Querying S7-300 CPU315-2PN/DP States to Excel via OPC and SFC51

CPU 315-2 PN/DP Hardware Overview

The SIMATIC S7-300 CPU 315-2 PN/DP (MLFB 6ES7315-2EH14-0AB0, successor to 6ES7315-2EH13-0AB0) is a mid-range CPU that integrates both a PROFINET interface (X2, two-port switch) and a PROFIBUS-DP interface (X1, MPI/DP combined) on the front panel. It is intended for medium-sized applications in discrete manufacturing where the program and data footprint exceed the CPU 312/314 range but do not justify a CPU 317/319.

Reference: SIMATIC S7-300 CPU 315-2 DP / CPU 317-2 DP Manual, Edition 12/2013 (entry ID 12996906) and the CPU 315-2 PN/DP product announcement (entry 19860749) on the Siemens Industry Online Support portal. The CPU type is selected in STEP 7 / TIA Portal under "SIMATIC 300 / CPU 315-2 PN/DP" with the matching firmware version (the firmware on the MMC must match the STEP 7 project or be higher).

Communication Paths to a PC

There are four practical ways to query a CPU 315-2 PN/DP from a host PC. The right choice depends on the available CP card in the PC, the number of concurrent connections required, and the licensing budget.

For a single PC reading tags and writing them to Excel, the typical setup is the on-board Ethernet NIC + a SIMATIC NET Softnet Lean S7 (6GK1704-1LW) license. Softnet Lean supports up to 8 S7 connections, which is enough for one OPC client and a few diagnostic connections.

Querying System Status with SFC51

Standard library SFC51 "RDSYSST" (Read system status) returns structured information about the CPU state, including LED states, run/stop transitions, communication status, and module faults. This is the function referenced in the field report and is the correct way to query system states from within a STEP 7 program.

SFC51 is part of the Standard Library shipped with STEP 7 V5.5 / TIA Portal V13+. It is documented in the SIMATIC S7-300/400 System and Standard Functions Reference Manual (entry 44240604) and the equivalent TIA Portal help.

SFC51 interface:

// SFC51 - RDSYSST (Read system status)
// Return: RET_VAL (Int) - error code
// REQ    : Bool  - TRUE to start
// INDEX  : Int   - sub-list ID (see table below)
// SZL_ID : Word  - system status list ID
// DR     : Any   - destination data area (must be large enough)
//        :       - SSL_HEADER, then the data records
// BUSY   : Bool  - true while read in progress
// SZL_HEADER struct: { LENTHDR : Word; N_DR : Word }

CALL  SFC51
       REQ    := TRUE            // or triggered cyclically / by event
       INDEX  := 0               // 0 for single sub-list, 1..32 for partial list
       SZL_ID := W#16#0011       // W#16#0011..0019 module identification
       DR     := P#DB100.DBX0.0  // destination ANY pointer (at least 34 bytes)
       RET_VAL:= MW100
       BUSY   := M101.0;

For "what is the CPU doing right now?" the most useful IDs are W#16#0011/0019 (identity), W#16#0024 (LEDs), and W#16#0121 (communication). For fault history, the diagnostic buffer (W#16#0A91) is the same content you see in STEP 7 under PLC > Module Information > Diagnostic Buffer.

Example: read CPU identification into DB100 and then write those bytes to a global DB that the PC polls over OPC.

// OB1 / OB100 - read CPU SSLs once at startup, then periodically
DATA_BLOCK DB100
  STRUCT
    SSL_HEADER : STRUCT   // 4 bytes
      LENTHDR  : WORD;   // length of one data record
      N_DR     : WORD;   // number of records returned
    END_STRUCT;
    SZL_DATA  : ARRAY[1..30] OF BYTE; // up to 30 bytes of payload
  END_STRUCT
END_DATA_BLOCK

// Call in OB1 once per second (or in OB35 if you want a constant rate)
CALL SFC51 (REQ:=TRUE, INDEX:=0, SZL_ID:=W#16#0011, DR:=P#DB100.DBX0.0, RET_VAL:=MW200, BUSY:=M201.0);

