Detecting ET200M Module Failures in S7-400H Profibus-DP Networks

Overview

Distributed I/O diagnostics on a SIMATIC S7-400H redundant controller talking to ET 200M stations over PROFIBUS DP requires more than passive error LEDs. When an IM 153-2 backplane loses a signal module, inserts a wrong module, or drops off the bus, the DP master must classify the event, localize the slot, and (in an H system) decide whether the active or standby CPU owns the diagnostic record. This reference covers the three practical detection paths that engineers actually deploy in S7-400H cells:

1. Evaluation of OB86 local-temp variables for rack/station faults.
2. Cyclic reading of DP slave diagnostic data with SFC13 DPNRM_DG.
3. Use of the Siemens diagnostic blocks FB125 and FC125 from entry ID 387257, which decode the standard PROFIBUS diagnostic frame and expose slot-level, module-level, and channel-level status to user code and to WinCC flexible / ProTool message screens.

The same toolchain applies to single-CPU S7-400 and S7-300 masters; the H-specific constraints (master/standby, master-master changeover, redundant DP) are called out in dedicated sections below.

System Architecture and Addressing

A typical S7-400H PROFIBUS-DP cell with ET 200M islands consists of:

• Two CPU 417-4H controllers, each with a DP master port (X1 or X2 depending on slot configuration) configured for PROFIBUS DP and synchronized over fiber-optic sync modules.
• One or more ET 200M stations built around the IM 153-2 interface module (6ES7153-2BA02 / -2BB00 / -2BA10 / -2BA70 / -2BA82 depending on feature set). The IM 153-2 is the PROFIBUS DP slave side; it accepts up to 8 or 12 signal modules depending on variant.
• Diagnostic addresses that are unique per station. Each ET 200M rack occupies a single PROFIBUS station address (for example, station 8 and station 9) but its slots are mapped inside the station's process image and its diagnostic address is the DP slave's logical base address.

The IM 153-2 operating instructions (see ET 200M Operating Instructions, edition 06/2009 or later) define the diagnostic buffer structure that FB125 parses. When you parameterize the IM 153-2 in HW Config, set:

Detection Path 1: OB86 Local-Temp Variables

OB86 (Rack failure / station failure OB) fires whenever a DP master detects a station come, go, or change event. The startup information gives you the DP master system ID, the station number, the event type, and the slot for module-level events.

Key local-temp bytes (OB86_START_INFO) per the S7-300/400 System and Standard Functions manual:

For a basic class-of-fault indicator, evaluate OB86_FLT_ID in OB86 and copy OB86_MDL_ADDR and slot information into a global diagnostic flag block. This delivers a low-latency, event-driven indication that the rest of the application can latch without polling PROFIBUS.

Detection Path 2: SFC13 DPNRM_DG

SFC13 DPNRM_DG reads the standard PROFIBUS DP diagnostic frame of a slave in compliance with EN 50170. It works on both S7-300 and S7-400 masters, including the active master in an H system. Inputs and outputs:

Recommended approach in an S7-400H cell: schedule a low-priority OB1 (or OB35 cyclic) call that cycles through the configured diagnostic addresses, calling DPNRM_DG only when BUSY of the previous call is 0. Decoding the resulting buffer by hand is tedious (you must walk the ID-related diagnostic block at offset 6, parse module status bit-by-bit, and decode channel-specific diagnostics at offset 12+). This is exactly the pain that FB125 removes.

Detection Path 3: FB125 and FC125

The Siemens-supplied block pair is the de-facto standard for ET 200M diagnostics in STEP 7 classic projects:

Installation

1. Download the package from Siemens Support entry 387257 (search title: "Function block for PROFIBUS DP diagnostics / FB125, FC125").
2. Unzip into a working directory and open the included STEP 7 project (or copy the STL sources into your project).
3. Open your S7 program, right-click the Blocks folder, and import the S7 library. The package ships FB125, its associated DB (DB125), the UDTs for the diagnostic structures, and example OB calls.

OB Calls Required

FB125 must be called in all three OBs the DP slave state machine can fire into:

• OB1 (or OB35) — cyclic polling, captures the standard diagnostic frame between events.
• OB82 — module diagnostic interrupt (analog cards, smart cards, channel faults).
• OB86 — rack/station failure & return.

Failing to wire all three OBs leads to silent loss of state transitions: a module that goes from "diagnostic pending" to "module removed" will not surface in DB125 unless OB86 also calls the block.

FB125 Interface (condensed)

Wire the output UDT to your HMI message system, your plant historian, and a maintenance-page bit. Reset NEW_DIAG with a positive edge from the operator "acknowledge" button.

Encoding Channel Error Codes

When FB125 surfaces a channel-level fault, the upper three bits of ERROR_CODE indicate the error type per EN 50170 / IEC 61158-6:

Map this to a human-readable string in your HMI rather than shipping raw bit fields to the operator.

