Decoding S7-300 CPU 317-2 PN/DP Diagnostic Buffer Hex Event IDs

A Siemens SIMATIC S7-300 CPU 317-2 PN/DP (order number 6ES7317-2EK14-0AB0 and earlier -AB0/-AK04 variants) maintains a non-volatile diagnostics buffer of up to 500 entries in its system data area. When the engineering station cannot resolve a hex event ID into a text message, the entry is rendered as "No entry in text database. Hexadecimal values will be displayed." This typically occurs when (a) the STEP 7 / TIA Portal version installed on the programming device does not contain a description for the firmware event class, (b) a custom application wrote a raw event using SFC 52 "WR_USMSG" without registering a corresponding text, or (c) the diagnostic interrupt originated from a PROFIBUS-DP slave whose GSD text is not loaded in the project. The first case is the most common in plants still running STEP 7 V5.5 against newer CPU firmware.

This reference decodes a real-world trace recorded on a CPU 317-2 PN/DP controlling an ET 200S distributed I/O station, explains the meaning of each hex field, and walks through the field-proven recovery sequence: power-cycle the failing DP station, replace the station if power cycling is not durable, and re-baseline the diagnostic buffer to confirm the fix.

1. Reading the Diagnostic Buffer

The diagnostics buffer is read online from the connected CPU. The procedure differs slightly between classic STEP 7 V5.x and TIA Portal but the underlying data record is identical.

1.1 STEP 7 V5.5 (classic)

1. Open the SIMATIC Manager project containing the S7-300 station.
2. Right-click the CPU 317-2 PN/DP in the component view and choose "Target System > CPU Messages > Diagnostics Buffer", or use the menu PLC > Diagnostics/Settings > Diagnostics Buffer.
3. Set the time format to the plant's local time (the buffer stamps events in CPU real time, not PC time).
4. Export the buffer to a .txt or .csv file using File > Save As for archival and ticket attachments.

1.2 TIA Portal V16 - V20

Connect online to the device, expand Online & Diagnostics, open the Diagnostics folder, and double-click Diagnostics buffer. The official Siemens procedure is documented at docs.tia.siemens.cloud — Reading out the diagnostics buffer of a CPU.

2. Anatomy of a Diagnostic Buffer Entry

Each entry in the buffer carries the following fields. The reference trace below is taken from the original fault.

3. Decoding the A1Fx Event ID Family

On S7-300/400 CPUs the diagnostics buffer uses a hierarchical 16-bit event ID. The high byte (A1 in this trace) identifies the event class; the low byte identifies the specific event within that class. Event class A1 is reserved for PROFIBUS-DP / PROFINET diagnostic interrupts raised by the CPU's integrated DP master / PN controller when processing a slave diagnostic frame.

The events captured in the reference trace are reconstructed below in chronological order (older events at the bottom):

Pattern analysis: at 09:48:56.655 the slave first issues a status interrupt (A1F6) followed by an update interrupt (A1F7) and a vendor interrupt (A1F8), all carrying the same DatID 16#59C9. About 1.3 seconds later the CPU raises the OB 82 incoming diagnostic interrupt (A1F1), and roughly 1.6 seconds after that the OB 82 going event (A1F2) with a different Additional info 1 (16#0002 instead of 16#000D) is registered. This sequence is the textbook signature of a DP slave briefly losing bus communication, the internal IM 151 re-establishing the link, and the OB 82 diagnostic interrupt being raised and then cleared.

4. Decoding DatID 16#59C9

The 32-bit DatID is split into two 16-bit halves. For PROFIBUS-DP events raised by the integrated DP master of the CPU 317-2 PN/DP, the high word is the slot / channel identifier class and the low word is the device-specific error code.

• High word 16#0059 — slot 89 (decimal). On a 1-slot IM 151-1 this is the interface module itself; on a multi-slot ET 200S it points to a power module (PM-E) or the IM 151 head. Slot 89 also matches the address of the first DO/DI module in many default ET 200S configurations.
• Low word 16#00C9 — 201 decimal. In the Siemens DPV1 diagnostic data set this code corresponds to "Station diagnostic: short circuit / overload on the backplane bus or on a module supply".

5. Decoding Additional Info Fields

So the trace reads, in plain English: "A diagnostic interrupt was raised by ET 200S slot 89, channel 3: first a short circuit (16#000D) was reported; roughly two seconds later the same channel reported an overload (16#0002) which then cleared."

6. Why STEP 7 Cannot Resolve the Text

Three technical reasons produce the "No entry in text database" message:

1. STEP 7 version older than the CPU firmware. The CPU 317-2 PN/DP ships firmware V3.x. The text database for class A1 (DP diagnostic) was last extended in STEP 7 V5.5 + SP4 + HF7. STEP 7 V5.4 cannot resolve A1F6 / A1F7 / A1F8 because those event codes were introduced in a later DP master firmware build.
2. Missing GSD file for the slave. The text shown when DatID 16#59C9 is decoded includes a reference to the module's GSD revision. If the project was built with a GSD that pre-dates the installed ET 200S IM 151 firmware, the text lookup fails.
3. Application called SFC 52 "WR_USMSG" without a registered text. The user's own program wrote a user diagnostic entry to the buffer using SFC 52 with EventID = W#16#A1F2 etc., bypassing the system text database. SFC 52 allows arbitrary 16-bit EventIDs in the range 16#A000 - 16#AFFF for user-defined messages; if no text is registered for that ID in the CPU's user text library the buffer shows the raw hex.

