Reading Profibus Slave Diagnostic on SIMATIC 555 with APT

Problem Overview

The SIMATIC 555 (TI505 series) CPU exposes Profibus slave diagnostics only through the Read Slave Diagnostic (RSD) instruction. RSD lives inside the Relay Ladder Logic (RLL) instruction set of Tisoft - it is not an APT instruction, not a structured-text block, and not a function accessible from APT's chart programming environment. Engineers who run their main application in APT (the Productivity Application Tool, the structured successor to Tisoft for the TI505 family) cannot issue RSD directly, but the data the RSD instruction reads is precisely the standard diagnostic buffer that EN 50170 Volume 2 mandates for every Profibus DP slave.

This article documents the field-proven bridge: build a small RSD-only ladder subroutine in Tisoft, reserve ladder and variable words in APT's Control Configuration, and load the two programs in a strict order so the ladder survives every APT download. The result: Profibus diagnostic data sits in V-memory where APT charts can monitor and alarm on it natively.

Why APT Cannot Issue RSD Directly

APT and Tisoft share the same V-memory and the same I/O image, but the compiler is split. APT compiles tasks (analogous to OB1 / cyclic) and uses CALL/CALB to invoke ladder subroutines that the user has pre-built in Tisoft. The RSD opcode is a relay-ladder-only instruction - APT's compiler does not parse it. Issuing RSD from an APT chart produces a compile error. The only way to call RSD is from a Tisoft rung.

The reference for the instruction and its operand format is the SIMATIC 555 Programming Reference manual. The relevant opcode layout is:

Per the SIMATIC 555 Programming Reference, one RSD rung consumes six (6) words of ladder memory regardless of slave count or length value. This number is fixed and is the key sizing input for the APT reservation.

Prerequisites

• SIMATIC 555 CPU (or any TI545/TI555/TI575 with Profibus DP scanner) running firmware that supports RSD
• Tisoft (or 505 Workshop) installed on a programming PC
• APT installed and able to open the project's Control Configuration
• Working Profibus DP network with a known slave GSD file and configured node addresses
• Serial or Ethernet download path to the PLC
• Documentation of existing V-memory allocation in the live APT program to avoid collisions

PROFIBUS DP Standard Diagnostic Format (EN 50170 Volume 2)

When RSD executes, the buffer it fills follows the format defined by EN 50170 Volume 2 (the PROFIBUS DP standard). The first six bytes are always present, and bytes 6+ are the optional extended diagnostic area.

Station Status 1 bit mapping (per PROFIBUS DP):

Station Status 2 bit mapping:

Bytes 2-3 only appear when Diag.Mas.S (master diagnostic) has been activated in the master's parameterization message. Bytes 4-5 hold the slave's Ident Number as set by the manufacturer in its GSD file. Bytes 6+ are vendor-specific extended diagnostics - the format and meaning are defined per device profile (e.g. encoder, drive, valve block). For an example of how to interpret extended channel diagnostic bytes in a modular station, see the Schneider Electric Profibus DP diagnose service FAQ.

Step-by-Step: Building the RSD Bridge

1. Open a fresh Tisoft project and create a dedicated subroutine (SBR) named RSD_DIAG or similar. Keep it in its own file so APT recompiles do not affect it.
2. Add one RSD rung per slave. Order them by slave address (3, 4, 5, ...). For each rung, populate the operands as shown in the recipe section below.
3. Reserve destination V-memory in a block that will not collide with APT. Document the start and end V-address of each slave's buffer.
4. Compile the Tisoft program and note the total word count of the new subroutine. The RSD instruction contributes 6 words per rung. Tag addresses, comments, and blank rungs add 0-2 words each.
5. Open the APT project, go to Control Configuration, then Reserved Locations.
6. Enter the ladder word count in the Ladder field: Tisoft subroutine word count plus 20-30% spare for future additions.
7. Enter the variable word count in the Variable field: total V-memory words consumed by all RSD buffers plus 20-30% spare.
8. Recompile the APT program. The compiler allocates the reserved area at the high end of the V-memory map.
9. Place the PLC in PGM mode and clear PLC memory using the Tisoft or APT utility menu. This is mandatory - do not skip.
10. Download the Tisoft program first. Use Tisoft's download dialog and let it complete fully before touching APT.
11. Download the APT program second, and uncheck the "Clear PLC before download" option. APT's download manager will overlay its application on top of the existing Tisoft image without erasing the RSD subroutine.
12. Switch to RUN mode from APT debug. The CPU begins scanning the RSD subroutine every cycle. Open an APT chart and add a watch window on the V-memory range you reserved.

RSD Operand Recipe

A typical RSD rung for slave address 5 with a 32-byte diagnostic buffer starting at V300 and a status word at V340 looks like this in Tisoft:

|  RSD(05, V300, 32, V340)  |

Operands in order:

For a 12-slave network the rung list looks like:

|  RSD(03, V100, 32, V140)  |
|  RSD(04, V200, 32, V240)  |
|  RSD(05, V300, 32, V340)  |
|  RSD(06, V400, 32, V440)  |
|  ... 12 rungs total ...
|  RSD(14, V1300, 32, V1340) |

Total ladder words: 12 x 6 = 72. Total V-memory used: 12 x 36 = 432. Reserve 100 ladder words and 550 variable words in APT to give headroom.

APT Control Configuration - Reserved Locations

The APT Reserved Locations dialog tells the compiler to leave a hole in the V-memory map so Tisoft-owned data is not overwritten. Configure it exactly as shown:

Download Order and PLC Memory Hygiene

The download sequence is the make-or-break step. APT defaults to "Clear PLC before download" - leave that checked for the very first download, but for every subsequent download, uncheck it. The RSD subroutine lives in ladder memory that APT does not know about, and an APT-initiated clear will wipe it.