SIMATIC NET OPC Server Architecture

SIMATIC NET is the PC-side communication package that exposes S7 memory (DBs, M, I, Q, PE, PA, timer/counter) and S7 connections to Windows applications as OPC DA 2.05/3.0 items. The stack has three layers:

1. SIMATIC NET PC Station - configured with the SIMATIC NET Commissioning Tool or TIA Portal (since V14). The PC Station is the OPC server's logical owner and contains the "OPC Server" slot and one or more "S7 connection" slots bound to an IE or PROFIBUS CP.
2. S7 driver (Softnet S7 Lean, Softnet S7, or CP 1612/1623 firmware) - implements the S7 protocol on the wire (ISO-on-TCP, port 102; or PROFIBUS FDL).
3. OPC DA 3.0 Server - registered as Siemens.SimaticNET.OPCDA.1. Browsable from any OPC client (Excel, VB, C#, MatrikonOPCSim, Kepware, etc.).

The minimum configuration for a single-PC OPC bridge to one CPU 315-2 PN/DP looks like this in the SIMATIC NET Commissioning Tool:

PC Station
├─ Index 1: WinCC Application  (or "OPC Server")  -- > slot 1
├─ Index 2: IE General (on-board NIC "Intel I219-V") -- > slot 2
└─ Index 3: S7 Connection -- > slot 3
              Partner: S7-300 CPU 315-2 PN/DP, IP 192.168.0.10, rack 0, slot 2
              Local connection resource: 0x01..0x0F (auto-assigned by S7DOS)

The S7 connection is then downloaded to the PC Station via "Station Configurator > PC Station > Download to Station". The OPC server reads/writes items using this connection.

Licensing: each "S7 connection" you define consumes one connection license in Softnet S7 Lean. Softnet Lean gives 8 connections for the single license; for a small project with one CPU you do not need a full Softnet S7 license.

Building the OPC-to-Excel Bridge

Excel is not a native OPC client. You need either (a) an OPC client component embedded in Excel via VBA, or (b) a thin Excel plug-in such as SIMATIC NET OPC DataControl. The field report mentions S7Label, S7Number, S7WCVB_Button, and S7WCVB_Slider; these are the SIMATIC NET ActiveX controls that ship with the SIMATIC NET PC software and are intended for use in VB6 / VB.NET (or, as the OP notes, Borland Delphi) form designers. They are not bundled with plain STEP 7 or with the OPC Scout.

For a generic, low-cost path you can use one of the two approaches below.

Option 1: SIMATIC NET OPC + Excel VBA (no STEP 7 required for the OPC side)

The OPC client automation wrapper is a Microsoft COM component that works with any OPC DA 2.0 server, including the SIMATIC NET one. The reference is the SIMATIC NET OPC - Programming with OPC and S7 (entry 15355168) manual.

Procedure:

1. Install SIMATIC NET on the PC; activate at least one license (Softnet Lean S7).
2. Configure the PC Station with an IE General on the NIC that reaches the CPU and an S7 connection to the CPU.
3. Download the PC Station and verify the connection is online (you should see the S7 connection icon turn green in the Station Configurator).
4. Open Excel, press Alt+F11, open the VBA editor, and add a reference to Siemens.SimaticNET.OPCDA (or use the generic OPC Automation 2.0 wrapper, file name OPCDAAuto.dll).
5. Paste the sample code below into a new module.
6. Run the macro. Tags defined in CONFIG_TAGS will be written to the named range on the active sheet.

'
' Excel VBA - poll SIMATIC NET OPC DA 2.0 and write to cells
' Requires: OPC Automation 2.0 (OPCDAAuto.dll) reference
' Tested against SIMATIC NET V16/V17 OPC server
'
Option Explicit

Const SERVER_NAME As String = "Siemens.SimaticNET.OPCDA.1"
Const UPDATE_INTERVAL_MS As Long = 1000

Dim WithEvents opcGroup As OPCAutomation.OPCGroup
Dim opcServer As OPCAutomation.OPCServer
Dim opcItems() As OPCAutomation.OPCItem
Dim itemHandles() As Long
Dim itemErrors() As Long
Dim itemValues As Variant
Dim itemTimes() As Date

