Problem Overview
The S7-1500F CPU enters STOP and posts a diagnostic-buffer entry of the form:
Temporary CPU error: User programmed STOP request in FB 32781
affecting OB 123 execution
HW_ID = 52
Internal address details: Caddr = 16#0000071A
On CPU 1517F-3 PN/DP (MLFB 6ES7 517-3FP00-0AB0) running firmware V2.8.2, this entry appears after the user performs any of the following operations while the safety program is running:
- Loading a new GSDML file (i.e., adding, replacing or updating a PROFINET device).
- Changing a PROFINET telegram (slot/sub-slot reassignment).
- Downloading a modified PLC program (full or delta).
- Changing the F-runtime group signature or F-block instance regeneration.
The CPU then refuses to restart cleanly. A subsequent download attempt produces a Memory card evaluation error, which forces the engineer to format the SIMATIC Memory Card and reload the project from the engineering station. Capturing the full diagnostic buffer (CSV/TXT) is mandatory before any MRES operation because the buffer is wiped during a memory reset.
Affected Hardware and Software Versions
| Item | Value | Notes |
|---|---|---|
| CPU MLFB | 6ES7 517-3FP00-0AB0 | CPU 1517F-3 PN/DP, work memory 3 MB code / 10 MB data |
| Firmware | V2.8.2 | Released for the F-variant of the 1517; check Siemens Industry Online Support for the latest HSP / FW update |
| Engineering tool | TIA Portal V16 (Update 9 or later recommended) | V16 without the latest updates has known F-library incompatibilities against FW 2.8.x |
| F-library | F-runtime library block that maps to FB 32781 (project-specific instance) | Numbering is library-dependent; verify in the project library under "Failsafe Library" |
| F-runtime OB | OB 123 | F-runtime group OB (cyclic safety execution) |
| HW_ID | 52 (decimal) | Internal identifier of a PROFINET sub-module or central I/O |
| Caddr | 16#0000071A (decimal 1818) | Byte offset in the process image of the failing I/O channel |
Diagnostic Buffer Analysis
The diagnostic buffer must be saved through Online > Diagnostics > Diagnostic buffer > Save as… (text/CSV) before any reset action. Decode the entry as follows:
| Field | Raw value | Decoded meaning |
|---|---|---|
| Event ID | 16#0xBF / 0x7xFE | Temporary CPU error (runtime-detected STOP request from the F-program) |
| OB reference | OB 123 | F-runtime group OB of the safety program |
| Block reference | FB 32781 | F-library function block instance inside the safety program |
| HW_ID | 52 | Hardware identifier of the PROFINET sub-module whose I/O image is being written by FB 32781 |
| Caddr | 16#0000071A | Internal slot/offset address inside the I/O area of HW_ID 52 (decimal 1818 = bit address in the F-channel DB or byte offset in the PII/PIQ) |
The Temporary CPU error event class is reserved for STOPs requested by the program itself through SFC 46 "STOP" or SFC 48 "SFC_STOP", including the implicit STOP raised by the F-runtime when an F-block detects an unrecoverable internal state. It is the lowest-priority STOP class: a re-initialisation (MRES or RUN→STOP→MRES→RUN) is normally sufficient to recover, but only if the underlying mismatch between the loaded configuration and the firmware/F-library is resolved.
Root Cause Analysis
The fault surface can be narrowed to three interacting causes that are typically triggered by a configuration change:
- F-library / firmware mismatch. TIA Portal V16 (without the latest updates) generates F-block instances that reference internal data structures introduced in later firmware revisions. When the same F-library is downloaded to a CPU running firmware V2.8.2, the F-runtime raises an internal consistency error and forces a STOP.
- Hardware-identifier drift after a GSDML update. Re-importing a GSDML file, changing a PROFINET slot, or modifying a telegram reassigns HW_IDs. The F-program still holds the old HW_ID (52 in this case). At the first F-cycle after the change, the F-block tries to address the new Caddr (16#0000071A) through an HW_ID that no longer matches, and the F-runtime aborts the F-cycle.
- F-runtime group signature break. Modifying the cyclic F-program or any referenced F-DB invalidates the F-runtime group signature stored in the CPU. If the operator is forced to perform an MRES, the F-signature is erased together with the program; the CPU then refuses the next download because the F-CRC no longer matches the project.
Of the three, the F-library/firmware mismatch is the one most often hidden by the symptom. The "User programmed STOP" wording in the buffer is misleading: it is the F-runtime itself that issues the STOP through its internal SFC 46 call when the F-program detects an internal access violation against the new I/O mapping.
