Recording S7-400H Analog Values: SIMATIC Manager Methods

1. Problem Definition and Engineering Constraints

The requirement is to capture analog process values from a SIMATIC S7-400H high-availability controller - specifically a CPU 417-4H (typical catalog number 6ES7417-4XT05-0AB0 or successor variants 6ES7417-4HT14-0AB0) - at a 100 ms sampling interval, persist the resulting dataset on the Programming Device (PG), and export it to a text/CSV file for offline trend analysis. The execution environment is restricted to SIMATIC Manager (STEP 7 V5.x); SCADA packages, third-party HMI, and non-Siemens tools are not permitted on the engineering workstation.

Two physical constraints dominate the design choice:

• Sampling period: 100 ms is faster than the typical 1 s SCADA poll and pushes the system outside the comfort zone of slow WinCC flexible trends, requiring either cyclic-interrupt organization blocks (OB3x) in the controller or a vendor tracing tool that hooks the S7 protocol directly.
• Storage target: The data must land on the PG, not in the CPU. With 100 ms cycles, a single AI tag generates 600 records per minute; ten tags for one hour produce 360,000 records, so file format, write rate, and write buffer depth must be sized before commissioning.

2. Prerequisites - Hardware, Firmware, and Software Stack

Verify the CPU has PUT/GET enabled (default since firmware V3) by opening HW Config > CPU 417-4H properties > Communication. If the H station is part of a Y-Link / PROFINET IO ring, ensure that the multicast/broadcast filter on the switches is disabled for the S7 connections used by the recording tool - otherwise the 100 ms packets are dropped under load.

3. Method Selection Matrix

For a strict "SIMATIC Manager only" requirement, Methods 1 and 2 remain inside the Siemens toolchain. Methods 3, 4, and 5 require the listed add-on software; the table flags them for completeness because, in practice, the 100 ms constraint forces at least one of them onto the PG.

4. OB35 Cyclic Interrupt Configuration for 100 ms Sampling

The default OB35 runs every 100 ms (parameter "OB35 execution time" = 100 ms in HW Config > CPU properties > Cyclic Interrupts). For 100 ms sampling of an analog input, the sample is best latched in OB35 so that the read timestamp is independent of OB1 jitter.

1. In HW Config, right-click the CPU 417-4H → Object Properties → Cyclic Interrupts.
2. Set OB35 to 100 (ms). Acceptable range: 1 ms to 60 000 ms in 1 ms steps.
3. Assign priority 12 to OB35 (default) - this sits below the H-sync OBs and above OB1, preventing OB1 stalls from corrupting the cadence.
4. Create OB35 in the S7 program sources. Use the SCL variant for clarity:

// OB35 - 100 ms analog sampler
// Inputs:  PIW 512..526 (8 AI from ET200M)
// Output:  DB100 (ring buffer of 600 records = 1 minute)

DATA_BLOCK DB100
  STRUCT
    head   : INT;       // write pointer, 0..599
    n      : INT := 600;// capacity
    ts_ms  : ARRAY[0..599] OF DWORD; // 32-bit millisecond tick
    ai     : ARRAY[0..599, 0..7] OF INT; // 8 AI values, raw 0..27648
  END_STRUCT
END_DATA_BLOCK

FUNCTION "FB_Sampler" : VOID
BEGIN
  // Read system tick - 1 ms resolution on 417-4H
  #ts := TIME_TCK();
  
  // Read 8 AI in one frame (consistent because we are inside OB35)
  #ai[0] := PIW512; #ai[1] := PIW514; #ai[2] := PIW516; #ai[3] := PIW518;
  #ai[4] := PIW520; #ai[5] := PIW522; #ai[6] := PIW524; #ai[7] := PIW526;
  
