Reading Sinamics PROFINET Status from S7-400 via CP443-1

PROFINET IO Communication Status on S7-400 with CP443-1: Reading Sinamics Inverter Health

A SIMATIC S7-400 CPU using a CP443-1 as the PROFINET IO Controller cannot query the per-device communication status of subordinate SINAMICS drives with SFC51 RDSYST the way an S7-300 PN CPU can, because the S7-400's RDSYST reads the local CPU's system state lists rather than the IO Device list of the PN Controller. The controller-side alternatives — SFC13 (DPNRM_DG), SZL/WZM (SSL/WZM) partial-list reads, OB82 diagnostic interrupt, and OB86 rack/station-failure OB — together with the cyclic PROFIdrive status words provide a complete picture of every drive on the ring. This reference shows how to implement each path, how to combine them into a single status DB for the HMI/SCADA, and how to verify the result on a real CP443-1 with SINAMICS G120/S120 drives configured with standard PROFIdrive telegrams.

1. PROFINET IO Architecture: Controller vs. Device

PROFINET IO defines three station roles per IEC 61784-2: IO Controller (the PLC that owns the data exchange), IO Device (the field device that exchanges process data), and IO Supervisor (engineering/diagnostic station). A CP443-1 inserted in an S7-400 rack can act as an IO Controller when configured as such; the CP443-1 Advanced also supports IO Device mode, but in a typical S7-400 layout the CP is the IO Controller for the SINAMICS drives.

SFC51 RDSYST reads the system state lists (SSLs) of the local CPU or, in some configurations, the diagnostic status of slaves on a DP master. In an IO-Device context (for example, an S7-300 CPU acting as a PROFINET IO device on a higher-level controller), RDSYST can expose the controller's view. From the IO Controller side, however, RDSYST cannot list "my IO devices are alive" because the controller is the master, not a polled device. This is the core reason RDSYST behaviour differs between the S7-300 PN CPU and the S7-400 with CP443-1.

For diagnostics on the controller side, the following mechanisms are available regardless of role:

Mechanism	Block	Information Returned	Use Case
Read diagnostic buffer	SFC13 DPNRM_DG	Channel errors, station status, vendor-specific diagnostic records	Pull diagnostic data on demand from a specific IO device
Diagnostic interrupt	OB82	Module-level diagnostic event (incoming / outgoing)	React to a fault event in real time
Rack / station failure	OB86	Loss or return of a PROFINET IO device	Detect that a drive has dropped off the network
SSL/WZM partial-list reads	SFC51 RDSYST	Module status, rack status, diagnostic status of slaves	Poll the local view of configured IO devices
Process status words	Direct I/O read (PEW)	Drive status word (ZSW1/ZSW2), warn/fault bits	Read PROFIdrive status in normal cyclic data

2. Why RDSYST Behaves Differently on S7-400 / CP443-1

SFC51 RDSYST on an S7-400 reads the SSLs of the local CPU, not of subordinate IO devices on a CP443-1. The CP443-1 owns its own diagnostic buffers and IO data; the status of devices attached to the CP443-1 is exposed by the CP, not by the local CPU's SSLs. To read that status, the user program must either:

• Call SFC13 DPNRM_DG against a specific IO device's diagnostic address, or
• Poll SSL_ID 0x0091 / 0x0131 / 0x0132 / 0x0191 / 0x0192 on the IO Controller's PN interface, or
• Subscribe to OB82 / OB86 events generated by the IO Controller when a device enters or leaves the operational state.

In the SIMATIC S7-400 Automation System reference manual (Siemens Industry Online Support entry ID 1117740), the SSL access for distributed I/O is documented as starting from SSL_ID 0x0091 (module LED) and 0x0131 / 0x0132 (DP slave diagnostic and status). These are the same SSLs RDSYST targets — but to return data for an IO Device on the CP443-1, the LADDR parameter must address the CP443-1 interface, and the SSL must be one the CP supports. Direct SSL access from the S7-400 user program is rarely the easiest path on a CP443-1, because the CP's firmware handles its own IO state machine and may not surface the full set of SSLs to RDSYST. Most field-proven implementations therefore use OB82 / OB86 plus SFC13.