Sub StartOPC()
    Dim itemsCfg(0 To 4, 0 To 1) As Variant  ' (item, name)
    itemsCfg(0, 0) = "S7:[CPU315_PNDP]DB100,W0"  ' Word
    itemsCfg(1, 0) = "S7:[CPU315_PNDP]DB100,W2"  ' Word
    itemsCfg(2, 0) = "S7:[CPU315_PNDP]DB100,REAL4"  ' Float
    itemsCfg(3, 0) = "S7:[CPU315_PNDP]MB10"  ' Merker byte
    itemsCfg(4, 0) = "S7:[CPU315_PNDP]E0.0"  ' PE bit
    itemsCfg(0, 1) = 0: itemsCfg(1, 1) = 0: itemsCfg(2, 1) = 0: itemsCfg(3, 1) = 0: itemsCfg(4, 1) = 0

    Set opcServer = New OPCAutomation.OPCServer
    opcServer.Connect SERVER_NAME, ""

    Set opcGroup = opcServer.OPCGroups.Add("XLSGroup")
    opcGroup.IsActive = True
    opcGroup.IsSubscribed = True
    opcGroup.UpdateRate = UPDATE_INTERVAL_MS
    opcGroup.DeadBand = 0

    ReDim opcItems(0 To 4)
    ReDim itemHandles(0 To 4)
    Dim i As Long
    For i = 0 To 4
        Set opcItems(i) = opcGroup.OPCItems.AddItem(itemsCfg(i, 0), i)
        itemHandles(i) = opcItems(i).ServerHandle
    Next i

    opcGroup.AsyncRead 5, itemHandles, itemErrors, itemValues, itemTimes
End Sub

Private Sub opcGroup_AsyncReadComplete(ByVal TransactionID As Long, _
                                       ByVal NumItems As Long, _
                                       ClientHandles() As Long, _
                                       Values() As Variant, _
                                       Qualities() As Long, _
                                       TimeStamps() As Date, _
                                       Errors() As Long)
    Dim i As Long, sheet As Worksheet
    Set sheet = ThisWorkbook.Sheets("Live")
    For i = 0 To NumItems - 1
        sheet.Cells(i + 2, 2).Value = Values(i)
        sheet.Cells(i + 2, 3).Value = Qualities(i)
        sheet.Cells(i + 2, 4).Value = TimeStamps(i)
    Next i
    ' Trigger next read
    opcGroup.AsyncRead NumItems, ClientHandles, Errors, Values, TimeStamps
End Sub

Sub StopOPC()
    On Error Resume Next
    opcServer.OPCGroups.Remove "XLSGroup"
    opcServer.Disconnect
    Set opcGroup = Nothing: Set opcServer = Nothing
End Sub

The S7:[CPU315_PNDP] prefix matches the connection name configured in the SIMATIC NET PC Station (or TIA Portal). DB100,W0 means data block 100 word 0. REAL4 reads a 32-bit real. E0.0 reads a process-input bit. Quality of 192 (OPC_QUALITY_GOOD) is required for valid data; 0 (OPC_QUALITY_BAD) indicates a fault - check connection and SZL_ID access permissions in the CPU.

Option 2: OPC DA Bridge to CSV / clipboard (no VB, no ActiveX)

If you cannot install any SIMATIC NET software on the target machine, use the OPC Scout (which ships with SIMATIC NET) to dump tags to a CSV, then refresh Excel's data import. The OPC Scout supports a "DaBrowse" tool and can log to file. This is not real-time but is acceptable for trend logging at 1 sample/second or slower.

ActiveX Controls Without a Full STEP 7 License

The source question asks which components are required to use the SIMATIC NET ActiveX controls (S7Label, S7Number, S7WCVB_Button, S7WCVB_Slider) without buying the full STEP 7 suite. The list of required components is:

The OCX files will register fine on a machine that has no STEP 7, but they will fail at design-time with "License not found" if no Softnet S7 license is active on the SLS. The cheapest paid path is therefore Softnet S7 Lean + the SIMATIC NET runtime. There is no freeware equivalent of these specific Siemens controls.