S7-400H-Specific Behavior

Three constraints dominate diagnostics on a CPU 417-4H redundant pair:

1. Standby CPU does not run OB82/OB86 by default. The standby CPU copies the master's memory areas but does not execute user program. It receives DP diagnostic events only via the link-up and master-master changeover. You cannot rely on standby-side OBs to feed your historian.
2. Master-master changeover (H-system failover) fires OB86 with OB86_FLT_ID = W#16#3904. When OB86 fires with that event, both CPUs mark the DP diagnostic state of the previously-active CPU as "stale". Call FB125 in OB86 to re-initialize DB125 after a changeover; otherwise NEW_DIAG will report events that belong to the pre-failover period.
3. Redundant ET 200M pairs (two IM 153-2 in the same rack, switched via Y-Link) require Y-Link-aware diagnostics. The Y-Link itself reports as one PROFIBUS station; the two ET 200M backplanes appear as sub-slots. FB125 with slot routing set in HW Config will resolve sub-slots, but you must extend DIAG_ADDR to the Y-Link's logical base address and verify the slot mapping against the Y-Link manual.

Module Replacement During Operation (Hot-Swap)

ET 200M supports pulling and inserting modules while the backplane is powered, provided the IM 153-2 supports "Module replacement during operation" and the function is enabled in HW Config. From the TIA Portal help: Configuration of the 'Module replacement during operation' function:

1. Right-click the IM 153-2 in the device view and open Properties > Module parameters > General.
2. Enable Module replacement during operation (also called Module swapping without PG).
3. Configure the slot from which modules may be replaced. Out of the box, the IM 153-2 reserves slot 0 for itself; slots 1..12 accept field modules. Reserved slots cannot be hot-swapped.
4. If required, configure the substitute module type per slot. The IM 153-2 verifies the inserted module against the configured type and either accepts the replacement silently (configured substitute) or raises a diagnostic interrupt (incorrect type).

Diagnostic flow during hot-swap:

1. Operator pulls a module → OB82 fires with module-removed diagnostic.
2. FB125 decodes SLOT_NUM and MODULE_TYPE and sets NEW_DIAG.
3. Operator inserts replacement → OB82 fires again with module-inserted diagnostic.
4. FB125 clears the per-slot fault and the new module's process image updates.

If the IM 153-2 reports the new module as type mismatch, the slot stays in diagnostic state and the process image of the slot is zero. Use this to alarm the operator that the wrong spare was inserted.

Response Monitoring Behavior

The IM 153-2 ships with response monitoring enabled. When the DP master fails or the bus is broken, the ET 200M outputs follow the configured fallback strategy:

• Response monitoring ON (default): outputs go to a safe state (typically 0) within the configured watchdog time (default 100 ms, configurable from 10 ms to 600 s).
• Response monitoring OFF: outputs hold their last value on a DP master failure. This is permitted by the IM 153-2 manual and is sometimes used in continuous-process applications where brief bus interruptions must not perturb the plant, but it must be enabled with a clear process-safety justification.

Cross-reference: ET 200M Operating Instructions, section on response monitoring.

Commissioning Procedure

1. In HW Config, configure the ET 200M station and set a unique diagnostic address in the DP slave properties. Note the address in the project documentation.
2. Enable Slot routing on the IM 153-2 (this is required for FB125 to deliver slot numbers).
3. Install FB125 / FC125 in the S7 program. Confirm DB125 is generated automatically when FB125 is first compiled.
4. Call FB125 in OB1, OB82, and OB86 with the correct DIAG_ADDR for each DP slave. In H systems, install on the active-master side only.
5. Compile and download.
6. Force a test event: pull a DI module, observe OB86 fire, confirm NEW_DIAG in DB125, confirm the slot number on the HMI. Re-insert the module, confirm NEW_DIAG clears and the process image updates.
7. Trigger a bus fault by unplugging the PROFIBUS connector. Confirm OB86_FLT_ID = W#16#3901 and that the operator screen reflects the station as failed.
8. In H systems, force a master-master changeover. Confirm OB86 fires with W#16#3904, confirm DB125 is re-initialized, confirm the new active master takes ownership of DP diagnostics.

Troubleshooting Matrix

Parameter Checklist (Print and Tape Inside the Cabinet Door)

• DP master interface: X1 of CPU 417-4H, PROFIBUS DP, baud 1.5 Mbit/s unless long trunks require 187.5 kbit/s.
• Bus terminators: ON at both physical ends, OFF on all intermediate stations. Use active RS-485 terminator element 6ES7972-0DA00-0AA0.
• IM 153-2 PROFIBUS address: unique, set with DIL switch on the module, must match HW Config.
• Diagnostic address: in slot 0 of the IM 153-2 properties; record the value in the HMI tag list.
• Watchdog: 100 ms default; increase to 300 ms for noisy plants, never above the process-safety limit.
• Slot routing: enabled (required for FB125).
• Module replacement during operation: enabled (operator-friendly, recommended).
• Response monitoring: ON unless process-safety review authorizes OFF.

Frequently Asked Questions