S7-300 Outputs Not Activating: STEP 7 Diagnostic Procedure

Problem Description

On a SIMATIC S7-300 system, the CPU reports RUN, digital input module LEDs correctly track operator panel push buttons, but no digital output activates. This symptom points to a failure in the path between input image acquisition and output image write to the output module. The fault may be in the user program, the output module, the load voltage supply, the HMI interlock, or the field wiring.

System Overview: S7-300 I/O Path

The SIMATIC S7-300 modular controller uses a backplane bus to transfer the process image between the CPU and signal modules (SM). The digital input module SM321 writes the state of each input into the process-image input (PII) area at the start of OB1. The CPU executes the user program and updates the process-image output (PIQ). The SM322 digital output module then writes PIQ bits to the physical outputs. A break anywhere in this chain produces the reported symptom.

The S7-300 platform is part of the Siemens product lifecycle and is available until 2033. The product family page lists current catalog modules, firmware versions, and migration paths: SIMATIC S7-300.

The classic S7-300 reference architecture uses a 1:1 mapping between PII/PIQ and the physical I/O bytes. The CPU cycle is: read inputs (PII) → execute OB1 → write outputs (PIQ). An empty OB1 still performs the read and the write, so the path itself is rarely the issue, but the program logic that decides what to write to PIQ often is.

Symptoms Checklist

Root Cause Matrix

Diagnostic Procedure

Step 1 - Confirm CPU Operating Mode and Force State

Open STEP 7 (Classic) or TIA Portal with the project that matches the target PLC. Go online and check the CPU operator panel and the FRCE LED.

1. Connect the PG/PC via MPI, PROFIBUS, or Ethernet to the CPU.
2. In STEP 7: Online > Accessible Nodes > select the CPU.
3. Open PLC > Module Information. The Operating Mode tab shows RUN, RUN-with-test, or STOP. The Force tab shows any active force values.
4. If FRCE is on, note the affected addresses. The most common single cause of "no outputs" with all inputs working is a force table still holding PIQ bits at 0 from a previous commissioning session.

Step 2 - Clear the Force Table

1. In STEP 7: Online > Force opens the force view.
2. To clear all force values: PLC > Clear Force. The CPU briefly enters STOP during this operation. The FRCE LED should go off.
3. Switch the CPU back to RUN via the mode selector (toggle to STOP then back to RUN) or PLC > Run from the menu.
4. Confirm outputs now follow the program. If they do, the issue is resolved and you should disable or remove the original force entries before returning the line to production.

Step 3 - Read the Diagnostic Buffer

The diagnostic buffer is the single most useful diagnostic for an S7-300 fault. It records every mode change, OB failure, module insert/remove, and I/O access error in chronological order.

1. Online > Accessible Nodes > select CPU > Module Information.
2. Click the Diagnostic Buffer tab.
3. Look for entries containing "OB not loaded", "STOP due to", "Module removed/inserted", "I/O access error", "Firmware update", or "MMC fault".
4. Click an entry to see the detail and the affected OB or module address.
5. Note the event timestamps. A repeated I/O access error against the same PIQ byte usually means a wiring or HW Config mismatch rather than a logic bug.

Step 4 - Verify OB1 Is Present and Running

If OB1 is missing, the S7-300 stays in STOP. If OB1 is present but OB82 (diagnostic interrupt OB) is missing, the CPU can go to STOP the first time the SM322 reports a fault such as wire break or overload. Default STEP 7 templates include both.

1. In the STEP 7 project tree: CPU > Program Blocks.
2. Confirm OB1 is listed. Open it online and watch the scan. If the timestamp on OB1 does not advance, OB1 is not running.
3. Add OB82 (drag from Standard Library > System Blocks > OB82) and place a single BE instruction in it. Download to the CPU.
4. If OB1 is empty but present, the CPU will read inputs and write outputs unchanged. Outputs still follow the inputs, so an empty OB1 cannot explain the fault on its own.

Step 5 - Confirm Load Voltage on the Output Module

The SM322 has a separate load voltage connection (L+ and M) on the front connector. The backplane powers the module's logic, but the output transistors switch the load voltage. If L+ is missing, all outputs read 0 V at the terminal even when PIQ is 1.