For Borland Delphi, the controls are still usable because they are standard COM/ActiveX. Use Component > Import ActiveX Control in Delphi to generate the Pascal wrapper, then drop them on a TForm and wire S7WCVB_Button to a tag handle on the OPC server. The same caveats apply: you must still own a SIMATIC NET license to run the controls against a real CPU.

Free and Open-Source Alternatives

Where licensing is a concern, the two most widely deployed open-source S7 stacks are:

A typical Snap7 + Python data-pump to Excel looks like this:

# pip install python-snap7 openpyxl
import snap7, time, struct
from openpyxl import Workbook, load_workbook
from openpyxl.utils import get_column_letter

client = snap7.client.Client()
client.connect("192.168.0.10", 0, 1, 102)   # IP, rack, slot, port
wb = Workbook(); ws = wb.active; ws.title = "Live"
ws.append(["Time","DB100.Word0","DB100.Word2","DB100.Float4","MB10"])

while True:
    db1 = client.db_read(100, 0, 12)  # 12 bytes from DB100
    w0, w2 = struct.unpack(">HH", db1[0:4])
    f4     = struct.unpack(">f",  db1[4:8])[0]
    mb10   = db1[8]
    ws.append([time.strftime("%H:%M:%S"), w0, w2, round(f4,3), mb10])
    wb.save("plc_log.xlsx")
    time.sleep(1.0)

This bypasses SIMATIC NET entirely; the only cost is development time and the IP connectivity (X2 port on the CPU, port 102/TCP must be reachable; on firmware < V3.0 you may need to enable "PUT/GET" in the CPU's Protection properties).

Diagnostic Buffer and Error Codes

When the OPC server reports bad quality or no data, the diagnostic buffer is the first place to look. SFC59 "RD_REC" reads DS0 (module diagnostic data) and SFC13 "DPNRM_DG" reads DP slave diagnostic frames. For the diagnostic buffer itself, use SFC51 with SZL_ID = W#16#0A91 or use OPC item S7:[CPU]DIAGBUF (only available with SIMATIC NET's "Symbolic OPC Server" mode).

Performance and Timing Considerations

Throughput numbers you should expect on a real CPU 315-2 PN/DP at the X2 PROFINET port (measured with Softnet S7 Lean on a 100 Mbit/s link, payload ~120 bytes per poll):

For Excel via VBA, do not poll faster than 500 ms; Excel's redraw will saturate long before the OPC server does. For closed-loop control, use the S7 connection for trigger/event-driven reads (event-OBs + PUT/GET) rather than periodic polling.

Security and Access Protection

From firmware V3.0 onward, the CPU supports a tiered password model that also governs OPC and SFC51 access:

• No password (factory default): read/write HMI access, no SSL access, no SFC51 with W#16#0xxx that contains protected info.
• Read-only password (level 1): HMI can read; writes return W#16#80F1.
• Read/write password (level 2): HMI can read/write; SSL access to W#16#0011..0019 (CPU identification) allowed; SZL IDs above that require level 3.
• Full access (level 3): required for diagnostic buffer (W#16#0A91), OB list, performance data.

Coupling: CPU Properties > Protection > Access Level in STEP 7 / TIA Portal. The same password must be entered on the PC side if the OPC server is configured to authenticate via S7DOS.

Putting It Together: A 20-Line Mini-Reference

1. CPU 315-2 PN/DP: 6ES7315-2EH14-0AB0, integrated PROFINET (X2) + PROFIBUS (X1).
2. From STEP 7: enable PUT/GET in CPU protection; create a DB (e.g. DB100) for the values you want exposed.
3. For system state from inside the PLC: use SFC51 with W#16#0011, W#16#0019, W#16#0024, W#16#0121, W#16#0A91.
4. PC: install SIMATIC NET runtime + Softnet S7 Lean (6GK1704-1LW), or use Snap7 / libnodave for free.
5. Configure PC Station with an IE General on the right NIC and an S7 connection to the CPU (rack 0, slot 2).
6. From Excel: use the OPC Automation 2.0 wrapper, or write a Python/Snap7 pump and save to xlsx.
7. ActiveX controls (S7Label, S7Number, etc.) require a paid SIMATIC NET license; there is no freeware version.
8. Verify quality=192 on every item; log bad quality and SFC51 RET_VAL for diagnostics.