Problem Description
Report System Error (RSE) diagnostics generated by FB49 on a SIMATIC S7-300/400 CPU (for example, a 315F-2 PN/DP, order number 6ES7 315-6TH13-0AB0) are visible in the STEP 7 V5.5 diagnostic buffer and on the PG, but they do not appear on a TP700 Comfort HMI (6AV2 124-1MC01-0AX0) when the panel project is engineered in TIA Portal V13 SP1 Update 6 with WinCC Professional V13 SP1 and STEP 7 Professional V13 SP1.
Standard HMI tag communication, screen navigation, and process value display work correctly. The HMI connection in the WinCC "Connections" editor shows a healthy, green connection to the proxy PLC. The problem is confined to the device-proxy bridge that WinCC uses to forward S7 diagnostic events to the Comfort panel runtime.
This article walks through the architecture, root causes, and the field-proven configuration path that allows FB49 messages to surface on the TP700 message view without abandoning the classic STEP 7 V5.5 project source.
Architecture Overview: Device Proxy and Report System Error
WinCC Comfort/Advanced/Professional supports two HMI engineering paths for an S7-300/400 PLC that was programmed in STEP 7 V5.x:
- Native TIA Portal integration – the PLC project is migrated to TIA Portal, and the HMI is compiled against the integrated S7 program.
- Device Proxy (HMI Device Proxy) – the TIA Portal HMI project references the STEP 7 V5.5 project through a generated proxy that exposes the S7-300/400 station as a PROFINET device. The HMI compiles against the proxy; the actual S7-300/400 station is brought in via GSD import.
The Device Proxy is the official integration path documented in the Siemens application note "WinCC TIA Portal STEP 7 V5 Proxy" documentation v2.0 (entry ID 73502293). It is required whenever the S7-300/400 program cannot or should not be migrated (for example, F-CPU safety programs on older firmware, or to preserve a long-running V5.5 project history).
Report System Error itself relies on the following PLC-side components:
- FB49 (SFM_FB / "Report System Error") – extracts diagnostic events from partial system state lists (SZLs) and writes them to the diagnostic buffer.
- DB49 (SFM_DB) – instance DB for FB49; contains the error organization.
- DB126 (SZL_DB) and DB127 (SFM_ERROR_DB) – auxiliary DBs required by FB49.
- OB82, OB83, OB84, OB85, OB86, OB87, OB121, OB122 – error OBs referenced by the RSE organization.
- SFC13 (DPRD_DAT), SFC51 (RDSYSST) – system functions used internally to read SZLs.
For the events to reach the TP700, the HMI runtime must:
- Establish a PROFINET/S7 connection to the proxy PLC (working in the reported case).
- Use the S7DOS driver to subscribe to the PLC's diagnostic buffer entries that FB49 publishes.
- Map the diagnostic buffer to a WinCC message configuration in the "HMI Messages" editor.
Failure of any of these three legs – while the basic tag connection still works – is the precise symptom of a Device Proxy that is missing the legacy S7 driver.
Root Cause: Missing S7DOS Driver in the Proxy Configuration
The dominant root cause reported by Siemens Support and reproduced in the field is that the HMI runtime image downloaded to the TP700 Comfort contains the standard S7-300/400 tag driver, but it does not contain the S7DOS (S7 Diagnostic Operator Station) channel unit that Report System Error requires. Tag polling, alarms, and recipe data work over the standard S7 connection; diagnostic events do not, because no S7DOS channel is compiled into the HMI image.
Triggering conditions observed in TIA Portal V13 SP1 Update 6:
- The PLC station is added to the TIA Portal project as a PROFINET device via GSD, but the HMI was not placed on the same PROFINET subnet as the proxy PLC, or
In every case, the basic HMI connection succeeds because WinCC falls back to the standard S7 PUT/GET channel, but the diagnostic channel remains unbound.
Prerequisites
Before reconfiguring, verify the following on the engineering station and the panel:
| Item | Required Version / Value | Verification |
|---|---|---|
| STEP 7 V5.5 | 2010 Professional SR4 (or later) with S7 Distributed Safety optional package if F-CPU is used | Help → About |
| TIA Portal | V13 SP1 Update 6 (build 13.1.0.210) or V14 SP1 Update 3 for newer toolchains | Help → About |
| WinCC Professional | Same version as TIA Portal | Help → About |
| TP700 Comfort image | Image version 13.1.0 or newer (matches the engineering version) | Panel: Control Panel → OP Properties → Version |
| GSD file for 315F-2 PN/DP | Siemens GSDML-V2.31-Siemens-S7-300F-20130912 or newer | Options → Manage GSD files |
| FB49 block family | SFM library (FB49, DB49, DB126, DB127, UDT1001, UDT1002, UDT1003) | STEP 7 V5.5 → Libraries → Standard Library → SFM |
| PROFINET name on the S7-300/400 | Must match the proxy device name in TIA Portal exactly (case-sensitive) | STEP 7 HW Config → PROFINET interface → Properties |
| IP address | Same subnet as the TP700, no duplicate IPs in the cell | PG, panel, PLC: ping test |
Step-by-Step Resolution
Step 1 – Verify the PLC side generates diagnostic records
- In STEP 7 V5.5 HW Config, ensure the CPU is configured with all relevant error OBs (OB82, OB83, OB85, OB86, OB87, OB121, OB122). Without them, FB49 cannot publish events.