1. Bring the CPU to STOP.
2. Pull the front connector from the SM322.
3. Measure between L+ and M on the connector with a multimeter. You should see 24 VDC +/- 10%.
4. If 0 V, trace the supply back through fuse, disconnect, and the 24 V PSU. S7-300 PSUs (for example, 6ES7 307-1EA01-0AA0, 5 A) commonly feed output modules through a fused 24 V distribution rail.
5. Check the polarity. Reversed L+ and M on some SM322 variants can trigger a module fault and light the SF LED.

Step 6 - Monitor PIQ with a VAT

1. In STEP 7: PLC > Monitor/Modify.
2. Create a VAT with the PIQ addresses of the SM322 (for example, QW 4 and QW 5 if the module is in slot 4).
3. Go online and watch the values. Toggle a known input and confirm the corresponding PIQ bit changes.
4. If PIQ changes but the output module LED does not, the SM322 is the suspect - likely a defective output driver or a diagnostic shutdown on that channel.
5. If PIQ does not change, the logic or interlock in the user program is the suspect.

Step 7 - Check for HMI / Reed Switch Interlock

A common pattern in this class of fault is a sensor fault written to an HMI tag, then read by the PLC, which uses it to inhibit outputs until the operator acknowledges the alarm on the HMI. The case described involves a reed switch that latches a fault on the HMI and prevents downstream clamp outputs.

1. On the HMI (WinCC flexible, TIA Portal HMI, or third-party), open the alarm view or status page for the reed switch.
2. Identify the PLC tag that holds the latched fault (for example, DB10.DBX0.0 named Reed_Fault).
3. In STEP 7 VAT, monitor that tag. If it stays at 1, the inhibit stays active.
4. Use the cross-reference (Ctrl+Alt+F) on the tag to find every rung that uses it. The output coils you see inhibited will be gated by that bit, often through an AND or a SET/RESET chain.
5. On the HMI, locate the ACK or Reset button. Verify that the button is wired to a write tag back to the PLC and that the PLC has a logic block to reset the fault bit on that signal's rising edge.

Step 8 - Inspect the Reed Switch Cable Run

A damaged cable from a reed switch to the junction box can cause intermittent contact, double pulses, or stuck-on / stuck-off states. The PLC input LED may show the contact closed, but the actual signal after debounce and the related process state may differ from what the HMI shows.

1. With the process in a safe state, disconnect the reed switch at the junction box.
2. Measure continuity end-to-end. A typical reed switch cable is 2-conductor shielded; check both conductors and the shield drain.
3. Check insulation resistance to ground with a megohmmeter at 500 V - typical reading should be greater than 1 MOhm.
4. Inspect the cable run for pinch points, abrasion, oil ingress, and connector corrosion. Reed switches are often mounted on moving guards or cylinders, so the flexing portion of the cable is the most likely failure point.
5. Replace the cable if any reading is marginal. A flaky reed signal is also a safety issue, not just a process issue.

Step 9 - Check Output Module Diagnostics

SM322 modules with diagnostic capability (for example, 6ES7 322-1BH01-0AA0) report wire break and overload on a per-channel basis via diagnostic interrupt.

1. The CPU diagnostic buffer will show "Diagnostic interrupt from SM322 in slot X".
2. Open HW Config, right-click the SM322, Module Information > Diagnostics tab.
3. Resolve the channel-level fault: wire break typically means an open load (broken wire, missing lamp), overload means a short or undersized wire, and short circuit means a direct short to M.
4. Acknowledge the diagnostic with ACK in the diagnostic view or via the OB82 logic. On a healthy module the SF LED on the SM322 should go off and PIQ writes should resume.

Step 10 - Compare Hardware Configuration with Physical Rack

1. Open HW Config in STEP 7.
2. Compare each slot's module type and order number (for example, SM 322 DO 16 x 24 VDC / 0.5 A, 6ES7 322-1BH01-0AA0) with the label on the physical module.
3. Confirm the starting address in HW Config matches the address the program uses. Address mismatches cause the CPU to either report an "I/O access error" in the diagnostic buffer or simply write to the wrong module.
4. If you change HW Config (for example, swap an 8-channel SM322 for a 16-channel module), recompile the hardware and download it. A stale HW Config in the CPU is a common cause of intermittent I/O faults.

