PROFINET ET 200M Diagnostics: SFC51, SSL, and WinCC Setup

1. Overview

Distributed I/O stations based on the ET 200M with the IM 153-4 PN interface module (catalog number 6ES7 153-4AA01-0XB0) communicate with a S7-300 controller (CPU 314 + CP 343-1) over PROFINET IO. Detecting a station drop-out and surfacing the event on a WinCC V6.2 SP3 SCADA requires three coordinated layers:

1. Diagnostic event generation in the PROFINET device, signalled to the IO controller through channel diagnostics and interruption semantics.
2. Diagnostic event capture in the S7-300 user program, using either error OBs (OB 82, OB 83, OB 86) or the System Status Lists read with SFC 51.
3. Diagnostic event visualization in WinCC, where the bit/state from the S7 program is mapped to a tag, alarm, or system-diagnostics faceplate.

This article documents a field-proven configuration that covers all three layers, including the extended PROFINET diagnostics add-on for WinCC, sample STL logic for the SFC 51 partial list reads, and the relevant SSL IDs to query for module and station status.

2. System Architecture and Prerequisites

The reference architecture used in the original commissioning consists of:

Prerequisites for the procedure below:

• STEP 7 installed with the HSP (Hardware Support Package) that includes the 6ES7 153-4AA01-0XB0 IM 153-4 PN (HSP for ET 200M).
• The IM 153-4AA01 supports PROFINET IO with diagnostics as a PROFINET IO device. See the Siemens entry 23678970 — Which PROFINET nodes support the extended PROFINET diagnostics for confirmation of supported devices.
• The IM 153-4 is configured in HW Config under a PROFINET IO system owned by the CP 343-1.
• WinCC V6.2 SP3 is installed with the option "ProAgent / System Diagnostics" or the system diagnostics add-on for PROFINET.

3. ET 200M IM 153-4 PROFINET Interface Specifications

The interface module 6ES7 153-4AA01-0XB0 (IM 153-4 PN, High Feature) is the central component of the ET 200M station on PROFINET. Key operating parameters relevant to diagnostics:

4. PROFINET Diagnostic Methods Overview

Three diagnostic paths are available on the S7-300 IO controller side. They are not mutually exclusive; a robust solution combines OB-driven events for fast reaction with SFC 51 polling for cyclic state and extended PROFINET diagnostics for graphical display in WinCC.

For a SCADA indicator ("station 1 disconnected", "station 2 disconnected"), the OB 86 path is the canonical solution because the PROFINET IO failure / return is reported as a rack failure / station failure event. The SFC 51 partial list SSL_ID = W#16#0A91 is the polling fallback when OB 86 is not written, for example on a different scan.

5. OB-Driven Diagnostic Capture

When an ET 200M station fails, the CPU enters OB 86 (Rack failure OB). The local data of OB 86 indicates which logical address (PROFINET device) has gone down or returned. Implementing OB 86 — even as an empty OB — makes the CPU enter STOP only if no handler is present; the OB content then sets a per-station status flag that the SCADA reads.

OB 86 local data structure (relevant fields):

Sample OB 86 STL (compile in STEP 7, attach to S7 program; this snippet handles the two ET 200M stations with logical addresses 100 and 101 — adjust to your HW Config):

FUNCTION_BLOCK FB 2000
TITLE = 'PROFINET station status from OB 86'
VAR
   sStation1Bad : BOOL;   // TRUE = station 1 (Addr 100) not OK
   sStation2Bad : BOOL;   // TRUE = station 2 (Addr 101) not OK
END_VAR
BEGIN
NETWORK
TITLE = 'Read event class from OB 86 local data (LDW = OW 0 of the OB instance is mapped via TEMP)
   L     #OB86_EV_CLASS     // 0x38 = outgoing, 0x39 = incoming
   L     B#16#38
   ==I
   JC    EVO                // Event is "station/IO failure"
   L     #OB86_EV_CLASS
   L     B#16#39
   ==I
   JC    EVI                // Event is "station/IO return"
   JU    END_OB86

EVO: L     #OB86_MDL_ADDR     // Logical address of the failed device
   L     W#16#0064           // 100 dec = station 1
   ==I
   JC    S1F
   L     #OB86_MDL_ADDR
   L     W#16#0065           // 101 dec = station 2
   ==I
   JC    S2F
   JU    END_OB86

EVI: L     #OB86_MDL_ADDR
   L     W#16#0064
   ==I
   JC    S1R
   L     #OB86_MDL_ADDR
   L     W#16#0065
   ==I
   JC    S2R
   JU    END_OB86

S1F: S     #sStation1Bad     // Failure of station 1
   JU    END_OB86
S2F: S     #sStation2Bad     // Failure of station 2
   JU    END_OB86
S1R: R     #sStation1Bad     // Return of station 1
   JU    END_OB86
S2R: R     #sStation2Bad     // Return of station 2
   JU    END_OB86

END_OB86: BE
END_FUNCTION_BLOCK

Call this FB from a cycle OB (OB 1) to publish the booleans into a data block (DB) that WinCC reads as tags. Alternatively, the OB 86 can write directly into a shared DB; both are valid.

