Diagnosing S7-417-5H Controller Halts Caused by SFB20 (STOP) and PG Stop Operations in SIMATIC PCS 7

In SIMATIC S7-417-5H redundant systems, an unexpected controller transition from RUN to STOP with the diagnostic buffer reporting 'STOP caused by PG stop operation or by SFB 20 (STOP)' indicates that the controller halt was initiated by an explicit software command rather than an internal hardware fault. This occurs when an engineering workstation commands a CPU stop, a third-party script triggers a STOP service, or custom application logic executes System Function Block SFB20 ('STOP'). To troubleshoot, inspect the Diagnostic Buffer call stack to identify the calling block and network, audit SIMATIC Logon records, and remove unauthorized SFB20 invocations.

S7-400H CPU Stop Mechanisms - Hardware Trips vs Commanded Halts

In high-availability SIMATIC S7-417-5H (6ES7417-5HT06-0AB0) redundant configurations, controller halts categorize fundamentally into two classes:
1. Uncommanded Hardware / Firmware Faults: Cycle time exceedance without OB80, fatal backplane bus errors, missing essential organization blocks (OB85, OB86, OB122), or double memory parity faults.
2. Commanded Software Stops: When the CPU Diagnostic Buffer explicitly records:
STOP caused by PG stop operation or by SFB 20 (STOP)
This event confirms that the CPU microkernel received an authorized command to transition to STOP mode. No hardware defect occurred; the halt was commanded either through an external engineering tool (PG/PC) or internally by user logic.

SFB20 (STOP) Execution Mechanics and Programmatic Shutdown

System Function Block SFB20 (STOP) is an integrated S7-400 system function:
* When called with input condition REQ := TRUE, SFB20 immediately places the local CPU into STOP mode at the conclusion of the current block execution.
* In redundant S7-400H configurations, if SFB20 is executed on the Master CPU, the controller attempts to shut down the automation station. Depending on redundancy status, the Standby CPU may also enter STOP if redundancy synchronization cannot be maintained.
* Legacy Engineering Artifacts: Engineers sometimes insert SFB20 during commissioning to halt execution upon extreme test conditions (such as severe communication loss), forgetting to remove the block prior to commercial plant operation.

Diagnostic Buffer Call Stack and Event Analysis

To pinpoint whether SFB20 or an external PG caused the shutdown:

[Phase 1: Open S7-417-5H Diagnostic Buffer]
   │  • In SIMATIC Manager: Select the faulted CPU -> PLC -> Module Information
   │  • Select tab: "Diagnostic Buffer"
   │  • Highlight event: "STOP caused by PG stop operation or by SFB 20"
   │
[Phase 2: Inspect Event Details and Call Stack]
   │  • Review "Details on Event":
   │      - If caused by PG: The event notes "External stop command from PG/PC"
   │      - If caused by SFB 20: The event provides block address details:
   │          "Current / meaning in OB: [e.g. OB1 or OB35]"
   │          "Priority class: [e.g. 12]"
   │  • Click the button: "Open Block"
   │  • STEP 7 opens the exact CFC chart or STL/SCL block where SFB20 was called!
   │
[Phase 3: Cross-Reference SIMATIC Logon and ES Audit Trail]
   │  • If event indicates a PG operation:
   │  • Open the SIMATIC Logon Event Log on the Engineering Station
   │  • Check for user actions: "Operating mode change: CPU -> STOP"
   │  • Correlate timestamp to identify the workstation and user account

Diagnostic Event Signature and Cause Comparison Matrix

Compare stop signatures in the S7-400H diagnostic buffer:

Diagnostic Buffer EntryPrimary Root CauseHardware ImpactResolution Workflow'STOP caused by PG stop operation or by SFB 20'Manual PG command or SFB20 call in logicNone (Software commanded)Trace call stack via 'Open Block'; audit user log.'STOP caused by priority class error'Unhandled programming error; missing OBNoneDownload required error OB (OB85, OB122).'STOP caused by cycle time exceeded'Program loop duration exceeded max scan timeNoneOptimize CFC execution sequence; adjust OB80 time.'Defective module / internal CPU error'Hardware ASIC or memory failureDefective HardwareReplace CPU module under warranty.

Verification

To confirm that unexpected software stops are permanently prevented:
1. In SIMATIC Manager, perform a global text search (Find in Program) across all blocks for string SFB20 or SFB 20; confirm zero instances exist in production logic.
2. Verify that all essential fault Organization Blocks (OB80, OB82, OB83, OB85, OB86, OB87, OB88, OB121, OB122) are present in the offline and online Blocks folder.
3. Switch both S7-417-5H controllers to RUN; confirm redundant synchronized status (RUN / Redundant).
4. Audit SIMATIC Logon permissions; ensure operator and maintenance roles lack permissions to execute controller STOP commands from engineering tools.

Limitations and Operational Precautions

Never use SFB20 (STOP) in production process control logic as a method of equipment safety protection. A complete CPU stop de-energizes all process outputs and drops plant bus communications, causing uncoordinated shutdown and severe process hazards. Equipment safety must be handled via certified fail-safe shutdown blocks (S7 F Systems) that place specific actuators into safe de-energized states while keeping the controller running.

Engineer FAQ

Can a WinCC SCADA client trigger an SFB20 stop?

WinCC cannot call SFB20 directly unless an engineer linked an internal tag to an AS block that calls SFB20. However, SIMATIC Manager or STEP 7 connected to the plant bus can issue a PG stop command.

Why did both S7-417H CPUs stop when only one CPU ran SFB20?

In redundant operation, if the master CPU stops while the standby CPU cannot maintain bumpless single-mode operation (e.g. due to a passivated bus link), both CPUs halt to prevent split-brain execution.

How do I find which block called SFB20 if 'Open Block' is disabled?

Inspect the diagnostic buffer hex dump (bytes 8 to 11) to extract the block type (FB/FC) and block number that executed the stop instruction.

What user permissions are required to command a CPU stop in STEP 7?

With SIMATIC Logon active, only users assigned to the 'Administrator' or 'Engineering' role with explicit CPU operating mode privileges can command a CPU stop.