Detecting PROFINET IO Device Failure on S7-1200 with G120 Drives

Problem Overview

When a SINAMICS G120 inverter equipped with a CU230P-2 PN Control Unit drops off PROFINET, an S7-1200 CPU does not automatically raise the user-defined reaction in the application program. Many integrators wire OB40 (hardware interrupt), OB82 (diagnostic error interrupt), and OB86 (rack/station failure) into the project expecting the cyclic OB1 program to be notified the moment the drive becomes unreachable, but the OB does not trigger and the diagnostic buffer lists "IO device failure - IO device not found" while the application keeps running with stale process data. The PLC and the drive exchange PROFINET IRT frames every millisecond, and TIA Portal exposes this loss in the diagnostic buffer, the LED indicators, and the DeviceStates function block, yet no OB fires because none of the project OBs of the corresponding class are loaded.

The three failure-handling OBs for PROFINET on S7-1200 (firmware V4.0 and later) are OB82 for diagnostic alarms, OB83 for module pull/plug events, and OB86 for station failure / station return. OB86 is the primary mechanism for the case where the G120 power section is de-energized, the PROFINET cable is broken, or the device name is missing - any condition that prevents the controller from reaching the drive at all. Until the OB is created in the project, the CPU does not have a routine to run and the system cannot react. This article walks through configuring OB86, complementing it with the DeviceStates function block, and adding OB82 for in-telegram diagnostic alarms coming from the drive itself.

Why OB82 and OB86 Do Not Fire on S7-1200

The S7-1200 CPU only calls an OB if that OB exists in the project. There is no implicit OB86, OB82, OB83, OB121, or OB122 like on a S7-1500 with default empty bodies - the engineer must explicitly add each one. Three other conditions also suppress OB execution on a CPU 12xx:

• CPU in STOP at startup. If the IO device failure occurs before the CPU leaves the startup phase, the diagnostic buffer records the event but OB86 is not called because the OB engine has not yet been started. The same behavior occurs on a warm restart. Add OB100 (warm restart) and OB101 (cold restart) so the application initializes the drive presence flag at the very first cycle.
• CPU firmware below V4.0. OB82 and OB86 were added to the S7-1200 line with firmware V4.0 (CPU 1211C/1212C/1214C/1215C/1217C and the 1212FC/1214FC/1215FC fail-safe variants). On V3.x firmware, the system cannot raise an OB86 even if the project contains one. Check the device properties in TIA Portal - the firmware version is shown under "Properties > General > Catalog Information".
• PROFINET interface disabled or device name missing. The G120 CU230P-2 PN must have a PROFINET device name that matches the configured name in the TIA Portal project. If the G120 was commissioned with the SINAMICS Starter or Startdrive tool and the device name was changed after the last TIA Portal download, the controller treats the drive as a different device and reports "IO device not found" with a station number mismatch. OB86 does still fire, but with OB86_FLT_ID = B#16#C4 and OB86_MDL_ID = 0, which can be confusing.

The "IO device failure - IO device not found" diagnostic buffer entry on S7-1200 firmware V4.4 (and later) carries event ID 0x013C. Older firmware shows it as event ID 0x02A1 with the same root meaning. The diagnostic buffer entry by itself does not invoke an OB; it is the underlying PROFINET stack that calls OB86 when the IO controller has lost all AR (Application Relationship) to the IO device. The full event is also published in the online PROFINET diagnostics under "Online & Diagnostics > PROFINET interface > Diagnostics" of the G120 device object.

Prerequisites and Engineering Environment

Before adding OBs to the project, confirm the following baseline. None of these steps is optional - skipping any of them is a documented source of "OB does not fire" complaints.

The SIMATIC S7-1200 Programmable Controller System Manual (109751634) and the SINAMICS G120 CU230P-2 PN Operating Instructions (109751320) define the standard telegrams and the parameter assignment of the PROFINET interface. The PROFINET diagnostics page (68052880) lists the standard event identifiers and how the controller maps them to OBs. Two legacy FAQs cover the S7-1200 error-handling case in detail: "How can you manage peripheral device errors detected by the S7-1200 PLC" (42781105) and "How can you manage block execution errors detected by the S7-1200 PLC" (42908460).

