Configuring S7-300/400 Module Diagnostics in WinCC Runtime

Problem Definition

Engineers integrating a SIMATIC S7-300 or S7-400 station with WinCC Runtime frequently need more than transient error logging on the operator screen. The runtime requirement is the continuous display of the complete hardware topology of the connected PLC so that an operator can see, slot by slot, whether a module is present, configured, healthy, faulty, or missing. The display must include:

• Slot occupancy of central rack (Rack 0) and expansion racks — including CPU, SM digital/analog modules, CP communications processors, and IM 360 / IM 361 interface modules.
• Per-module status: OK, Fault, Wrong module, Sub-module missing, or Not configured.
• Diagnostic buffer entries generated by OB 82 (Diagnostic Interrupt), OB 83 (Insert/Remove), OB 85, and OB 122 (I/O access error).
• Channel-level faults of SM 331 / SM 332 / SM 321 / SM 322 analog and digital modules.
• Status of all PROFIBUS DP slaves and PROFINET IO devices owned by the CPU.

Prerequisites & System Topology

Before selecting a diagnostic method, verify the controller, engineering tool, and runtime components installed on the WinCC server. The minimum configuration required is:

The PC runtime side can be a WinCC single-user station, WinCC server/client pair, or a WinCC Professional (TIA Portal) station. STEP 7 (HW Config) and WinCC Runtime do not need to reside on the same machine, but the diagnostic configuration must be exported from STEP 7 and re-imported into WinCC; the engineering station must have read/write access to the PLC and the runtime must have its configured S7 connection.

Diagnostic Method Comparison

Five distinct mechanisms are available for surfacing module information in WinCC. Each has different licensing implications, configuration effort, and depth of information:

Method 1 — Report System Error (RSE)

Report System Error is the simplest way to export STEP 7 hardware configuration diagnostic information into WinCC alarm logging. It generates a standard FB 127 / FB 126 block, populates WinCC messages, and ties each message to the specific slot and channel of the originating module.

1. Open the STEP 7 project containing the S7 station.
2. In HW Config, select Options > Report System Error.
3. Choose the CPU to which the diagnostic blocks should be downloaded.
4. Configure the WinCC connection, message classes, and acknowledge model. Decide whether Acknowledgement triggered by PLC or Acknowledgement by the operator is used.
5. Compile the S7 program and download only the new blocks (the wizard generates FB 126/127 and DBs).
6. Run WinCC Graphics Designer on the OS, open the alarm logging editor, and verify that the imported messages appear under the configured class, e.g. "AS Fault" / "AS Status".

Once active, any module pulling its diagnostic bit (DIAGNOSE LED) or generating a channel diagnostic (e.g. wire break on SM 331 channel 0) raises an entry in WinCC Alarm Logging carrying the slot and channel number in the message text. The mapping is documented in the STEP 7 Online Help topic Report System Error — Message structure.

Method 2 — Online HW Config and S7HWCNFX.EXE Quick Access

For engineering or maintenance PCs where STEP 7 is installed alongside WinCC, the executable S7HWCNFX.EXE located in ...\Siemens\Automation\S7\BIN\ opens the STEP 7 HW Config editor in online view against a target PLC. From there, the engineer can:

• Right-click any module on the rack and choose Module Information to view the diagnostic buffer.
• View the DP Slave Diagnostic tab for every PROFIBUS DP slave, displaying station status bytes 1–3 plus identifier-related diagnostics.
• Open the IO Device Diagnostic tab for PROFINET IO devices to read channel, slot, and channel error type.

To surface this in the WinCC Runtime screen, create a button in Graphics Designer whose event calls the program S7HWCNFX.EXE with appropriate command-line switches. The official Siemens documentation lists switches such as -online to start directly in online view and -target to pre-select the PLC. This approach bypasses the need for ProAgent or PCS 7 Maintenance Station but is intended for engineering/maintenance access — not for general operator use.

; Example WinCC button C-action (VBScript)
Sub OnLButtonDown(ByVal Item, ByVal Flags, ByVal x, ByVal y)
    Dim sShell
    sShell = "C:\Program Files (x86)\Siemens\Automation\S7\BIN\S7HWCNFX.EXE "
    sShell = sShell & "-online -target S7ONLINE:<TCP/IP> -address 192.168.0.1"
    Shell sShell, vbNormalFocus
End Sub

Method 3 — PCS 7 Maintenance Station

For PCS 7 plants, the Maintenance Station is the recommended asset-health dashboard. It uses the same OB 82 / OB 83 stream as Report System Error but layers it with:

• Plant hierarchy (technological tree) automatically generated from the STEP 7 HW Config.
• Rolling maintenance counters per module (e.g. hours since last module replacement).
• Maintenance request / maintenance demand / failure indication matching IEC 62443 / NAMUR NE 107.
• Direct link from the asset tile to the diagnostic faceplate for that module.