3. CP443-1 Operating Modes Relevant to Diagnostics

The CP443-1 ships in three principal variants — CP443-1, CP443-1 Advanced, and CP443-1 RNA (Redundant Network Access) — and diagnostic capabilities differ between them:

Variant	Order Number	PN Controller	PN Device	PROFIenergy	Notes for diagnostics
CP443-1 (legacy)	6GK7443-1EX11-0XE0	Yes	No	No	Basic IO controller; older firmware; no IRT
CP443-1	6GK7443-1EX20-0XE0	Yes	No	No	Replaces EX11; supports IRT and PROFINET security
CP443-1 (current)	6GK7443-1EX30-0XE0	Yes	No	Yes	Adds extended diagnostic buffer; current product family
CP443-1 Advanced	6GK7443-1GX20-0XE0	Yes	Yes	Yes	Supports both controller and device role
CP443-1 RNA	6GK7443-1RX20-0XE0	Yes	No	Yes	Redundant network access for S7-400H

For OB82 / OB86 to fire, the CP443-1 must be configured as the PROFINET IO Controller and must have its devices assigned to it in HW Config. The CP's diagnostic buffer can be read with the online/diagnostic view in STEP 7 — useful during commissioning, but not directly addressable from the user program with simple SFCs. For a detailed description of CP443-1 functions, see the CP443-1 manual on Siemens Industry Online Support entry ID 76488150.

4. SFC13 DPNRM_DG: Reading a Single IO Device's Diagnostic Buffer

SFC13 reads the diagnostic data of a DP slave or PROFINET IO device. It is the standard tool for "give me the current diagnostic record of that drive right now." The signature in STEP 7 is:

RET_VAL := SFC13( REQ := TRUE, LADDR := W#16#..., RETVAL := ..., RECORD := P#DBxx.DBX0.0 BYTE 64, BUSY := ... );

LADDR is the diagnostic address configured in HW Config for the IO device (not the IO address — the diagnostic address is the one used by STEP 7's "Online → Accessible Nodes" path). RECORD must be a byte sequence large enough to hold the largest expected record; 64 bytes is a safe minimum, 256 bytes is recommended for SINAMICS drives because they include channel diagnostics and vendor-specific extensions.

The diagnostic data record format returned by SFC13 follows the PROFINET IO specification (IEC 61784-2 / IEC 61158-6-10):

Offset	Length	Meaning
0	2 bytes	Block type (DS0 = 0x0000) and block length
2	1 byte	Block version (typically 0x01)
3	1 byte	Number of additional alarm-type blocks
4	2 bytes	Slot 0 — ChannelProperties / ChannelNumber
6	2 bytes	Slot 0 — ChannelErrorType / ExtChannelErrorType
8	2 bytes	Slot 0 — Direction / Type
10	2 bytes	Slot 0 — Padding
12+	6 bytes per slot	One block per affected slot

When the device is healthy and idle, SFC13 returns DS0 with no per-slot blocks. The first per-slot block appears only when a fault or warning is active.

Important: SFC13 with LADDR pointing to a PROFINET IO device only works on the IO Controller. Calling it on a CPU that is not the IO Controller of that device returns W#16#80C4 (communication fault) or W#16#80C3 (resource error). This is another reason a CP443-1 acting as controller is required.

