Diagnosing Profibus Slave Faults on S7-300 with TIA Portal

Overview: Profibus Fault Diagnosis on S7-300 Systems

When a Profibus slave (for example, an AC drive) drops off the network or returns a diagnostic alarm, the S7-300 CPU records the event in its diagnostic buffer and calls specific organization blocks (OBs). The most useful OB for slave-station failures is OB 86 — Rack or station failure, which the operating system invokes whenever a DP slave or Profibus station is detected as missing, returns, or reports a fault. By evaluating the OB 86 local data and the diagnostic buffer, the user program can map each event to a specific function (for example, "function 7" starts when station 7 fails).

This reference documents the OB 86 mechanism, the related diagnostic OBs (OB 82, OB 85, OB 100, OB 121, OB 122), the SFC 51 "RDSYSST" calls used to read the Profibus diagnostic status list, and a complete ladder-logic / SCL pattern for mapping station faults to user-defined functions on S7-300 CPUs programmed with TIA Portal (STEP 7 V13 and newer).

Profibus Fault Categories and Trigger OBs

Profibus faults on a S7-300 station can be grouped into four categories. Each category maps to one or more organization blocks that the CPU calls automatically:

For AC drives, the most relevant events are:

• Station Failure: physical dropout (cable break, drive powered off, address conflict). Handled by OB 86 with Event_ID = 0x39C4 (incoming) and 0x39C5 (outgoing) at the DP-master level, plus the slave address in the local data.
• Diagnostic Interrupt: the drive reports a specific error (overcurrent, encoder fault, parameter error). Handled by OB 82 with Event_ID = 0x39B0 / 0x39B1. The associated extended diagnostic data is read with SFC 13 "DPNRM_DG".

OB 86 Local Data Layout

OB 86 is invoked with 20 bytes of local data describing the failing station. Bytes 0–7 hold the standard OB header. Bytes 8–19 carry the event information. The most relevant fields for station-fault-to-function mapping are:

Example OB 86 Local Data Decoding

Given a Profibus DP master (CPU 315-2 DP, master system 1) and a slave at PROFIBUS address 7 with configured diagnostic address 256, the OB 86 local data on a station-loss event is:

OB86_OB_HEADER  = 00 00 39 C5 86 00 12 00   // standard OB header (Event_ID 0x39C5)
OB86_FLT_ID     = 75                         // DP station failure (partial)
OB86_LEN        = 0F                         // 15 bytes of payload follow
OB86_MASTER_ID  = 01 00                      // master system 1
OB86_DIAG_ADDR  = 00 01                      // diagnostic base 0x0100 = 256
OB86_PNT_INFO   = 07 00                      // PROFIBUS address = 7

FLT_ID interpretation: 0x75 indicates a partial failure (one slot missing), 0x78 indicates a full station failure. FLT_ID 0x74 corresponds to a central-rack failure and is not relevant to DP slaves. The full symbolic start information of OB 86 (for example, OB86_MASTER_ID, OB86_PNT_INFO, OB86_EV_CLASS) is documented in the Siemens System and Standard Functions manual for S7-300/400.

Configuring Diagnostic OBs in TIA Portal

1. Open the project in TIA Portal and select the S7-300 CPU in the project tree.
2. Open Device configuration → Properties → System and clock memory and verify the diagnostic OB priority is at the project default (OB 86 priority = 25).
3. Right-click the CPU → Add new object → Organization block (OB). From the list select OB 86 — Rack or station failure. Confirm priority; leave the "Synchronous error OB" option disabled (OB 86 is asynchronous).
4. Repeat for OB 82 — Diagnostic interrupt if the AC drives are configured to send DPV1 diagnostic interrupts (SFC 13 read-back required).
5. Compile and download. From this point on, any slave dropout will call OB 86 and any diagnostic interrupt will call OB 82. Without these OBs in the program the CPU will go to STOP on the first DP failure.

Mapping Profibus Station Fault to a User Function (LAD + SCL)

The cleanest implementation is an FC that reads the OB 86 input parameters and dispatches the event to a global flag word indexed by the slave's PROFIBUS address. Each bit of the flag word represents one drive's "station fault" state. A second word can be used for "diagnostic interrupt" status. The example uses STL-style comments but compiles in TIA Portal LAD/FBD or SCL.

