Reading CP 341 Diagnostics with SFC51 SSL_ID W#16#00B1 in S7-300/400

The Siemens CP 341 (Point-to-Point Communication processor) is a serial interface module used in S7-300 and, via the IM 153-2 interface, in S7-400 and S7-400H redundant systems. Like every Siemens distributed or central I/O module, the CP 341 publishes a 4-byte standard diagnostic record that the CPU can read out over the backplane bus. The standard tool for this on STEP 7 V5.x is the system function SFC 51 (RDSYSST) with partial system status list SSL_ID W#16#00B1. This reference documents the SFC 51 call, the 4-byte record layout, the meaning of each bit, common field errors, and the verification procedure.

1. Diagnostic Architecture of the CP 341

The CP 341 supports two complementary diagnostic paths:

1. Hardware interrupt (OB 40 / OB 82 / OB 86) when a channel or module fault occurs. The CP can be configured to generate a diagnostic interrupt that is routed to the assigned CPU, indicating a malfunction of the CP 341 over the S7-300 backplane bus.
2. Polled diagnostics via SFC 51 using the module's standard diagnostic data record. The CP 341 provides 4 bytes of diagnostics information that can be requested at any time through the system status list (SSL).

For S7-400 stations that use an IM 153-2 to expose an S7-300 ET 200M rack (for example, to insert a CP 341 in an S7-400H system), the same SFC 51 mechanism applies. The CP's logical base address is the slot's input or output address configured in HW Config (STEP 7) or in the TIA Portal hardware catalog.

2. SSL_ID W#16#00B1 — Module Diagnostic Information

SSL partial list W#16#00B1 is the standard "module diagnostic data" record. The list is one entry long per module; each call returns the 4 bytes of the targeted module.

For the CP 341 the most common call uses the input address space (bit 15 = 0), because in STEP 7 the CP 341 occupies a small input range used for status and handshake. If you wired the slot as an output-dominant module, flip bit 15 to 1.

2.1 Sample SCL / Structured Text call

// Read 4-byte diagnostic record of CP 341 at I-base address 272
// (replace 272 with the configured logical base address of your CP)

FUNCTION_BLOCK FB_CP341_Diag
VAR
    iRetVal   : INT;
    bBusy     : BOOL;
    szlHeader : STRUCT
        LENTHDR : WORD;
        N_DR    : WORD;
    END_STRUCT;
    abDiag    : ARRAY[0..3] OF BYTE;   // 4 bytes module diagnostic data
END_VAR
BEGIN
    // Trigger one-shot read
    iRetVal := RDSYSST(
        REQ      := TRUE,
        SZL_ID   := W#16#00B1,
        INDEX    := 272,              // bit15=0 => input address space
        RET_VAL  := iRetVal,
        BUSY     := bBusy,
        SZL_HEADER := szlHeader,
        DR       := abDiag);
END_FUNCTION_BLOCK

2.2 Ladder equivalent (STEP 7 V5.x)

      DBX.DBX0.0   "CP_Diag_Start"            --[ CALL SFC 51 ]--
                              REQ     :=  "CP_Diag_Start"
                              SZL_ID  :=  W#16#00B1
                              INDEX   :=  272         // I-address of CP 341
                              RET_VAL :=  "CP_Diag_RetVal"
                              BUSY    :=  "CP_Diag_Busy"
                              SZL_HEADER := "CP_Diag_Hdr"
                              DR      :=  P#DB100.DBX0.0 BYTE 4

3. Decoding the 4-Byte Diagnostic Record

The four bytes returned in abDiag[0..3] have the following meaning for an S7 module (CP 341 follows the same SSL definition):

4. STEP 7 vs. TIA Portal — Where the CP 341 Lives

Although the CP 341 is technically an S7-300 module, it is fully supported in:

• STEP 7 V5.x / V5.5 SP2+ for SIMATIC S7-300 and S7-400 (including H systems).
• TIA Portal V16+ for S7-300 CPUs and S7-400 CPUs (the CP 341 is included in the TIA hardware catalog under "S7-300 / Point-to-Point / CP 341"). The manual page for the module is at CP 341 (S7-300, S7-400) configuration.