5. OB82 — Diagnostic Interrupt OB

OB82 fires whenever an IO module on a PROFINET/DP line raises a diagnostic interrupt. The start information contains the logical base address of the module, the diagnostic event (incoming / outgoing), and the channel diagnostic data. Start info layout (OB82_PV_REC) for an S7-400:

• Bytes 0–7: standard OB82 header (event class, fault ID, OB priority, OB number)
• Bytes 8–11: IO flags (16 bits, one bit per byte of the IO area)
• Bytes 12–13: logical base address of the module raising the interrupt
• Bytes 14–15: diagnostic-event identifier (0x0001 = incoming, 0x0002 = outgoing)
• Bytes 16–23: module status (DS0)
• Bytes 24–29: channel diagnostic, slot 0
• Bytes 30–35: channel diagnostic, slot 1
• Bytes 36+: extended channel diagnostics

Sample implementation in STL for an S7-400 / CP443-1:

OB82:
  L     #OB82_MDL_LADDR         // logical base address of faulty module
  T     "drive_status_db".fault_addr

  L     #OB82_EV_CLASS          // B#16#39 = incoming, B#16#38 = outgoing
  L     B#16#39
  ==I
  JC    _incoming

  L     B#16#38
  ==I
  JC    _outgoing

  JU    _ob82_end

_incoming:
  S     "drive_status_db".alarm_active     // bit: alarm pending
  JU    _ob82_end

_outgoing:
  R     "drive_status_db".alarm_active

_ob82_end:
  BE

OB82 only fires if it exists in the project and the CPU's property "Required" is set to Yes for OB82. In HW Config, the default behaviour for the CPU is to leave OB82 required if you have configured any PROFINET/DP devices; check the CPU's properties under "OB → OB82 — Diagnostic Interrupt".

6. OB86 — Rack Failure OB

OB86 fires when a configured but unavailable IO device enters or leaves the network (DP slave / PROFINET IO device failure). The start information layout:

Offset	Length	Meaning
0	8 bytes	Standard OB86 header
8	2 bytes	Event ID (W#16#38 = slave failure, W#16#39 = slave return)
10	2 bytes	Reserved
12	2 bytes	Logical base address of the affected IO device (if applicable)
14	2 bytes	Fault ID — see table below
16+	variable	Additional information depending on fault ID

Fault IDs returned in OB86 for PROFINET IO devices:

Fault ID (hex)	Meaning
0x0010	PROFINET IO: loss of IO device (physical removal)
0x0011	PROFINET IO: return of IO device
0x0012	PROFINET IO: loss of submodule
0x0013	PROFINET IO: return of submodule
0x0014	PROFINET IO: diagnosis of IO device — different from the loss
0x0015	PROFINET IO: substitute / replacement
0x0016	PROFINET IO: device temporarily unavailable (substitute in progress)

Use OB86 with fault ID 0x0010 as the definitive "drive went away" event. Use OB82 for the diagnostic-level "drive reports a fault channel" event. Both are useful, but they answer different questions.

7. Combined Status Map: One DB Per Drive

For a fleet of SINAMICS inverters, build a single shared DB indexed by drive number. The DB is updated by OB82 and OB86 and is the data source for the HMI or SCADA. Field-tested layout:

DATA_BLOCK "drive_status_db"
STRUCT
  comm_ok        : ARRAY[1..32] OF BOOL;   // TRUE = device reachable, no fault
  alarm_active   : ARRAY[1..32] OF BOOL;   // TRUE = OB82 alarm pending
  loss_event     : ARRAY[1..32] OF BOOL;   // TRUE = OB86 loss event received
  return_event   : ARRAY[1..32] OF BOOL;   // TRUE = OB86 return event received
  last_fault_id  : ARRAY[1..32] OF WORD;   // last OB86 fault ID
  last_laddr     : ARRAY[1..32] OF WORD;   // last logical base address
  zsw1           : ARRAY[1..32] OF WORD;   // PROFIdrive ZSW1, cyclically read
  zsw2           : ARRAY[1..32] OF WORD;   // PROFIdrive ZSW2 if configured
END_STRUCT
END_DATA_BLOCK

Indexing rule: each drive's logical base address is mapped to a slot index in the DB via a small lookup. The simplest mapping is to make the IO address equal to (slot_index × 16) − 16, or to use a small lookup table stored in HW Config comments. The CP443-1 firmware applies its own address arithmetic internally; the user program only sees the logical address as configured in HW Config.

