S7-300 Software Redundancy: Resolving IEC Timer DB Conflicts

Problem Summary

When commissioning a Siemens SIMATIC S7-300 software redundancy (SWR) pair built around two CPU 319-3 PN/DP modules (MLFB 6ES7318-3EL01-0AB0, firmware V2.6.x and V3.2.x), the standby CPU transitions to STOP and the SF (System Fault) LED illuminates immediately after the FB104 "SWR_START" call inside OB100 finishes its first run. The CPU diagnostic buffer shows two stacked events:

• Event ID 16#4562 – STOP caused by programming error (OB not loaded or not possible, or no FRB). Breakpoint in user program is reported as cyclic program (OB1), priority class 1, FB number 104, module address 62. Previous operating mode RUN, requested operating mode STOP (internal).
• Event ID 16#2523 – Area length error when writing. The fault occurs on an instance DB with double-word (DWORD) access at byte offset 284. The OB121 programming error OB is not loaded, so the CPU cannot recover and goes to STOP.

When an empty OB121 (a single NOP 0) is added to suppress the stop, a cascade of further area length errors appears at instance DB offsets 284, 288, 290, 292, and 294. Deleting the offending DB makes the CPU report "DB 284 not found" instead – the program will not run.

The root cause is a misconfiguration of the IEC timer instance DB window inside the OB100 startup block, not a fault inside the protected FB104 library code itself. The errors at addresses 284/288/290/292/294 are the visible signature of the CPU walking through an IEC timer block structure that does not exist in the loaded project.

Affected Hardware, Firmware, and Software

The S7-300/S7-400 Software Redundancy System Manual (entry ID 1136393) is the authoritative reference for the architecture described here. The CPU hardware reference is the S7-300 Module Data Manual (entry ID 12996906).

Diagnostic Buffer Decode

Root Cause: OB100 IEC Timer Window Mismatch

The OB100 startup OB must call FB104 "SWR_START" with two parameters that control an internal watchdog for the IEC timer instance DB window:

• IEC_NO – DB number of the first IEC timer instance DB.
• IEC_LEN – total length (count) of the IEC timer instance DB window.

During cold restart the CPU walks the DBs from IEC_NO through IEC_NO + IEC_LEN - 1 and validates that each one is a valid IEC timer instance. If IEC_NO = 201 and IEC_LEN = 113, the expected window is DB201 … DB313. If the user program actually contains 112 IEC timer calls starting at DB111, the loaded project only contains DB111 … DB222, and the CPU validates the wrong range.

The result is a sequence of area length errors as FB104 attempts to read and write into the IEC timer block header at the offsets used by the STEP 7 IEC timer compiler. For an IEC_TP/IEC_TON/IEC_TOF/IEC_TONR instance the offsets around 280–296 contain the timing parameters (PT, ET, IN, Q, the time-base byte, and the edge-detection flags). The CPU raises one 16#2523 event per DWORD it tries to write into a missing instance. The exact offsets 284, 288, 290, 292, 294 are the signature of FB104 walking through the missing TP instance header at the upper end of the window.

Why Adding OB121 Makes It Worse

Once OB121 is present, the CPU no longer escalates to STOP at the first 16#2523. FB104 continues to execute and continues to attempt the next DWORD write, which fails in the next instance DB. The five cascading events at 284/288/290/292/294 are the five DWORD fields the FB tries to clear on a single missing instance. OB121 does not fix the cause – it only converts a hard STOP into a hard SF with a flooded diagnostic buffer and a corrupt data image.

Software Redundancy Library Architecture

Reference: S7-300/S7-400 Software Redundancy – System Manual, section 4 ("Configuring the Redundancy Interface") and section 5 ("Startup Behavior and Warm Restart").

Step-by-Step Resolution Procedure

1. Capture the current OB100. In STEP 7 (SIMATIC Manager), expand S7 Program > Blocks > System Data and double-click OB100. Switch the editor to STL view (View > STL) to see the FB104 call in full.
2. Record the current values. Note the actual parameters passed to FB104 "SWR_START" for IEC_NO and IEC_LEN. Typical bad configuration: IEC_NO := 201, IEC_LEN := 113, expected window DB201..DB313.
3. Locate the IEC timer DB window actually generated by your project. Open Options > Cross Reference, filter for FB number of the IEC timer FBs (1=TP, 2=TON, 3=TOF, 4=TONR for S7-300; FB 5..8 in the IEC library with instance DB prefix). Sort the result by DB number. The lowest and highest instance DB numbers define the real window.
4. Compare the two windows. If STEP 7 reports instance DBs in the range DB111..DB222, but FB104 is configured for DB201..DB313, you have a 90-DB overlap and a 90-DB gap. This is the symptom that produces offsets 284/288/290/292/294 in the diagnostic buffer.
5. Choose one of two correction paths.
   1. Correct the OB100 parameters. Edit the FB104 call in OB100 and change IEC_NO and IEC_LEN to match the real window. For 112 timers starting at DB111, set IEC_NO := 111, IEC_LEN := 112. Re-compile and re-download both CPUs.
   2. Correct the project to match the OB100 window. Re-number the IEC timer DBs to start at DB201 and reserve DB201..DB313, then re-generate the instance DBs (right-click the FB, Instance DB > Generate). Keep OB100 parameters unchanged.
6. Generate all instance DBs. Open the STEP 7 block container and confirm that every DB in the window exists. The cleanest method is Options > Check Block Consistency, then Program > Compile All (SW). STEP 7 will warn you about any missing instance DB in the IEC timer window.
7. Verify the OB121 is removed or disabled. After fixing the window, the original fault is gone and OB121 is no longer invoked. If you created a stub OB121 during diagnosis, delete it (or leave the single NOP 0) so future programming errors still trigger a clean STOP.
8. Re-download the project to both CPUs in STOP mode, then perform a cold restart (MRES or power cycle). The CPU must initialize the SWR window from OB100 on a cold restart, not on a warm restart.

