Diagnosing Unscheduled S7-400 CPU STOP Mode Events via Diagnostic Buffer and Organization Blocks

In SIMATIC PCS 7, an S7-400 or CPU 417-4 controller entering STOP mode spontaneously (such as once per day) is primarily caused by missing error-handling Organization Blocks (OBs)—specifically OB85, OB86, or OB122—when transient fieldbus communication or I/O access errors occur. When a peripheral fault arises and the corresponding fault-handling OB is missing from controller memory, the CPU's default operating system reaction is an immediate transition to STOP mode. The definitive root cause must be diagnosed by retrieving the CPU Diagnostic Buffer in SIMATIC Manager (Ctrl+D), which records the precise event ID and faulting block number.

Operating System State Machine: Why S7-400 CPUs Enter STOP Mode

In SIMATIC S7-400 controllers (e.g., CPU 417-4 6ES7417-4XT05-0AB0 or CPU 417-5H), the central processing unit operates under a deterministic real-time operating system. The CPU executes user logic cyclically across Organization Blocks (OB1, OB32–OB38).

When an unexpected event, hardware fault, or software exception occurs, the operating system interrupts cyclic execution and attempts to call a designated Error-Handling Organization Block:
* The Default Protection Rule:
If the operating system detects a fault for which no matching error-handling OB exists in CPU memory, the CPU firmware considers the integrity of the process compromised. To prevent unmanaged machine movement or catastrophic plant damage, the controller automatically enters STOP mode, de-energizing all physical digital and analog outputs.
* The Intermittent Failure Mystery:
A CPU running normally for 23 hours before suddenly tripping into STOP mode once a day indicates an intermittent physical event—such as a transient PROFIBUS drop, an electromagnetic noise burst, or an acyclic record read addressing an unconfigured module.

The Role of Error-Handling Organization Blocks (Fault Masks)

In SIMATIC PCS 7, standard project templates automatically insert essential error-handling OBs into the offline block container. However, during system migrations or custom programming, these critical blocks are sometimes omitted:

Asynchronous Error OBs (Hardware & Network Faults):
OB82 (Diagnostic Interrupt): Called when an intelligent I/O module detects an internal wire break, short circuit, or blown fuse.
OB83 (Insert/Remove Module): Called when a module is hot-swapped in an active rack.
OB85 (Priority Class Error / Program Execution Error): Called when an I/O update fails during cyclic process image exchange, or when a DB is unreadable.
OB86 (Rack Failure / Fieldbus Station Failure): Called when a distributed I/O station (ET 200M, ET 200S) drops off PROFIBUS or PROFINET.
OB87 (Communication Error): Called when message frames are corrupted.
OB88 (Processing Abort): Called when block execution is aborted due to nesting depth.
Synchronous Error OBs (Software & Memory Access Faults):
OB121 (Programming Error): Called when logic evaluates an invalid timer, math division by zero without trap, or calling a non-existent FC/FB.
OB122 (I/O Access Error): Called when logic reads or writes directly to an I/O peripheral address (PIW, PQW) that is not physically present.

Retrieving and Interpreting the CPU Diagnostic Buffer (Ctrl+D)

Engineers should never guess at the reason for a CPU STOP. The controller firmware permanently preserves the sequence of events leading up to the halt in its Diagnostic Buffer:

Connect to the CPU: Establish an online PG/PC connection over Industrial Ethernet or PROFIBUS.
Open Module Information: In SIMATIC Manager, select the CPU and press Ctrl+D (or select PLC > Module Information).
Inspect the Diagnostic Buffer Tab:
* The buffer retains the last 100 to 500 events in chronological order.
* Locate the event titled: STOP caused by... or Defective OB not loaded.
* Note the Event ID (e.g., 16#4567, 16#38C4, 16#4541).
* Inspect the detailed explanation: The log explicitly names the missing OB (e.g., "OB 86 not found"), the block where the fault occurred (e.g., "FB 1850"), and the instruction address.

Common Root Causes: Fieldbus Timeouts, Missing OBs, and Cycle Timeouts

Statistical field experience across industrial plants reveals three primary triggers for intermittent daily CPU halts:

Scenario 1: Transient PROFIBUS DP Drop + Missing OB86:
A remote ET 200M station experiences a brief 100 ms communication glitch (caused by a loose sub-D connector, vibration, or an inductive motor start). The CP or CPU detects station loss. The OS attempts to call OB86. Because OB86 is not present in CPU memory, the CPU trips to STOP.
Scenario 2: Cycle Time Exceeded (OB80):
If a software loop runs out of control or extensive communication processing blocks OB1, the scan time exceeds the configured maximum cycle time (e.g., 6,000 ms). The CPU calls OB80. If OB80 is missing, or if the cycle time is exceeded a second time within the same scan, the CPU enters STOP.
Scenario 3: Acyclic Record Access + Missing OB122:
A channel block attempts to read a HART data record (SFB 52 RDREC) from an analog module that temporarily resets. The I/O access fault calls OB122. In the absence of OB122, the CPU halts.

