Diagnosing Profibus-DP Slave Faults on S7-300 CPU315-2DP

1. Overview: Why Empty OBs Don't Show the Fault

The classic symptom reported on S7-300 CPU315-2DP masters is that diagnostic Organization Blocks OB82, OB85, OB86, OB87, and OB122 are downloaded into the controller, the CPU never goes into STOP, yet operators still cannot tell which DP slave has been lost. The reason is that simply inserting OBs only prevents the CPU from stopping on the corresponding error class; the OBs themselves contain no logic. To turn those OBs into a useful identification mechanism you must read the OB start information (or call SFC51 RDSYSST) and write the result to a flag area, a data block, or an HMI tag.

This reference covers three production-proven approaches used on S7-300 / S7-400 / CPU315-2DP systems:

1. Reading diagnostic data inside the OBs (OB86_MASTER, OB82) and storing the slave address in a global DB.
2. Calling SFC51 (RDSYSST) cyclically with SSL ID W#16#00B4 (DP slave diagnostic information) to enumerate the bus.
3. Using Report System Error (RSE) in STEP 7 to generate the diagnostic blocks, WinCC messages and icon views automatically.
4. Deploying the SIMATIC Maintenance Station for WinCC to surface the topology to operators.

2. Prerequisites

3. Diagnostic OB Reference and Start Information

Each OB receives a 20-byte local-data area that contains the error source. The fields relevant to slave identification are summarized below.

3.1 STL Snippet for OB86 (DP Slave Failure)

FUNCTION_BLOCK FB_Diag
VAR_TEMP
  info : STRUCT
    evt_class  : BYTE;   // LB8
    fault_id   : BYTE;   // LB9
    slot       : WORD;   // LW10
    spec       : WORD;   // LW12
    log_base   : WORD;   // LB16/LB17  logical base addr
  END_STRUCT;
END_VAR
BEGIN
  info.evt_class := OB86_FLT_ID;       // byte 8  event class
  info.fault_id  := OB86_FLT_ID;       // byte 9  e.g. W#16#3A
  info.log_base  := OB86_MASTER_STATE; // LB16..17 master state
  // Save logical base of failed slave into global DB
  "dbDiag".slave_failed  := info.log_base;
  "dbDiag".ob86_event    := OB86_FLT_ID;
END_FUNCTION_BLOCK

3.2 Mapping Logical Base to Profibus Address

The logical base address of a DP slave is the address configured in HW Config for slot 0 of the slave. To convert it into the human-readable Profibus address (1-125) use the diagnostic buffer of the CPU or call SFC51 with SSL ID W#16#00B4, which returns the full diagnostic record including the physical Profibus node number.

4. Reading the Bus with SFC51 (RDSYSST)

SFC51 RDSYSST reads System Status Lists (SSL). For DP diagnostics the most relevant SSL IDs are:

4.1 STL Example - Enumerate All DP Slaves

// Call once on startup or cyclically every 5 s
CALL SFC51
  REQ        := TRUE
  ID         := W#16#00B4   // DP slave diagnostic list
  INDEX      := 0
  MLEN       := 256          // receive buffer length
  RET_VAL    := MW100        // 0 = OK, 80A1 = busy, 80B0 = illegal ID
  BUSY       := M101.0
  RECORD     := P#DB50.DBX0.0 BYTE 256
  // Output:
  // Each entry 32 bytes:
  // Byte  0  : rack/station
  // Byte  2  : logical base address low
  // Byte  3  : logical base address high
  // Byte  4  : Profibus node number (1..125)
  // Byte  5  : status (0=ok, 1=failed, 2=disabled, 3=not configured)
  // ...

4.2 Status Byte Decoding

5. Report System Error (RSE) Wizard

STEP 7 V5.5 ships with the Report System Error wizard (Options > Report System Error). It auto-generates:

• FB49 / FB50 / FB79 diagnostic blocks
• Diagnostic DBs DB90..DB99
• WinCC message configuration with text library
• Icon view for the WinCC Maintenance Station

5.1 Step-by-Step Setup

1. In SIMATIC Manager open the S7 program, then Options > Report System Error.
2. Select the OB priority, default = priority class 5 for OB82 / OB86 / OB85 / OB87 / OB121 / OB122.
3. Choose the message destination: WinCC, HMI Pro, or Save as file.
4. Activate the checkboxes DP slave diagnostics and DP master diagnostics.
5. Click Generate. STEP 7 inserts the FBs and creates DB90 with one bit per configured slave.
6. Compile the WinCC project. The wizard creates a Standard diagnostics screen with a plant view where red/green icons indicate each slave.

