SFB32 DRUM: Siemens S7 Step Sequencer Programming and PLCSIM Fix

David Krause15 min read
S7-300SiemensTechnical Reference
Licensed PE Working through this on a live machine? A Maine-licensed engineer can take it from here — included with IMD hardware, by the hour for everything else. Book an engineer

1. Block Overview

The SFB32 "DRUM" is a Siemens standard function block that implements a sequential drum controller on SIMATIC S7-300 and S7-400 CPUs. It is part of the "Standard Functions" library that ships with STEP 7 V5.x and is found in the Standard Library under System Function Blocks. SFB32 is firmware-resident: the block is loaded from the CPU's system memory and does not consume user program memory beyond its instance data block.

SFB32 models a classic electromechanical drum sequencer in software. The drum has a configurable number of steps (1 to 16), and exactly one step is active at any moment. The active step drives up to 16 boolean outputs, and a transition to the next step is decided by an event that the engineer assigns to the current step. Up to eight discrete events are available, each tied to a dedicated boolean input (EVENT_1 through EVENT_8).

Typical applications include:

  • Batch-process step controllers (fill, heat, agitate, drain).
  • Material-handling sequences where each step is a distinct motion profile.
  • Machine-state machines with less than 16 states and event-driven transitions.
  • Replacement for hard-wired drum timers and cam switches.

For a deeper dive into the standard library, see the SIMATIC S7-300/400 Standard Functions reference manual and the STEP 7 online help for SFB32.

CPU availability: SFB32 is supported on S7-300 CPUs 313C and above, and on all S7-400 CPUs. It is not present on S7-200, LOGO!, or the S7-1200/1500 families. Migrating a drum sequence to S7-1200/1500 requires a manual rewrite using a GRAPH state machine or a structured IEC 61131-3 implementation.

2. SFB32 I/O Interface and Parameter Reference

The block is called by an instance DB that holds both the runtime state and the engineered step table. The formal parameter list below matches the STEP 7 block interface (LAD/FBD/STL):

Parameter Direction Type Description
SET INPUT BOOL JOG mode: rising edge sets the drum to the step number present at STEP_NO (0 = initial step).
RESET INPUT BOOL High level resets the drum to step 0; STATE returns to 0.
JOG INPUT BOOL AUTO/JOG: rising edge advances to the next step as defined in the step table.
DRUM_EN INPUT BOOL Master enable. Outputs and step transitions are frozen while FALSE.
LST_STEP INPUT INT Index of the last valid step (1 to 16). Steps above this index are not processed.
EVENT_1..EVENT_8 INPUT BOOL Eight event flags. The current step selects which one to evaluate.
OUT0..OUT15 OUTPUT BOOL Individual step output flags. Only one is TRUE at a time (or none during transitions).
OUT_WORD OUTPUT WORD Bit-packed mirror of OUT0..OUT15. Bit 0 = OUT0, bit 15 = OUT15.
STEP_NO OUTPUT INT Currently active step number (0 to 15). 0 = initial state.
STATE OUTPUT INT Operating state: 0 = reset, 1 = running, 2 = hold, 3 = wait for event, 4 = error.
ERR OUTPUT WORD Error word. See Section 10 for the bit-level decode.
Direction terminology: Siemens STEP 7 documents parameters as INPUT or OUTPUT relative to the user's calling logic. Even though the value originates in the instance DB, the event and step-target data are written by the user (INPUT to the block), while OUT0..OUT15 are written by the block and read by the user (OUTPUT).

2.1 Operating-State Encoding (STATE output)

STATE Meaning Typical Trigger
0 Reset / drum disabled RESET = TRUE or DRUM_EN = FALSE
1 Running (event evaluated, advancing) Normal AUTO operation
2 Hold (event still FALSE, staying on step) Waiting for an event to become TRUE
3 JOG / manual stepping JOG pulse received
4 Error condition See ERR word for the specific fault

3. Instance DB Structure and Step Table

When SFB32 is inserted into a STEP 7 block, the editor auto-generates an instance DB. The instance DB has two distinct regions:

  1. Static working area — written by the block at runtime (current step, last event seen, output mirror).
  2. Engineered step table — configured by the user, telling the block what to do at each step.

