Diagnosing PROFIBUS DP Slaves in SIMATIC S7 with OB86 and SFC51

Diagnosing PROFIBUS DP Slaves in SIMATIC S7 with OB86 and SFC51

This reference documents five field-proven methods for detecting PROFIBUS DP slave presence, loss, and return events from STEP 7 (SIMATIC Manager) without requiring an external diagnostics tool. It targets S7-300, S7-400, and the DP-master variants of those CPUs (also valid in concept for S7-1500 with adaptation to OBs and SFCs in TIA Portal). The methods span event-driven OB86 processing, cyclic SFC51 (RDSYSST) polling with SSL_ID = W#16#00B4, cyclic SFC13 (DPNRM_DG) standard-slave diagnostics, the WinCC Flexible FB125 block, and the "Report System Errors" generator. Each method is documented with input/output parameters, working STL samples, and the wiring required in HW Config so the diagnostic frames actually reach the CPU.

1. PROFIBUS DP Diagnostic Architecture in an S7 Station

A PROFIBUS DP master (integrated on the CPU, or via CP 342-5 / CP 443-5) maintains a cyclic poll to every configured slave. The slave returns a fixed-length diagnostic telegram. When a slave disappears, breaks, or returns, the DP master raises an event that propagates into the CPU as an OB86 call and as a system status list (SSL) update. STEP 7 exposes this information through three coordinated mechanisms:

For a "slave present / not present" decision alone, the OB86 + bit-map approach is the lightest and most CPU-efficient. For richer fault analysis (e.g. channel-level diagnostics on SINAMICS, SIMOCODE), SFC13 must be called once the event is detected.

2. Prerequisites and HW Config Requirements

Before any user program can react to DP slave state, two configuration rules must be satisfied in HW Config (SIMATIC Manager → Station → Open HW Config):

1. Diagnostic address must be assigned to every DP slave. Open the slave properties, switch to the "DP Slave Diagnostics" tab, and accept the default diagnostic address (typically the next free input address above the I/O area). Without this address, OB86 will not be raised for the slave.
2. For I-slaves (S7-300/400 acting as intelligent slave), assign diagnostic addresses to both the DP master interface and the I-slave interface. This is documented in the TIA Portal / STEP 7 online help at Configuring diagnostic addresses (S7-300, S7-400). If either side is missing a diagnostic address, OB86 will not fire for the affected slot.

3. Method 1 — OB86 Event-Driven Slave Status (Recommended Baseline)

OB86 is called by the operating system when a DP slave fails or returns. The temporary (TEMP) variables of OB86 give the diagnostic address, event class, fault ID, and a rack/station bitmap. The relevant inputs are:

3.1 STL implementation — single slave into a single bit

The reference program used in the field by the original author captures each event, derives the DP slave number from the diagnostic address, and writes a single bit per slave into a marker word area. The pattern M[MD 1304] is an indirect bit-mapped marker access, where the address of the bit to set or reset is computed at runtime.

// ===== OB86 — DP slave status bit map =====
// Inputs (TEMP) auto-populated by the CPU
L   #OB86_MDL_ADDR          // diagnostic address of failed/returned slave
T   "MDL_ADDRs"             // DB / MW copy for visibility
L   #OB86_EV_CLASS
T   "EV_CLASS"
L   #OB86_FLT_ID
T   "FLT_ID"
L   #OB86_RACKS_FLTD
T   "rack_fltd"

// Convert diagnostic address → slave number (lower 8 bits)
L   "rack_fltd"
L   DW#16#FF                 // mask low byte
AD
T   "dp_slave_number"

// Build pointer: bit address = slave_number * 8
L   "dp_slave_number"
SLD  3                      // shift left 3 bits → byte offset (×8)
T   MD 1304                 // pointer into bit-mapped marker area

// Filter: only handle DP-slave failure/return events
L   "FLT_ID"
L   B#16#C4                 // DP slave diagnostic event
<>I
JC  nosl

L   "EV_CLASS"
L   B#16#38                 // incoming: slave back in operation
==I
JC  inwr

L   "EV_CLASS"
L   B#16#39                 // outgoing: slave lost
==I
JC  ouwr
JU  nosl

inwr: NOP 0                 // set the "life" bit
SET
S   M [MD 1304]
JU  nosl

ouwr: NOP 0                 // reset the "life" bit
SET
R   M [MD 1304]
JU  nosl

nosl: NOP 0
BE

3.2 Behavioural rules and pitfalls

• OB86 fires only on state change. A healthy running plant produces zero OB86 calls. Do not implement "presence detection" by counting OB86 events; instead use the marker word itself.
• The mapping DP_address → M[bit] works only while the diagnostic addresses are configured consistently with the marker layout. If diagnostic addresses are renumbered in HW Config, the mapping must be regenerated.
• For projects with > 50 DP slaves, indirect addressing via MD 1304 eliminates hundreds of lines of code compared to A M 5.0 / S M 5.0 blocks.
• If the master is configured as DP-V1, OB86 also handles "station failure" with FLT_ID = B#16#C5 on return. Both 0xC4 and 0xC5 may need to be accepted depending on firmware.

