Migrating CPU 318-2DP to 317-2DP: Resolving SFC51 Warnings

Overview

The CPU 318-2DP (6ES7318-2AJ00-0AB0) is a high-end S7-400 CPU that relies on a back-up battery to retain the user program and data when the rack power supply is lost. When a project is ported to an S7-300 target such as the CPU 317-2DP (6ES7317-2AK14-0AB0 or earlier 6ES7317-2AJ10-0AB0), the load memory concept changes fundamentally: the S7-300 stores its load memory on a non-volatile Micro Memory Card (MMC) and no longer requires a battery. Any program block that polls battery status via SFC 51 RDSYSST with the battery SSL IDs (notably W#16#011B) or that handles battery faults in OB 81 must be cleaned up, while PROFIBUS diagnostics (for example SFC 61 DP_TOPOL or other SZL reads on DP slave status) must be preserved.

This reference explains the meaning of the CPU 318 Migration Check warning, identifies the exact SSL indices and OBs that have to be touched, and walks through a controlled migration from the legacy S7-400 program to an S7-300 target CPU using STEP 7 V5.x or TIA Portal.

Prerequisites

• STEP 7 V5.5 SP4 or later (the migration tool ships with the standard STEP 7 install) or TIA Portal V15.1 and newer for re-engineering.
• A license or compatible download of the CPU 318 Migration Check tool (free of charge; available via Siemens Support entry 22680601).
• Source S7-400 project archive (CPU 318-2DP as the configured PLC) and the STEP 7 source files for the S7 program.
• Target CPU 317-2DP with a valid order number: 6ES7317-2AK14-0AB0 (current) or 6ES7317-2AJ10-0AB0 (legacy). Verify the firmware version is compatible with the project's library blocks.
• S7-300 MMC sized to the user program + retentive data. Common catalog numbers: 6ES7953-8LL31-0AA0 (2 MB), 6ES7953-8LM31-0AA0 (4 MB), 6ES7953-8LP31-0AA0 (8 MB). F-size and FE-size variants exist for newer CPUs.
• MPI/ PROFIBUS or Ethernet programming cable to download the project to the new CPU.

Hardware Differences: CPU 318-2DP vs CPU 317-2DP

Before editing any code, confirm that the migration makes sense for the application. The table below summarizes the practical differences that affect program portability.

Because the S7-300 CPU has no battery, every program element that assumes a battery is present must be removed or rewritten. That is the entire reason the Migration Check tool raises a warning.

Understanding the SFC 51 Battery-Status Warning

SFC 51 RDSYSST reads partial or complete System State Lists (SSL) from the CPU. The CPU 318 Migration Check tool scans the S7 program for calls to SFC 51 whose SZL_ID input targets a battery-related SSL and reports an item such as:

Warning: SSL W#16#011B (battery status) is not supported on the target CPU 317-2DP.

The same warning can also be phrased as a generic "battery examination is unnecessary" hint because the target CPU has no battery to examine. The point is: do not silently leave the call in the project; remove the call, remove the surrounding wrapper FB/FC, or replace it with a diagnostic check appropriate for an MMC-based S7-300.

SSL IDs and Index Values Related to Battery Diagnostics

The SSL identifier is the second input on SFC 51 (parameter SZL_ID, type WORD). The following IDs are the ones most commonly observed in legacy S7-400 programs when querying battery status. Their values must be removed from the target project.

A typical SFC 51 battery check looks like this in the original S7-400 code:

CALL SFC 51
  REQ    := TRUE                // single read
  SZL_ID := W#16#011B           // battery status
  INDEX  := W#16#0000           // rack 0 / slot 0
  RET_VAL:= MW100               // return value
  BUSY   := M101.0
  SZL_HEADER := DB20.SSL_HDR    // SSL header
  SZL := DB20.SSL_DATA          // SSL data
// Evaluate SZL: byte 0 = battery 1 status, byte 1 = battery 2 status
// 0 = OK, 1 = critical, 4 = battery not used

On the CPU 317-2DP, the same call returns RET_VAL = W#16#80A1 (substitution not possible) or W#16#8090 (SSL not supported), depending on firmware. The cleanest fix is to delete the call entirely, including its wrapper code and any data-block scaffolding.

OB 81 Handling in the Migration

OB 81 is the Power supply fault / battery fault organization block. It is called by the operating system of the CPU when:

• At least one back-up battery is discharged or missing on a battery-backed CPU.
• A redundant power supply module fails (in 1oo2 redundant configurations).
• The rack power supply fails on certain S7-400 racks.

On the S7-300 CPU 317-2DP, OB 81 will only be triggered by power supply / rack faults (and only if the PS is configured to support diagnostics); the battery portion never fires because no battery exists. The CPU 318 Migration Check correctly recommends deleting OB 81 when the application no longer relies on battery diagnostics.

Recommended steps:

1. Open the S7-400 project in STEP 7 V5.x and locate OB 81 (Blocks > System Blocks > OB 81).
2. Inspect the local variables OB81_EV_CLASS, OB81_FLT_ID and OB81_RESERVED_1. Battery faults set OB81_FLT_ID = B#16#22; power supply faults set OB81_FLT_ID = B#16#23.
3. If the entire OB only handles battery faults, delete the block.
4. If the OB also sets error flags or triggers a message, replace the battery-specific code with an MMC-health check (for example periodic read of SSL_ID = W#16#0131 for MMC serial number / wear) or remove the battery branch entirely.
5. Mark the block deleted in the cross reference. Cross references can be generated via Options > Cross References in SIMATIC Manager.

