Reading MP277 Profibus Diagnostic Status with SFC13

Problem Overview

When a SIMATIC MP277 (or any WinCC flexible Runtime panel such as MP270, MP277, MP370, MP377) is connected to a S7-300/S7-400 PLC over PROFIBUS, engineers often want to know whether the HMI is still alive, whether it has completed startup, and whether the operator has switched the device offline. The instinct is to call SFC13 "DPNRM_DG" (Read Slave Diagnostic Data) and decode the returned Standard Diagnostic Bytes, Identifier-Related Diagnostics, and Module Status – the same approach that works for an ET200S, ET200M, or ET200pro station.

SFC13 will return some bytes for the MP277, and field experience shows that the data does change when the panel is unplugged from the bus. The problem is that the payload is not documented the way an ET200S manual documents it. There is no published mapping of "byte 0 = …, byte 7 = …" for the MP277 because, from the PLC's point of view, the HMI is not a DP slave at all.

Root Cause of the Documentation Gap

PROFIBUS defines three classes of diagnostic information that a DP slave must make available to a Class 1 master (see IEC 61158 / EN 50170, PROFIBUS DP specification):

• Standard diagnostic bytes (6 bytes) – station status 1, station status 2, station status 3, and the master address.
• Identifier-related diagnostics – per-module OK/fault bits.
• Module status / channel-related diagnostics (DPV1) – extended alarms.

For ET200S / ET200M stations Siemens publishes a byte-by-byte table in the ET200S Distributed I/O System manual. For the MP277, that dataset exists internally but is not part of the public documentation set – the panel is a Master Class 2, not a slave, and Siemens does not commit to a fixed slave diagnostic layout for it.

The supported path for the PLC to read HMI operational state is the Coordination area pointer in WinCC flexible. The HMI writes two words into a configured DB on the PLC, and every bit has a defined meaning.

The Coordination Area Pointer

The Coordination area pointer is one of several WinCC flexible area pointers used for user-defined data exchange between the HMI and the PLC (the others are Tag, Date/Time, PLC Job, Project ID, and Screen Number). The Coordination pointer has a fixed length of two words (4 bytes) and is updated by the HMI in its own cycle.

Prerequisites

• STEP 7 V5.4 or later with a configured S7-300 / S7-400 station and a connected MP277.
• WinCC flexible 2007 / 2008 / 2008 SP2 (or the matching SP/HF patch level installed on the panel).
• A free data block in the S7 CPU (for example DB100) of at least 4 bytes, located in a non-optimised area accessible to the HMI connection.
• PROFIBUS connection between PLC and MP277 (MPI/PROFIBUS switch set to PROFIBUS on the panel back).

Step-by-Step Configuration

1. Create the coordination DB in STEP 7

1. In the S7 program, open the SIMATIC Manager and add a new data block (e.g. DB100) with the symbol HMI_Coordination.
2. Declare the first four bytes as WORD:
   coord WORD (Word 0, contains startup / mode / life bit)
   reserved WORD (Word 1, leave as scratch, do not use)
3. Save and download the DB to the CPU. Make sure the DB is not optimised (S7-300/400 classic DB layout – this is the default).

2. Configure the Coordination area pointer in WinCC flexible

1. In the WinCC flexible project, open Connections and select the S7 connection used by the panel.
2. Open Area Pointers and double-click Coordination.
3. Enable the pointer and enter the PLC address: DB 100, Byte 0 (offset 0, length 2 words – the field is fixed, you can only choose the DB number and byte offset).
4. Compile and transfer the project to the MP277.

3. Evaluate the bits in the PLC

The two relevant signals are DB100.DBX0.0 (startup), DB100.DBX0.1 (operating mode) and DB100.DBX0.2 (life bit). Sample STL code that flags an HMI failure when no life-bit edge has been seen for > 3 s:

// DB100 = HMI coordination, edge flag = M100.0, watchdog timer = T1
A   DB100.DBX0.2       // life bit
FP  M100.0             // positive edge of life bit
=   M100.1             // M100.1 = "got life tick"

A   M100.1
L   S5T#3S
SD  T1                 // retrigger 3 s watchdog on every tick

AN  T1                  // T1 elapses when no tick for > 3 s
=   M100.2              // M100.2 = "HMI communication lost"

