Diagnosing PCS 7 System Alarms for Module Errors and Asynchronous PLC Faults on S7-400 Controllers

Cascading alarms indicating module errors and asynchronous PLC faults in SIMATIC PCS 7 occur when physical bus failures or hardware component defects trigger controller diagnostic interrupt organization blocks. When a decentralized I/O station drops from PROFIBUS DP or PROFINET networks, the S7-400 CPU executes OB82, OB85, and OB86, driving diagnostic driver blocks to log module and PLC fault alarms in WinCC. If the system experiences concurrent bus fault and internal fault LED indications, engineers must evaluate the CPU diagnostic buffer to isolate the primary triggering station, verify bus physical health, and ensure required error organization blocks are present.

Architecture of PCS 7 Diagnostic Organization Blocks and System Alarms

SIMATIC PCS 7 employs an automated diagnostic framework that links operating system interrupt organization blocks (OBs) directly to Advanced Process Library (APL) diagnostic driver blocks (MOD_D1, MOD_HA, OB_DIAG1, RACK). When a hardware anomaly occurs, the CPU operating system intercepts the interrupt and calls the corresponding organization block:

OB82 (Diagnostic Interrupt): Triggered when an intelligent I/O module detects an internal or external channel fault (wire break, short circuit, missing 24V DC sensor supply, or internal ADC failure).
OB85 (Priority Class Error / Unbuffered I/O Access): Triggered when the CPU program attempts to access process image inputs or outputs belonging to a module that is missing, disconnected, or non-responsive.
OB86 (Rack / Subnet Failure): Triggered when an entire distributed I/O station (e.g., ET 200M, ET 200SP HA, or field DP slave) loses communication, experiences a power failure, or disconnects from the PROFIBUS DP / PROFINET network.
OB121 / OB122 (Synchronous Programming and Access Errors): Triggered when user code executes an illegal operation or directly addresses unbuffered peripheral addresses (PIW/PQW) on defective hardware.

The PCS 7 driver generator automatically inserts diagnostic blocks during chart compilation. These blocks process start information from OB82/OB85/OB86 and route standardized alarm messages to WinCC via ALARM_8P.

Anatomy of the Cascading Fault Sequence

When an operator station logs sequential alarms:
1. Module error entering state
2. Asynchronous plc error entering state
3. Synchronous plc error entering state

accompanied by CPU LED indications INTF (Internal Fault), EXTF (External Fault), and BF1 / BF2 (Bus Fault), a severe cascading breakdown has occurred:

Primary Trigger: A physical bus disruption (e.g., severed PROFIBUS cable, loose bus connector, or power loss to an active ET 200 rack) causes an entire distributed slave to disconnect.
Immediate System Reaction (OB86): The CPU detects station loss, lights BF and EXTF LEDs, and triggers OB86. WinCC receives the "Module error entering state" notification.
Secondary Cycle Errors (OB85): In the next cyclical execution cycle (OB1 or OB3x), the CPU tries to update process image partitions for the missing station. Because peripheral addresses cannot be read, OB85 fires and WinCC logs "Asynchronous plc error".
Direct Peripheral Reads (OB122): When application code attempts unbuffered direct peripheral reads (PIW) or executes SFC14/15 calls targeting the disconnected station, OB122 fires, generating the "Synchronous plc error" alarm.

Step-by-Step Diagnostic Buffer Analysis

To pinpoint the root cause of the controller shutdown, execute an immediate diagnostic buffer interrogation:

Step 1: Connect to Controller Diagnostic Buffer

Connect the Engineering Station to the plant bus via Industrial Ethernet.
Open SIMATIC Manager.
Select the target CPU 416-3 DP in the project tree, or select Target System -> Display Accessible Nodes.
Press Ctrl + D to open the Module Information dialog, and select the Diagnostic Buffer tab.

Step 2: Filter and Evaluate Historical Events

Click Settings and set the buffer view to display maximum entries (up to 3200 on modern S7-400 CPUs).
Scroll to the specific timestamp of the plant shutdown.
Locate the first event in the sequence. Trace backward to find the initial incoming event rather than the final STOP event.
Note the initial failure: e.g., "Distributed I/Os: station failure (Station number: DP address X)".

Step 3: Extract Diagnostic Hexadecimal Identifiers

Click the first failure entry to view detailed event information.
Record the Event ID (e.g., 16#38C4, 16#39B3, 16#4563).
Note the DP Master System ID, Station Number, and logical base address of the affected module.
Match this logical address against HW Config to identify the physical cabinet, rack, and channel.

Physical Layer and PROFIBUS DP Network Troubleshooting

When BF1/BF2 LEDs illuminate alongside module error alarms, the physical communication layer is compromised:

Bus Termination Verification:
* Inspect the active termination switches on both physical ends of the affected PROFIBUS DP segment.
* Ensure terminating resistors have 5V DC power from their host nodes or dedicated active terminators.
* Verify that intermediate bus connectors have their termination switches set strictly to OFF.
Physical Cable and Shielding Inspection:
* Measure RS485 loop resistance: A healthy, unpowered segment should exhibit approximately 110–220 ohms across lines A and B when terminated, and infinite resistance between line and shield.
* Check for crushed cables, tight bend radii, or cables routed adjacent to high-voltage variable frequency drive (VFD) power leads.
Active Bus Modules and Power Supplies:
* In ET 200M/ET 200SP HA installations, verify the 24V DC auxiliary power supply feeding the interface module and I/O backplanes.
* Check whether an active bus module on the DIN rail is loose or mechanically unseated.