4. Method 2 — Cyclic SFC 51 (RDSYSST) with SSL_ID W#16#00B4

SFC 51 reads a partial list of the System Status List (SSL). The sub-list W#16#00B4 returns the diagnostic status of a single DP slave. The result is a 6-byte record where byte 0 reports the slave diagnostic state:

• B#16#00 — Slave is present and configured (normal operation).
• B#16#01 — Slave is not reachable / station failure.
• B#16#02 — Diagnostic data available, slave is in a fault condition (call SFC 13 for details).
• B#16#03 — Slave does not respond / is not configured.

4.1 SFC 51 call interface

4.2 STL implementation

// ===== OB1 — read DP slave status with SFC 51 =====
// Repeat this block for every slave, change SZL_INDEX
CALL "RDSYSST"
REQ   :=TRUE
SSL_ID:=W#16#00B4
INDEX :=W#16#0800         // diagnostic address of slave (example 0x0800)
SZL_HEADER:="".SZL_HEADER_1
DR    :=P#M 1000.0 BYTE 6
BUSY  :=M 1100.0
RET_VAL:=MW 1102

// Evaluate byte 0 of result
L     MB 1000             // status byte
L     B#16#00
==I
S     "slave_OK"          // set "present" flag
L     MB 1000
L     B#16#01
==I
S     "slave_LOSS"        // set "lost" flag
L     MB 1000
L     B#16#02
==I
S     "slave_FAULT"       // set "fault" flag

5. Method 3 — SFC 13 (DPNRM_DG) Standard Slave Diagnostics

SFC 13 reads the standard PROFIBUS DP diagnostic buffer of a single slave. This is mandatory when the answer to "is the slave alive?" must be followed by "what is wrong?". For SINAMICS drives and SIMOCODE pro devices, the standard diagnostic frame is followed by identifier- and channel-specific extensions that identify the faulting module and channel.

5.1 When to use SFC 13

• You need the slave manufacturer, module, or channel information.
• You want to log the standard PROFIBUS diagnostic frame into a circular DB for trending.
• You need to forward the diagnostics to an HMI/SCADA tag.

SFC 13 must be called at the diagnostic address — not at the slave's station number. The DP master module address (e.g. LADDR = W#16#0800) is what HW Config exposes.

6. Method 4 — FB125 (WinCC Flexible Slave Diagnostics)

When a SIMATIC Panel with WinCC Flexible is in the project, the FB125 "DP_Diagnostics" block provides a pre-built interface for displaying DP slave status, station number, and error code on the HMI. It iterates through all configured slaves and updates a UDT that WinCC Flexible can pick up directly.

Typical call in OB1:

CALL "DP_DIAG"
DP_MASTERSYSTEM :=1
EXTERNAL_DP_INTERFACE :=FALSE
DP_DIAG_OUTPUT :="DP_DIAG_DB"     // UDT with status per slave

The HMI engineer then binds the panel tags to the fields of DP_DIAG_DB without any extra PLC code. FB125 is the path of least resistance when a panel already exists in the project.

7. Method 5 — Report System Errors (RSE)

Report System Errors is a STEP 7 / TIA Portal generator that automatically produces standardized diagnostic blocks (one central FB, one central DB) covering PROFIBUS DP, PROFINET, and module-level faults. To use it:

1. In HW Config, right-click the DP master system → "Report System Errors" → enable for the whole station.
2. Select the OB priority, the diagnostic DB number, and the languages in which error texts are generated.
3. Compile. STEP 7 inserts FB_SERR, DB_SERR, and the supporting DBs automatically.
4. Connect the panel to the standard diagnostic DB; error texts appear as messages on the HMI without further code.