Configuration is performed in PCS 7 Plant View and SIMATIC Manager; after compilation, the maintenance overview appears in WinCC Explorer / Maintenance view at runtime. This option requires the PCS 7 AS bundle license and is documented in the PCS 7 Maintenance Station manual.

Method 4 — ProAgent / S7-Pdiag Process Diagnostics

S7-Pdiag / ProAgent generates type-specific FBs for supported modules (SM 331, SM 332, SM 321, SM 322, FM 350-1, FM 351, FM 352, FM 354, FM 455, ET 200S, ET 200pro). For each supported module it inserts FBs in the OB 1 call tree. The runtime behavior is identical for S7-300 and S7-400 stations; only the call depth changes because S7-400 stations are subject to OB priority classes.

1. Install ProAgent / S7-Pdiag on the engineering PC; the package adds menu items under Options > Process Diagnostics in STEP 7.
2. Open HW Config, select the slave / station, and run Options > Process Diagnostics > Generate Blocks. The wizard scans the rack and inserts FBs for every supported module.
3. The wizard also generates a default PDM-style faceplate set into the WinCC project. Each faceplate carries the channel status, fault memory, and standard operating buttons.
4. Compile and download. The first cycle reports module name, slot, and OBs available; on mismatch, a "Configuration mismatch" status is raised.

ProAgent / S7-Pdiag is the official way to obtain channel-level diagnostic faceplates without writing custom code. However, it depends on the engineer performing a workflow inside STEP 7; if ProAgent does not recognize an unsupported module (e.g. older SM 334 or third-party PROFIBUS slaves), it falls back to a generic "Unsupported module" diagnostic block and the channel information must be supplied by an additional custom FB or by SZL polling.

Method 5 — Custom Diagnostics via SZL (SFC 51 RDSYSST)

When none of the optional packages are licensed, an engineer can poll the SIMATIC System State Lists (SZL) from user program to obtain a per-slot map of the entire central rack and all configured DP slaves / IO devices. The relevant SZL IDs are:

A typical STEP 7 (ST) implementation, called cyclically from OB 1 with consistent values, is:

FUNCTION_BLOCK fb100_RackStatus
VAR
    iResult : INT;
    iIndex : INT;
    iSZL_ID : WORD;
    iDB : INT;
END_VAR
BEGIN
    iSZL_ID := W#16#011;            (* SZL 0x011 - Status of all plugged modules *)
    iIndex := 1;                    (* rack 0 / slot 1 begin *)
    iDB := 200;                     (* any pre-allocated DB *)

    iResult := RDSYSST(SZL_ID := iSZL_ID,
                       INDEX := iIndex,
                       RET_VAL := iResult,
                       BUSY := FALSE,
                       SSL_HEADER_INFO := NULL,
                       DATA := DB200.Data);
END_FUNCTION_BLOCK

Store the result block in DB200. Each 32-byte record is interpreted as follows:

• Bytes 0–1: Module status (Bit 0 = module OK, Bit 2 = module faulty, Bit 5 = wrong module, Bit 6 = channel diagnostic pending, Bit 7 = parameter assignment error).
• Bytes 2–3: Module identification index (4-digit H-code). Reference STEP 7 Module Description for the lookup table (e.g. 0x00FF SM 331 AI 8x12Bit).
• Bytes 4–5: Firmware version.

Move these data words to WinCC tags (one tag per slot, type Unsigned 16) via the S7 driver connection and bind to a status symbol on the runtime faceplate. Because the result is purely polling-driven, it captures modules that never generate an OB 82 — exactly the use-case the original poster asked for.

Reading Rack-0 SM / CP Module Status

The user's original question — "How do I see the status of the SM and CP modules in rack 0?" — specifically targets the central rack of an S7-300 / S7-400 station (Slots 1…18 in S7-300, Slots 1…18 in S7-400 with different physical numbering). Three reliable patterns are:

Pattern A — Online HW Config + Manual Block

From STEP 7 in online mode, right-click a SM module in Rack 0 and select Module Information > Diagnostic Buffer. The diagnostic buffer shows events for that module only. To walk the full rack, repeat on each SM. This is the most explicit method because it tells the engineer, by design, the contents of the diagnostic buffer the CPU itself maintains.

Pattern B — SZL 0x0011 Poll

Use the pattern shown in Method 5 for the index range that corresponds to the full rack. For S7-300, valid slots are 1 (PS), 2 (CPU), 3 (IM), 4…11 (SM/CP), so index range 1…11 yields 11 records. For S7-400 with several expansion racks, request each Rack ID separately or one-shot the partial listing SZL 0x0123.

