Documenting Siemens SIMATIC Support Requests: Field Reference

Why Detailed Documentation Matters in Automation Engineering

When a SIMATIC system behaves unexpectedly, the difference between a one-hour resolution and a multi-day escalation often lies in the first message sent. Control engineers routinely underestimate the cost of ambiguous technical inquiries: each round-trip between requester and responder burns 30 to 90 minutes of senior engineering time, and the cumulative cost across a project easily exceeds the budget of the original problem.

Siemens Industry Online Support and distributor technical support groups triage inquiries using structured information. Engineers who provide complete hardware, firmware, and configuration context in the first message receive faster, more accurate responses. This reference defines the information set a SIMATIC support inquiry should include, with field-proven procedures for capturing each artifact. It also applies internally: the same checklist, used inside an engineering team, cuts resolution time when the on-call engineer differs from the original designer.

Hardware Identification: MLFB, Firmware, and the As-Built Record

Every Siemens automation component carries a Machine-Readable Product Designation (MLFB) printed on the front panel. The MLFB encodes the device class, function, and variant; the firmware version is a separate identifier that must be reported alongside it. Sending only the MLFB without firmware is the single most common incomplete-data pattern in SIMATIC support requests.

MLFB Structure for S7-1500 CPUs

The MLFB for a CPU follows a fixed pattern:

• 6ES7 = SIMATIC S7 product family
• 5xx = CPU class (511 = S7-1511, 516 = S7-1516, 518 = S7-1518)
• Position 8 after the dash = hardware functional variant (display, work memory, performance grade)
• Position 9 = firmware version digit group (02 = V2.x, 03 = V3.x)
• Last four digits = order number suffix

Common S7-1500 MLFBs in current use:

Locating Firmware Version

Three reliable sources:

1. Front panel of the CPU - printed under the article number or visible in TIA Portal after going online
2. TIA Portal Online & Diagnostics → CPU information → Firmware
3. Web server of the CPU (default: http://<CPU-IP>/) → Module Information

Always report both. The MLFB without firmware is incomplete: the same CPU MLFB can run V1.8, V2.5, V2.9, or V3.1 depending on the installed firmware, and each version has different bug-fix and feature sets. In particular, behavior of PROFINET IRT, OPC UA server, motion control, and Security Integrated features differs significantly between V2.x and V3.x firmware generations.

Distributed I/O

For ET 200SP, ET 200MP, and ET 200AL stations, report:

• Interface module MLFB and firmware (for example, 6ES7155-6AU30-0BN0 IM 155-6 PN HF, FW V4.4)
• Each I/O module MLFB and firmware
• BaseUnit type (BU type A0, A1, B0, etc. affects potential distribution groups)
• Terminal block and accessory assignments where they influence grounding or shielding

Software Stack Documentation: TIA Portal, HMI, and Drives

Software version mismatches are the single largest source of preventable support escalations in TIA Portal projects. A support inquiry without explicit version data frequently ends with the responder recommending a firmware update that the requesting engineer has already applied.

Required Version Identifiers

Report these values verbatim in the inquiry:

• TIA Portal version and service pack (for example, V18 Update 3, V17 Update 9)
• Installed Support Packages / HSP (Hardware Support Package) versions
• HMI runtime version (WinCC Professional V18, Unified V18, Comfort V17)
• Drive commissioning software version (STARTER, Startdrive, SINAMICS DCC)
• Any installed SIMATIC options (PLCSIM, S7-PLCSIM Advanced, Safety Advanced)
• Operating system on the engineering station (Windows 10 LTSC 2021, Windows 11 23H2)
• .NET version (required for some TIA Portal features, especially OPC UA configuration)

Compatibility Pitfalls

A program compiled in TIA Portal V18 cannot be loaded into a CPU running firmware older than the V18 baseline support level. Conversely, a project opened in V17 cannot see devices added later than the V17 SP release dates. The official compatibility matrix is published in the TIA Portal release notes.

The TIA Portal release notes and compatibility overview are the authoritative reference: TIA Portal versions and compatibility - Siemens Industry Online Support.

Programming Language Specification

The same functional block in LAD, FBD, STL, SCL, and GRAPH exposes different editor surfaces, breakpoint semantics, and compilation paths. Support engineers routinely default to SCL or LAD review because they are most familiar; a requester posting GRAPH source with implicit step transitions may receive incorrect guidance if the language is not specified.

When posting source, declare the language explicitly:

Language: SCL (Structured Control Language)
Block: FB105 "Motor_SeqCtrl"
Calling environment: OB1 cyclic, OB35 (100 ms)

When the block uses language extensions (compiler attributes, pragmas, attribute system), include the relevant lines:

{S7.optimize := 'TRUE'}
// ATTRIBUTE 'quality_code' := 'TRUE'

For GRAPH, report the sequencer structure (number of steps, transitions, branches, parallel branches) and whether the sequencer uses Interlock, Supervision, or both. STL is increasingly rare on S7-1500 but still supported; if STL is in use, the SCL/STL source viewer will render it but the optimization switches differ from SCL.