8. Cyclic Status from PROFIdrive Telegram

For SINAMICS drives configured with standard telegrams (Telegram 1, 2, 3, 4, 5, 6, 7, 9, 102, 105, 106), the controller receives the status word ZSW1 (status word 1) and ZSW2 (status word 2) in every cycle. Bit-level layout of ZSW1 (PZD1 received from the drive):

Bit	Name	Meaning
0	RDY_ON	Ready to switch on
1	RDY_RUN	Ready to run (precharge OK)
2	RDY_REF	Operation enabled (drive released)
3	FAULT	Fault active
4	NO_OFF2	OFF2 not active (coast stop not requested)
5	NO_OFF3	OFF3 not active (quick stop not requested)
6	INHIBIT_ON	Switch-on inhibit
7	ALARM	Warning active
8	AT_SETPOINT	Drive at setpoint
9	REMOTE	Control from PLC requested
10	ZSW1_B10	Speed actual value reached
11	ZSW1_B11	Torque limit reached
12	ZSW1_B12	Hold/Quick stop active
13	ZSW1_B13	Standstill indication
14	ZSW1_B14	Speed setpoint reached
15	ZSW1_B15	BCD 1 (parameter mode)

ZSW1 bit 2 (RDY_REF) is the strongest single-bit indicator that the drive is fully operational. ZSW1 bit 3 (FAULT) and bit 7 (ALARM) reflect the drive's own fault and warning state. Combine these with OB82 / OB86 events for a complete picture: OB86 loss = physically gone; OB82 alarm = drive reports a fault but is still talking; ZSW1.7 = drive warns but still runs; ZSW1.3 = drive is faulted.

9. SFC13 Sample Code in STL

This snippet reads a SINAMICS drive's diagnostic buffer on demand:

CALL  SFC13 (
  REQ    := M10.0,                  // trigger (rising edge)
  LADDR  := W#16#0A,                // diagnostic address from HW Config
  RETVAL := MW12,                   // return value
  RECORD := P#DB20.DBX0.0 BYTE 64,  // buffer in DB20
  BUSY   := M14.0
);

// Sample return value interpretation
L     MW12
L     W#16#0000
==I
JC    _ok                            // 0000 = done, no error

L     MW12
L     W#16#80C3
==I
JC    _busy                          // 80C3 = job still busy
// any other value: see SFC13 error documentation

_ok:
  SET
  R     M10.0
  JU    _end

_busy:
_end:

SFC13 return codes for PROFINET IO:

RETVAL (hex)	Meaning
0x0000	Job completed without error; RECORD contains valid data
0x80C3	Resource error — job still busy, BUSY = TRUE
0x80C4	Communication fault — device not reachable, wrong LADDR, or not on this IO Controller
0x80B2	LADDR invalid
0x8092	RECORD length too short for the data returned

10. PLCSIM Limitations for PROFINET IO Controller

S7-PLCSIM (versions through V16 / V17 / V18) supports PROFINET IO Controller emulation in limited scope: only the IO image is simulated; no real network traffic is generated, no real IO devices respond. The following SFCs and OBs behave differently in PLCSIM versus a real CP443-1:

• SFC13 DPNRM_DG: returns W#16#80C4 (communication fault) because no device responds. To test, simulate the diagnostic record manually by writing to the target DB.
• OB86: does not fire because there is no real IO device failure. Simulate by forcing the OB start info and downloading it via PLCSIM's debug API.
• OB82: same as OB86 — simulate manually.
• PEW reads from the IO image: return the value last written by the test program.

If you need to test the diagnostic flow on PLCSIM, set the CPU's property "OB82 / OB86 — required" to "Yes" and ensure the OB exists in the project. PLCSIM will only call them if the start info is forced; the test harness should populate OB82_PV_REC and OB86_PV_REC manually via the S7-PLCSIM API.

11. SINAMICS-Specific Diagnostic Parameters (via PROFIdrive Parameter Channel)

Standard telegrams 1, 2, and 3 do not include the parameter channel (PKW). To read fault memory, alarm history, or device-name parameters, use one of:

• Telegram 4 or 7 / 9 (with PKW), or
• Data record read/write (SFB52 RDREC / SFB53 WRREC) to access SINAMICS parameters 947, 948, 2100, 2130 etc.