Driver Block Architecture and Channel Diagnostic Flags

The PCS 7 driver system handles faulty hardware signals systematically to maintain process safety:

Channel Driver Outputs: When an input module fails, the channel driver block (Pcs7AnIn, Pcs7DiIn) detects module failure via the MOD diagnostic block.
Signal Quality Code: The driver sets the process value quality code (PV_ST.ST = 16#00 or 16#28, indicating Bad or Device Failure).
Substitute Value Activation: If configured via SubsPV_En, the block outputs the pre-programmed substitute value (SubsPV) to downstream logic, preventing mathematical overflow in PID loops.
Bad Output Flag: The Bad.Value output asserts to 1, signaling downstream interlock blocks (Intlk02, Intlk04) to trigger protective trip logic.

Verification

Following physical repair and replacement of the defective module or cable segment:

LED Verification on S7-400 CPU:
* Confirm that BF1 and BF2 LEDs extinguish completely.
* Confirm that EXTF extinguishes once all distributed stations report healthy status.
* Verify that the CPU remains in the RUN operating state.
WinCC Alarm Clearance:
* Open the WinCC Alarm Logging list.
* Verify that "Module error exiting state" and "PLC fault asynchronous exiting state" messages appear, transitioning alarms from active to cleared.
HW Config Online Status:
* In SIMATIC Manager, open HW Config and select Target System -> Diagnostics/Hardware -> Open Online.
* Confirm that all distributed racks and interface modules display a healthy status (green checkmark).

Limitations and Operational Precautions

Never Omit Error Organization Blocks: Every PCS 7 automation station must contain OB80, OB81, OB82, OB83, OB84, OB85, OB86, OB87, OB121, and OB122 in its offline block folder. If any of these OBs are missing, the CPU instantly transitions to STOP when a corresponding fault occurs, halting the entire plant.
Hot Swapping Precautions: Hot swapping I/O modules on active bus backplanes requires verified active bus modules (e.g., 6ES7195-7HA00-0XA0). Extracting a module on non-active backplanes breaks the bus and crashes the entire rack.
Cyclic Diagnostics CPU Load: Rapid, intermittent bus chatter can flood the CPU with thousands of OB82/OB86 interrupts per second, exhausting CPU communication buffers and causing watchdog trips (OB80).

Engineer FAQ

What is the primary difference between a synchronous and an asynchronous PLC fault in PCS 7?
A synchronous fault occurs directly in response to program execution (e.g., accessing an invalid I/O address in user logic), while an asynchronous fault occurs independently (e.g., a hardware module defect, power failure, or bus cable disconnect).
Why did the CPU shut down if PCS 7 has redundant or fault-tolerant features?
A non-redundant S7-400 (such as CPU 416-3 DP) will drop to STOP if a missing error organization block (like OB85 or OB86) is called, or if a bus disruption causes cycle time exceedance (OB80).
How do I identify which specific module triggered 'Module error entering state'?
Open the CPU Diagnostic Buffer in STEP 7 (Ctrl+D), locate the earliest timestamped event, and check the logical base address and station number referenced in the event details.
What causes the CPU EXTF LED to illuminate?
The External Fault (EXTF) LED illuminates when a fault originates outside the central CPU rack, such as a wire break on a distributed analog input module or a PROFIBUS slave disconnection.
Can a defective 24V DC sensor power supply cause both OB82 and OB86 interrupts?
Yes, if 24V DC auxiliary power feeding an entire ET 200 station drops, the interface module loses communication (triggering OB86), while prior brownout detection triggers diagnostic alarms (OB82).
What does the WinCC message 'PLC fault asynchronous' indicate?
It indicates that the CPU executed an asynchronous error organization block (OB82, OB83, OB84, OB85, OB86, or OB87), reported to WinCC by system diagnostic blocks.
How can I prevent an I/O access error from triggering CPU STOP when replacing a module?
Ensure OB83 (module removal/insertion interrupt) and OB85/OB122 are loaded into the CPU, and download changes using proper maintenance procedures.
What is the function of the PCS 7 block 'MOD_D1'?
MOD_D1 is a standard PCS 7 diagnostic block that monitors the health and operating state of digital I/O modules, evaluates OB82 start information, and generates WinCC alarms.
Why did Bus Fault LEDs (BF1/BF2) illuminate when only one module failed?
If a module failure causes a short circuit on the backplane bus or if an unseated active bus connector disrupts the communication loop, the entire interface module drops off the PROFIBUS network.
How do I clear the diagnostic buffer after resolving the hardware issue?
Diagnostic buffer entries are stored in circular retentive memory and cannot be manually cleared in S7-400 CPUs; old entries naturally roll off as new system events occur.

Technical References

Siemens Industry Online Support (SIOS) Portal: What is the meaning of the WinCC messages 'PLC fault synchronous' and 'PLC fault asynchronous'? (Entry ID: 19389530).
SIMATIC S7-400 Controller Hardware and Installation Manual, Siemens AG.
SIMATIC PCS 7 Advanced Process Library (APL) Manual, Siemens AG.

Related Tags

PCS 7, S7-400, CPU 416, Diagnostic Buffer, PROFIBUS, OB82, OB86, Troubleshooting

Diagnosing PCS 7 System Alarms for Module Errors and Asynchronous PLC Faults on S7-400 Controllers