Regardless of the engineering tool, the runtime mechanism is the same: the CP 341 publishes a 4-byte diagnostic data record over the backplane bus that the CPU can fetch with SFC 51 / RDSYSST at SSL W#16#00B1. The TIA Portal SCL/FB syntax for RDSYSST is identical to STEP 7 V5.x.

5. Step-by-Step Procedure

1. Identify the CP's logical base address. Open HW Config (STEP 7) or the device view in TIA Portal and read the I-address (or Q-address if used) of the CP 341 slot. Typical values for a single CP 341 in slot 6 of a rack are 272..279.
2. Declare a 4-byte buffer in a global DB or in the instance DB of an FB. The buffer must be exactly 4 bytes; SFC 51 will not write to a buffer that is the wrong size.
3. Call SFC 51 / RDSYSST with SZL_ID = W#16#00B1 and INDEX = base address + (0 if input, 32768 if output).
4. Evaluate RET_VAL. 0 means success. Negative values are error codes; the most relevant ones are listed in Section 6.
5. Decode byte 1, bits 0..3 to confirm the slot is occupied by a CP. Anything other than 8 (hex 0x08) means the module class is wrong — the slot is the wrong module, or the wrong SSL index is being used.
6. Decode byte 0 to identify the fault class (internal/external/channel). Use this to drive a status word or HMI faceplate.

5.1 STEP 7 Configuration Checklist

6. SFC 51 RET_VAL Error Codes

7. Triggering Diagnostics from OB 82

For an event-driven implementation, hook the call into OB 82 (diagnostic interrupt):

// OB 82 - Diagnostic Interrupt
// OB82_MDL_DEFECT bit 0..3 of OB82_MDL_DEFECT flag in the local temp area

IF "CP_OB82_Evidence" THEN
    IF OB82_MDL_DEFECT = TRUE THEN
        // The CP 341 is signalling a fault - read SSL W#16#00B1
        // to learn which byte/bit tripped the alarm
    END_IF;
END_IF;

For a polled implementation, call SFC 51 cyclically in OB 1 (slow scan, e.g. every 1 s) and store the result in a global DB for the HMI to display. The CP 341 manual is available from Siemens Industry Online Support as CP 341 Point-to-Point Communication, Installation and Parameter Assignment — section 6 of that manual describes the diagnostic record in detail.

8. Verification Procedure

1. Insert a fully working CP 341 in the configured slot. After CPU startup the SF LED on the CP must be off and byte 1 bits 0..3 must equal 1000b (0x08, module class CP).
2. Trigger SFC 51 and read abDiag[1] = 16#08. This confirms the SSL path is reaching the right slot.
3. Pull the front connector of the CP 341. Within one OB 82 cycle the SF LED lights and abDiag[0] bit 5 = 1 ("front connector missing").
4. Disconnect 24 V at the load supply. abDiag[0] bit 4 = 1 ("external auxiliary voltage missing").
5. Remove the CP 341 from the slot. OB 85 (program execution error) or OB 82 fires with abDiag[0] bit 7 = 1 ("wrong module / module removed").

9. Troubleshooting Matrix

10. Edge Cases and Field Notes

• S7-400H redundant CPU: both H-CPUs receive the diagnostic record independently. Place the SFC 51 call in a non-fail-safe OB (OB 1, OB 35, OB 82) and use a primary/backup discrimination tag if you need to log which CPU read which value.
• IM 153-2 redundancy: if you operate two IM 153-2s on the same PROFIBUS segment, the SFC 51 call must be made on the active IM. Reading the passive IM returns a "module not available" error (RET_VAL 80A4) until failover completes.
• CP 341 in a distributed ET 200M on PROFINET: SFC 51 still works because the CP's standard diagnostic data record is mapped through the PROFINET/PROFIBUS gateway (IM 153-4PN or IM 155). Just confirm that the slot is a real module in HW Config and that the device is online.
• Multiple CP 341 modules: call SFC 51 sequentially per module; never call SFC 51 in parallel for two different SSLs on the same CPU because the call is not re-entrant.

11. Cross-References and Official Documentation

• CP 341 Point-to-Point Communication - Installation and Parameter Assignment Manual (Siemens Industry Online Support, attachment 1117397)
• CP 341 (S7-300, S7-400) configuration in TIA Portal V21 (Siemens TIA documentation portal)