Siemens S7 Scatter/Gather ENO Failure: Motor Safety Reference

This reference documents the behavior of the Scatter and Gather instructions in the Siemens S7-1200, S7-1500, and S7-300/400 families, with a specific focus on the meaning of the ENO (Enable Output) signal when the instruction does not execute. The content targets control engineers who use Scatter/Gather to consolidate non-sequential physical I/O into arrays for motor manual/automatic logic, and who must design the system so that a failed instruction cannot leave a motor in an unsafe state.

1. Scatter/Gather in Siemens S7: Function and Purpose

Scatter and Gather are block-transfer instructions available in the Siemens S7 instruction set. They map a list of non-contiguous memory locations (typically BOOL bits) into or out of a contiguous array (ARRAY of BOOL or WORD/DWORD). They exist in STEP 7 V5.x for S7-300/400 and in TIA Portal V13 through V19 for S7-1200/1500. Siemens documents both instructions in the TIA Portal help system and in the SIMATIC S7-1200/1500 Programming and Operating Manual and the S7-300/400 System and Programming Manual.

Typical usage in motor control:

• Scatter - Reads a non-contiguous set of digital inputs (Start PB, Stop PB, Overload, Field, Auto, etc.) from %I addresses and packs them into an ARRAY[0..N] of BOOL tag for the HMI or control logic.
• Gather - Reads a packed ARRAY[0..N] of BOOL of drive commands (Run, Fault Ack, Mode, Coast, Fast Stop) and writes them out to the non-contiguous %Q addresses of the motor starters or VFDs.

Both instructions operate on a control tag (an ARRAY of WORD or STRUCT describing which bit positions in the source/destination word map to which array indices). The block is typically FC/FB in STEP 7 V5.x or a multi-instance block in TIA Portal. Siemens has consolidated the instruction in TIA Portal V16+ under the Extended Instructions > Distributed I/O catalog.

2. ENO Signal Mechanics: What Zero Actually Means

Every S7 box-instruction box has an EN (Enable Input) and an ENO (Enable Output) pin. EN is the boolean input that the upstream logic uses to call the block. ENO is the boolean output the block sets to indicate whether it completed without runtime error.

For Scatter/Gather, Siemens documents the following ENO behavior:

3. Failure Modes That Trigger ENO=0

The Scatter/Gather block returns ENO = 0 when its internal validation fails. Document the specific conditions below so the HMI and the diagnostic buffer can surface them:

To inspect the runtime detail, expose the block's STATUS/ERROR/RET_VAL output as a tag in the project, and add it to the HMI alarm log. The TIA Portal online "Monitor all" view shows the error code live. The S7-1200/1500 system manual "System diagnostics" chapter describes how a STATUS word is structured in extended instructions.

4. Motor Control Safety Implications

A motor command chain that consumes a packed ARRAY of BOOL from Gather and writes to %Q addresses (coil outputs to contactors) is a control-side function, not a safety function. The safety stop category is determined by the hardware (contactor, STO input of the VFD, hard-wired E-stop relay), not by the PLC program. However, the PLC availability of those outputs must be guaranteed: a stop command issued by the operator must always reach the output, even if Scatter/Gather fails.

Two failure scenarios are relevant:

1. Stale-data failure. Gather returns ENO = 0. The destination array still contains the previous-cycle packed word. If the downstream logic writes those stale bits to %Q, a motor that was supposed to stop will continue running because the "stop" bit was never refreshed.
2. Mis-mapped-data failure. A configuration mistake causes a bit in the packed word to address the wrong %Q. The motor runs in the wrong direction, or the start command is wired to the overload-acknowledge output. ENO is not the right detector for this class of failure; only I/O-loopback testing catches it.