Each row of the engineered step table contains four fields. The exact UDT (user-defined data type) varies slightly by STEP 7 version, but the canonical structure is:

TYPE UDT_DrumStep
STRUCT
    OutputMask  : WORD;   // which OUT0..OUT15 bits are TRUE in this step
    EventMask   : BYTE;   // 0 = no event, 1..8 = index of EVENT_n to check
    NextStepTrue  : INT;  // step number to go to if selected EVENT_n = TRUE
    NextStepFalse : INT;  // step number to go to if selected EVENT_n = FALSE
END_STRUCT;
END_TYPE

The instance DB then declares an array of these structures:

DATA_BLOCK "DB_Drum"
  SFB32
  VAR
    Step : ARRAY[0..15] OF UDT_DrumStep;  // Step[0] is the initial state
  END_VAR
  BEGIN
    // Engineer fills Step[0]..Step[LST_STEP] with values
  END_DATA_BLOCK

A small 3-step sequence configured for "fill, heat, drain" would look like the following (numbers in DEC):

Step OutputMask (hex) EventMask (dec) NextStepTrue NextStepFalse
0 (idle) 0x0001 0 1 0
1 (fill) 0x0002 1 2 1
2 (heat) 0x0004 2 3 2
3 (drain) 0x0008 3 0 3

Reading row 1: while the drum sits on step 1, the "fill" solenoid (OUT1) is energized. Event 1 (e.g., "level reached") is evaluated; when it goes TRUE the drum jumps to step 2, otherwise it stays on step 1.

EventMask = 0 disables the event check for that step. The block then follows NextStepTrue on the very next PLC cycle. This is useful for unconditional jumps and for the initial step.

4. Operating Modes and State Machine

SFB32 supports three operating modes that are selected implicitly by the inputs you drive:

4.1 AUTO Mode (event-driven)

Set RESET = FALSE, DRUM_EN = TRUE, leave JOG and SET idle. The drum evaluates the event assigned to the current step every cycle. When the event goes TRUE, the block advances to NextStepTrue; when it is FALSE, the block either stays on the current step (default) or jumps to NextStepFalse if the step is configured to leave on event-FALSE.

Step 1 (fill) Step 2 (heat) Step 3 (drain) EVENT_1=TRUE EVENT_2=TRUE OUT1=TRUE OUT2=TRUE OUT3=TRUE STATE=1 (running) STATE=2 (hold) STATE=1 (running)

4.2 JOG Mode (manual pulse advance)

A rising edge on JOG forces the drum to NextStepTrue regardless of the event. Engineers use this to step through the sequence by hand during commissioning. SET + STEP_NO lets the operator jump to a specific step directly (setpoint load).

4.3 RESET Behavior

RESET is level-sensitive. As long as it is TRUE the drum sits on step 0 with STATE = 0. Releasing RESET allows the sequence to start from the top on the next OB1 cycle.

5. STL Programming Example

The example below calls SFB32 in OB1, drives the eight events from a process image, and copies the boolean outputs to outputs that the rest of the program reads. Replace DB_Drum with the actual name of the auto-generated instance DB.

// FB / OB1 STL
NETWORK 1  // Title: Drum sequencer call
  A   "StartCmd"           // Operator start pushbutton
  S   "DrumEnable"         // Latch enable

  A   "StopCmd"
  R   "DrumEnable"

NETWORK 2  // Map process signals to EVENT inputs
  A   "LevelReached"        // event 1
  =   "DrumEvents".EVENT_1  // or use a temporary in the instance DB
  A   "TempOK"              // event 2
  =   "DrumEvents".EVENT_2
  A   "DrainClosed"         // event 3
  =   "DrumEvents".EVENT_3
  A   "FlowSwitch"
  =   "DrumEvents".EVENT_4
  // Events 5..8 left FALSE