Station-Fault Dispatch (LAD/FB)

// In OB 86, evaluate FLT_ID and the DP station address.
L     #OB86_FLT_ID           // WORD from local data bytes 8..9
L     W#16#7500              // FLT_ID low = 0x75 (partial failure)
==I
JC    sta
L     #OB86_FLT_ID
L     W#16#7800              // FLT_ID low = 0x78 (full station failure)
==I
JC    sta
BEU                          // other IDs: leave

sta: L     #OB86_PNT_INFO     // bytes 12..15 = diag addr + PROFIBUS addr
      L     W#16#00FF        // mask PROFIBUS address (low byte)
      AD
      T     #slave_no        // 0..125

      L     #OB86_EV_CLASS   // 0x39C5 = incoming failure, 0x39C4 = outgoing
      L     W#16#39C5
      ==I
      JC    setbit

// Outgoing event: clear the bit for this slave
      A     "DB_StationFault".Status[#slave_no]
      R     "DB_StationFault".Status[#slave_no]
      BEU

setbit:  // Incoming event: set the bit for this slave
      S     "DB_StationFault".Status[#slave_no]
      // Trigger per-drive function call
      JU    dp_call

In TIA Portal SCL, the same logic is significantly shorter and easier to read:

IF #OB86_FLT_ID IN {WORD#16#7500, WORD#16#7800} THEN
   // Slave is identified by the low byte of PNT_INFO (PROFIBUS address)
   #slave_no   := DWORD_TO_INT(#OB86_PNT_INFO AND DWORD#16#00FF);
   #incoming   := (#OB86_EV_CLASS = WORD#16#39C5);
   "DB_StationFault".Status[#slave_no] := #incoming;

   IF #incoming THEN
      CASE #slave_no OF
         1:  "FC_Drive1_Fault"();
         2:  "FC_Drive2_Fault"();
         3:  "FC_Drive3_Fault"();
         4:  "FC_Drive4_Fault"();
         5:  "FC_Drive5_Fault"();
         6:  "FC_Drive6_Fault"();
         7:  "FC_Drive7_Fault"();
         8:  "FC_Drive8_Fault"();
         ELSE "FC_Default_Fault"();
      END_CASE;
   END_IF;
END_IF;

This pattern provides direct one-to-one mapping: fault in station 7 → FC_Drive7_Fault, matching the original requirement. The same DB can be referenced by an HMI tag for visual fault display.

Reading the Diagnostic Buffer and SZL with SFC 51

In addition to the OB-based push mechanism, the S7-300 can be polled for diagnostic state using SFC 51 "RDSYSST" (Read system status list, SZL). Relevant SZL indexes for Profibus are:

Sample SCL call to read the diagnostic buffer

// Read last 10 diagnostic buffer entries
FOR #i := 0 TO 9 DO
   "ret_val" := RDSYSST(
      REQ      := TRUE,
      SZL_ID   := WORD#16#00A0,
      INDEX    := INT_TO_WORD(#i),
      BUSY     := "busy",
      SZL      := "SZL_Buffer",
      RET_VAL  := "ret_val"
   );
   IF "ret_val" = 0 THEN
      "DB_DiagLog".Entry[#i].Valid      := TRUE;
      "DB_DiagLog".Entry[#i].TimeStamp  := "SZL_Buffer".TimeStamp;
      "DB_DiagLog".Entry[#i].Event_ID   := "SZL_Buffer".EventID;
      "DB_DiagLog".Entry[#i].Info1      := "SZL_Buffer".Info1;
      "DB_DiagLog".Entry[#i].Info2      := "SZL_Buffer".Info2;
   ELSE
      "DB_DiagLog".Entry[#i].Valid := FALSE;
   END_IF;
END_FOR;

Reading Extended Slave Diagnostics with SFC 13

When a slave reports a diagnostic interrupt (OB 82), the full diagnostic telegram is read with SFC 13 "DPNRM_DG". The block returns up to 32 bytes of slave-specific diagnostic data, which for an AC drive typically includes the drive's status word, fault code, and parameter-set number.