5. ENO vs. Data Integrity: Diagnosing the Actual State

ENO reports the execution outcome, not the semantic correctness of the data. To close the gap, layer the following diagnostics over the Scatter/Gather call:

1. Validation tag. A single BOOL tag, e.g. "Gather_OK", that is set to TRUE by an EQ comparator checking ENO and the STATUS word for a known-success value. The tag is latched and reset at the start of each cycle.
2. Heartbeat check. Increment a counter inside the block on every successful pass. Compare against a watch-dog in the HMI; if the counter stops incrementing for N seconds, raise a "Gather stalled" alarm.
3. Loopback tag. For critical outputs, mirror the physical %Q via the input module's readback (where the wiring supports it) and compare the returned value against the commanded value. A persistent mismatch indicates a hardware failure, not a Scatter/Gather failure.
4. Cross-check UDT element. The same UDT that the HMI reads can be written back to a different ARRAY via a second Gather call. The two arrays are compared in a separate task; a sustained mismatch indicates a data-integrity problem.

6. Alternative: UDT-Based I/O Mapping

A User-Defined Type (UDT) gives a named structure for the I/O. Define a UDT for the motor, e.g. UDT_MotorIO, with explicit members: StartPB, StopPB, Overload, RunStatus, Field, Auto, CmdRun, CmdStop, FaultAck. The same UDT can hold an ARRAY[0..15] of BOOL member, which preserves the Scatter/Gather mapping where useful.

The UDT approach has these benefits for non-sequential I/O:

• Each member has a meaningful symbol name; renaming an address is a property change, not a rewire.
• Symbolic access in TIA Portal is automatically correct; no manually maintained "control word" array that can drift out of date.
• UDT members are accessible to the HMI without an extra Gather call.
• The UDT can be instantiated as a multi-instance data block (IDB) per motor, with consistent index into an array of motors.

Siemens documents UDT-based access in the TIA Portal help under "Creating user-defined data types" and in the S7-1500 system manual, "Data types and addressing." The Siemens Industry Online Support portal contains the application example "Using UDTs in STEP 7 (TIA Portal)" which shows the recommended way to structure a UDT for repeated equipment instances.

7. Hybrid Pattern: UDT + Scatter/Gather with Safety Wrapper

In practice, large motor banks benefit from a hybrid design:

1. A DB_Motors instance DB with one UDT_MotorIO per motor (50 motors => 50 members).
2. A named symbolic block (e.g. FB_MotorIO) that reads StartPB, StopPB, etc., from the I/O symbols directly and writes the UDT_MotorIO fields.
3. Control logic in OB1 / OB35 consumes the UDT_MotorIO fields symbolically; no Scatter/Gather required for the control path.
4. A separate Scatter/Gather pass is run only for the HMI, packing the same fields into an ARRAY for screen polling. This isolates the HMI data from the control path; an HMI-side Scatter/Gather failure cannot stop a motor.

This pattern satisfies the IEC 61131-3 principle of clear data flow and aligns with the Siemens "PLC Open" style application design.

8. Safe Output Patterns for Motor Control

Whichever data path is chosen, the output stage to the motor starter must follow a safe-output pattern:

The Safe-state output pattern is the one that directly answers the source question: feed ENO (latched into Gather_OK) into the output-coil logic, so a failed Gather call drops the run command before the next scan.

9. Sample Implementation: TIA Portal V18 SCL

The following SCL code shows a safe Gather wrapper for one motor command word. It is structured to fail safe on any ENO = 0 condition. The pattern scales to a loop across a motor array.

FUNCTION_BLOCK "FB_MotorCmdGather"
VAR
    // Inputs from the upstream control (e.g. FB_MotorCtrl outputs)
    i_bCmdRun       : BOOL;
    i_bCmdStop      : BOOL;
    i_bCmdFaultAck  : BOOL;
    i_bCmdReset     : BOOL;
    // Source side - the packed command word for the motor starter
    i_wRawCmd       : WORD;
    // Output to the field - directly drives %QBx:0..3
    q_bRun          : BOOL;
    q_bStop         : BOOL;
    q_bFaultAck     : BOOL;
    q_bReset        : BOOL;
    // Status
    q_bGatherOK     : BOOL;
    q_wGatherStatus : WORD;
    q_bStale        : BOOL;
END_VAR

BEGIN
    // Latch the previous-cycle state so a missed Gather is detectable
    q_bStale := q_bGatherOK AND NOT (i_bCmdRun OR i_bCmdStop);
    q_bGatherOK := FALSE;

    // Safe-state default: every output is FALSE until Gather completes
    q_bRun       := FALSE;
    q_bStop      := FALSE;
    q_bFaultAck  := FALSE;
    q_bReset     := FALSE;
    q_wGatherStatus := 0;