6. SIMATIC Maintenance Station for WinCC

The Maintenance Station package (entry ID 24359616) extends WinCC with a dedicated diagnosis view that lists every Profibus master, every slave and every module. It uses the same @Maintenance blocks generated by RSE and adds:

• A navigable tree of plant areas
• Live status icons (green = OK, gray = deactivated, red = failed)
• A message log that points to the affected Profibus address, the slot, and the channel number
• Operator button to acknowledge the fault

6.1 Compatibility Matrix

7. WinCC Flexible / Comfort Integration

For smaller panels (TP177, KTP1200, MP277) the RSE wizard generates a tag-prefix-based screen. Procedure:

1. After RSE generation in STEP 7, export the messages using Options > WinCC Configuration > Export.
2. In WinCC flexible open the project, then Project > Import WinCC Configuration.
3. Add a screen DiagView and insert an Alarm View with the imported message classes @System error 3000..3999.
4. Add a 16-bit integer tag SlaveStatus[16] and bind each bit to one slave (offset = profibus address - 1).

8. Diagnostic Buffer Reading (CPU Diagnostic Buffer)

When a slave disappears the CPU writes a detailed entry into its diagnostic buffer. Reading it programmatically with SFC59 DB_REC_READ is useful for archiving. The entry format:

DB_BUFR.read(REQ:=TRUE, ID:=W#16#00B1, INDEX:=0, MLEN:=2048, RECORD:=P#DB_DIAG_BUF.DX0.0 BYTE 2048);

The buffer entry contains: timestamp (32-bit), event ID (16-bit), info1..info4 (16-bit each). Typical event IDs:

9. Practical Step-by-Step: From OB to Operator Screen

1. Insert OB82, OB85, OB86, OB87, OB122 in the S7 program (Blocks > Insert > Organization Block).
2. Inside OB86, evaluate OB86_MASTER_STATE and copy OB86_FLT_ID into DB100.DBW0. Use temporary STAT variables so nested blocks do not corrupt them.
3. Add a 256-byte buffer DB101. Call SFC51 cyclically (e.g. OB35 every 100 ms) with SSL W#16#00B4.
4. Run the Report System Error wizard and regenerate. The wizard picks up your new DB101 and adds slave-status bits automatically.
5. In the WinCC project create an Alarm logging screen with the imported messages. Add an I/O field bound to DB100.DBW0 to display the failing Profibus address numerically.
6. Simulate the fault: in HW Config uncheck Operating on a slave, or physically pull the connector. Verify OB86 fires and the operator screen turns the corresponding icon red.

10. Troubleshooting Matrix

11. Verification Checklist

• OB presence: PLC > Module Information > Diagnostic Buffer > Event ID 0x4300 confirms each OB.
• Slave status bits: Toggle a slave in HW Config and watch DB101 byte 5 change to 0x01.
• WinCC alarm: Acknowledge alarm and confirm bit cleared in DB90.
• Cable health: Disconnect and reconnect the connector; CPU must log entry ID 0x3950 (slave return).
• Bus timing: Open Bus diagnostics in HW Config and verify Tslot, Tset, Tqui match the slave GSD file (typical Tslot = 300-1000 bit-times).

12. Advanced Topics

12.1 Using SFB52 / SFB53 for DPV1 Diagnostics

For ET200S / ET200MP stations that support DPV1, call SFB52 (RDREC) to read record 0 (module diagnostic) and record 1 (channel diagnostic). Each record contains 4 bytes of channel + error type that can be forwarded to MES as a quality stamp.

12.2 Failsafe DP Slaves

If the network includes PROFIsafe slaves the diagnostics are written to F-Peripherie DB (e.g. DB1000). OB82 entries must be evaluated for safety-related PVs as well; otherwise the safety program will go to STOP via F-STOP on F-channel-fault.

12.3 Replacing a CPU315-2DP with CPU315F-2DP

The F-variant has identical diagnostic blocks but adds a safety message frame. Re-running the RSE wizard regenerates all @ blocks; no user code changes required. The Safety Acceptance Test must be re-run (entry ID 18945243).

13. Frequently Asked Questions