Example: read parameter r0947[0..7] (current fault code, up to 8 faults) with SFB52 against slot 0 of the drive:

CALL  SFB52 (
  REQ    := M20.0,
  ID     := DW#16#0A,                 // logical address of drive
  INDEX  := 16#002F,                  // data record index for r0947 (drive-specific)
  MLEN   := 16,                       // 16 bytes
  VALID  := M22.0,
  BUSY   := M22.1,
  ERROR  := M22.2,
  STATUS := MW24,
  LEN    := MW26,
  RECORD := P#DB30.DBX0.0 BYTE 16
);

The exact data record numbers and offsets are documented in the SINAMICS S120 / S150 / G120 Communication Manual on Siemens Industry Online Support entry ID 109757304.

12. STEP 7 Configuration Steps

1. Open HW Config and place the CP443-1 in the S7-400 rack. Assign a PN IO interface and an IP address within the subnet used by the SINAMICS drives.
2. Add SINAMICS drives as IO devices. Assign a unique Device Name to each drive (for example, "drive01" … "drive32"). The Device Name is case-sensitive and must match the name loaded into the drive (default is empty on first commissioning).
3. Configure the diagnostic address of each IO device. This is the address passed to SFC13.
4. Configure the IO addresses. The Telegram layout (1, 2, 3, 4, 5, 6, 102, 105, 106) determines the input/output lengths.
5. Insert OB82 and OB86 into the project (right-click OB1 → "Insert New Object → Organization Block"). Confirm the CPU property "OB82 / OB86 — required" is set to Yes.
6. Compile and download the hardware configuration and the user program.
7. Assign the IO device names to the physical drives using STEP 7's "PLC → Ethernet → Assign Device Name" menu. The drives will not appear in the cyclic exchange until this is done.

13. Verification Checklist

Check	Method	Expected Result
Drive visible in PG/PC "Accessible Nodes"	STEP 7 → Options → Set PG/PC Interface → Accessible Nodes	Drive listed with Device Name and IP
Drive reports OK to controller	STEP 7 → PLC → Monitor/Modify → diagnostic buffer of CP443-1	No "station failure" entries
OB82 fires on a real drive fault	Force a fault on one drive (for example, remove encoder cable on SINAMICS S120)	OB82 start info populated; DB.alarm_active[slot] = TRUE
OB86 fires on a real drive loss	Power off drive or disconnect PROFINET cable	OB86 start info with fault ID 0x0010; DB.loss_event[slot] = TRUE
ZSW1 updates cyclically	Monitor PEW for the drive in VAT	Bits update at the configured send clock (typically 1 ms)
SFC13 returns data	Trigger SFC13 from VAT with M10.0; watch RETVAL and RECORD bytes	RETVAL = 0; RECORD block version = 0x01
OB82 / OB86 still fire after the drive returns	Reconnect the cable and observe DB.return_event	DB.return_event[slot] = TRUE; comm_ok returns to TRUE

14. Troubleshooting Matrix

Symptom	Likely Cause	Action
OB86 never fires	OB86 not loaded in CPU; CPU property "OB86 — required" set to No	Add OB86 to project; recompile and download
OB86 fires repeatedly without a real failure	Watchdog time on the CP too short; send-clock mismatch	Match update time in CP and drive configuration; raise CP watchdog
SFC13 returns 0x80C4	LADDR wrong; IO device not assigned to this controller; IO device not reachable	Verify Device Name assigned; check "Accessible Nodes"; verify LADDR matches the diagnostic address in HW Config
SFC13 returns data but no per-slot blocks	Drive is healthy — DS0 alone is returned	Force a fault to verify the per-slot path
ZSW1 bits never change	Wrong telegram; drive not in cyclic exchange	Verify Telegram layout; check green LED of drive's PROFINET interface
Drive Name missing	Device Name never assigned to physical drive	STEP 7 → PLC → Ethernet → Assign Device Name; load the configuration into the drive
PLCSIM does not call OB82 / OB86	PLCSIM cannot simulate real PROFINET traffic	Force the start info manually using S7-PLCSIM API for unit-test coverage
OB82 fires but DB slot index wrong	Logical base address not translated correctly	Implement a lookup table mapping LADDR → slot index
OB86 fault ID is 0x0014 instead of 0x0010	Drive is reporting a diagnosis but not a loss	Read SFC13 record for channel details