Immediate Recovery – MRES Procedure
Use this procedure only after the diagnostic buffer has been exported. The procedure mirrors the official Siemens S7-1500 CPU error-behaviour guidance.
- Switch the CPU mode selector to STOP.
- Hold the MRES position for at least 3 s; the CPU's STOP LED flashes slowly, then rapidly.
- Release the selector briefly, then re-engage MRES for another 3 s. The STOP LED stays lit – the memory reset is complete.
- Pull the SIMATIC Memory Card, format it (FAT32, 32 KB cluster) on a PC, re-insert, and reload the corrected project.
- If the format step is skipped and the next download fails with Memory card evaluation error, repeat the cycle: STOP → MRES (3 s) → release → MRES (3 s), then reformat.
If MRES does not clear the fault and the CPU still raises the same event after a clean reload, escalate to a factory reset as documented in the SIMATIC S7-1200/S7-1500 programming and operating manual: Online and diagnostic tools – CPU error behavior.
Permanent Resolution
- Update the engineering tool. Install the latest TIA V16 updates (at minimum the F-library update package that ships with TIA V16 Update 9 or later). The cumulative updates patch the F-library version embedded in the F-blocks.
- Match the firmware to the F-library. The compatibility matrix in the SIMATIC S7-1500 F-CPU manual (Siemens Industry Online Support) lists which F-library version is compatible with which firmware revision. For FW 2.8.2 the supported F-library is the one shipped with TIA V16 SP1 Update 7 or TIA V17 (when downloading to a V2.8.x target).
- Recompile the safety program. After the update, open the safety program, right-click the F-runtime group and select Compile > Software (rebuild all blocks). This regenerates the F-blocks (including the instance that maps to FB 32781) and the F-CRC.
- Re-assign the F-signature. In TIA Portal navigate to Properties > Safety > F-runtime group 1 and click Assign F-signature. Note the new signature; it must be entered at every operator panel that performs F-acknowledgement.
- Re-import the GSDML only in offline state. Never change a GSDML or telegram while the F-program is running. Make the change offline, recompile, then download in STOP with full initialisation.
Configuration Change Procedure to Avoid Recurrence
The factory-accepted way of loading any change that touches a HW_ID referenced by an F-block is the STOP-mode download with re-initialisation. The sequence is:
- Set the CPU mode selector to STOP.
- In TIA Portal, Online > Download to device > CPU (complete).
- Tick Stop all modules and Reset modules to factory settings for the PROFINET devices involved.
- After the download, the CPU stays in STOP. Use the operator panel or the F-acknowledge input to bring the F-runtime group back to RUN.
- Validate the F-signature against the HMI/SCADA.
Any change that touches the PROFINET topology – adding a station, swapping a GSDML, changing a slot assignment, modifying a telegram – re-runs the F-compiler and may break the FB 32781 instance. Treat each of these as a controlled modification with a documented safety impact assessment.
Diagnostic Buffer Capture Procedure
- Establish an online connection to the CPU (PROFINET or PROFIBUS).
- Open the project in TIA Portal and select the CPU in the project tree.
- Online > Online & diagnostics > Diagnostics buffer.
- Click Save as…, choose Text file (*.txt) or CSV (*.csv) with the "Extended" option ticked.
- Save the file under a name that embeds the plant area, the CPU serial number, and the timestamp.
Repeat the capture after every re-occurrence. A minimum of three buffer dumps, taken with the same project revision, is usually sufficient for Siemens support to identify the F-library version mismatch and the affected F-block.
Verification and Commissioning Checks
| Check | Method | Pass criterion |
|---|---|---|
| F-runtime group cycle time | Online > Diagnostics > Cycle time | ≤ 50 % of the F-monitoring time |
| F-monitoring time | Properties > Safety > F-runtime group | ≥ 2 × typical F-cycle, ≤ 1000 ms (SIL 3 / PL e) |
| F-CRC match | Compare the F-CRC on the operator panel with the F-CRC in TIA Portal | Identical hex string |
| Diagnostic buffer | After a 24 h burn-in | No entry of class "Temporary CPU error" |
| PROFINET device status | Online > Online & diagnostics > PROFINET diagnostics | All substations in "Station OK" |
| F-block consistency | Project tree > Safety program > right-click > Check consistency | No errors, no warnings |
| Operator F-acknowledge | Force F-acknowledge from the panel; acknowledge each F-channel | All F-channels return to RUN within F-monitoring time |
Related Temporary CPU Error Variants
The same family of faults presents with different text in the diagnostic buffer. The engineering response is similar but the corrective action must be tuned to the variant.