6. SFC 51 (RDSYSST) System Status List Polling

SFC 51 RDSYSST reads System Status Lists (SSL) from the CPU. The relevant partial lists for PROFINET station and module diagnostics are:

The result record (SSL_HEADER) is always two words long:

• Word 0: length of the partial list record (LEN_DATA), excluding the header.
• Word 1: number of records returned (N_DR).

For SSL_ID W#16#0A91 (module status), each record is one word that maps to a configured slot of the CPU or a PROFINET device:

Sample FC written in STL to call SFC 51 for 0x0A91 partial list (rack 0, all slots and PROFINET stations):

FUNCTION FC 1000 : VOID
TITLE = 'Poll SSL 0x0A91 and pack per-station status into DB'
VAR_TEMP
   tBusy : BOOL;
   tLen  : INT;
   tNdr  : INT;
   tErr  : INT;
   tRet  : WORD;
END_VAR
BEGIN
NETWORK
TITLE = 'Single call to SFC 51 for partial list 0x0A91'
   CALL "RDSYSST" (
        REQ             := TRUE,
        SZL_ID          := W#16#0A91,    // module status, all racks
        SZL_INDEX       := W#16#0000,    // 0 = full list
        RET_VAL         := #tRet,
        BUSY            := #tBusy,
        SZL_HEADER      := P#DB100.DBX 0.0 BYTE 4,   // 4 bytes: LEN_DATA, N_DR
        SZL_DATA        := P#DB100.DBX 4.0 BYTE 200  // large enough for full list
        );

   L     #tRet;
   L     0;
   ==I;
   JCN   ERR;          // RET_VAL <> 0 → check error class

   L     DB100.DBW 0;  // LEN_DATA (excluding header)
   T     #tLen;
   L     DB100.DBW 2;  // N_DR (number of records)
   T     #tNdr;
   JU    END_FC;

ERR: L     #tRet;
   T     #tErr;
   // Map SFC 51 error to MW 200 if desired
END_FC: BE
END_FUNCTION

After the SFC call completes (poll BUSY until FALSE), the SZL_DATA section of DB 100 contains one word per slot. Decode the words that correspond to the PROFINET devices to drive two booleans in DB 101: Station1_OK, Station2_OK. These are the tags WinCC reads.

7. Extended PROFINET Diagnostics Configuration

For a graphical representation of the diagnostic state directly in WinCC, use the Extended PROFINET Diagnostics add-on. According to Siemens entry 23678970, the extended PROFINET diagnostics is supported by the IM 153-4AA01 and requires that the option be activated in STEP 7.

STEP 7 setup (V5.5 or V5.6):

1. Open HW Config, select the IM 153-4 of the ET 200M station.
2. Open the dialog Properties → PROFINET IO → Diagnostics.
3. Enable "Activate extended channel diagnostics" and, where offered, the option to forward PROFINET device diagnostics to the higher-level controller (CP 343-1 / CPU).
4. In the Cycle tab, set the update time within 1..512 ms. For diagnostics that are aggregated in WinCC, 32..128 ms is a reasonable balance between CPU load and granularity.
5. Compile and download the HW Config to the CPU.

For the configuration of ET 200M itself, follow the ET 200M configuration page in TIA documentation: ET 200M configuration — TIA Portal V20 documentation. The TIA Portal flow is functionally identical to the STEP 7 V5.5 flow for the diagnostic-relevant options; the same option set exists in both tools.

8. WinCC V6.2 SP3 SCADA Integration

WinCC V6.2 SP3 supports two complementary ways of consuming the diagnostic information.

8.1 Method A — Tag-based indicators (minimal effort)

1. In STEP 7, configure the OPC / MPI / TCP connection to WinCC. The WinCC station connects to the S7-300 over TCP/IP via the CP 343-1 (Industrial Ethernet, ISO-on-TCP, RFC 1006).
2. Expose the two booleans Station1_Bad and Station2_Bad from a shared DB (e.g., DB 101.DBX0.0 and DBX0.1) in the WinCC tag list (binary tags, length 1 bit, address DB 101 DBW 0).
3. In the WinCC Graphics Designer, place two rectangles and bind the fill color to the tag value (e.g., red when TRUE, green when FALSE). Add the text "Station 1 disconnected" / "Station 2 disconnected" behind each.
4. Configure an Alarm Logging entry of class "Error" that fires on positive edge of the boolean, and a "Return" message on negative edge.