- Open the SFC and FB containers and confirm that FB49 is being called in OB1 (or in a cyclic interrupt OB such as OB35) and that DB49 is generated.
- Force a known diagnostic event (for example, pull a PROFINET module) and read Menu → PLC → Diagnostic/Setting → Module Information → Diagnostic Buffer in STEP 7. The buffer must show the RSE-formatted entry. If not, fix FB49 first; the HMI cannot display what the CPU never publishes.
Step 2 – Build the HMI device proxy correctly
- In TIA Portal V13 SP1, create a new HMI project for the TP700 Comfort.
- Use the "HMI Device Proxy" wizard. When prompted, browse to the STEP 7 V5.5 S7-300/400 station and select it. This is the step that injects the legacy S7 driver (including S7DOS) into the HMI runtime image.
- Add the S7-300/400 station to the same PROFINET subnet as the TP700. The Devices & Networks editor must show a green line between the panel and the proxy PLC.
- Verify the PROFINET device name on the proxy matches the S7-300/400 CPU name in STEP 7 V5.5 HW Config exactly.
Step 3 – Enable the Report System Error message class on the HMI
- In the TIA Portal project tree, expand HMI → Messages → HMI Messages.
- Open the "Settings" of the message configuration.
- Under Report System Error, enable "Use Report System Error for this HMI device".
- Select the proxy PLC as the source. TIA Portal will auto-generate one HMI message per S7 diagnostic event class that the PLC publishes through FB49.
- Compile the HMI project. Verify that the compiler log shows "Channel unit S7DOS added" in the output. If it does not, the proxy was not built from the STEP 7 V5 source.
Step 4 – Configure the display on the TP700
- Add a "Message view" control to a screen.
- Bind the control to the "HMI Messages" system category. Do not point it to "PLC alarms"; RSE events appear in the system message category only.
- Build the runtime image and download to the TP700 Comfort.
- Reboot the panel. The S7DOS channel initialization occurs at runtime startup; a partial image (download in RUN) is not sufficient for the channel unit change.
Step 5 – Load the panel runtime from the engineering station
- Use "Online → Extended Download to Device" with the panel in Transfer mode.
- After download, the panel will perform two reboots. The first applies the image; the second initializes the S7DOS channel.
- Trigger a test event (PROFINET pull, wire break on a digital module). The message must appear in the TP700 message view within 2–3 seconds.
Verification
Use the following checks to confirm a healthy end-to-end configuration:
| Check | Method | Expected Result |
|---|---|---|
| S7DOS channel present in panel image | Control Panel on TP700 → Service and Commissioning → Installed Components | "S7DOS" channel unit listed |
| PROFINET name resolution | PG → ping the PLC by name | Resolves to the CPU's IP address |
| Diagnostic buffer populated | STEP 7 V5.5 → PLC → Module Information → Diagnostic Buffer | Entry with RSE event class, timestamp, OB that raised the error |
| Channel diagnostics on HMI | Start the HMI runtime, open a diagnostic screen tied to the connection | Connection state = Connected, channel unit = S7DOS |
| End-to-end event propagation | Pull a PROFINET device, watch the TP700 message view | Message appears within 2–3 s with module slot and error text |
Diagnostic Decision Matrix
| Symptom | Likely Cause | Fix |
|---|---|---|
| Tag polling works, RSE messages do not | S7DOS channel unit not in the HMI image | Rebuild the proxy from STEP 7 V5 source, enable RSE in HMI Messages settings, recompile |
| Tag polling and RSE both fail, HMI shows "Connection interrupted" | PROFINET name mismatch or wrong subnet | Match PROFINET name on CPU to proxy device; verify subnet mask and IP range |
| RSE works once after download, fails after panel reboot | TIA Portal compiled image without S7DOS for the runtime that was last loaded | Full image download, not delta; reboot panel twice |
| CPU diagnostic buffer empty when error occurs | OB82/OB85/OB86/OB121/OB122 missing or not configured for SFM | Add the error OBs, ensure OB priority allows FB49 to run |
| TIA Portal reports "No suitable S7 driver for the selected proxy" | WinCC Professional install missing legacy S7 option, or TIA Portal version mismatch with STEP 7 V5.5 SP | Repair-install WinCC; ensure STEP 7 V5.5 SP4 is installed alongside TIA Portal V13 SP1 Update 6 |
Edge Cases and Field-Proven Caveats
- F-CPU behavior: On a 315F-2 PN/DP, the safety-related diagnostics travel on a separate channel. RSE on the F side requires S7 Distributed Safety V5.4 SP5 or newer. The standard FB49 does not raise F-STOP diagnostics into the operator panel; use S7 F-FB libraries and the safety message configuration.