7. SFC 52 "WR_USMSG" — Anatomy and Risk

SFC 52 "WR_USMSG" is the system function used to write a user-defined diagnostic buffer entry. Its signature is:

// SFC 52 - WR_USMSG - Write user element in diagnostic buffer
// Block number: 52
// Family: Base S7-300/400 system function

VAR_INPUT
  REQ     : BOOL;   // FC 0/1: write on rising edge
  EVENTID : WORD;   // Event ID, e.g. W#16#A1F2
  OB_NUMBER: INT;   // OB number active at time of call (e.g. 1)
  BUFFER  : ANY;    // Pointer to data buffer with additional info
  DATA_LEN: INT;    // Length of data buffer in bytes
END_VAR

When called from OB 1 (as in the captured trace) the parameters OB_NUMBER = 1, EVENTID = W#16#A1F2, and the data buffer filled with 16#0002 0000 0003 produce an entry that is visually indistinguishable from a genuine DP diagnostic interrupt. Operators reading the buffer later cannot tell whether the message came from the DP master or from the user program. This is a common maintenance trap.

8. Field-Proven Root Cause and Recovery

8.1 Initial power-cycle fix

Removing and re-applying the 24 V supply to the ET 200S head module (IM 151-1, order number 6ES7151-1AA04-0AB0) forces the station to re-enumerate on the bus. The CPU's DP master detects the station again, clears the OB 82 diagnostic interrupt, and writes the A1F2 going event to the buffer. This explains why the operator saw a self-healing recovery the first time the fault occurred.

8.2 Recurrence and final fix

When the same station failed a few hours later with BF (bus fault) and SF (system fault) LEDs blinking together on the CPU, a power cycle was no longer sufficient. The combination of BF + SF on a CPU 317-2 PN/DP points to a permanent DP slave failure that the master cannot recover automatically. The corrective action was to replace the entire ET 200S station (head module + power module + I/O modules) and re-terminate the PROFIBUS connector at the upstream T-piece. After replacement the diagnostic buffer remained clean.

9. Step-by-Step Recovery Procedure

1. Export the diagnostics buffer to a file before any change. Use PLC > Diagnostics/Settings > Diagnostics Buffer in STEP 7 V5.5 or the online diagnostics view in TIA Portal.
2. Decode the Event ID, DatID, and Add1/Add3 using the tables in Sections 3-5 of this article. Build a chronological timeline in a spreadsheet.
3. Identify the failing slave by looking at the DP diagnostics structure in the buffer; the slot field (Add3 or low byte of DatID1) maps to the slot number configured in the DP slave properties.
4. Inspect the slave physically: 24 V supply at PM-E terminals, PROFIBUS connector screws, terminating resistor position (ON only at the two physical ends of the bus segment), and any channel that Add3 pointed to.
5. Measure the backplane current on the ET 200S station. ET 200S supports up to 5 A of 24 V backplane load; an overloaded PM-E will drop out and cause the symptoms seen above.
6. Power-cycle the station by removing and re-applying 24 V to the PM-E. Observe whether the buffer registers a clean A1F2 going event.
7. If the fault returns, replace the entire ET 200S station rather than individual modules. The A1F8 vendor interrupt with DatID 16#59C9 typically indicates internal power-supply degradation of the head module, which is not reliably field-repairable.
8. After replacement, force an OB 82 scan by issuing PLC > Clear/Reset > Diagnostic Buffer or by performing a CPU restart (RUN -> STOP -> RUN). Monitor the buffer for at least 24 hours.

10. Verification Checklist

11. Preventive Measures

1. Keep STEP 7 and TIA Portal up to date. Install the latest Hotfix for STEP 7 V5.5 or upgrade to TIA Portal V18 / V19 / V20. The diagnostic text database is refreshed with each service pack.
2. Install the latest GSD files for every PROFIBUS slave in the project. Re-import the GSD whenever the IM 151 or PM-E is replaced with a newer firmware revision.
3. Size the PM-E correctly. Sum the worst-case 24 V consumption of every downstream module and derate by 25%. If the sum exceeds 5 A, add a second PM-E segment.
4. Use a dedicated 24 V power supply for the ET 200S stations rather than daisy-chaining off the CPU's sensor supply. Voltage drop under a short event is the most common cause of the A1F8 + 16#000D signature.
5. Reserve the A1Fx event ID range for the operating system and use a different range (e.g. 16#A101 - 16#A1FF mapped via SFC 52) for application messages.
6. Enable OB 82 and OB 86 in the CPU's hardware configuration. Without OBs the CPU will go to STOP on a DP diagnostic interrupt, masking the root cause.
7. Add a periodic diagnostic buffer dump to the maintenance routine: a SFC 59 / SFB 4 transfer of the buffer to a CSV file on the engineering station every 7 days.

12. Cross-Reference: S7-300 vs S7-1500 Diagnostics

On an S7-1500 CPU the diagnostics buffer uses a similar 16-bit event ID, but the A1xx class has been restructured. PROFINET IO diagnostic events in S7-1500 use class 0xA0xx and are resolved automatically from the GSDML. If the application is being migrated, the S7-300 trace in this article maps to the following S7-1500 event IDs:

The decoding logic for the DatID and Additional info fields differs; refer to the S7-1500 system diagnostics manual (Siemens entry ID 109478691) when migrating.

FAQ