Add a startup-completed flag:

A   DB100.DBX0.0       // startup bit = 1 once HMI has finished starting
S   M100.3             // "HMI ready"

And a current-mode indicator:

A   DB100.DBX0.1       // 1 = HMI offline
=   M100.4             // "HMI offline"

When SFC13 Still Makes Sense

Even with the Coordination pointer in place, SFC13 (DPNRM_DG) remains useful for monitoring the bus health of other DP slaves (ET200S, ET200M, ET200pro, frequency inverters with PROFIBUS option, etc.). The call signature is:

CALL SFC13
  REQ    := TRUE            // request once on startup, FALSE to retrigger
  LADDR  := W#16#3FF        // diagnostic address of the slave (HW config)
  RET_VAL := MW200          // return code (0 = OK, 80C1 = slave not found, …)
  RECORD := P#DB110.DBX0.0 BYTE 32   // buffer for up to 32 bytes of diag data
  BUSY   := M210.0

Common return values from SFC13 you may see at runtime:

Decoding SFC13 Output for a Standard ET200S Slave

For comparison and for the stations where the manual is available, the first 6 bytes of an ET200S SFC13 read are:

Bytes 6 onward are identifier-related and module-status diagnostics. The MP277 does not guarantee this layout; that is why the Coordination pointer is the supported solution.

PROFIBUS Bus-Health Diagnostics Beyond the HMI

When the HMI is healthy but other slaves are intermittent, escalate to bus-physics tools. The PROFIBUS specification (IEC 61158) defines signalling levels, telegram timing, and a repeater-based topology that must be terminated at both ends with 220 Ω. Field-proven checklist for any "DP slave sometimes goes off bus" report:

1. Check termination: exactly two terminators, one at each physical end of the segment, both set to ON.
2. Measure the shield-to-ground bond at every drop.
3. Confirm baud rate and segment length match (1.5 MBd ≈ 200 m, 500 kBd ≈ 400 m, 187.5 kBd ≈ 1000 m – the standard table, not an interpretation).
4. Use an oscilloscope or a class-2 PROFIBUS tester to view the idle voltage, the signal rise time, and the reflected waveform at the ends of the line. Tools such as the Softing PROFIBUS Diagnostics Suite decode signal quality, retries, and lost telegrams continuously and can be left inline during commissioning.
5. Run a DPV1 trace if acyclic communication is suspect – the "Everything you ever wanted to know about DPV1 diagnostics" white paper from PI (PROFIBUS & PROFINET International) describes the four diagnostic categories (start-up, cyclic, acyclic, alarms) and how a class-2 master, including an HMI, uses them.
6. Cross-check the diagnostic-repeater counters (if a diagnostic repeater is fitted) for the segment that is misbehaving.

Verification

1. Download the STEP 7 and WinCC flexible projects. Power-cycle the MP277. With a VAT table open on DB100, confirm byte 0 transitions from 00 (or a briefly set startup = 0) to 04 / 05 / 06 / 07 as the life bit toggles, and that bit 0 is steady 1 after startup.
2. From the panel's project menu, choose Stop Runtime / "Switch offline". The operating-mode bit (DBX0.1) must go to 1 within one update cycle.
3. Disconnect the PROFIBUS connector at the MP277. The life-bit edge must stop within ~1 s, and the 3 s watchdog flag (M100.2) must raise.
4. For the bus health check, run the Softing diagnostics suite (or any class-2 tester) for at least 30 minutes under normal load and confirm zero lost telegrams and zero retries.

Troubleshooting Matrix

Field Notes and Caveats

• The Coordination pointer is updated roughly every 200–500 ms depending on the configured acquisition cycle. Do not sample the life bit faster than the update rate or you will see false edges.
• On an S7-1500, the DB used for the area pointer must remain in the classic (non-optimised) area pointer-compatible layout. Optimised / "new" DBs are not visible to WinCC flexible without an explicit PUT/GET access point.
• If you migrate from WinCC flexible to WinCC (TIA Portal) the same Coordination pointer exists, but it is configured in the HMI device's Connections → Area Pointers editor of the TIA Portal project and points to a DB whose attributes are "Accessible from HMI".
• For a multi-HMI setup, each panel needs its own Coordination DB – the pointer is a 1:1 binding, not broadcast.