8.2 Method B — System Diagnostics add-on for PROFINET

1. Install the System Diagnostics add-on for WinCC V6.2. This is part of the ProAgent / System Diagnostics option on the WinCC setup media.
2. Open the WinCC project, right-click Logical Connections, ensure the S7-300 connection is configured. The system diagnostics viewer requires the S7 variable service to be active.
3. Insert the System Diagnostics faceplate from the WinCC library (under "System Diagnostics"). Place it on the process screen.
4. On the faceplate's Configuration dialog, set the connection to the S7-300 connection. The faceplate enumerates the configured PROFINET devices from the STEP 7 project if the configuration is downloaded to WinCC via Compile OS in PCS 7 or the WinCC Symbol Export mechanism.
5. On a station failure, the faceplate highlights the affected PROFINET device in red and shows the diagnostic text returned by the IM 153-4.

The system diagnostics add-on requires the PROFINET diagnostic data records to be forwarded by the CPU. The relevant configuration toggle is in HW Config at the CP 343-1 (or the CPU if it is a CPU 31x PN/DP): Properties → PROFINET IO → Diagnostics forwarding. Enable "PROFINET device diagnostics → Forward to higher-level system". For CP 343-1, ensure the operating mode is set to PROFINET IO controller (not just S7 communication).

9. End-to-End Configuration Procedure

1. Verify the IM firmware. Open the ET 200M IM in HW Config → Module Information in online mode → check the firmware version. For 6ES7 153-4AA01-0XB0, firmware ≥ V4.x is required to expose all PROFINET diagnostic records used by System Diagnostics.
2. Set the device name. In HW Config → Target system → Ethernet → Edit Ethernet Nodes, assign a unique PROFINET device name to each IM 153-4 (e.g., et200m-1, et200m-2). The device name is what the IO controller uses to address the station; a missing or duplicate name is the most common cause of a station that refuses to come up.
3. Configure the diagnostic address. In the IM 153-4 properties, set the diagnostic address (default 0 in the slot 0, but the project may already reserve a separate one). The CPU and the IM exchange PROFINET alarms over this address.
4. Compile the HW Config and download to the CPU and to the IMs. After the download, the CPUs and IMs go through the AR (Application Relationship) setup. Wait for the BF (Bus Fault) LED on the IM to go off.
5. Insert OB 86 into the S7 program (project tree → Blocks → Insert New Object → Organization Block → OB 86). Without OB 86, a PROFINET station failure sends the CPU to STOP if other OBs are also missing; with OB 86 inserted, the failure is captured and the CPU continues running.
6. Implement the OB 86 logic described in Section 5, or use SFC 51 polling from Section 6. For SCADA-grade diagnostics, implement both — OB 86 drives the immediate reaction, SFC 51 drives the cyclic HMI state.
7. Download the S7 program to the CPU.
8. Configure the WinCC connection to the S7-300, expose the diagnostic DB, and bind the indicators on the process screen (Section 8).
9. Verify the alarm path: pull the Ethernet cable from one of the IM 153-4 ports and confirm that within 1..3 seconds the SCADA shows the corresponding station as disconnected and the Alarm Logging entry fires. Reconnect and confirm the return message.

10. Verification and Acceptance Test

11. Troubleshooting Matrix

12. Field-Proven Notes

• The most common commissioning issue with the IM 153-4AA01 is the device name assignment. Always re-assign the device name with "Edit Ethernet Nodes" after a module replacement, even if the IM was repaired in the same slot with the same MAC address; the name is stored in the IM's non-volatile memory but is not always restored automatically.
• Update time on the PROFINET IO system affects the OB 86 latency. With 32 ms update time, the OB 86 fires within 2..4 update cycles after the cable is removed — typically < 150 ms in practice.
• When using SFC 51, do not call it from OB 1 unconditionally at the same scan rate as the IO update time. A poll period of 100..250 ms is sufficient for the SCADA tag and keeps the OB 1 cycle time low.
• The IM 153-4AA01 only supports a maximum of 12 I/O modules in the ET 200M rack. If the project includes more slots, the IM will reject the configuration at startup. Slot 1 of the ET 200M is reserved for the power supply; the IM is slot 0 and is not counted toward the 12-module limit.
• For a redundant PROFINET network with the IM 153-4 (PN variants only), the diagnostics from each port are reported separately. The System Diagnostics faceplate shows the affected port; the OB 86 path needs additional logic to decode the port number from the extended diagnostic data (record 0x800A).