NETWORK 3  // Drive SFB32
  CALL "DB_Drum", "DrumInst"  // instance DB
       SET          := FALSE
       RESET        := "StopCmd"
       JOG          := "JogBtn"
       DRUM_EN      := "DrumEnable"
       LST_STEP     := 3
       EVENT_1      := "DrumEvents".EVENT_1
       EVENT_2      := "DrumEvents".EVENT_2
       EVENT_3      := "DrumEvents".EVENT_3
       EVENT_4      := "DrumEvents".EVENT_4
       EVENT_5      := FALSE
       EVENT_6      := FALSE
       EVENT_7      := FALSE
       EVENT_8      := FALSE
       OUT0         := "DrumOut".OUT0
       OUT1         := "DrumOut".OUT1
       OUT2         := "DrumOut".OUT2
       OUT3         := "DrumOut".OUT3
       OUT4..OUT15  := (remaining outputs)
       OUT_WORD     := "DrumOutWord"
       STEP_NO      := "DrumStepNo"
       STATE        := "DrumState"
       ERR          := "DrumErr"

NETWORK 4  // Use the step outputs to drive field devices
  A   "DrumOut".OUT1
  =   "FillValve"
  A   "DrumOut".OUT2
  =   "Heater"
  A   "DrumOut".OUT3
  =   "DrainValve"
Call frequency: SFB32 should be called once per OB1 cycle (or once per a fixed-time OB like OB35). Calling it multiple times in the same cycle is harmless but redundant; the block is edge-sensitive on JOG, so a single call captures one rising edge per cycle.

6. Ladder Logic Equivalent

In LAD/FBD the same logic is built with the SFB32 box. The instance DB must be created first by inserting the SFB into a network and confirming the prompt. The eight EVENT_n pins sit above the enable bar; the OUT0..OUT15 pins sit below it. Connect JOG to a normally-open contact driven by an FP edge flag in front of the box so the rising edge is generated cleanly.

7. PLCSIM Limitations and Diagnosis

PLCSIM is the STEP 7 internal simulator that runs S7-300/400 firmware on a virtual CPU. The official Siemens S7-PLCSIM V5.4 release notes and supported block list document that SFB32 is not fully simulated in every PLCSIM version. Engineers see the block call execute (no OB1 stop), but OUT0..OUT15 never go TRUE and STEP_NO stays at 0. This matches the failure mode described in the field report: "I get no output's when triggering a event... I have also define OUT_VAL variable at the DB" and the follow-up "NO ERROR but no output".

7.1 Why SFB32 Fails in PLCSIM

  • The block relies on internal CPU services that PLCSIM either replaces with stubs or does not implement.
  • The SFB is implemented as a "system block" loaded from the CPU firmware image; PLCSIM ships a different firmware image in which the SFB32 service is either missing or returns "not supported".
  • STEP 7 does not report a compile error because SFB32 is present in the offline catalog — the failure only surfaces at runtime.

7.2 Diagnosing the PLCSIM Problem

  1. Open the instance DB online and confirm the step table was downloaded (view > monitor).
  2. Force DRUM_EN = TRUE, RESET = FALSE, and JOG = pulse. Watch STEP_NO in VAT or in the instance DB.
  3. Read STATE. If it stays at 0 with DRUM_EN = TRUE, the block is not running.
  4. Read ERR. A non-zero value confirms the firmware rejected the call.
  5. Open the CPU diagnostic buffer (PLC > Module Information > Diagnostic Buffer). Look for entries referencing SFB32 or "system function".

7.3 Workarounds for PLCSIM

  1. Test on a real CPU. S7-300 starter kits such as the CPU 314C-2 PN/DP are inexpensive and behave correctly. This is the most reliable path.
  2. Use PLCSIM with a newer STEP 7 version. PLCSIM in TIA Portal V13+ supports a wider SFB set on the S7-300 emulation, but you still must confirm the exact firmware image.
  3. Substitute a user-written drum in PLCSIM. Replicate SFB32 behavior with a few network branches during the simulation phase, then swap the SFB32 call in for the real CPU. This is acceptable because the step table is the same and only the executor changes.
  4. Substitute FB85 from the TI-S7 converting library. See Section 8.
Production tip: Always commission the drum on a real CPU (or a hardware-in-the-loop test rig) before shipping. PLCSIM is a logic-correctness tool, not a substitute for a hardware acceptance test when system blocks are involved.