Preserving SFC 61 and PROFIBUS Slave Diagnostics

The Migration Check warning specifically targets battery-status uses of SFC 51. Calls to SFC 61 DP_TOPOL or to SFC 51 with PROFIBUS-related SSL IDs (for example W#16#0F31 in DP diagnostics, W#16#00C0 / W#16#00C1 for DP slave diagnostics on some firmware versions) must be preserved because the S7-300 CPU 317-2DP supports the same DP master interface and the same diagnostic SZLs.

Where the legacy program calls SFC 51 from FB 10 to verify DP slave presence, no removal is required. Confirm by:

1. Opening FB 10 in LAD / FBD / STL editor.
2. Reading the network that calls SFC 51 and noting the constant on SZL_ID.
3. If the constant is one of the battery IDs above, delete the call. If it is a DP-slave ID (e.g. W#16#0294, W#16#0F31 in DP context, or W#16#0019 with INDEX = slave address), keep the call.
4. Cross-reference FB 10 across the project (right-click > Cross References). Any other consumer of FB 10 (e.g. OB 1 cyclic call) inherits the change automatically.

SFC 61 itself (DP_TOPOL) is part of the S7-300/400 standard library and is supported on CPU 317-2DP. Verify that the firmware of the target CPU supports SFC 61 - it does from firmware V2.0 onwards on the 6ES7317-2AK14 variant.

Step-by-Step Migration Procedure

1. Run the CPU 318 Migration Check. Launch STEP 7 V5.5 SP4, open the source project, choose CPU 318 Migration Check from the Tools menu and select the configured CPU 318-2DP. Click Start Analysis. The tool generates an HTML report per target family.
2. Save the report. Use File > Export > HTML. The exported report is the QA evidence that all battery-related calls have been tracked and resolved.
3. Filter the report for warnings. Look for entries that contain the keywords Battery, SSL W#16#011B, SSL W#16#0019, or OB 81.
4. Edit each warning. For each warning, navigate to the listed block (FB / FC / OB) and remove the SFC 51 call, the surrounding wrapper, and any data-block scaffolding. For OB 81, decide between delete, rewrite or leave for non-battery events.
5. Re-run the analysis. Repeat the CPU 318 Migration Check. A clean run shows zero Battery warnings.
6. Re-target the project. In HW Config, replace the S7-400 CPU 318-2DP with the S7-300 CPU 317-2DP. Save and compile (Station > Save and Compile).
7. Configure the MMC. Insert the MMC into the CPU 317-2DP slot. The download copies the load memory onto the MMC. Note: the CPU 317-2DP has no integrated RAM load memory; the MMC is the load memory.
8. Define retentivity. Open HW Config > CPU Properties > Retentive Memory. Mark DB ranges as retentive to replace battery-backed RAM behaviour.
9. Download the project. Use PLC > Download to Target. STEP 7 will perform a memory reset on the MMC if it contains a different project.
10. Run warm restart. Switch the CPU selector to RUN or perform a power cycle. Confirm the CPU enters RUN and that no OB 81 is called.

Verification & Commissioning

After the download, perform the following checks. Each check is small enough to run from the CPU's diagnostic buffer or from STEP 7's online view.

• Diagnostic buffer. Open PLC > Diagnostic/Setting > Diagnostic Buffer. Confirm there are no entries for OB 81 with FLT_ID = B#16#22 (battery fault).
• Module information > Memory. Verify the MMC is recognized, the work memory is sized correctly, and the retentive areas match HW Config.
• Force table / watch table. Walk through each FB / FC that previously called SFC 51 for battery status. Confirm the wrapper DBs are no longer referenced and the output bits stay at their default values.
• DP slave diagnostics. Open PLC > PROFIBUS > Diagnose and confirm that the SFC 61 / SFC 51 calls in FB 10 still produce valid slave status lists.
• Cross-reference scan. Re-run the cross-reference for SFC 51 and OB 81. They should either be absent or limited to the DP-diagnostic networks (depending on whether they were retained).
• Restart type. Trigger a manual warm restart and confirm OB 100 is called (or is intentionally absent). For S7-300, a warm restart is the default behaviour and OB 100 is optional.

Troubleshooting Matrix

Edge Cases & Field-Proven Caveats

• Multi-instance use of FB 10. If FB 10 is called from multiple OBs (OB 1, OB 35, OB 82) and each call passes a different static instance DB, the cross-reference must be checked for every instance DB. Removing the SFC 51 call in the FB source automatically removes it from each instance.
• Indirect SFC 51 access. Programs that load the SSL ID via a variable (e.g. L W#16#011B; T MW 200; L MW 200 before the CALL) hide the call from a quick visual scan. Re-run the CPU 318 Migration Check after each removal pass; the tool performs static data-flow analysis and will surface indirect battery reads.
• Standard library blocks. Older versions of the Standard Library > Communication Blocks contain FBs that read battery status. Replace these with current library versions or with the S7-300 / TIA Portal equivalents documented under TIA Portal migration readiness.
• Documentation trail. Attach the exported Migration Check HTML report to the project's Documentation folder. QA reviewers and audit teams will look for proof that every battery-related warning has been resolved.
• MMC size validation. The MMC must be large enough for the entire user program and any recipe data. If the project previously used 4 MB of battery-backed load memory, fit an 8 MB MMC (6ES7953-8LP31-0AA0) to avoid truncation.

Standards & Official References

• Siemens Support entry 22680601 - CPU 318 Migration Check
• Siemens Support FAQ 18365209 - What to watch out for when migrating from CPU 318-2DP to CPU 317-2DP / CPU 317-2 PN/DP
• CPU 318 Migration Check documentation V11 (PDF)
• TIA Portal V20 - Check migration readiness of hardware components