- PROFINET name length: Siemens allows up to 240 characters, but WinCC Professional V13 SP1 truncates to 127. Use a short, station-based name (for example, "PLC_LINE1") to avoid mismatch.
- Firewall / proxy servers on the engineering station: If the TIA Portal installation lives behind a corporate proxy, the install/update of the WinCC option packs may fail silently. This is not a runtime issue but it leaves the engineering station without the S7DOS package. Validate by attempting a repair install with the proxy temporarily disabled, per Microsoft's guide to troubleshooting network and proxy errors during Visual Studio installation (same WinHTTP/ProxyEnable pattern applies to the Siemens installer).
- BCAAA-style driver errors: Some legacy BCAAA patterns in proxy environments raise "A device attached to the system is not functioning" when the driver handshake fails. Although the BCAAA article in the Broadcom knowledge base (ID 235409) targets a different product family, the same first-line checks apply: confirm the runtime service is started, the driver DLL is registered, and the channel unit is bound. On TP700, this manifests as the HMI showing tags but no diagnostic events.
- Migrating off Device Proxy: If a project can be migrated to TIA Portal V14 or V15, the device proxy is no longer required. The S7-300/400 station can be added natively (or imported as a TIA Portal station) and the S7DOS channel is then built in by default. This is the cleanest long-term fix.
- WinCC Flex 2008 fallback: Some users report that RSE worked under WinCC Flex 2008 SP3. This is correct: WinCC Flex loads the S7DOS channel automatically because it is bound to a native STEP 7 V5 project, not a proxy. If RSE is mission-critical and the proxy cannot be stabilized, porting the panel project to WinCC Flex on the same TP700 hardware is a supported path – the TP700 Comfort runs both WinCC Flex and WinCC Comfort/Professional runtime images.
Standards and Reference Documents
- Siemens TIA Portal Help: System diagnostics with 'Report System Errors' (S7-300, S7-400) – official description of the SZL/SFM flow and HMI message mapping.
- Siemens application note 73502293: WinCC TIA Portal STEP 7 V5 Proxy documentation v2.0 – the device proxy configuration reference.
- STEP 7 V5.5 Online Help: SFM block family (FB49, DB49, DB126, DB127, UDT1001, UDT1002, UDT1003) – required for any non-TIA RSE deployment.
- PROFINET Installation Guideline (PNO document 8.062 / IEC 61784-2) – for naming and IP planning referenced in the steps above.
FAQ
Why do my HMI tags work but Report System Error messages never appear on the TP700?
The standard S7 PUT/GET channel is loaded for tag polling, but the S7DOS channel unit required for diagnostic events is missing from the panel image. Rebuild the HMI device proxy by browsing the original STEP 7 V5.5 project (do not add the S7-300/400 station only via GSD), enable "Use Report System Error for this HMI device" in the HMI message configuration, and recompile so that the S7DOS channel is included in the runtime image.
Do I need STEP 7 Distributed Safety on the engineering station for FB49 on a 315F-2 PN/DP?
For the standard (non-safety) diagnostic buffer entries on the F-CPU, FB49 from the SFM library in STEP 7 V5.5 is sufficient. Safety-related F-STOP diagnostics require the S7 Distributed Safety optional package plus the S7 F-FB libraries, and they appear in a separate F-message configuration, not in the standard RSE category.
Can I keep my STEP 7 V5.5 project and still get Report System Error on a Comfort panel?
Yes. Use the HMI Device Proxy path documented in Siemens application note 73502293. Engineer the TP700 in TIA Portal V13 SP1 Update 6 (or V14/V15), point the proxy at the STEP 7 V5.5 station, place the HMI and the proxy PLC on the same PROFINET subnet, and enable the Report System Error message class on the HMI. Tag polling and RSE will both work without migrating the PLC program.
Is there a faster fix than rebuilding the proxy?
No reliable shortcut. Adding the S7-300/400 station via GSD without browsing the STEP 7 V5.5 source leaves the S7DOS channel out of the compiled panel image. A repair install of WinCC Professional or moving the engineering station off a corporate proxy may be required if the optional S7DOS package is missing from the install. The cleanest long-term fix is to migrate the S7-300/400 project to TIA Portal so the proxy is no longer required.
Why does RSE work in WinCC Flex 2008 but not in WinCC Comfort/Professional?
WinCC Flex binds directly to a STEP 7 V5 project and loads the S7DOS channel unit by default. WinCC Comfort/Professional, when used with a STEP 7 V5.5 PLC, requires the Device Proxy and an explicit "Use Report System Error" setting. If the proxy path cannot be stabilized, you can load a WinCC Flex 2008 SP3 runtime image onto the same TP700 Comfort hardware; both runtimes are supported on this panel.