8. FB85 TI-S7 DRUM Alternative

Texas Instruments released a library of "converting blocks" under the name TI-S7 Converting Block Library that mirrors the TI Series 505 / TI 545 PLC instruction set on STEP 7. Block FB85 in that library implements a drum sequencer with a similar step/event interface to SFB32, but is implemented entirely in STL and therefore runs on any S7-300/400 CPU and inside PLCSIM without the firmware dependency.

8.1 When to Use FB85

  • You need to simulate the drum in PLCSIM and SFB32 is unsupported in your PLCSIM build.
  • You are converting a TI Series 505 program and want to keep the original drum timing semantics.
  • You want a fully user-space drum that you can step through in the debugger without relying on system memory.

8.2 Differences vs SFB32

Aspect SFB32 (system) FB85 (TI-S7)
Storage Firmware-resident (no FB code) User FB, downloaded to CPU
PLCSIM support Limited by firmware image Runs in any PLCSIM version that supports STL
Max steps 16 Typically 16 (FB-dependent)
Events 8 fixed inputs 8 fixed inputs (same mapping)
Instance DB Auto-generated Engineer-defined, mirrors SFB32 layout
Performance Optimized in firmware Interpreted STL, slightly longer scan time

8.3 Importing the TI-S7 Library

  1. Open STEP 7 Manager and select File > Open > Library.
  2. Navigate to the TI-S7 Converting Block library archive (ships with STEP 7 V5.x under the third-party examples or downloaded from the Siemens third-party portal).
  3. Copy FB85 into your S7 program blocks.
  4. Insert the FB85 into a network and let STEP 7 generate the instance DB.
  5. Populate the step table in the same format as the SFB32 example in Section 3.

Once FB85 runs cleanly in PLCSIM, swap the call to SFB32 before downloading to a real CPU. The interface is similar enough that only the block name and instance DB reference need to change.

9. Commissioning on a Real CPU

  1. Download the hardware configuration to the S7-300/400 station. Confirm the CPU is in RUN with no SF (system fault) LED lit.
  2. Download the program blocks including the SFB32 instance DB.
  3. Open the instance DB online and verify the step table was written. PLCSIM or a partial download can leave the table at zero.
  4. Force RESET = TRUE for at least one cycle, then release. Confirm STEP_NO = 0 and STATE = 0.
  5. Raise DRUM_EN and force JOG once. Verify STEP_NO advances to 1 and OUT1 goes TRUE.
  6. Force the event assigned to step 1. Confirm the drum advances to step 2 and the correct output goes TRUE.
  7. Repeat for each step until the sequence completes one full cycle.
  8. Test RESET from mid-sequence. Confirm the drum returns to step 0 and outputs drop.
  9. Test DRUM_EN = FALSE. Outputs should freeze and no further step transitions should occur.
Safety: For any drum that drives motion or process actuators, wire a hard-wired E-stop in series with the controlled outputs. Do not rely on the PLC outputs alone — drum transitions may produce unintended intermediate states during commissioning.

10. Troubleshooting Matrix

Symptom Likely Cause Diagnostic Step Fix
OUT0..OUT15 never TRUE PLCSIM not executing SFB32 Check PLCSIM version against the supported SFB list Test on real CPU or substitute FB85
STATE stays 0 with DRUM_EN = TRUE RESET latched or JOG missing edge Inspect RESET, JOG in VAT Release RESET, generate clean rising edge on JOG
STEP_NO advances but wrong outputs light Step table OutputMask misconfigured Open instance DB online, compare to design Re-write the engineered step table
Drum skips a step EventMask pointing to an event that is already TRUE Inspect EVENT_n flags in VAT Add a debounce or condition the event
STATE = 4 (error) Check ERR word bits Decode ERR per Section 10.1 Fix per the error code
Drum cycles too fast EventMask = 0 with no intentional unconditional jump Check step table Set EventMask to the correct event index (1..8)
OUT_WORD ≠ expected pattern Outputs read from wrong bit position Recall bit 0 = OUT0 Re-map the bit read
Drum freezes after power cycle Instance DB not in retain / not initialized Check DB properties Set Non-Retain on the step table region or re-initialize on startup

10.1 ERR Word Bit Decoding

The exact bit assignment varies by firmware version, but the canonical encoding is:

Bit Meaning
0 LST_STEP out of range (< 0 or > 16)
1 STEP_NO jumped to an undefined step
2 EventMask references an undefined event
3 NextStepTrue or NextStepFalse out of range
4 Internal state error (firmware-specific)

If bit 0 is set, correct the LST_STEP input. If bit 1 or 3 is set, audit the engineered step table for next-step values that exceed LST_STEP. Bit 2 indicates an engineer mistake in EventMask.