Reed Switch and HMI Interlock Deep Dive

The case described in the field involves a reed switch whose fault is latched on the HMI and inhibits outputs for related clamps. This is a typical safety-related interlock chain:

1. The reed switch physical contact closure is read by an SM321 input.
2. PLC logic detects that the contact state is inconsistent (for example, expected open but the input stays closed for more than X seconds).
3. The PLC sets a fault bit in the process DB.
4. The HMI polls or is notified by the PLC and displays the alarm.
5. The operator presses ACK on the HMI, which writes a reset bit back to the PLC.
6. The PLC clears the fault bit and re-enables downstream outputs.

If any link in this chain is broken - the sensor, the PLC logic, the HMI ACK write, or the cable from the reed switch to the junction box - the outputs stay inhibited. This is by design, but it confuses technicians who only see "inputs are on, outputs are off" without checking the fault DB.

Recommended diagnostic for this case:

1. Force the suspect input via STEP 7 to verify the input wiring is sound.
2. Monitor the fault DB word by word with a VAT while toggling the input.
3. On the HMI, look for a Reset or Acknowledge button on the alarm and verify it is wired to a write tag to the PLC.
4. Check the cable from the reed switch to the junction box with a continuity and insulation test. Replace if any reading is below spec.
5. After clearing the fault, perform a function test of the affected clamps under safe conditions to confirm the inhibit chain has been released end-to-end.

Common S7-300 Output Modules Reference

CPU Mode Selector Behavior

The S7-300 CPU mode selector has three positions: RUN, RUN-P, and STOP. RUN-P allows the PG/PC to write to the program (programming mode). RUN is "process" mode and blocks online writes. When the mode selector is in RUN-P and the program is downloaded, the new code takes effect on the next OB1 scan.

To recover from a fault that has latched outputs off:

1. Toggle the mode selector to STOP.
2. Wait at least 2 seconds.
3. Toggle back to RUN (or RUN-P if you need to download).
4. Confirm the RUN LED is solid green and the SF and BF LEDs are off.
5. If the CPU does not stay in RUN, the diagnostic buffer will tell you which OB the CPU tried to call and failed. That OB is the one to add or fix.

Memory, Battery, and MMC Behavior

The S7-300 has three layers of program storage: the load memory (the Micro Memory Card / MMC), the work memory (RAM on the CPU), and the system memory (bit memories, timers, counters, PII, PIQ).

• The MMC is the persistent store. The user program on the MMC survives a power cycle.
• Work memory contents in RAM survive a power cycle only if the battery on the CPU is healthy (BATF LED off). On CPUs without a battery holder, the work memory is lost on power cycle and the program must be reloaded from the MMC.
• If the MMC is missing, unformatted, or has a firmware mismatch, the CPU may stay in STOP with a diagnostic buffer entry such as "MMC fault" or "Firmware update required".

On commissioning day, format the MMC in STEP 7 (PLC > MMC > Format) before downloading the project. A corrupted MMC is a frequent cause of intermittent STOP/RUN cycling.

STEP 7 Force Table Reference Commands

The following menu paths are useful when the force table is suspected:

Verification

1. The CPU diagnostic buffer shows no "OB not loaded", "I/O access error", or "Module fault" entries since the last restart.
2. The FRCE LED on the CPU is off and the force table is empty.
3. A VAT shows PIQ bits change in step with the corresponding PII bits.
4. Output module LEDs track PIQ.
5. Field-side load voltage (output terminal to M) equals the rated module voltage when the output is on.
6. The HMI shows no active alarms related to the suspect input.
7. All output channels are function-tested by toggling each input and verifying the physical actuator (valve, contactor, lamp) responds.
8. The mode selector is returned to RUN (not RUN-P) before the line is handed back to operations, to prevent further online writes.

Preventive Measures

• Save the STEP 7 project to the MMC after every change. The S7-300 CPU loses RAM contents on a power cycle without a battery; the MMC is the persistent store.
• Disable or remove force entries after commissioning. Use the force table only for tests, never for production override.
• Wire the load supply L+/M through a fused disconnect so a downstream short does not bring down the whole output module.
• Use SM322 modules with diagnostic capability for any output that drives a safety-relevant function (clamp, gate, brake).
• Implement OB82 with a BE instruction so a transient diagnostic does not stop the CPU.
• Document the HMI ACK tag-to-PLC mapping in the project so that operators and technicians can locate it without reverse engineering the program.
• Add OB121 and OB122 with a BE to prevent CPU STOP on programming errors and I/O access errors during commissioning.
• Schedule periodic inspection of the reed switch cabling on moving parts, especially the flexing portion at the cylinder or guard.

FAQ