Siemens S7-1200/1500 Fault Bit Test: Mask, OR, Array Methods

Overview

When a fault word is spread across a non-contiguous bit range such as %M62.4 to %M64.5, the most common engineering question is: "Is any of these bits currently equal to 1?" On a Siemens S7-1200 or S7-1500 controller programmed in TIA Portal, there are four practical answers — direct OR in ladder logic, a word-level bit mask with AND, an Array of Bool indexed scan, and the legacy PEEK instruction. Each method trades code volume against scan-time efficiency and portability. This reference walks through the bit address layout, derives the masks, shows working STL, SCL and FBD code, and benchmarks the methods for cycle-time impact.

Bit Memory Address Structure

Siemens S7-1200/1500 controllers expose a global flag (German: Merker) memory area that the programmer addresses by byte/bit, byte, word, or double word. The official naming convention, defined in the S7-1200 System Manual, is:

• %M<byte>.<bit> — single bit (e.g. %M62.4)
• %MB<byte> — byte (8 bits, e.g. %MB62)
• %MW<word> — word (16 bits, two bytes, e.g. %MW62)
• %MD<dword> — double word (32 bits, e.g. %MD62)

The user's fault range %M62.4 … %M64.5 spans three consecutive bytes, with the relevant bits shown in the layout table below.

Of the 24 bits, only 10 are actually fault slots: M62.4, M62.5, M62.6, M62.7, the entire MB63 (any of M63.0 … M63.7), and M64.0, M64.1, M64.2, M64.3, M64.5. Bit M64.4 is unused by the application.

Method 1 — Direct OR in Ladder Logic (FBD/LAD)

The most readable and most portable approach is a wide OR contact network. Any of the ten flag bits feeding one rung sets the result coil. In FBD this is one AND of ten NO contacts; in LAD it is ten parallel NO contacts feeding a single output coil.

// FBD network
      |---[ M62.4 ]---|
      |---[ M62.5 ]---|
      |---[ M62.6 ]---|
      |---[ M62.7 ]---|
      |---[ M63.0 ]---|
      |---[ M63.1 ]---|
      |---[ M63.2 ]---|
      |---[ M63.3 ]---|
      |---[ M64.0 ]---|
( ---[ M64.1 ]--- )----( program_fault_exists )
      |---[ M64.2 ]---|
      |---[ M64.3 ]---|
      |---[ M64.5 ]---|

If you only need a global flag per byte, you can collapse the eight M63 contacts into a single byte comparison MB63 <> 0 (SCL) or a single DEZ/HEX compare block. In LAD, this becomes a CMP <>I instruction with input MB63 and constant 0. The result bit, together with the two bit groups, drives program_fault_exists.

Method 2 — Word-Level Bit Mask (AND + compare)

Because all ten fault slots are inside three adjacent bytes, you can mask each byte against a constant and compare the union to zero. This is the technique discussed in the source thread and it produces a single boolean. The masks are derived from the bit table above.

The compound expression is:

program_fault_exists := ((MB62 AND 16#F0) OR MB63 OR (MB64 AND 16#3F)) <> 16#00;

The expression inside the parentheses is OR, not AND as originally posted. The intermediate logical AND with each mask forces irrelevant bits to zero, after which any non-zero result means at least one fault bit is set. Without the masks, e.g. MB62 OR MB63 OR MB64 <> 0, you would also report bits that are not fault slots (M62.0 … M62.3, M64.4, M64.6, M64.7). The corrected expression is one STL instruction or one SCL line.

STL Implementation

// STL segment in S7-1200/1500
L     MB62
AW    W#16#00F0          // mask upper nibble of MB62 (shown as word mask; byte works the same)
L     MB63
OW                        // OR in byte 63
L     MB64
AW    W#16#003F          // mask lower 6 bits of MB64
OW                        // OR in masked byte 64
L     0
==I
=     "program_fault_exists"  // BOOL tag

SCL Implementation

// SCL block (TIA Portal V15.1+)
IF (("MB62" AND 16#F0) OR "MB63" OR ("MB64" AND 16#3F)) <> 16#00 THEN
    "program_fault_exists" := TRUE;
ELSE
    "program_fault_exists" := FALSE;
END_IF;

Method 3 — Array of Bool Indexed Scan

For S7-1200 and S7-1500 controllers the cleanest organisational approach is to store the faults in a global Array[0..9] of Bool tag, then test membership with a single FOR loop. This is the technique proposed in the source thread for the 1200/1500 family.

