Detecting S7-400 PROFIBUS DP Slave Communication Loss for CEMAT

Detecting S7-400 PROFIBUS DP Slave Communication Loss for CEMAT Alarms

When a Siemens SIMATIC S7-400 PLC loses its distributed I/O over PROFIBUS DP — typically because of a power-supply failure on the DP slave, a disconnected bus cable, or a failed slave station — the CPU reports the event through a family of error and diagnostic organization blocks (OB82, OB85, OB86, OB87, OB122). Each OB exposes a standardized set of start information that lets user logic latch a per-slave fault bit, which can be forwarded to the SIMATIC CEMAT operator system as a documented alarm. This reference covers the four practical ways to detect a DP-slave failure on an S7-400 (PROFIBUS DP and PROFINET IO), the start-information fields you must evaluate, the code patterns for each method, and the recommended approach for CEMAT integrations.

1. Problem Definition and Failure Modes

A S7-400 connected to distributed peripherals over PROFIBUS DP can lose communication in several distinct ways. Each failure type triggers a different organization block, and choosing the right OB is the first engineering decision when designing the alarm.

For CEMAT alarm purposes the most useful signal is OB86 with the diagnostic address of the failing DP slave, because it fires once on entry and once on exit, and the start information contains the logical base address of the slave that failed. This matches the architecture CEMAT expects: one bit per slave, edge-stable, set/reset from OB86 only.

2. Prerequisites and Engineering Setup

Before writing any OB code, complete the following in the SIMATIC Manager (or TIA Portal where applicable to the project vintage):

1. Open HW Config and select the DP slave that must be monitored. Note its Diagnostic Address (for example, 2035). This is the value loaded into #OB82_MDL_ADDR / #OB86_MDL_ADDR.
2. Verify that OB82, OB86 and OB87 are inserted into the S7 program (right-click the S7-400 station, Insert > S7 Block, OB82, OB86, OB87). If the OB is missing the CPU goes into STOP on the first fault.
3. Identify the PROFIBUS / PROFINET subnet number in HW Config (Properties of the DP master interface, "Network" tab). This is the value used for SFC51 INDEX.
4. Reserve a fault data block (for example DB100, DB200) sized at 1 bit per DP slave plus 1 word for the network-fault summary. CEMAT expects stable, mapped addresses for OS variables.
5. Wire the fault bits to CFC so the CEMAT chart can publish them to WinCC; see the CEMAT manual block "CEMAT_ALARM_8P" or the equivalent alarm driver in the library.

3. Method A — OB82 Channel-Diagnostic Detection

OB82 (Diagnostic Interrupt) fires when a channel or module on a DP slave reports a diagnostic event, even if the slave as a whole is still cyclic on the bus. CEMAT operators often want this separately from a full station loss, because it indicates "degraded" rather than "lost." The block's local data contains the diagnostic address of the affected module and the channel number.

3.1 OB82 Start Information

3.2 STL Implementation (OB82)

//--------------------------------------------------------------
//  OB82 – Diagnostic Interrupt
//  Latch one bit per DP-slave diagnostic address in M 91.0..M 91.7
//  2035 = example diagnostic address of slave #1 in HW Config
//--------------------------------------------------------------
A(
L #OB82_MDL_ADDR
L 2035                       // Diagnostic address of DP slave
==I
)
= #fault_1                   // Intermediate flag

A #fault_1
A(
L #OB82_EV_CLASS
L B#16#39                    // Fault incoming
==I
)
S M 91.0                     // Set M91.0 (slave 1 fault)

A(
L #OB82_EV_CLASS
L B#16#38                    // Fault outgoing
==I
)
R M 91.0                     // Reset M91.0 when fault clears
NOP 0

Repeat the same block for each DP slave. Each slave's diagnostic address becomes one set/reset pair in a dedicated data block. CEMAT OS variable mapping reads DB100.DBX0.0..DB100.DBXn.0 for slave 1..n.

4. Method B — OB86 Rack Failure / DP Slave Station Failure

OB86 is the recommended primary detector for whole-station failures. The block fires exactly once per failure entry and once per recovery, and the start information contains the logical base address of the station that failed. This is the CEMAT-preferred path because one slave in / out equals one set / reset on one bit.

4.1 OB86 Start Information

4.2 STL Implementation (OB86)

//--------------------------------------------------------------
//  OB86 – Rack / DP station failure
//  One entry, one exit, one address – one bit per slave
//--------------------------------------------------------------
A(
L #OB86_FLT_ID
L B#16#C4                    // Fault ID for DP-slave station failure
==I
)
A(
L #OB86_MDL_ADDR
L 2035
==I
)
= #dp1_fault

A #dp1_fault
A(
L #OB86_EV_CLASS
L B#16#39                    // Station failure incoming
==I
)
S DB100.DBX0.0               // Slave 1 fault bit – CEMAT reads this

A #dp1_fault
A(
L #OB86_EV_CLASS
L B#16#38                    // Station failure outgoing
==I
)
R DB100.DBX0.0
NOP 0

5. Method C — OB85 / OB87 / OB122 + SFC51 RDSYSST Polling

Where the project requires a per-channel fault bit rather than a per-station fault bit — for example, when CEMAT must report exactly which input word on a slave became invalid — use the combination of OB85 / OB87 / OB122 to wake the program and then call SFC51 (RDSYSST) to read the system state list (SZL). SZL sublist W#16#294 reports the status of every station on a PROFIBUS subnet; W#16#292 reports the same for a PROFINET IO subnet. The sublist contains one record per station with status code, vendor ID and station address.