"ret_val" := DPNRM_DG(
   REQ      := TRUE,
   LADDR    := "DB_DiagLog".Entry[#i].IO_LADDR,  // diagnostic address from OB 82
   RET_VAL  := "ret_val",
   BUSY     := "busy",
   RECORD   := "DB_Slave_Diag"                   // ANY pointer, 32 bytes
);

For a Siemens Micromaster or Sinamics drive on Profibus, the first 6 bytes follow the standard DP-diagnostic format defined in IEC 61158-6:

Bit 3 of Station status 1 indicates "Diagnostic is pending"; bit 0 of Station status 2 indicates "Slave is not ready for data transfer". A drive-specific fault code is usually mapped to bytes 7–8. Refer to the drive's parameter manual (PWE / PZD layout) for the exact mapping.

Diagnosis of Common Profibus Errors on S7-300

Field-Proven Recommendations and Cabling

The HMS Networks whitepaper "Diagnostics of PROFIBUS Networks" groups Profibus errors into three classes, each with a distinct remediation approach:

1. Address and configuration errors (slave address conflict, GSD mismatch): detected by the master at startup; OB 86 will fire as soon as the master goes into OPERATE. The fix is the master configuration in TIA Portal (Devices & Networks → slave properties → DP slave diagnostics).
2. Cabling and physical-layer errors (shield breaks, repeater faults, reflections): visible as intermittent OB 86 events on the affected station. Use a Profibus cable tester (e.g., Softing BC-700-PB, Indu-Sol PB-Q One) to measure signal levels, line attenuation, and short-circuits. Termination resistors must be ON at exactly the two line ends; all intermediate connectors must be OFF.
3. Device-internal errors (drive controller fault, parameter block mismatch): visible as OB 82 with extended diagnostic data, not OB 86. Read the diagnostic buffer with SFC 13 and decode the vendor-specific bytes (drive manual required).

For a S7-300 with several AC drives, classify each event before drawing conclusions: if OB 86 fires for a specific drive and then stops, suspect a configuration or address problem. If OB 82 fires, suspect the drive itself. The HMS whitepaper emphasises the use of a permanent bus-monitor (tap or listener) for the third class of intermittent errors that may not even reach the CPU.

Maximum Cable Lengths per Baud Rate (IEC 61158-6 Reference)

Verification and Commissioning Procedure

1. Compile and download the project with OB 82, OB 86 and OB 122 loaded. Force the CPU to RUN.
2. Open the diagnostic buffer in TIA Portal (Online & diagnostics → Diagnostics buffer). Verify "All events" is selected. Pull the Profibus connector from station 7; within ~3 seconds, two new entries should appear: W#16#39C5 (incoming) and W#16#39C4 (outgoing) with PROFIBUS address 7 in the additional info.
3. Online monitor OB 86: right-click OB 86 in the project tree, "Monitor/Modify". The local data of the last OB 86 call is shown. Reconnect station 7; the next call should have the same PROFIBUS address with Event_ID 0x39C4 (recovered).
4. Test the FC_Drive7_Fault trigger. Add a "Trigger tag" set in the OB 86 body. In the PLC tag table, watch the boolean and verify it transitions to TRUE only when station 7 is disconnected.
5. Save the diagnostic buffer to a file: Online & diagnostics → Diagnostics buffer → Save As for inclusion in the FAT/SAT protocol.
6. Stress test with all drives running: power-cycle one drive at a time and verify the matching FC is called and the diagnostic buffer accumulates exactly one pair of W#16#39C5 / 0x39C4 entries per dropout.

Standards Reference

Profibus diagnostics are standardised in IEC 61158-6 (Application Layer Service Definition) and IEC 61784-1 (Profile sets for continuous and discrete manufacturing). The diagnostic-telegram format (DPV0/DPV1) and the "Station failure" service are defined there. The OB 86 mechanism and the SZL/SFC 51 indices are Siemens-specific extensions layered on top of the IEC service definitions. Where this article references values (e.g., cable lengths, termination rules), consult the cited IEC clauses before treating them as contractual on a project — implementation may vary by manufacturer and Profibus profile (DP, PA, FMS).

FAQ