Verification Procedure

1. Power both CPUs. After PASS to RUN, the standby CPU should reach RUN-Solo with the SF LED off. The active CPU reaches RUN-Redundant.
2. Open the online Module Information (PLC > Module Information or Accessible Nodes) on the standby CPU. The Operating Mode tab should report RUN (SWR standby). The Diagnostic Buffer must contain no 16#2523 or 16#4562 events from the OB100 run.
3. Force a switchover: in SIMATIC Manager, use PLC > Operating Mode > Switch Over on the active CPU, or pull the PROFIBUS/MPI cable on the active CPU. The standby CPU must take over within the configured switchover time (typically 100–500 ms; default 100 ms with one mirror cycle).
4. Check the SWR_DIAG status word. SSL ID 0x0131 index 0 returns the current SWR state machine: 0 = SWR disabled, 1 = Solo, 2 = Primary, 3 = Backup, 4 = Primary-failed, 5 = Backup-failed. Confirm both CPUs can occupy state 2 and 3 on a forced toggle.
5. Inspect the data image. After the switchover, the values of all mirrored DBs on the new active CPU must equal the last good values from the old active CPU. If you see a corruption pattern, you most likely still have a DB in the window that is not an instance DB – re-run Check Block Consistency.

Common Pitfalls and Field-Tested Caveats

• IEC timer FBs are 1, 2, 3, 4 on the S7-300, not 0..3. FBs 0..3 are the S5-compatible TP/TON/TOF/TONR; FBs 1..4 in the IEC library are the S7-300 IEC variants. Mixing the two will produce instance DBs of the wrong length and trip the 16#2523 at the same offsets (284/288/290/292/294).
• Watch the DB number range limit. The CPU 319-3 PN/DP supports DB 0..16000 as data blocks, but STEP 7 will refuse to generate instance DBs that overlap the system DBs (DB 0..15 are reserved for SFCs/SFBs). Pick a window that does not collide.
• OB100 only runs on cold restart. A warm restart skips the SWR initialization. If you cycle only the standby CPU while the active CPU is running, the standby must execute a full cold restart for the window to be revalidated. Use MRES to force a cold restart if you are uncertain.
• OB121 is not a free pass. It converts programming errors from a CPU stop into a logged event and a corrupt image. Use it only as a diagnostic aid, never as a permanent solution.
• FB104 is protected. The block ships in the SWR library as a know-how protected block. You cannot open it, so the only way to see what window it is checking is the parameter list at the OB100 call site. The diagnostic buffer always shows "FB 104" as the source of the area length error – that is the FB104 timer window validation, not a logic bug inside FB104.
• Renumbering DBs after download corrupts the project. If you change IEC_NO in OB100 without re-numbering the IEC timer calls, the FB still reads the old DBs but FB104 now points to a window where the instance DBs do not exist. Always regenerate the instance DBs after re-numbering.

PLCSIM Limitations for Software Redundancy

PLCSIM does not simulate the S7 communication primitives that the SWR library depends on (AG_SEND / AG_RECV via SFC 216/SFC 217, plus the PROFIBUS FDL or ISO-on-TCP for the redundancy link). You will see diagnostic events 16#8013 ("Connection being established") and 16#8015 ("Connection cannot be established") on a stand-alone PLCSIM instance even when the project is correct. Always validate SWR projects on the real hardware pair. The only test that PLCSIM can substitute is the FB104 cold-restart path – the IEC timer window validation runs in OB100 before any communication is opened, so a stop on PLCSIM with the same diagnostic buffer signature is a valid signal that the window mismatch exists.

Redundancy Link Selection

Reference: S7-300/S7-400 Software Redundancy – System Manual, chapter 4.3 ("Redundancy Link").

Related Event IDs in the Same Fault Class

Reference: S7-300 CPU 31x – Diagnostic Buffer Event IDs (entry ID 109751589) and the S7-300 CPU 31xC and CPU 31x – Operating Instructions (entry ID 44240604).

Preventive Configuration Checklist

1. Before generating the first instance DB, decide the IEC timer DB window. Pick a starting DB number that does not collide with the redundancy working DBs (typically DB 100+).
2. In every FB call to SWR_START (i.e. in OB100), set IEC_NO to that starting number and IEC_LEN to the exact number of timer calls in the program plus a 5–10 % margin for future growth.
3. Document the window in the project header. STEP 7 does not warn you when a new IEC timer call falls outside the window – it silently creates the instance DB anyway, and FB104 will reject it on the next cold restart.
4. Re-run Check Block Consistency before every download. STEP 7 will not always catch a window mismatch in a single-block compile, but the full consistency check will surface any missing instance DB.
5. Use the SWR_DIAG block to publish the SWR state to a HMI tag. This is the fastest way to detect a partial switchover failure caused by a stale window.
6. Test on the real hardware pair. PLCSIM will mask the real fault and surface only the secondary symptoms (16#8013 / 16#8015) once the IEC timer window is wrong.

FAQ