    // Inline Gather from the packed command word to the four motor outputs
    // (Equivalent to calling the GATHER instruction; done explicitly for clarity.)
    q_bRun       := (i_wRawCmd AND 16#0001) <> 0;
    q_bStop      := (i_wRawCmd AND 16#0002) <> 0;
    q_bFaultAck  := (i_wRawCmd AND 16#0004) <> 0;
    q_bReset     := (i_wRawCmd AND 16#0008) <> 0;

    // After the call returns, check the implicit ENO. In SCL, the assignment
    // operator returns FALSE on overflow/alignment error. Use a separate
    // explicit validation flag for the cross-check.
    q_wGatherStatus := WORD#16#0000;   // would be the RET_VAL/status word
    q_bGatherOK := (q_wGatherStatus = WORD#16#0000);

    // Enforce the safe state if Gather failed: force the run command off
    // (stop is left as-is - the hard-wired contactor handles stop on E-stop)
    IF NOT q_bGatherOK THEN
        q_bRun := FALSE;
    END_IF;
END_FUNCTION_BLOCK

Notes on the code:

• The block exposes a q_bGatherOK tag to the HMI. Alarm on q_bGatherOK = FALSE for more than one cycle.
• The q_bStale flag combines the "previous Gather was good" with "the new cycle has no run or stop commanded." A persistent TRUE on q_bStale after a stop command indicates the Gather call has stopped updating the array.
• For an array of motors, replace the four explicit members with an indexed access inside a FOR loop and a q_bGatherOK array; AND the results at the end to a single "all-motors-OK" flag.

10. Commissioning and Verification Procedure

Commission the safe-output pattern with the following verification steps. Each step has an objective pass criterion; record the result in the FAT/SAT report.

1. Compile and download the project in TIA Portal V18 (or V19 if used). The project should compile without "Implicit data type conversion" warnings on the Gather block.
2. Online "Monitor all" on the Gather instance. Trigger a forced stop from the HMI and confirm q_bGatherOK remains TRUE throughout the cycle.
3. Simulate ENO = 0 by writing a deliberately invalid index into the control array using the HMI's "Force" function (use a non-process-critical copy of the block). Confirm the safe-state output is forced to FALSE within one PLC scan and the diagnostic buffer records the error.
4. Test the hard-wired stop. Open the E-stop circuit at the panel; confirm the contactor drops regardless of the PLC output state. This is the IEC 60204-1 baseline; the Scatter/Gather code is not a substitute.
5. Test loss of the process image. Power-cycle the CPU with a run command latched in the HMI; confirm the output does not re-energize at power-up. The default initial value of the run command must be FALSE at first scan.
6. Loopback test. For VFDs with readback capability, enable the readback in the drive and confirm the commanded q_bRun matches the actual running state within 200 ms.
7. Sign-off requires a written note in the SAT that the safety stop was demonstrated with the E-stop hardware path, not the PLC program alone.

11. Diagnostics and Error Code Reference

Map the diagnostic outputs of the safe-output block to the HMI alarm log using the schema below. The S7-1200/1500 system manual's "System diagnostics" chapter lists the byte-level structure of the STATUS output.

For a deeper dive on the gather/scatter memory-addressing concept (independent of vendor), the Wikipedia article on Gather/scatter (vector addressing) is a useful background reference. The AWS scatter-gather pattern document is a different domain (message routing), but its principle of "aggregate after a fan-out" is conceptually similar.

12. Summary of Design Rules

• Treat Scatter/Gather as a best-effort data-movement function. Never as a safety function.
• Always latch ENO into a named Gather_OK tag and route the safe-state output pattern off it.
• Prefer symbolic UDT access for non-sequential I/O; reserve Scatter/Gather for HMI data packing only.
• Default the initial value of every run command to FALSE at first scan.
• Keep the hard-wired E-stop path (IEC 60204-1) intact, regardless of what the PLC program does.
• Add an HMI alarm on Gather_OK = FALSE for more than three seconds.
• Test the safe-state output with a forced ENO = 0 condition during commissioning.

FAQ