8. Configuring DP Diagnostic Addresses (S7-300 / S7-400)

The diagnostic address is the address space where the CPU writes slave-level diagnostic events so OB86 can reference them. Without a correctly assigned diagnostic address, the operating system has nothing to raise OB86 against. For S7-300/S7-400 DP slaves, follow the Siemens online help procedure at Configuring diagnostic addresses (S7-300, S7-400):

1. Open the DP slave properties dialog from HW Config.
2. Switch to the "Addresses" tab; ensure the diagnostic address checkbox is enabled.
3. For I-slaves, repeat the assignment on both the master and slave side, and ensure that the two ranges do not overlap.
4. Save and recompile HW Config, then download to the CPU.

8.1 Diagnostic address layout example

9. STL Code Example — Compact Multi-Slave Status Map

The complete OB86 block below accepts any DP slave event and updates one bit per slave in a marker word area. The pattern is parameterised so a single copy serves a 100+ slave installation. For multi-master stations, call this code with different diagnostic address filters.

FUNCTION_BLOCK FB 2000
TITLE =DP Slave Status Map
VAR_TEMP
  t_addr : WORD ;
  t_ev   : BYTE ;
  t_flt  : BYTE ;
  t_mask : DWORD ;
END_VAR
BEGIN
NETWORK 1  // Capture OB86 inputs
L   #OB86_MDL_ADDR ; T #t_addr ;
L   #OB86_EV_CLASS ; T #t_ev  ;
L   #OB86_FLT_ID   ; T #t_flt ;
L   #OB86_RACKS_FLTD ; T #t_mask ;

NETWORK 2  // Filter on DP-slave events
L   #t_flt ; L B#16#C4 ; <>I ; JC END_FB ;

NETWORK 3  // Determine slave number from mask
L   #t_mask ; L DW#16#FF ; AD ;
SLD 3       ; T MD 1304 ;       // byte pointer into marker area

NETWORK 4  // Set / reset by event class
L   #t_ev ; L B#16#38 ; ==I ; JC SET_BIT ;
L   #t_ev ; L B#16#39 ; ==I ; JC RES_BIT ;
JU  END_FB ;

SET_BIT: SET ; S M [MD 1304] ; JU END_FB ;
RES_BIT: SET ; R M [MD 1304] ;
END_FB: BE ;
END_FUNCTION_BLOCK

Place CALL FB 2000, DB 2000 inside the OB86 STL body. The DB must be an instance DB created when FB 2000 is compiled.

10. Comparison Table — Choose the Right Method

11. Verification and Commissioning Procedure

1. Static check. In HW Config, verify that every DP slave in the project tree shows a green diagnostic-address bar. Greyed-out bars indicate no diagnostic address has been assigned.
2. Download and go online. Connect via MPI/Profibus/TCP and force the CPU to RUN with the OB86 code present.
3. Read the marker word. Open the VAT online viewer and check that all slave status bits are TRUE (1) once the bus is fully cyclic.
4. Pull a slave. Disconnect the PROFIBUS connector of one slave. Within one OB86 cycle, the corresponding bit must drop to 0 (0). The CPU must remain in RUN.
5. Reconnect. Reconnect the slave; the bit must return to 1 within the next DP cycle and a B#16#38 OB86 event should appear in the diagnostic buffer.
6. SFC51 sanity check. Call SFC51 against the same slave with SSL_ID = W#16#00B4; byte 0 must return B#16#00 in steady state and B#16#01 when disconnected.
7. SFC13 sanity check (optional). If detailed diagnostics are required, call SFC13 and verify the standard diagnostic byte sequence. For a healthy SINAMICS, the first bytes should decode to "station OK, no module fault".

12. Troubleshooting Matrix

13. Field-Proven Best Practices

• Always download OB86, OB82, OB121, OB122 together. They cover rack faults, diagnostics, and programming errors. Their presence is the difference between a fault-tolerant system and a CPU that drops to STOP on a single disconnected slave.
• Place the marker-word slave map in a retentive DB if you want the last-known-good state visible after a CPU restart.
• For SINAMICS drives, do not stop at OB86 — the drive's own fault buffer (r0947 / r0948) contains fault codes (F-code numbers like F30002) that OB86 cannot expose. Combine DP slave presence detection with drive-side parameter fault retrieval for complete diagnosis.
• For SIMOCODE pro, the standard diagnostic byte 1 reports the device state (0 = run, 1 = fault). SFC 13 is the only path to retrieve it.
• Decide diagnostic polling cadence per criticality. Safety-relevant drives should not be polled faster than the DP cycle; non-critical slaves can be polled at multi-second intervals to reduce bus load.
• Reserve an M-word block (e.g. MW 1000..MW 1099) for slave status only, and document the bit-to-slave mapping in a comment row of the symbol table.

14. Frequently Asked Questions