Project Documentation: Screenshots, Hardware Configuration, and Symbol Tables

Reviewers cannot execute ZIP files in their head. Text-only code is preferable to a screenshot of code because it is searchable, copy-pastable, and lossless. Hardware configuration, however, is best shown as a screenshot because the topological relationships are not extractable from the source.

Screenshot Conventions

When capturing screenshots:

• Maximize the relevant pane; do not show the entire TIA Portal window with unrelated project tree elements
• Include the path or title bar so the device is identifiable
• Capture in 1x or 2x DPI; avoid pre-resized thumbnails that lose detail
• Use the built-in Windows Snipping Tool or TIA Portal Copy screenshot function
• Annotate with red boxes for the specific element under discussion

Hardware Configuration (Device View)

Capture the device view of the rack including:

• Slot numbers
• Order numbers (MLFBs)
• Module diagnostics addresses
• Submodule configurations (PROFINET port assignments, channel diagnostics enabled)

For distributed I/O on PROFINET, capture:

• Device name as configured (note: not the IP - PROFINET addressing is by name)
• Device number
• Slot mapping of the head module and inserted modules

Symbol Table

Export the relevant portion of the PLC symbols table as CSV or include it inline:

Tag,Data Type,Address,Comment
Motor1_Run,BOOL,%Q0.0,"Contactor for Motor 1"
Motor1_Fault,BOOL,%I0.3,"Thermal overload feedback"
Motor1_Speed,REAL,%MD4,"Actual speed in RPM"

Watch and Force Tables

If the problem involves runtime values, capture the watch table with the current online values. Use Monitor all and screenshot once values have stabilized. Force table contents are sensitive and should be included only when the force operation is the suspected cause of the issue. Force operations that bypass the program logic frequently mask root causes and complicate remote diagnosis.

Diagnostic Buffer Capture Procedure

The CPU diagnostic buffer is the highest-value artifact in any S7-1200 or S7-1500 support inquiry. It is a chronological, time-stamped event log maintained in non-volatile memory. Capturing it correctly requires care.

Procedure for S7-1500 (TIA Portal V17+)

1. Connect to the CPU via Online → Connect to target system
2. Open Online & Diagnostics from the project tree
3. Expand Diagnostics → Diagnostic buffer
4. Verify that the CPU clock is synchronized (Online & Diagnostics → Set time)
5. Right-click the diagnostic buffer → Save As → Export as .txt or .csv
6. Capture the Time and Event ID columns; note any entries with incoming / outgoing pairings

For S7-1200, the procedure is similar but the diagnostic buffer holds fewer entries (roughly 50 vs. 320 on S7-1500) and the older CPUs do not retain power-off events.

What to Look For

The diagnostic buffer separates informational, warning, and error events. Event IDs in the 16#4000 range typically mark operating mode transitions, IDs in the 16#4300 range mark distributed I/O events, and IDs in the 16#4500 range are PROFINET/PROFIBUS communication events. Because exact ID semantics are refined between firmware releases, always cross-reference the specific ID against the S7-1500 system manual diagnostic buffer appendix rather than relying on memory.

When posting the diagnostic buffer, redact only IP addresses that are confidential; do not truncate the event IDs or timestamps - they are the precise match key the support team uses against the diagnostic manual.

The S7-1500 system manual documents every event ID in the diagnostic buffer reference appendix: SIMATIC S7-1500 System Manual - Siemens Industry Online Support.

LED Status and Error Code Documentation

Every S7-1500 CPU has four front-panel LEDs that summarize the CPU state. Reading the LED pattern takes five seconds and routinely identifies the failure class.

S7-1500 LED Meanings

When an SF (System Fault) LED is red, the diagnostic buffer is mandatory: it contains the OB that failed to execute, the associated event ID, and the block that caused the fault. Capture the LED state at the same instant the buffer is read; CPU LED state history is not stored.

For ET 200SP stations, capture the channel-level diagnostics (channel status byte) for each module with a fault. The status word structure is module-family-specific and is documented in the ET 200SP module manuals available on Siemens Industry Online Support.

Communication Configuration Documentation

PROFINET, PROFIBUS, and Industrial Ethernet communication problems account for roughly 40% of SIMATIC support escalations. The configuration that must be reported depends on the protocol.

PROFINET

• Device name (case-sensitive, max 240 characters)
• IP address, subnet mask, default gateway
• PROFINET device number (1-512)
• Update time (typically 1 ms for isochronous, 1-512 ms otherwise)
• Watchdog time (default 3x update time)
• IRT vs RT class
• Port assignments (port 1, port 2 connections)
• LLDP topology configuration

PROFIBUS

• Slave address (1-125)
• Baud rate (45.45 kbps to 12 Mbps)
• DP version (DPV0, DPV1, DPV2)
• Slave diagnostic bytes captured live
• GSD file version used

S7 Communication / PUT-GET / OPC UA

• Connection ID
• Local and remote TSAP for S7 connections
• Partner IP or address
• Active vs passive connection establishment
• OPC UA endpoint URL, security policy, authentication mode

For PROFINET diagnostics, a Wireshark capture of the PN-IO frames is invaluable. Capture for at least 60 seconds during the fault condition and attach the .pcapng file. Filter to display only PN-IO traffic for readability:

Reproducibility: The Minimum Viable Test Case

Support engineers cannot diagnose problems they cannot reproduce. When describing an issue, structure the report around the minimum set of conditions required to trigger the fault.