Diagnostic Matrix of Critical S7-400 STOP Event IDs

The following table lists the most critical Diagnostic Buffer Event IDs that force an S7-400 CPU into STOP mode:

Event IDDescription in Diagnostic BufferMissing / Required OBImmediate Corrective Action16#4541STOP caused by priority class error (OB not loaded)OB85 / OB86 / OB122Insert missing OB into CPU Blocks folder16#4567STOP caused by missing error organization blockOB82, OB83, OB86, OB121Download the named OB into controller memory16#4301Cycle time exceeded (scan time watchdog overflow)OB80Optimize execution run sequence; increase cycle limit16#38C4Distributed I/O station failure / Bus faultOB86Repair physical bus cabling; check PROFIBUS terminator16#2522I/O access error during peripheral read/writeOB122Verify hardware module addressing in HW Config16#49A0STOP caused by memory parity error / hardware defectN/A (Hardware fault)Reseat memory card / replace CPU hardware module

Step-by-Step Procedure to Diagnose and Prevent Unscheduled CPU Halts

Follow this verified engineering workflow to eliminate unscheduled CPU halts:

Extract and Save the Diagnostic Buffer:
* Open SIMATIC Manager online.
* Press Ctrl+D on the CPU > Diagnostic Buffer.
* Click Save As... to preserve the full diagnostic text file for audit records.
* Identify the exact event immediately preceding the transition to STOP.
Download Required Error-Handling OBs:
* In SIMATIC Manager, navigate to the offline Blocks container.
* Verify the presence of all standard error OBs: OB80, OB82, OB83, OB85, OB86, OB87, OB121, OB122.
* If any are missing, right-click > Insert New Object > Organization Block, enter the OB number, and leave the code body empty (an empty OB provides the necessary fault mask to prevent STOP mode).
* Download the newly created OBs to the CPU in RUN-P mode.
Resolve Underlying Physical Fieldbus Issues:
* If the diagnostic buffer logged 16#38C4 (Station Failure):
- Use a physical PROFIBUS tester or oscilloscope to inspect bus signal waveforms.
- Ensure terminating resistors at both ends of the segment are switched ON and powered (5 VDC).
- Check that intermediate drop taps have terminating resistors switched OFF.
Compile and Download Entire CFC Program:
* Ensure that all technological channel blocks have module drivers generated cleanly (Generate module drivers).

Verification

Verify operational stability following remediation:
1. In SIMATIC Manager, confirm that OB80, OB82, OB83, OB85, OB86, OB87, OB121, and OB122 are present in the CPU online block folder.
2. In a staging environment, simulate an ET 200M power drop; verify that the CPU remains in RUN mode (illuminating the red SF / BF LED, but continuing to execute automation logic without halting).
3. Monitor the CPU Diagnostic Buffer across a 48-hour operational window; verify that zero STOP caused by... events occur.
4. Confirm in WinCC that all field alarms are correctly reported in the alarm banner without controller interruption.

Limitations and Operational Precautions

Empty OBs Mask Symptoms: While downloading empty error OBs (e.g., OB86) prevents the CPU from halting, it does not fix the underlying physical fault (such as a loose cable or failing sensor). Always investigate and resolve the root cause recorded in the diagnostic buffer.
Redundant Controllers (S7-400H): In high-availability redundant systems, an unhandled fault on one CPU may cause it to drop into STOP mode, forcing a single-CPU degraded mode. Ensure both redundant CPUs have identical error OBs loaded.
Cycle Time Watchdog Limits: Never set the maximum cycle time watchdog (OB80) to an excessively large value (e.g., > 10,000 ms) as a workaround for infinite loops, as this severely compromises process safety reaction times.
Commercial Accuracy: High-performance S7-400 controllers (e.g., 6ES7417-4XT05-0AB0 or CPU 410-5H 6ES7410-5HX08-0AB0) require authorized licensing and certified engineering workflows. Procure hardware through an authorized Siemens distributor quotation.

Engineer FAQ

Can downloading an empty OB86 harm my automation program?

No. An empty OB86 merely instructs the S7-400 operating system: 'When a distributed I/O station drops, log the diagnostic event, but continue executing the user program.' This keeps the rest of the plant running normally.

Why did my PROFIBUS tester show 3.5V if the bus was failing?

A static DC voltage test of 3.5V confirms power across lines A and B, but cannot detect high-frequency signal reflections, inductive spikes, or transient packet collisions that cause temporary station timeouts. An oscilloscope or dynamic bus analyzer is required.

Can I insert error OBs into an S7-400 CPU while it is in RUN mode?

Yes. Standard Organization Blocks (such as OB82, OB85, OB86, OB122) can be downloaded directly to the controller in RUN-P mode without interrupting plant operation.

What happens if an error occurs and neither OB121 nor OB122 is loaded?

If a program logic error (OB121) or an I/O peripheral access error (OB122) occurs and the respective OB is missing, the CPU enters STOP mode instantly on that exact CPU instruction cycle.