Resolving SFC Execution Error (ExecErr) and Collective Error (CollErr) Following CPU Warm Restart

Following a CPU warm restart or temporary voltage loss in SIMATIC PCS 7 V8.2, active SFC Types assert ExecErr (Execution Error) and CollErr (Collective Error) while locking out automatic commands from SIMATIC BATCH because the SFC runtime enters an interlocked CPU restart recovery state. The SFC evaluates instance data consistency: if consistent (indicated by a green resume symbol), the error clears only when an operator or recovery logic executes a 'Resume', 'Stop', or 'Abort' command; if inconsistent (indicated by a red backwards reset arrow), a 'Reset' command is mandatory. Executing the appropriate recovery command resets CPU_Restart, clears ExecErr and CollErr, and restores SIMATIC BATCH control.

SFC Runtime State Machine and CPU Restart Behavior

In SIMATIC PCS 7, Sequential Function Charts (SFC and SFC_Type / FB247) govern multi-step sequential automation compliant with ISA-88 and NAMUR standards. When integrated with SIMATIC BATCH, SFC instances execute batch recipe phases.

When an AS controller undergoes a warm restart (e.g., following a plant voltage dip, power cycle, or CPU memory reinitialization), the SFC runtime intercepts the transition. To prevent dangerous autonomous machinery movement or batch contamination upon power restoration, the runtime blocks all automatic progression. It sets output CPU_Restart = TRUE, asserts ExecErr and CollErr, and halts batch phase execution until operational recovery is acknowledged.

Consistent vs Inconsistent Instance Data Evaluation

Upon controller startup, the SFC engine evaluates the internal data integrity of each active instance:
1. Consistent Data (Green Resume Symbol): The step numbers, target setpoints, and elapsed timers in the instance DB remained intact throughout the power interruption (e.g., supported by CPU backup battery or retentive work memory). The SFC can safely resume execution from the interrupted step or execute an orderly stop.
2. Inconsistent Data (Red Backwards Reset Arrow): Step tracking or step pointer integrity was corrupted or lost during power cycling. The runtime considers step conditions invalid. Progression is prohibited; the phase can only be returned to the initial state via an explicit Reset command.

Recovery Command Matrix for Restarted SFC Phases

The table below details SFC restart recovery modes, visual status symbols, and required operator commands:

Data Integrity StateVisual Indicator in WinCC / SFCPermitted Recovery CommandsResulting SFC StateClears ExecErr?Consistent DataGreen Resume ArrowResume (Run), Stop, AbortResumes active step or enters Stopping/AbortingYes: Resets ExecErr, CollErr, and CPU_Restart.Inconsistent DataRed Backwards ArrowResetEnters Idle state directlyYes: Resets ExecErr and purges active step data.Standard Auto ModeOperator Prompt in WinCCLocked until restart clearedUnresponsive to BATCH start/holdNo: Auto commands rejected while ExecErr = 1.Idle StateGrey CircleStartBegins sequence executionNormal state; ExecErr remains 0.

Step-by-Step Recovery and Restart Parameterization Procedure

Identify Blocked SFC Instance: In the WinCC SFC Visualization overview or SIMATIC BATCH Control Center, locate the interlocked SFC phase reporting execution error.
Inspect Data Integrity State: Open the SFC faceplate or SFC Editor online:
- If a Green Resume Arrow is displayed: Click Resume to continue batch processing, or click Stop / Abort to terminate the batch safely.
- If a Red Reset Arrow is displayed: Click Reset. The phase transitions to Idle.
Clear BATCH Server Control Lock: In SIMATIC BATCH Control Center, right-click the blocked recipe unit -> select Release unit or Resume batch. With ExecErr = 0, SIMATIC BATCH re-acquires control of the SFC phase.
Configure Automated Restart Properties (Preventative Engineering):
- In the SFC Type Editor, select Options -> SFC Type Properties -> Characteristics.
- Inspect parameter Restart on power recovery:
- Configure whether the phase should automatically hold, abort, or attempt automatic resumption without operator prompt according to plant safety regulations.
Compile and Download Changes: Save SFC Types, compile CFC changes, and download to the AS in RUN mode.

Verification

Verify recovery and restart handling through the following steps:
1. In CFC test mode on the SFC block, confirm that outputs CPU_Restart = FALSE, ExecErr = FALSE, and CollErr = FALSE.
2. In WinCC OS Runtime, confirm that the SFC faceplate status bar shows Running or Idle without red error banners.
3. In SIMATIC BATCH Control Center, verify that the batch status transitions from Held (Interrupted) back to In Progress with recipe steps advancing normally.

Limitations and Operational Precautions

Never automate unconditional automatic resumption (Auto-Resume) on chemical batch reactors or high-temperature processes. If a power dip interrupts agitation, exothermic thermal runaways can develop; restarting pumps or heaters automatically without verifying field temperature and agitation states violates process safety standards (IEC 61511). Always ensure inconsistent data scenarios are routed to a verified safe shutdown state.