OB Architecture and Priority Classes on S7-1200

OB86, OB82, OB83, and OB40 all run at the same fixed priority (priority class 16, OB-number priority 9) on a S7-1200. They cannot interrupt each other: while OB86 is executing, an incoming diagnostic alarm is queued and raised after OB86 returns. The firmware queues a single pending event per OB class; if two stations fail in rapid succession, the second failure overwrites the first and is reflected only in the diagnostic buffer. This is acceptable for a G120 that drives a fan or pump (the application only needs a boolean "drive reachable" flag), but it is not sufficient if every station must be reported individually. The standard solution is to use DeviceStates inside OB1 to obtain a 32-bit status mask that captures the state of up to 32 IO devices in a single call.

For a G120 application, the two OBs that matter are OB86 (loss of the IO device) and OB82 (incoming diagnostic alarm from a sub-module, e.g. PROFIsafe channel fault or encoder wire break on a CU240 PN). They have different scopes: OB86 tells the application that the entire drive is unreachable, OB82 tells the application that the drive is reachable but a sub-slot has reported a channel-level diagnostic alarm. Skipping OB82 means missing any internal fault that the drive reports via the standard PROFINET diagnostic record 0x000A (channel diagnostics). The S7-1200 OB priority overview is documented in section "Organization blocks" of the System Manual (109751634).

Creating OB86 in TIA Portal

Open the S7-1200 device in the project tree, right-click "Program blocks", and select "Add new block > Organization block > OB86 - Rack or station failure". The wizard inserts an empty OB86 with the standard temporary tags shown below. Leave the default priority (16) and do not add an OBs in an OB-startup OB100 - that combination is illegal in S7-1200 firmware 4.x and forces the CPU to STOP.

The default temporary tags of OB86 are:

The following SCL body in OB86 raises a global flag and a non-retentive tag of the same value so the cyclic program can read the failed logical address without re-decoding the OB-start info on every scan:

// OB86 - Rack or station failure (S7-1200)
// Triggered when a PROFINET IO device is unreachable or returns

IF #OB86_EV_CLASS = B#16#38 THEN          // Event entering (failure)
    IF #OB86_FLT_ID = B#16#C4 THEN         // Station failure
        "G120_FailurePending" := TRUE;
        "G120_LastFailedAddress" := WORD_TO_INT(#OB86_MDL_ADDR);
        "G120_LastEventTime" := #OB86_DATE_TIME;
    END_IF;

ELSIF #OB86_EV_CLASS = B#16#39 THEN       // Event leaving (return)
    IF #OB86_FLT_ID = B#16#C5 THEN         // Station return
        "G120_FailurePending" := FALSE;
        "G120_RestoredAddress" := WORD_TO_INT(#OB86_MDL_ADDR);
        "G120_LastEventTime" := #OB86_DATE_TIME;
    END_IF;

END_IF;

Using the DeviceStates Function Block

OB86 is event-driven and only reports a single failure at a time. To obtain a complete map of every PROFINET device in a single call, the application should use the DeviceStates instruction located at "Instructions > Communication > PROFINET" (TIA Portal V16 and later) or under "Extended instructions > Distributed I/O" in earlier versions. The block returns a 32-bit word where each bit corresponds to a configured PROFINET device. Bit n is set when the device whose PROFINET interface address (the IO device number) is n is in the requested state.

DeviceStates has four input/output parameters:

The typical pattern is to call DeviceStates with MODE = 2 once per OB1 cycle and OR the result with a sticky tag so a transient dropout lasting only a few cycles is still captured. The G120 is usually device number 1 (PROFINET device index 0 in the state mask corresponds to device number 1, so the bit index is device number - 1).

// "PRN_State" is a global data block (DB) with:
//   G120_Failed      : BOOL   - sticky failed flag
//   G120_FailedNow   : BOOL   - transient flag for this cycle
//   G120_Available   : BOOL   - sticky available flag
//   Error            : BOOL   - DeviceStates returned an error
//   RawStateDword    : DWORD  - raw DeviceStates return

IF "PRN_State".Error THEN
    "PRN_State".Error := FALSE;
END_IF;

// Query failed devices (MODE = 2)
"DeviceStates_1"(
    LADDR  := 0,
    MODE   := 2,
    RET_VAL := "PRN_State".Error,
    STATE  := "PRN_State".FailedArray
);

