S7 Process Image Partitions: OB35 PIP vs Manual PIB Transfer

Overview

On S7-300 and S7-400 controllers, every digital input byte is held in two distinct CPU memory regions: the peripheral input area (address space PEB / PIB / PEW / PED, sometimes called the direct I/O area) and the process image of inputs (address space IB / IW / ID). The process image (PI) is a snapshot that the CPU refreshes from the physical modules at well-defined instants, so that user program code reads a stable, consistent copy rather than racing the field.

By default, the entire input PI is partition PII 0, refreshed once per OB1 cycle. Process Image Partitions (PIPs) let you split the PI so that selected input ranges are refreshed by a specific OB - for example, OB35 (a 100 ms cyclic interrupt by default). A recurring field question is whether the two-line ladder pattern

L  PIB 512
T  IB  512

placed at the top of OB35 is functionally equivalent to assigning the input module's PIP to OB35 in HW Config. The short answer is yes inside OB35, but not elsewhere. The long answer - which is what this document covers - covers deterministic timing, cross-OB consistency, pulse-rate limitations when counting without a high-speed counter module, S7-400-only SFCs, and the right way to configure both STEP 7 V5.x and TIA Portal projects.

Process Image and PIP Architecture in S7-300/400

The process image is sized by HW Config when the station is compiled. For an S7-300 CPU 315-2 PN/DP it is typically 128 bytes in and 128 bytes out, for an S7-400 CPU 416 it can be 4 KB in / 4 KB out. The PI is split into up to 16 partitions:

• PII 0 / PIQ 0 - the default partition, always refreshed at OB1 entry and OB1 exit.
• PII 1..15 / PIQ 1..15 - user-defined partitions, each bound to exactly one update OB.

A module's input range is mapped to a single PIP. Mixing is not allowed: a byte cannot live in two partitions. The compiler generates System Data Blocks (SDB 1000+) that the CPU uses at startup to schedule peripheral reads.

Peripheral-direct access (L PEB / L PIB / L PEW) bypasses the PI entirely. It reads the module's current physical state on demand, typically within a few microseconds, but cannot be relied upon for a consistent multi-byte read because the bus (PROFIBUS / PROFINET) is not transaction-isolated. The PI exists specifically to provide that consistency window.

OB35 Cyclic Interrupt: Timing and Priorities

OB35 is the standard cyclic interrupt OB with priority class 12 on both S7-300 and S7-400. Its period is configurable from 1 ms to 60,000 ms in HW Config (CPU Properties → Cyclic Interrupts). The default 100 ms is suitable for slow closed-loop control and integrating totalizers. For high-speed applications the period must be shortened to match the Nyquist criterion of the controlled process.

Because OB35 has higher priority than OB1, it interrupts OB1 at any instruction boundary. Inside OB35 the system guarantees that the PI partition assigned to OB35 is fresh by the time OB35's first network begins to execute. That guarantee is what hardware PIP assignment buys you.

Method A: Hardware-Configured OB35 PIP Assignment

Configuration in HW Config (STEP 7 V5.x):

1. Open the station, double-click the digital input module.
2. Select the Addresses tab.
3. Clear the System default checkbox for the Process Image Partition row.
4. From the dropdown, choose the PIP that maps to OB35 - typically PIP 2 if you use the OB35 default PIP.
5. Save and compile the station. The SDB carries the PIP binding to the CPU.

When the user program reaches the first statement of OB35, the CPU has already executed the input update for PIP 2, copying the physical inputs into IB x..IB x+n. Reads of IB x from any code inside OB35 return the just-captured state. No user code is required.

Side effects of Method A:

• Only the partition's I/O range is refreshed at OB35 entry. PII 0 is still refreshed by OB1.
• If a different OB (OB1, OB100, OB82) reads IB x, it sees the value last captured by whichever OB drives this PIP. There is no guarantee it is current.
• Each PIP refresh costs one peripheral read, which the system performs as part of OB startup. The overhead is small (a few hundred microseconds for a typical 32-byte partition).

Method B: Manual PIB-to-IB Transfer in OB35

The pattern looks like this in STL:

//  OB35 - first network
L   PIB 512       // direct peripheral read of input byte 512
T   IB   512       // copy into the process image

Or in LAD/FBD with a MOVE box whose input is PIB512 and output is IB512. Inside OB35, both styles achieve the same effect: the PI byte is now current for the rest of the OB's execution.

This method also works for word and double-word transfers (L PEW / T IW, L PED / T ID). It must be the first network because every later network that reads IB x needs the snapshot in place.

What Method B actually does:

1. CPU executes L PIB 512, issuing a peripheral read for byte 512.
2. CPU executes T IB 512, storing the loaded value at offset 512 in the PI memory.
3. The PI is now consistent with the field only for that one byte, and only until OB35 terminates.

Functional Equivalence and Where the Two Diverge

For code running inside OB35 only, the two methods are observationally indistinguishable. The IB read after the manual transfer matches the IB read after the hardware PIP update. The answers to the original forum question - does it work, and why does Siemens offer both? - depend on three subtle differences that appear when you look beyond OB35 itself.

The third row is the most important. Consider an input byte that drives both OB1 alarm logic and OB35 pulse counting. With Method B, every OB35 cycle writes the latest PIB into IB. OB1 then reads that IB. Because OB35 and OB1 are asynchronous, OB1 may read:

• A value sampled only milliseconds ago (if OB35 just ran), or
• A value up to one full OB35 period old (if OB35 is about to run again).

Method A eliminates this ambiguity: OB1 sees the PII 0 value (OB1 update) and never the OB35-timed value, because the same physical input is mapped to two different partitions. If you need both OB1 and OB35 to read the same input at their own cadence, do not use Method B - put the module in PII 0 (OB1 PIP) and either:

• Read PIB x directly in OB35 (Method B minus the T), or
• Configure the module in two different stations (e.g., one symbol in PII 0, one replicated via PROFIBUS DP slave-to-slave) - rarely justified.