Pattern C — DP / IO Device Poll

For PROFIBUS DP slaves, use SFB 13 DPNRM_DG in STEP 7 to read the slave diagnostic buffer. For PROFINET IO devices, use the OB 82 stream together with the indexed record sets. Always call SFB 13 synchronously when the master state machine allows because each call locks the slave's diagnostic resources briefly.

Configuration Procedure

Apply the following procedure to set up the most common configuration — Report System Error for transient faults plus SZL polling for steady-state slot mapping:

1. Build HW Config. Open STEP 7, drop the S7-300 / S7-400 station onto the project, insert modules from the catalog (right-click Rack 0 > Insert Object > Signal Module / Function Module / Communications Module). Save and compile.
2. Enable diagnostic OBs in the CPU. In HW Config, double-click the CPU, go to Diagnostics/Clock, and ensure OB 82, OB 83, OB 85, OB 86, OB 100, OB 102, OB 121, OB 122 are downloaded with the project. If any of these OBs are missing, the CPU goes to STOP instead of continuing on the diagnostic event.
3. Run Report System Error. Use menu Options > Report System Error and follow the wizard. The wizard generates FB 126/127 plus instance DB and pre-wires message texts from the S7 module catalog.
4. Generate the SZL poll FB. Insert fb100_RackStatus (from Method 5) into OB 1. Allocate DB200 with enough records to hold the maximum slot count. Note that OB 1 on CPU 315-2 PN/DP runs at priority 1, while OB 82 is priority 26 — so the SZL poll must be non-blocking (cyclical, single call).
5. Export WinCC tags. In NetPro, define the S7 connection. From STEP 7, export all symbols required for the diagnostic FBs (RSE FBs and DB200 records) to a WinCC symbol file. Use Options > WinCC Configuration File to populate the WinCC tag list automatically.
6. Design the runtime faceplate. In WinCC Graphics Designer, create a graphic (one "slot tile" per slot) and bind property BackgroundColor to the SZL module-status word. Mapping: Bit 0 = OK (green), Bit 2 set = red flashing, Bit 5 = orange, Bit 7 = yellow. Apply either direct tagging or the WinCC StatusList configuration.
7. Link RSE messages to the alarm view. Open Alarm Logging, confirm the imported message classes carry the slot and channel placeholders. Insert an Alarm Control in the runtime picture and filter by class "AS Fault" / "AS Status".
8. Save, compile, download. Compile OS, full-transfer the project to the WinCC server, and start the runtime.

Verification & Troubleshooting Matrix

Validate the configuration against the following checks before going live:

Common fault-tree branches observed in the field:

• CPU goes to STOP instead of generating OB 82. — The diagnostic OB is not present in the project; either delete the OB 82 in HW Config or download an empty OB 82.
• Slot tiles in WinCC are all green immediately after CPU restart, never update. — Custom SZL poll is reading too large an SZL size; reduce or split reads. SZL 0x0011 has a record size of 32 bytes — exceeding index range causes RET_VAL = W#16#80A4 from RDSYSST.
• RSE alarms appear but channel column is empty. — Module has not been added to the Report System Error configuration; re-run the wizard with the entire HW Config selected.
• S7-Pdiag supported module does not generate an FB. — Module is older revision; check firmware compatibility (e.g. SM 331 old type 6ES7331-7KF02).
• WinCC Alarm Logging duplicate messages. — Multiple connections to the same CPU; consolidate to a single WinCC S7 connection.

Field Commissioning Notes

Engineers commissioning a multi-rack S7-300 / S7-400 station should observe the following practical caveats that are not always explicit in the manuals:

• OB 1 priority differs between S7-300 and S7-400. On CPU 417-4 (S7-400), OB 1 runs at priority 9, while OB 82 runs at priority 26; that means a long-running OB 1 cycle delays the diagnostic response. Use OB_PRIOR inspections or break the poll across multiple ticks.
• For S7-300 stations with IM 361, the expansion racks are polled one at a time using separate SZL calls; carry the rack number in the SZL index register.
• WinCC V7.5 removed the legacy APC Diagnostics component; if upgrading from V7.0 to V7.5, re-migrate diagnostic screens to the modern Alarm Control or ProAgent faceplates.
• Retaining a "Module status word" tag in WinCC at all times ensures the plant operator sees the slot map even during a CPU restart sequence (SZL 0x0099 helps differentiate "COLD restart pending" from "RUN").
• For PROFINET IO devices, SZL 0x0F31 gives the device's PROFINET device ID; cross-reference against GSDML catalog tables for diagnostic parameter mapping.

Frequently Asked Questions