15. Sample Diagnostic Status Word for SCADA

Once the DB is populated, expose a single DWORD per drive to the SCADA layer:

DATA_BLOCK "drive_diag_word"
STRUCT
  diag_word : ARRAY[1..32] OF DWORD;     // bit-packed status
END_STRUCT
END_DATA_BLOCK

Bit map of diag_word per drive:

Bit	Source	Meaning
0	ZSW1.2	Operation enabled
1	ZSW1.3	Fault active
2	ZSW1.7	Warning active
3	DB.comm_ok	Communication OK (no OB86 loss)
4	DB.alarm_active	OB82 alarm pending
5	DB.loss_event	OB86 loss event received since last reset
6	ZSW1.6	Switch-on inhibit
7–15	reserved	—
16–31	last_fault_id	Most recent fault code from SINAMICS

16. PROFINET Cable and Switching Considerations

OB86 events that the controller reports as "loss" can be caused by:

• Cable break between switch and drive.
• Switch port flapping (cable length exceeds 100 m for copper; 50 m for some industrial variants).
• EMI on long cable runs near VFD output cables — keep PROFINET cable ≥ 200 mm from motor cables and use shielded variants.
• Device-name conflict — two drives with the same name on the network will fight for the slot.
• Firmware mismatch — a drive with a major firmware revision mismatched to the GSDML may fail to come up.

The PROFINET system description (Siemens Industry Online Support entry ID 19292127) provides guidance on cabling, send-clock selection, and watchdog-time calculation.

17. Comparing RDSYST vs. SFC13 vs. OB86

Approach	Pros	Cons
RDSYST (SFC51) with SSL 0x0C91	Same call works for all IO devices on the local interface	CP443-1 may not support the SSL fully; slow polling; depends on CP firmware version
SFC13 DPNRM_DG	Detailed channel and vendor diagnostics	One call per device; cannot be polled at high rate
OB86 + OB82 events	Event-driven; minimal CPU load; immediate notification	Event-driven only — a quiet loss may not be seen until OB86 fires; some fault scenarios never raise OB82
Cyclic ZSW1 read	Always current; works with every Telegram	Does not report link-down loss (PEW is frozen on last value)

Best practice is to combine all four: OB86 / OB82 for event-driven response, ZSW1 for ongoing status, SFC13 for deep diagnostic, and SFC51 against SSL 0x0C91 as a periodic poll for "is this drive still alive?". The pattern is also described in the TIA Portal DeviceStates instruction reference, which conceptually applies to controller-side diagnostics on any SIMATIC platform.

18. Common Pitfalls

• Calling SFC13 on a CPU that is not the IO Controller of the target device. The CP443-1 must be the IO Controller; the S7-400 CPU merely hosts the user program that calls SFC13. This is the most common cause of "SFC13 returns 0x80C4".
• Storing the RECORD buffer in an instance DB of an FB that is called multiple times — the buffer may be corrupted by parallel access. Use a shared DB or a standalone buffer.
• Forgetting that OB82 / OB86 must be present in the project if the CPU property "Required" is set to Yes.
• Assuming PLCSIM supports PROFINET IO Controller — it does not, in the traditional sense. Use a real CP443-1 for integration testing.
• Ignoring the send-clock mismatch between the controller's PROFINET cycle and the drive's accepted update time. SINAMICS drives generally support 1 ms / 2 ms / 4 ms; a mismatch will cause the drive to leave the cyclic exchange and trigger OB86.
• Using a single watchdog setting for a heterogeneous drive fleet — older firmware revisions of SINAMICS G120 require longer watchdog times than current S120 firmware.