// Query available devices (MODE = 1) - optional sanity check
"DeviceStates_2"(
    LADDR  := 0,
    MODE   := 1,
    RET_VAL := "PRN_State".Error,
    STATE  := "PRN_State".AvailableArray
);

// G120 is IO device #1, so its bit is index 0 in the array
"PRN_State".G120_FailedNow := "PRN_State".FailedArray[0];

IF "PRN_State".G120_FailedNow THEN
    "PRN_State".G120_Failed := TRUE;
ELSE
    "PRN_State".G120_Available := TRUE;
END_IF;

OB82 Diagnostic Error Interrupt Handling

OB82 fires when an IO device sends a PROFINET diagnostic alarm. The G120 CU230P-2 PN raises channel diagnostics whenever the power module reports an overtemperature, the encoder reports a wire break, or the safety channel reports a PROFIsafe fault. The OB82 standard temporary tags include the channel number, the I/O logical address, and the channel fault ID. The OB is called twice: once when the fault appears (event class B#16#38) and once when it clears (B#16#39).

The body in OB82 should:

1. Check OB82_FLT_ID: B#16#42 = module fault, B#16#43 = module OK, B#16#44 = channel fault present, B#16#45 = channel fault gone.
2. Read OB82_MDL_ADDR to identify the affected G120 logical base address.
3. Read the channel-specific diagnostic data using SFB 52 (RDREC / RALRM) to extract the PROFIdrive channel diagnostic record 0x000A. The record contains a 32-bit channel properties word and a 16-bit channel error number; on a G120, error number 0x0001 means channel 1 of the safety module is in the fault state.
4. Copy the structured data into a global DB so the HMI can display the diagnostic text.

// OB82 - Diagnostic error interrupt (S7-1200)
// Triggered when the G120 reports a channel-level diagnostic alarm

IF #OB82_EV_CLASS = B#16#38 THEN          // Fault entering
    CASE #OB82_FLT_ID OF
        B#16#42:                           // Module fault
            "Diag".LastModuleFaultAddr := WORD_TO_INT(#OB82_MDL_ADDR);
        B#16#44:                           // Channel fault present
            "Diag".LastChannelFaultAddr := WORD_TO_INT(#OB82_MDL_ADDR);
            "Diag".ChannelFaultPending := TRUE;
        ELSE
            "Diag".OtherFaultPending := TRUE;
    END_CASE;

    // Read the standard diagnostic record 0x000A (16-byte channel diagnostic)
    "RDREC_DB"(REQ := TRUE,
               ID  := #OB82_MDL_ADDR,
               INDEX := 16#000A,
               MLEN := 16,
               VALID => "Diag".RecValid,
               LEN  => "Diag".RecLen,
               ERROR => "Diag".RecError,
               STATUS => "Diag".RecStatus,
               RECORD := "Diag".ChannelDiag);

ELSIF #OB82_EV_CLASS = B#16#39 THEN       // Fault leaving
    "Diag".ChannelFaultPending := FALSE;

END_IF;

The legacy FAQ "How can you manage peripheral device errors detected by the S7-1200 PLC" (42781105) walks through the same RDREC pattern with a complete SCL example that you can drop into the project. Use it together with the standard RALRM instruction in OB82 if you need the full slot-level diagnostic data, including the slot, sub-slot, channel, and direction (incoming / outgoing).

Combined Code Example: Full Fault Reaction in OB1

Once OB86 and OB82 are loaded and DeviceStates is called once per cycle, the cyclic program can implement a controlled fault reaction. The typical pattern in a fan or pump application is to coast the G120 by clearing the control word bit 0 (OFF1) the moment the drive is unreachable, raise a group fault, and switch the HMI status to "G120 not reachable".