Pulse Counting Without HSC: Limits and Aliasing

The original problem statement noted that the inputs drive pulse counters for flow totalizers and that the input module is not an HSC. That is the most operationally significant constraint in this scenario. OB35 polls the input, but does not count transitions - it captures the binary state at each sample instant.

If a flowmeter emits N pulses per second and OB35 runs every T ms, the maximum count that OB35 can resolve in a cycle is:

Max resolvable pulses per OB35 cycle = ceil(N * T / 1000) + 1

For N = 10 pulses/s and T = 100 ms, that is 2 pulses/cycle. The counter increments by either 0 or 1 at each cycle, losing the distinction. This is the classic aliasing problem. To count accurately without an HSC you must satisfy:

T < 1000 / (2 * N)

i.e. sample at least twice per pulse. For a 1 kHz flow signal you need T < 500 µs, which is impossible with OB35. A 100 Hz signal needs T < 5 ms, still beyond OB35 unless you shorten the cyclic interrupt period to 1-2 ms and accept the CPU load.

Totalization logic should also include:

• A runtime debounce of the digital input (CPU-side; do not rely on input filter alone).
• A monotonic guard - if the previous count equals the current, treat as zero flow rather than counting.
• An overflow counter separate from OB35, written in OB1 or OB100 cold-restart.
• For batch accuracy, scale the count: flow_l_per_pulse * (current_count - previous_count).

S7-400 Specifics: SFCs 26 / 27 and Phasing

The S7-400 extends the PIP concept with two SFCs that allow user-triggered partition updates outside any OB:

Calling CALL SFC 26 with PART := B#16#2 forces a refresh of PIP 2 at that exact program location. This is the right tool when you need an event-driven, deterministic PI read outside the OB35 schedule - for example, inside OB40 (hardware interrupt) when a specific input edge fires.

S7-400 also supports phase offset for OB35. By shifting OB35's start time relative to OB1 you can avoid the simultaneous PI update storm that occurs when many cyclic interrupts fire at the same moment in the OB1 cycle. The phasing is configured in HW Config (CPU Properties → Cyclic Interrupts → Phase Offset in ms). Method B (manual L PIB) ignores the phase because it executes whenever OB35 actually runs, not at OB startup.

Configuration Procedure (STEP 7 V5.x and TIA Portal)

STEP 7 V5.x

1. SIMATIC Manager > HW Config.
2. Open the CPU; double-click the digital input module.
3. Addresses tab - note the start address (e.g., 512).
4. In the Process Image row, clear System default; select PIP 2 (or the PIP you have bound to OB35).
5. Save & Compile (Station > Save and Compile).
6. Download the SDB to the CPU. After CPU restart, the partition is active.

TIA Portal (V15 and later)

1. Project tree > Device configuration.
2. Select the digital input module; open Properties > I/O addresses.
3. Uncheck Use automatic address assignment for PIP if you want a non-default partition.
4. In the Process image dropdown, choose the PIP for OB35.
5. Compile (HW) and download to the CPU.

Verification, Diagnostics, and Troubleshooting Matrix

After configuration, verify the binding with the following checks:

1. Open a VAT (Variable Table) with IB 512 as a monitored address.
2. Toggle the physical input - observe IB 512 update.
3. Set an OB35 breakpoint in OB1 (Editor > Test > Breakpoints). OB35 fires - inspect IB 512 in the call stack of OB35.
4. In the CPU diagnostics buffer (Online > Diagnostics > Module Information) look for SDB download confirmations.
5. For pulse counters, inject a known frequency with a signal generator and compare integrated total against the reference over 60 s. Acceptance: <0.1 % deviation.

Step 7 V5.x error codes for the SFCs above are documented in the Siemens Industry Online Support portal under entry category "Standard and System Functions". Common SFC 26/27 return codes:

• W#16#0000 - no error.
• W#16#8090 - PIP address invalid (range outside configured PIP).
• W#16#80A1 - PIP not configured (no input range assigned).
• W#16#80B0 - PIP update aborted by another OB (priority collision).

Best Practices and Field-Commissioning Checklist

• Use hardware PIP assignment (Method A) for any input that is sampled in a cyclic interrupt and also read elsewhere. Method B is acceptable only when the byte is exclusively consumed inside OB35.
• Never put a byte that drives both PII 0 and an OB35 PIP into Method B - you will create data inconsistency between OB1 and OB35.
• For pulse counters without HSC, calculate the required OB35 period from T = 0.5 / f_pulse and add a 20 % safety margin. If T < 5 ms is required, install an HSC.
• Configure the input filter on the digital module (Properties > Inputs > Input filter). 3 ms is the typical default; drop to 0.5 ms only if the mechanical switch is debounced externally.
• Profile OB35 with SFC 78 "OB_RT" or the trace to verify the configured period is greater than the actual execution time, ideally with a 30 % margin.
• On S7-400, use phase offset to desynchronize OB35 from other cyclic interrupts (OB32-OB38).
• Document the PIP-to-OB mapping inside the S7 program header so future edits do not accidentally rebind the partition.
• If you must call SFC 26 from OB40 (hardware interrupt), make sure OB40 has higher priority than OB35 (it does - OB40 is class 16-26) and that the PIP you are updating is bound to an OB with priority < OB40.
• For redundant S7-400H stations, both CPUs read from the same PIP - verify the SDB is consistent on both sides after a configuration change.
• Validate with an acceptance test: force a 60-second reference flow, compare integrated totalizer against the reference value. Pass criterion: < 0.1 % deviation across the operating range.

FAQ