Monitoring Diagnostic Data in APT Charts

Once the CPU is in RUN mode, the RSD subroutine writes the standard diagnostic bytes into the reserved V-memory range on every scan. In APT, build a chart page that displays each slave's status bytes.

For a slave at V300, the chart monitor configuration is:

// Slave 5 - Standard Diagnostic
V300  : Station Status 1  (binary view, bits 0-7)
V301  : Station Status 2  (binary view, bits 0-7)
V302  : Station Status 3  (binary view, bits 0-7)
V303  : Master Addr
V304  : Ident# High
V305  : Ident# Low
V306+ : Extended Diagnostic
V340  : RSD Status Word   (0 = OK, FFFF = error)

To convert V300 (a 16-bit word) into individual bits, use APT's MOVE and AND pattern, or simply enable the binary display in the chart watch window. Many teams mask the bits of interest with constants for HMI display:

// Mask the "Diag.Fault" bit (bit 7 of Station Status 1) for HMI alarm
FaultFlag = V300 AND 0x0080

Sizing the Tisoft Subroutine

The total Tisoft ladder word count is the sum of every RSD rung (6 words each) plus any glue logic you add (coils, contacts, MOVE blocks for status processing). Use the following rule of thumb:

Total Ladder Words = (N_slaves x 6) + (Aux_rungs x 4) + Spare
Total V-Memory Words = (N_slaves x (Length + 4)) + Spare
// "Length + 4" because the status word and a 3-word internal buffer
// sit adjacent to the user buffer in TI505 implementations.

Add 20-30% spare on top so future slaves (a new drive or a new I/O island) do not require another APT recompile. The example below shows a 12-slave sizing for a typical cell.

505 Workshop / PLC Workshop Suite Alternative

For new deployments on a 2500-series or TI555-class CPU, the modern path is the PLC Workshop Suite. It is a Windows-native IDE that supersedes Tisoft and adds:

• Integrated Profibus configurator with live topology import from the GSD library
• Online Profibus status monitor that reads the same standard diagnostic buffer the RSD instruction writes
• Symbolic tag database shared between ladder and chart logic - no separate APT ladder reservation step
• Native ladder upload/download with project diff

The PLC Workshop Suite supersedes both Tisoft and APT, storing Profibus diagnostics as named tags accessible from any block type, removing the bridge technique entirely on supported hardware.

Modern S7 Equivalent: DPNRM_DG

Engineers migrating to S7-1200 or S7-1500 with Profibus DP masters use the DPNRM_DG instruction. It is the direct conceptual descendant of the SIMATIC 555 RSD instruction, but in a CALL-able function block form. The TIA Portal DPNRM_DG documentation describes the operands as follows:

The buffer populated by DPNRM_DG follows the same EN 50170 Volume 2 layout documented in the standard diagnostic format section above. Migration from a SIMATIC 555 RSD bridge to S7 DPNRM_DG is essentially a translation of the rung count to a series of CALLs and the V-memory pointer to a DB block.

Physical Layer Diagnostics - Diagnostic Repeater

Standard diagnostic bytes tell you that a slave has a fault, not why. The Siemens Diagnostic Repeater (6ES7 972-0AB01-0XA0) is a Profibus DP repeater that monitors segment-level signal quality on copper cables, including reflections, missing terminators, and short circuits. Connecting it between the master and the first slave adds a physical-layer alarm stream that complements the standard diagnostic data from RSD. The Siemens diagnostic repeater delivery release lists the part number, supported baud rates (9.6 kbps to 12 Mbps), and segment monitoring capabilities.

Troubleshooting Matrix

Verification Procedure

1. Disconnect one Profibus slave and confirm the Diag.Non_Existent bit (Station Status 1, bit 1) sets within one scan cycle in the corresponding V-memory word.
2. Force a diagnostic condition on a slave (unplug an I/O module from a modular station) and confirm the Diag.Fault bit (bit 7) sets and the extended diagnostic bytes in V306+ carry the expected channel error code.
3. Reconnect the slave and confirm the Diag.Fault bit clears after the next slave's parameterization cycle.
4. Compare the slave's Ident Number in V304-V305 against the value in the GSD file. A mismatch indicates the master is configured for the wrong device profile.
5. Cycle power on the PLC and verify the diagnostic data resumes within two scan cycles of RUN mode entry.
6. Run an APT download (without "Clear PLC before download" checked) and verify the diagnostic data continues to update. If it stops, the APT download overwrote the Tisoft area - increase the reservation.

Field-Proven Caveats

• Cycle time penalty. Each RSD takes a measurable slice of the scan. On a 12-slave network with 32-byte buffers, expect an additional 15-30 ms per scan on a TI555. If cycle time is critical, distribute the RSDs across multiple scans by enabling each rung on a different scan counter value.
• V-memory address alignment. TI505 V-memory is word-addressed, but Profibus diagnostic data is byte-stream. Always use an even-numbered starting V-address to avoid misalignment when reading bytes from a chart.
• Memory reservation at compile. APT only reclaims the reserved V-memory at full recompile. If you change the reservation in Control Configuration and forget to recompile, the new reservation has no effect.
• Firmware compatibility. Some legacy TI545 CPUs shipped before RSD support landed. Confirm the CPU firmware revision supports RSD before starting the bridge - the Programming Reference manual lists the minimum cut-in firmware.
• Reserved Locations are project-wide. If the same Tisoft subroutine is used across multiple APT projects (a typical maintenance scenario), the reservation value must be consistent in every project that downloads the same image, otherwise the diagnosis V-memory will be in a different location in each.

Frequently Asked Questions