| Buffer text fragment | Typical cause | Corrective action |
|---|---|---|
| User programmed STOP request in FB … | F-block issued internal STOP (this case) | Recompile F-library; match firmware; reload in STOP |
| Area length error in FB … | Address parameter out of bounds – user code reads/writes past the end of a DB | Bound-check the address parameter in the F-block call and return a diagnostic without stopping |
| Programming error in OB … | Access to a non-existent DB, wrong area type, or wrong block number | Recompile the program; check the DB numbers against the cross-reference |
| IO access error in OB … | PROFINET device failed or telegram mismatch | Check station status, replace if necessary, then reload the configuration |
| STOP caused by parameter error | Parameter assignment of the F-runtime group invalid | Reset the CPU to factory settings, reload the project |
Troubleshooting Matrix
| Symptom | First check | If first check fails | Escalation |
|---|---|---|---|
| Same buffer entry after reload | F-library version in TIA Portal | Update TIA V16 to the latest cumulative update | Open a Siemens Support Request with the saved buffer |
| Memory card evaluation error | Card file system | Format the card on a PC, not on the CPU | Replace the card if the error persists |
| F-CRC mismatch on panel | F-signature in TIA Portal | Re-assign the F-signature and reload in STOP | Re-validate against the safety requirements specification |
| CPU returns to STOP after F-acknowledge | F-monitoring time | Increase the F-monitoring time and reduce the F-cycle time | Re-architect the safety program (split F-runtime groups) |
| HW_ID 52 reports "not available" | Device configuration | Re-import the GSDML and rebuild the configuration | Re-place the F-block on the new HW_ID |
| Caddr 16#0000071A invalid | Process image partition | Re-map the I/O to the correct PIP and update the F-symbols | Move the address out of the PIP and reference it via an I/O DB |
Preventive Measures
- Pin the firmware version in TIA Portal (Properties > General > Firmware version) and disable the auto-update prompt.
- Maintain a single source of truth for GSDML files; never load a GSDML directly from the field device on an F-segment.
- Use the F-runtime group F-monitoring time of at least 2× the measured worst-case F-cycle, capped at 1000 ms for SIL 3.
- Lock the project against silent firmware upgrades via the project read-only setting and a checked-in copy in the version-control system.
- Schedule an annual F-system review to re-validate signatures, library versions, and HW_ID references against the as-built documentation.
What does "Temporary CPU error: User programmed STOP request in FB 32781 affecting OB 123" actually mean?
It means the F-runtime (OB 123 is the S7-1500F safety OB) detected an unrecoverable internal state inside the F-block instance numbered 32781, and called SFC 46 to put the CPU in STOP. The wording "User programmed" is misleading – it is the F-library itself raising the STOP, not the user code.
Is the fault caused by TIA Portal V16 or by firmware V2.8.2?
It is caused by the combination. The F-library shipped with early TIA V16 builds generates blocks that require firmware V2.9 or newer. Installing the latest TIA V16 cumulative update (Update 9 or later) re-aligns the F-library with firmware V2.8.2 and the fault no longer appears.
Do I really need to format the memory card?
Yes, if the second download fails with "Memory card evaluation error". The CPU writes internal bookkeeping files that are tied to the previous project signature; a corrupted signature forces a clean card. Always export the diagnostic buffer before formatting because the buffer is wiped during the format.
Can I ignore the F-signature mismatch and continue running?
No. The F-signature is the integrity seal of the safety program. Running with a mismatched signature violates IEC 61508 / ISO 13849 and renders the safety function non-compliant. Re-assign the signature in TIA Portal, reload in STOP, and re-validate before returning to production.
How do I capture the diagnostic buffer before an MRES?
In TIA Portal, open Online > Online & diagnostics > Diagnostics buffer, tick the "Extended" checkbox, then click Save as… and export as TXT or CSV. The export is mandatory because the buffer is cleared by every memory reset.
What is HW_ID 52 and Caddr 16#0000071A?
HW_ID 52 is the internal hardware identifier of the PROFINET sub-module (or central I/O slot) that the failing F-block writes to. Caddr 16#0000071A is the byte/bit offset (decimal 1818) inside that module's process image where the access violation occurred. Together they pinpoint the failing channel.