Reading Siemens S7 Module Information via SFC51 and SSL IDs

Overview

The Siemens SIMATIC S7-300/400 CPUs expose a large set of internal diagnostic and runtime data through partial System State Lists (SSL / SZL). The standard function block SFC51 "RDSYSST" (Read System State) is the PLC-side mechanism for retrieving these partial lists at runtime, while STEP 7 / TIA Portal use them implicitly when the user opens Ctrl+D > Module Information from a PG/PC.

The Module Information dialog (online > target system > module information) shows nine categories:

1. General
2. Diagnostic Buffer
3. Memory
4. Performance Data
5. Identification
6. Time System
7. Scan Cycle Time
8. Stacks
9. Communication

Items 1-5 are documented partial lists accessible through SFC51. Items 6-9 either require a different SFC, are only available via OB1 temporary variables, are only meaningful in STOP/HOLD, or can only be read by the engineering tool (PG) over MPI/PROFINET — not from user program code.

SFC51 RDSYSST Interface

SFC51 is part of the IEC standard block library on every S7-300/400 CPU (and on S7-1500 as "RDSYSST" inside the legacy SFC compatibility set). The full call signature is:

// STL call example
CALL  SFC  51
     SSL_ID    := W#16#xy11      // partial list selector (see below)
     INDEX     := W#16#0001      // sub-index / object ID
     RET_VAL   := MW100          // return value (error code)
     BUSY      := M101.0         // 1 = read in progress
     RD        := P#M 200.0 BYTE 200  // destination area
     DR        := MW104          // length of data returned (bytes)

Parameters:

SSL ID Reference Table

The table below lists the documented partial lists relevant to each Module Information tab. xx denotes the module-class byte described above. All values are in hexadecimal.

SSL_ID W#16#0000 returns the catalog of all supported partial lists for the addressed module class. Query this first to discover which lists the target CPU actually exposes — older CPUs (e.g., CPU 314, CPU 412-1) implement a strict subset of the full catalog.

Module Information Tabs Not Readable Through SFC51

Three of the nine categories shown in Ctrl+D > Module Information are not reachable by SFC51 in RUN. Substitute mechanisms are listed:

Working Example: Scan Cycle Time

The cleanest runtime read of scan-cycle time uses the OB1 temporary interface, declared automatically when OB1 is opened:

// OB1 temp declarations
VAR_TEMP
    OB1_EV_CLASS   : BYTE;       // Bits 0-3 = 1, bits 4-7 = 1
    OB1_STRT_INF   : BYTE;
    OB1_PRIORITY   : BYTE;
    OB1_OB_NUMBR   : BYTE;
    OB1_RESERVED_1 : BYTE;
    OB1_RESERVED_2 : BYTE;
    OB1_PREV_CYCLE : DWORD;      // ms - last cycle
    OB1_MIN_CYCLE  : DWORD;      // ms - shortest cycle
    OB1_MAX_CYCLE  : DWORD;      // ms - longest cycle
    OB1_DATE_TIME  : DATE_AND_TIME;
END_VAR

Move the values into process data or a DB on every OB1 cycle to make them visible to HMI / OPC:

L     OB1_PREV_CYCLE
T     DB100.DBD0      // last cycle [ms]
L     OB1_MIN_CYCLE
T     DB100.DBD4      // min cycle [ms]
L     OB1_MAX_CYCLE
T     DB100.DBD8      // max cycle [ms]

For CPUs without OB1 temps (older S7-300 types), fall back to SFC51 with SSL_ID = W#16#0022; the returned 16 bytes contain the same three counters in the order last, shortest, longest, current OB1 priority.

Working Example: Diagnostic Buffer Scan

The diagnostic buffer keeps the last 200 events on a CPU 414-3. SFC51 supports two modes:

1. Single-record mode: read entry n with SSL_ID = W#16#00Bn, INDEX = n, RD minimum 20 bytes.
2. Multi-record mode: pass SSL_ID = W#16#00B1 and an INDEX = 1; the CPU fills the destination with as many full 20-byte entries as fit and returns DR with the byte count.

// Ladder / FBD equivalent
A     M    100.0        // Trigger: rising edge once per minute
JCN   END1
CALL  SFC   51
     SSL_ID := W#16#00A0     // Buffer header
     INDEX  := W#16#0000
     RET_VAL:= MW110
     BUSY   := M111.0
     RD     := P#DB110.DBX0.0 BYTE 12
     DR     := MW112
END1: NOP 0

Decode DB110.DBD0 for number-of-entries and DB110.DBD4 for newest-event index, then read each event with the matching W#16#00Bn list.

Working Example: Current Time of Day

CALL  SFC   1                      // READ_CLK
     RET_VAL := MW200
     CDT     := DB120.DBD0         // DATE_AND_TIME (8 bytes BCD)

The 8 bytes are coded YYYY-MM-DD hh:mm:ss weekday in BCD, allowing direct forward to an HMI time field without conversion. SZL 0x224 returns the identical bytes; SFC1 is preferred because it is one call rather than two-stage (catalog lookup + data read).

ModuleStates Instruction (S7-1200 / S7-1500)

On S7-1200 / S7-1500, SFC51 is replaced by the ModuleStates extended instruction. It returns a bit list of the operational states of distributed I/O modules on PROFINET or PROFIBUS without the partial-list indirection. See the SIMATIC S7-1200 manual collection for the full reference: ModuleStates — Read module status information of a module.

// SCL example, S7-1500
"DB_ModStates"(REQ := TRUE,
               LADDR := 0,
               STATE := "dbModBitList",
               RETVAL := "iwRet");

Each bit of STATE represents one module. A 0 bit means the module is error-free; a 1 means it is in fault / not accessible. The bit position follows the configured slot order, so users can build HMI error lists directly without parsing SZL records.

Error Codes (SFC51 RET_VAL)

Verification & Commissioning Steps

1. In STEP 7, place SFC51 on a cyclic OB (OB1 or OB35). Wire the desired SSL_ID and a destination DB sized large enough for the longest record (use 200 bytes to cover the diagnostic buffer header).
2. Compile and download. Force the trigger bit, then monitor the destination DB online.
3. Open Ctrl+D > Module Information on the same PG/PC and compare each tab to the data placed in the DB; values must match to the byte.
4. For diagnostic buffer, capture the first 20 entries by iterating W#16#00B1..W#16#00B4 four times with INDEX = 1, 2, 3, 4 — four is the maximum number of single-record reads per SFC51 invocation on S7-400. For deeper scans, run multiple OB1 passes.
5. For cycle time, verify against OB1_PREV_CYCLE. If values differ, suspect a CPU under scan-load that is masking the cycle counter.
6. Disconnect PG online and run a control panel test that polls the DB to prove the values are visible without engineering tools.

Troubleshooting Matrix

Field-Proven Caveats

Related Function Blocks