and process image behavior.
• SIMATIC S7-300 Programming with STEP 7 V5.x: Ladder Logic Reference Manual - SR/RS blocks, edge detectors, and bit logic instructions.
• SIMATIC S7-400 System Manual - background OB, OB35, OB82 documentation.
• SIMATIC S7-1200 Programmable Controller - System Manual - same scan-cycle model ported to S7-1200.
• SIMATIC S7-1500 Programmable Controller - System Manual - process image partitions and edge detection on the S7-1500.
• IEC 61131-3, Programmable Controllers - Part 3: Programming Languages - SR/RS semantics and edge detector definitions.
• Siemens Industry Online Support - firmware notes, FAQs, and product catalogs.

FAQ