Reproducibility Template

Environment:
- CPU: 6ES7516-3AN02-0AB0, FW V2.9.7
- TIA Portal: V18 Update 3, HSP0372
- Engineering station: Windows 11 22H2
- HMI: TP700 Comfort, 6AV2 124-1GC01-0AX0, FW V17.0.0.0

Preconditions:
- Project compiled, downloaded to CPU in RUN
- PROFINET IO 1 (IM 155-6 PN, FW V4.4.0.4) online with all modules OK

Steps to reproduce:
1. Trigger tag Motor1_Start (BOOL) rising edge
2. Observe Motor1_Run output
3. After ~2 seconds, OB35 (100 ms) fault

Observed:
- SF LED solid red, CPU enters STOP
- Diagnostic buffer shows PROFINET station-failure entry

Expected:
- Motor1 sequence completes within 4 seconds, no fault

Workarounds attempted:
- Memory reset and full project re-download: fault reproduces
- Reducing OB35 priority: no change

A report structured this way can be triaged in 10 to 15 minutes. A typical "the system doesn't work" report takes 60 to 90 minutes of back-and-forth before any meaningful diagnosis begins.

Support Channel Routing

Different issues belong in different channels. Routing the inquiry correctly is itself a documentation practice.

Siemens Industry Online Support (Free)

The entry point for all SIMATIC technical issues: Siemens Industry Online Support. Search the support database before opening a request - the searchable index contains application examples, FAQs, and known-issue entries for most common configurations. Submitting a support case via the portal requires a Siemens Industry registration; allow 24-72 hours for first response on standard severity.

SIMATIC Support Card (Paid)

For production-down situations or projects with active SIMATIC Card entitlements, the regional hotline provides direct telephone support with response time SLAs (typically 2 hours for severity 1). The card is sold as a yearly subscription per CPU article number and provides direct access to Siemens application engineers. SIMATIC Card is the appropriate channel for:

• Plant-down emergencies with active production loss
• Compliance-sensitive industries (pharma, food) requiring documented Siemens support
• Multi-site programs where Siemens must provide a single source of authority

Regional Application Engineering

Siemens regional pre-sales application engineers can clarify hardware selection and topology questions; they are not a substitute for post-sales technical support but can be invaluable during commissioning windows.

Bug Reports

Firmware or TIA Portal defects should be reported via the official Siemens support portal with the reproduction package described above. Bug reports submitted as "TIA Portal is broken" without reproduction details will not be acted on. When a firmware update resolves the issue, request the SPR number (Siemens Problem Report) from Siemens so the fix can be tracked in the project documentation.

Anti-Patterns in Technical Inquiries

These patterns consistently produce the slowest responses and the least accurate first replies.

Vague Subject Lines

• Bad: "PLC not working"
• Good: "S7-1516 FW V2.9 - OB35 raises SF after 2 minutes of cyclic operation"

Missing Version Information

A request that omits TIA Portal version and CPU firmware version is missing roughly 80% of the diagnostic context. Always include both.

Screenshot of Code

A PNG of a 200-line SCL block is unsearchable, uncopy-pastable, and unreadable at the resolution at which support threads typically display. Always post code as text using the appropriate code block formatting.

Cross-Posting

Posting the same question in multiple channels (internal team chat, distributor, Siemens support, integrator partner) creates redundant effort and conflicting answers. Pick one channel; if no response in 48 hours, escalate by replying with the case number rather than re-posting.

Premature Escalation

Escalating a question as urgent before establishing reproducibility wastes the response team's triage capacity. Mark severity accurately; let the response team judge actual urgency from the documented fault impact.

Solution Reports Without Cause

When posting that a problem was solved, include the root cause, not just the workaround. The next engineer facing the same issue benefits from understanding both the cause and the fix.

Quick Reference Checklist

Use this list as a pre-submission check for every SIMATIC support inquiry:

1. CPU and module MLFBs listed (with firmware versions)
2. TIA Portal version with SP and UPDATE designation
3. Programming language of every block referenced
4. Hardware configuration screenshot from device view
5. Diagnostic buffer export (.txt or .csv)
6. LED state at the time of fault (or sequence leading to fault)
7. PROFINET or PROFIBUS topology (devices, names, IPs, addresses)
8. Minimum reproduction steps with preconditions
9. Observed vs expected behavior stated explicitly
10. Workarounds already attempted (with results)
11. SPR numbers if Siemens has acknowledged a bug
12. Time zone and time stamp synchronization status

FAQ