// OB1 cyclic body - fault reaction for unreachable G120

// 1. If OB86 or DeviceStates reported the G120 as failed,
//    clear the process output bit for the drive control word bit 0 (ON/OFF1).
IF "PRN_State".G120_Failed OR "Diag".ChannelFaultPending THEN
    // Force STW1.0 = 0 (coast to stop) and STW1.3 = 0 (no enable).
    // Use the PQW base address of the G120 telegram.
    "G120_STW1" := "G120_STW1" AND (WORD#16#FFFF AND (NOT WORD#16#0001));
    "G120_STW1" := "G120_STW1" AND (WORD#16#FFFF AND (NOT WORD#16#0008));

    "PRN_State".DriveCommandedOff := TRUE;
ELSE
    "PRN_State".DriveCommandedOff := FALSE;
END_IF;

// 2. Edge-triggered HMI alarm on rising edge of the failed flag
IF "PRN_State".G120_Failed AND NOT "PRN_State".G120_FailedOld THEN
    "HMI".AlarmBit_G120Missing := TRUE;
END_IF;
"PRN_State".G120_FailedOld := "PRN_State".G120_Failed;

// 3. Optional: call GetError / GetErrorID to recover gracefully
//    from any I/O access error on a missing PQW
IF "Diag".RecError THEN
    "GetErrorInstance"(ERROR := "Diag".LastErrorInfo,
                       ID    := "Diag".LastErrorID);
END_IF;

The companion FAQ "How can you manage block execution errors detected by the S7-1200 PLC" (42908460) provides the GetError and GetErrorID SCL examples used in the last block. Pairing OB86 with GetError is the only safe way to access a process output word on a missing IO device; without it, a read of the PQW inside OB1 raises an I/O access error and - if OB122 is not present - drives the CPU to STOP.

Verifying the Configuration

After downloading the project, the configuration must be verified in three places: the online device view, the diagnostic buffer, and a deliberate drop-and-reconnect test. None of these checks is optional.

1. Online > Diagnostics > PROFINET > Topology. The G120 must show "OK" and the PROFINET device name must match the project. If the name field is empty, OB86 will fire the first time the controller ARMs the AR, then never again until the project is downloaded. Open the G120 in the project, set the device name in the Properties > Ethernet addresses tab, and assign it via the online function "Assign PROFINET device name".
2. Online > Diagnostics > Diagnostic buffer. Before pulling the cable, the buffer should be empty (or contain only cleared entries). The PROFINET interface should be in "Operational" state. The error LED on the G120 should be OFF.
3. Drop test. With the project running, pull the PROFINET cable at the G120 end. Within one PROFINET update cycle (default 1 ms for IRT, 2 ms for RT), the controller should report "IO device failure" in the diagnostic buffer with event ID 0x013C, OB86 should fire once with OB86_FLT_ID = B#16#C4 and OB86_MDL_ADDR = <G120 logical base address>, and the global tag PRN_State.G120_Failed should remain TRUE. Reconnect the cable; OB86 fires a second time with OB86_FLT_ID = B#16#C5, and the global tag clears.
4. DeviceStates sanity check. Force the project online, open the watch table, and read PRN_State.FailedArray[0] while the cable is disconnected. It must be TRUE. Reconnect and confirm it returns to FALSE within one PROFINET update cycle.
5. OB82 channel alarm test. Force a G120 fault using Startdrive (e.g. simulate a "Speed controller output limited" alarm by setting p2177). OB82 should fire with OB82_FLT_ID = B#16#44 and the channel diagnostic record should report the corresponding channel number and error code.

Troubleshooting Matrix

Field-Engineering Checklist

Use this checklist before site acceptance testing:

• OB82, OB83, OB86, OB100, OB101, OB121, OB122 are all present in the project with non-empty bodies.
• DeviceStates is called at least once per OB1 cycle with MODE = 1 (available) and MODE = 2 (failed).
• The G120 PROFINET device name is assigned from TIA Portal and matches the project name.
• The G120 telegram is set to standard telegram 1 (or 350/352 if the application uses the extended PROFIdrive channel).
• Watch tables PRN_State and Diag are pinned and reviewed during commissioning.
• HMI alarm "G120 unreachable" is configured with the failed tag and acknowledged via OB86 station return.
• Diagnostic buffer is cleared before final SAT; the next "IO device failure" entry must be the deliberate drop test.

For redundant S7-1500R/H systems, the same principle applies but the OB86 instance is raised against the backup controller first; the official SIMATIC S7-1500R/H manual collection describes this in "Application planning > Failure scenarios > Failure of an IO device in the PROFINET ring" at docs.tia.siemens.cloud. The S7-1200 has no redundant PROFINET interface and is treated as a single-controller system, so the simpler OB86 + DeviceStates pattern is sufficient.

FAQ