Configuring S7-300/400 Hardware Diagnostics in WinCC via STEP 7

Hardware diagnostics on a SIMATIC S7-300/S7-400 station is the foundation of any maintenance strategy. When an ET 200S slave drops off Profibus, an SM 321 DI module fails, or a rack power supply enters a fault, the PLC detects the event and the HMI must surface the message in operator-readable language. Siemens' standard mechanism for this on legacy S7-300/400 systems is the Report System Error (RSE) function in STEP 7 V5.x, paired with WinCC as the HMI/SCADA layer. This article provides the engineer-level procedure, the underlying OBs/SFBs/SFCs, the WinCC tag and alarm wiring, and a field-tested verification workflow.

1. Diagnostic Information Flow Overview

Before configuring, understand the data path:

1. An I/O module or DP slave enters a fault state and writes a diagnostic record to its local diagnostic buffer.
2. The CPU's diagnostic OB (OB82, OB83, OB84, OB85, OB86, OB87, OB121, OB122) is triggered. RSE installs a centralized FB 192 with SFB 192-style behaviour that reads the diagnostic info using SFC 13 (DP_TOPOL) / SFC 51 (RDSYSST) / SFB 54 (RALRM).
3. RSE generates one standardized bit per slot (the "module status" bit) and writes a structured text block describing the error to a configured DB.
4. WinCC reads the status bits via the integrated project connection (no separate driver required) and displays the text block on the Alarm Logging view.

2. Prerequisites

Verify the following before opening the Hardware Catalog:

3. STEP 7 V5.x Project Configuration

3.1 Open the Diagnostic Wizard

1. In SIMATIC Manager, select the S7 program node of your station (e.g. S7-400 / CPU 414-3).
2. Right-click → Special Object Properties → Report System Error…
3. The Report System Error dialog appears. Enable "Activate Report System Error" with a checkmark.

3.2 Configure the AS-OS Interface

RSE writes status bits and message text into a single DB. By convention Siemens uses DB 192 (AS-OS data block), but any unused DB number works.

Click Generate. STEP 7 will insert:

• FB 192 with instance DB 194 — the central RSE block (installed in OB1, OB82, OB86, etc., as required)
• DB 192 — 1 bit per module slot, used by WinCC as a "coming/going" trigger
• DB 193 — STRING array, one entry per slot, containing the localized alarm text
• Text libraries in the project (German + English), with a user-editable comment field for custom messages

4. WinCC Configuration

4.1 Integrated Project Connection

When the WinCC project is integrated into the STEP 7 project (right-click → "Integrate WinCC Application"), the tag and alarm configuration is automated:

1. Open the WinCC Explorer. Switch to Tag Management.
2. Under SIMATIC S7 PROTOCOL SUITE → TCP/IP (or named connection), the system auto-creates the connection.
3. Open Alarm Logging. You will see a populated message class (default: "System") with the generated RSE messages for every slot in the project.

4.2 Internal Tags for Splitting the Alarm Source

The message text references @(slot) placeholders. To filter, sort, or display per-rack/per-station alarms, add internal tags in WinCC:

4.3 Alarm View Customization

In the WinCC AlarmControl, ensure these columns are visible: Date, Time, Status, Tag (Comment), Message text, Acknowledgment. The "Tag (Comment)" field is automatically populated with the affected slot's text from DB193, which provides operator-friendly text like:

5. System Diagnostics OCX and Library Blocks (Alternative Path)

Where RSE does not provide sufficient detail — for example, custom cyclic polling of SZL 0x0131 (module status) or SZL 0x0192 (rack/station failure) — engineers use the System Diagnostics package:

The S7CPUDiag OCX is configured on a WinCC picture, pointed at the connection, and it automatically discovers the rack layout. Each module is drawn as an icon; the icon changes color (green/yellow/red) based on the live state. Clicking the icon opens a details window with the full diagnostic text, channel information, and last error code.

6. Available System Status Lists (SSL) and Their Use

RSE internally calls SFC 51 (or SFC 13 for DP). For advanced use, the following partial lists are most relevant:

7. STEP 7 Diagnostic OBs — When They Fire and Why They Matter

You can verify which diagnostic OBs are loaded with the CPU Properties → Diagnostics/Clock tab in STEP 7, or in the online "CPU → Module Information → OB List".

8. TIA Portal Alternative for S7-1200 / S7-1500 / S7-300/400 with TIA

When the same problem is solved on TIA Portal (V13+), the equivalent of RSE is the integrated System Diagnostics option. It is selected on the CPU's "Properties → System Diagnostics" tab and writes directly into the WinCC (TIA) alarm subsystem. Differences from legacy RSE:

• No separate FB 192 — the CPU firmware provides the diagnostic data natively.
• WinCC (TIA) consumes the alarms through the standard "System Diagnostics" view control — no OCX needed.
• Profinet diagnostics are first-class and reach channel level automatically.
• No manual AS-OS DB wiring required — WinCC reads the alarms via the integrated connection.

For mixed installations (an S7-400 still on STEP 7 V5.x communicating with a TIA-portal S7-1500 in the same WinCC), the legacy RSE path remains the only option for the V5.x portion. The two alarm streams can coexist in a single WinCC alarm view by configuring separate message classes and tag prefixes.

9. Field-Proven Commissioning Procedure

1. Compile and download the STEP 7 program with RSE generated. Confirm in the SIMATIC Manager dialog "Download to Target System" that OB82, OB83, OB85, OB86, OB87, OB121, OB122 are all loaded (not the default empty version). For S7-300 they are optional; for S7-400 at least OB82, OB86, OB121, OB122 should be present even if RSE is not used.
2. Force a fault in a controlled way to verify the path: open the HW Config, place a "Module"/"Submodule" in fault state using the online menu "Online → Module Information → Operating Mode" or pull an ET 200S DO module's connector briefly.
3. Watch the CPU diagnostic buffer (Online → CPU → Diagnostic Buffer). You should see two entries: the raw event (with OB number and diagnostic ID) and a second one from RSE indicating the alarm was generated.
4. On the HMI, the corresponding message appears in the Alarm Control within the configured scan cycle (default 1 s, configurable via UpdateCycle in the alarm logging settings).
5. ACK flow: press the operator ACK button. WinCC writes an acknowledgment bit to the same DB 192, and RSE's SFB 192 ACK path clears the slot bit once the fault is also gone.

10. Troubleshooting Matrix

11. Verification Checklist

After commissioning, the following must all be true:

• OB 82, OB 83, OB 85, OB 86, OB 87, OB 121, OB 122 are present in the CPU online view.
• DB 192 contains at least one bit per module of the configured station.
• DB 193 is at least the size of the largest expected diagnostic text buffer; the wizard's default of 256 bytes per slot is usually enough.
• WinCC Alarm Control shows the configured message class with no error overlays.
• Operator can ACK the alarm and the state transitions to "ACK gone" once the fault clears.
• CPU diagnostic buffer does not show any "OB not loaded" entries.

12. Migration to TIA — Field Note

If the plant is moving to TIA Portal, you can preserve the existing diagnostics structure: STEP 7 V5.x projects can be migrated with the STEP 7 V5.x → TIA Portal migration tool, which carries RSE-generated blocks and alarm text. After migration, run a "Convert → Standardize" on the migrated TIA project to switch the now-old RSE into the TIA-native System Diagnostics. The message texts in DB 193 are copied to the TIA project as text lists — review and trim duplicates. Always back up the original V5.x project before migration, because DB 193 is partially regenerated and custom text additions may need re-application.

Frequently Asked Questions