// FB "FaultScan" — SCL, called in OB1
FUNCTION_BLOCK "FaultScan"
VAR
    Faults : ARRAY[0..9] OF BOOL;   // M62.4..M64.5 mapped symbolically
    i       : INT;
    Result  : BOOL;
END_VAR
BEGIN
    Result := FALSE;
    FOR i := 0 TO 9 DO
        IF Faults[i] THEN
            Result := TRUE;
            EXIT;   // optional: stop at first hit
        END_IF;
    END_FOR;
END_FUNCTION_BLOCK

When the source code originally writes the faults, write the symbolic array element instead of M62.x. For example, a motor-overtemperature latch becomes:

// Symbolic write into the array
IF "TempSensor_OK" = FALSE THEN
    Faults[0] := TRUE;     // formerly M62.4
END_IF;

The benefit is that the array index is now a debuggable, watchable, retentive (when configured) block of faults, and the scan loop scales to 100, 1000 or 10000 elements with the same code length. A second pass with the same loop can copy the first set bit index into a word for the HMI to display as a numeric fault code.

Method 4 — PEEK Instruction (Memory-Pointer Read)

For symbolic or absolute addressing that cannot be resolved at compile time — e.g. fault offsets that change at runtime — the S7-1200/1500 PEEK (read) and POKE (write) instructions access any memory area by byte offset. PEEK is available in S7-1200 firmware V4.0 and all S7-1500 firmware versions. The instruction is intrinsically slower than direct symbolic access because it must resolve the area pointer at runtime, but it is useful for diagnostic tools that scan the entire M area.

// SCL — PEEK one byte, then bit-test
FOR #i := 0 TO 15 DO    // 16 bits in MB62, MB63, MB64 …
    IF PEEK(area := 16#83,   // 0x83 = M area, byte access; 0x84 = word, 0x85 = dword
            byteOffset := 62 + (#i / 8),
            bitOffset  := #i MOD 8) = 1 THEN
        Result := TRUE;
        EXIT;
    END_IF;
END_FOR;

The hex constant 16#83 is the "area" selector for bit-level access to the M (Merker) area per the S7-1200 System Manual, section "PEEK and POKE instructions". Use 16#82 for byte, 16#84 for word, 16#85 for dword. Cycle-time warning: the runtime resolves the pointer on every call; this is acceptable for a once-per-scan diagnostic but unacceptable inside a 1 ms interrupt OB.

HMI Display Strategy

For an HMI (WinCC Professional, Comfort Panel, Unified Panel, or WinCC RT Advanced) the most efficient display is the word-level status field. Place a numeric output field on the screen and bind it to MB62, MB63 or MB64 in binary or hex format. The HMI multiplexes the eight bits per byte automatically and lights the corresponding fault symbol; the PLC code does not have to push individual bits to the panel. For grouped alarms, the BOOL program_fault_exists drives a single "Fault" indicator. If the HMI is a Comfort or Unified panel, the alarm view can subscribe to the discrete bits through the HMI tag list without any extra PLC code.

Method Comparison

For a 10-fault CPU scan the four methods are functionally equivalent at 1 ms cycle time. The deciding factors are organisation (array scales best), documentation (LAD/FBD is the most readable printout) and pointer-driven dynamism (PEEK is the only option for runtime-determined offsets).

Cross-Platform Notes

The same bit-mask approach transfers directly to other Siemens families with minor syntactic changes:

• S7-300 / S7-400 (STEP 7 V5.x): L MB62 / UW W#16#F0 / L MB63 / OW / L MB64 / UW W#16#3F / OW / L 0 / <>I. The STL works identically. PEEK is not available; use L PEB (load pointer-byte) inside an STL network instead.
• ET 200SP CPU / S7-1500 software controller: identical to S7-1500. No restrictions.
• LOGO! 8 (BM): the M area exists as flag bytes (M1..M27 depending on the LOGO! variant). OR-contacts and byte-compare blocks are available in FBD, but SCL and STL are not. Use the "Analog threshold trigger" or a series of NO contacts.
• S7-200 / S7-200 SMART: uses V (variable) memory instead of M. The mask method is identical, but use VB62 instead of MB62 and the STL is Micro/WIN syntax (no AW on byte; use MOVB + ANDB).

Verification Procedure

1. Open the PLC online in TIA Portal and load the project to the CPU.
2. Open the "Watch table" that contains the tags MB62, MB63, MB64 and program_fault_exists.
3. Force each fault bit individually with "Modify" → "Modify to 1". Watch the corresponding bit in the byte column turn red.
4. Confirm program_fault_exists transitions to TRUE for every forced bit, including the eight bits of MB63 and the masked M64.5.
5. Force a non-fault bit (e.g. M62.0 or M64.4) to 1. The mask method should leave program_fault_exists FALSE — if it goes TRUE, the mask is wrong.
6. Reset all forces ("Cancel forcing") and cycle power to confirm the retain attribute behaves as designed for arrays in a DB.
7. Add the program to a runtime test: trigger each fault source in turn (e.g. unplug the temperature sensor, simulate a motor overload). Verify the HMI alarm text matches the forced bit.

Troubleshooting Matrix

References (linked official documentation)

For further detail consult the official Siemens manuals:

• SIMATIC S7-1200 Programmable Controller System Manual (edition 09/2021)
• SIMATIC S7-1500 Automation System System Manual (edition 12/2020)
• STEP 7 (TIA Portal) SCL programming and operating manual
• PEEK and POKE instruction reference in S7-1200/1500