11. Migration to S7-1200/1500

SFB32 does not exist on the S7-1200 or S7-1500 families. The recommended replacements are:

  1. S7-GRAPH for complex sequences. GRAPH provides a state-machine editor with steps, transitions, and interlocks, and is the standard replacement for drum-style sequencing.
  2. Structured Text (SCL) state machine for compact sequences. A CASE block on the current step with IF event_n THEN step := next; END_IF; replicates SFB32 in a few lines and runs on every S7-1200/1500 CPU.
  3. LAD/FBD with latching bits for the smallest sequences, mirroring the step table in a data block.

11.1 SCL Replacement Skeleton

// SCL state machine replacing SFB32
IF "Reset" THEN
    "Drum".Step := 0;
    "Drum".State := 0;
ELSIF "DrumEnable" THEN
    CASE "Drum".Step OF
        0:
            "Drum".Out0 := TRUE; "Drum".Out1 := FALSE; ...
            IF "Event1" THEN "Drum".Step := 1; END_IF;
        1:
            "Drum".Out0 := FALSE; "Drum".Out1 := TRUE; ...
            IF "Event2" THEN "Drum".Step := 2; END_IF;
        // ... etc.
    END_CASE;
END_IF;

This approach removes the PLCSIM compatibility question entirely because the drum is now plain user code that runs in every simulator.

12. Field-Engineering Checklist

  • Confirm SFB32 is supported on the target CPU firmware version (check the CPU's Module Information > Firmware).
  • Engineer the step table offline; document each step's outputs, event, and next-step targets in a spreadsheet before entering them in the instance DB.
  • Mark the instance DB as non-retain if the sequence is always re-initialized at startup; mark the step table retain if not.
  • Test in PLCSIM first to validate the logic; expect SFB32 to be limited and substitute FB85 if needed.
  • Validate on a real CPU with one cycle per step exercised manually before connecting field devices.
  • Add E-stop and watchdog interlocks in series with the drum outputs at the wiring layer, not in software.
  • When migrating to S7-1200/1500, port to S7-GRAPH or an SCL state machine rather than searching for a SFB32 equivalent.

Why does SFB32 show no outputs in PLCSIM?

SFB32 is a firmware-resident system block and PLCSIM does not implement every SFB service across all versions. OUT0..OUT15 never go TRUE and STEP_NO stays at 0 even though the call compiles. Use a real S7-300/400 CPU for testing, substitute FB85 from the TI-S7 converting library, or rewrite the drum as plain STL/SCL that PLCSIM can execute.

What is the maximum number of steps and events for SFB32?

SFB32 supports up to 16 steps (1..16) and 8 events (EVENT_1 through EVENT_8). The active count is set by the LST_STEP input and the per-step EventMask byte. EventMask = 0 disables event evaluation for that step.

How do I trigger a step transition from user logic?

Drive the JOG input with a rising edge to force-advance the drum, or assign an event to the current step (via EventMask) and assert the corresponding EVENT_n input. AUTO mode evaluates the event every cycle, so a latched event is not required.

Can I change the step table at runtime?

Yes. The instance DB is a normal data block, so you can write to OutputMask, EventMask, NextStepTrue, and NextStepFalse from HMI, SFC, or SFB. Take care to stop the drum first (set DRUM_EN = FALSE) to avoid the block reading a partially updated step.

How do I replace SFB32 on a S7-1200 or S7-1500 CPU?

There is no direct replacement. Use S7-GRAPH for a graphical state machine, or implement an SCL CASE block on the current step that checks events and assigns the next step. Both run natively in PLCSIM and the TIA Portal simulator.

Back to blog