5.1 SFC51 Parameter Mapping

5.2 STL Implementation (OB86 + SFC51)

//--------------------------------------------------------------
//  OB86 – Trigger SFC51 read on station failure
//--------------------------------------------------------------
A(
L #OB86_EV_CLASS
L B#16#39
==I
)
S M 100.0                    // "Read SZL request" flip-flop

//--------------------------------------------------------------
//  OB1 / OB35 – poll SFC51 until BUSY=FALSE, then evaluate
//--------------------------------------------------------------
CALL "RDSYSST"
REQ := M 100.0
SZL_ID := W#16#294           // PROFIBUS subnet station status
INDEX := MW 102              // Subnet number from HW Config
RET_VAL := MW 104
BUSY := M 106.0
SZL_HEADER := DB200.DBX0.0   // LENGTH_DR, N_DR
DR := P#DB200.DBX10.0 BYTE 256

A M 106.0                    // BUSY
R M 100.0                    // Clear request when done
NOP 0

5.3 Decoding the Station-Status SZL Record

Each station-status record returned by SFC51 with SZL_ID = W#16#294 is 28 bytes long. The fields used for CEMAT alarming are:

For PROFINET IO, set SZL_ID = W#16#292. The record layout differs (uses device number and slot information); see the S7-300/400 System and Standard Functions reference manual.

6. Method D — Standard FB125 / FC125 from Siemens

Siemens ships a free, ready-made standard block for exactly this task: FB125 "DP_SLAVE_DIAG" (sometimes distributed as FC125 depending on package) plus accompanying WinCC faceplates. The block encapsulates OB82 + OB86 evaluation, the SFC51 polling, and the per-slave status flags. For CEMAT projects this is the path of least engineering risk because the faceplate data block layout is already documented.

The block is delivered in the standard library "SIMATIC S7 Modulating / Standard PID Control" and on the Siemens Industry Online Support portal under entry ID 387257 (search "FB125 DP_SLAVE_DIAG"). It is free of charge, runs on CPU 41x and CPU 410-5H, and the WinCC-side includes pre-built screens for single and redundant DP slaves.

6.1 FB125 Interface

6.2 Call Pattern in OB1 / Cyclic Task

CALL "DP_SLAVE_DIAG"
MAX_SLAVE := 32
NET_NUMBER := 1
SLAVE_STATE := MW 200
RET_VAL := MW 202
FAULT := M 110.0
NOP 0

Map M 110.0 (FAULT summary) to a CEMAT message class "Communication fault – DP1" and map individual bits in MW 200 to per-slave messages. This gives operators a clear top-level alarm plus one drill-down line per slave.

7. CEMAT Alarm Mapping

CEMAT expects the alarm information to be exposed in two layers: a high-level "network fault" message that triggers from any DP failure, and one detailed message per slave. The wiring from the PLC fault bits to the CEMAT faceplate is performed in CFC.

7.1 Mapping Table

In CFC, place the standard CEMAT block CEMAT_DIAG_8P on a chart in the plant area, connect its MSG_1..MSG_8 inputs to the per-slave bits, and connect the SUMMARY_FAULT input to the OR of all eight slaves. The OS will then display the messages on the plant area faceplate with the standard CEMAT alarm colors (red = fault, yellow = warning, no color = OK).

8. Method Comparison and Selection Guide

Recommended architecture for a new CEMAT project: FB125 for per-station bits + summary + OB87 evaluation for the master-interface fault + a single CFC chart that publishes the result via CEMAT_DIAG_8P blocks. This minimises hand-written code, uses certified Siemens standard blocks, and matches the OS faceplate that ships with FB125.

9. Verification Procedure

1. Compile and download the OB82, OB86, OB87 blocks, the SFC51 call (if used), and the fault DB to the S7-400.
2. Online view: open the OB86 in STEP 7 with "Monitor" — verify the temporary variables OB86_FLT_ID and OB86_MDL_ADDR populate when you power-cycle a DP slave.
3. Force the fault bit on a slave that is actually present to confirm the OS message appears in WinCC with the correct color and class.
4. Power-down test on one ET200S / ET200M / DP slave — confirm the corresponding fault bit sets, the CEMAT faceplate shows "Faulted," and the OS message arrives with the right instance name.
5. Restore test — re-energise the slave and confirm the bit resets automatically without operator intervention (OB86 outgoing event).
6. Bus-cable disconnect test — pull the PROFIBUS connector at the slave. Confirm OB86 fires and that the OS message arrives within one DP cycle (typical cycle on a 1.5 Mbit/s segment with 16 slaves = 5–10 ms; CPU-side detection latency on S7-400 firmware V5 = 10–20 ms).
7. Master-interface fault simulation — unplug the master DP module. Confirm OB87 fires and the summary "DP network fault" message appears.
8. Diagnostic-buffer inspection: in STEP 7, PLC > Diagnostic Buffer. Each DP-slave loss should be logged with an "OB86 – Rack failure / DP station failure" entry and the diagnostic address.

10. Troubleshooting Matrix

11. Performance and Timing Considerations

OB86, OB82 and OB87 are interrupt OBs with priority 26 (OB82), 26 (OB86), 26 (OB87) on S7-400; they interrupt the cyclic OB1. Each invocation is typically 50–150 µs on a CPU 416, dominated by the address comparison. With 32 DP slaves on a single subnet the combined worst-case execution is below 5 ms per fault event, well inside the DP cycle. The SFC51 read, however, can run 2–50 ms depending on the number of stations — call it from OB35 (cyclic interrupt at 1 s) rather than from OB86, and use the BUSY flag to avoid blocking OB1.

For redundant H-CPUs (CPU 410-5H, CPU 417-4H) the OB86 fires on both sides; coordinate the fault-bit handling to avoid two simultaneous updates of the OS variable. The standard FB125 already handles H-mode correctly.