  // Write into ring buffer
  i := DB100.head;
  DB100.ts_ms[i]  := DWORD(#ts);
  DB100.ai[i,0]   := #ai[0]; DB100.ai[i,1] := #ai[1];
  DB100.ai[i,2]   := #ai[2]; DB100.ai[i,3] := #ai[3];
  DB100.ai[i,4]   := #ai[4]; DB100.ai[i,5] := #ai[5];
  DB100.ai[i,6]   := #ai[6]; DB100.ai[i,7] := #ai[7];
  
  i := i + 1;
  IF i = 600 THEN i := 0; END_IF;
  DB100.head := i;
END_FUNCTION

Capacity math: 600 records × (4 B timestamp + 16 B AI) = 12 KB. The 417-4H ships with tens of MB of work memory; this is negligible. For a full 24 h run, plan 600 records/min × 60 × 24 = 864,000 records (about 17 MB raw). On the H side, mark DB100 as non-redundant (Properties → "Block is not redundant") to avoid double-buffering cost; the recording is offline diagnostic, not safety-relevant.

5. Method 1 - DB-Based Circular Buffer with CSV Export

This is the lowest-cost path: STEP 7 only, no extra runtime on the PG, and a one-time export at the end of the recording session.

1. Build DB100 as shown in §4. Stop the CPU only if you need to enlarge the buffer (online block expansion is possible from firmware V4).
2. Start the recording - the OB35 sampler runs forever and overwrites the oldest record every minute.
3. Stop the recording by clearing the OB35 cycle (set OB35 to "Execution: none" in HW Config, then download HW Config).
4. Open SIMATIC Manager → Online → Accessible Nodes, browse the H station, mark DB100, and choose Upload to PG (Ctrl+U). The block arrives as an online view; right-click and select Monitor/Modify to confirm the head pointer stopped incrementing.
5. Export: from the same Monitor/Modify window, Table view → Copy and paste into Excel. For headless export, use the STEP 7 File → Save As on the online DB to produce a .db file.

For batched CSV export of the ring buffer, a 30-line SCL snippet inside OB1 (when triggered by a flag from the PG) can write the timestamps and AI values into a STRING and use the XPUT/XGET blocks to ship the string to the PG. This is rarely used; the manual copy approach above is the field-proven one.

6. Method 2 - SIMATIC ProDave Library

ProDave (catalog 6ES7 708-2AA00, current SIMATIC ProDave V7) is a DLL that exposes the S7 protocol as C/C++/VB function calls. It is the canonical answer to "read PLC data from a STEP 7-only workstation in real time" and is the mechanism every Siemens training example uses.

1. Install ProDave on the PG. Add the install directory (typically C:\Program Files\Siemens\Automation\ProDave) to the system PATH.
2. In STEP 7, configure the PC/PG interface to "TCP/IP → Network card" pointing at the S7-400H rack's industrial Ethernet subnet.
3. Define a connection in NetPro: S7 connection → unspecified → Partner: CPU 417-4H. Note the local TSAP (typically 01.01) and the partner TSAP (03.01 for slot 3 rack 0).
4. Compile a small console program that calls the ProDave functions. The skeleton in C is:

/* prodave_log.c - 100 ms polling of DB100 on CPU 417-4H */
#include <windows.h>
#include <stdio.h>
#include <"prodave7.h">        /* SIMATIC ProDave V7 header */

#pragma comment(lib, "prodave7.lib")

#define CONN        1
#define DB_NUM      100
#define DB_START    0
#define DB_LEN      12000        /* 600 records * 20 B */
#define POLL_MS     100

unsigned char  buf[DB_LEN];

int main(void) {
    FILE *f = fopen("C:\\logs\\s7400h_$(date).csv", "a");
    if (!f) return 1;

    if (prodave_init()        != 0) return 2;
    if (prodave_connect(CONN) != 0) return 3;

    for (;;) {
        if (db_read(CONN, DB_NUM, DB_START, DB_LEN, buf) == 0) {
            /* parse head, ts, ai[0..7] from the byte buffer */
            fprintf(f, "%lu,%d,%d,%d,%d,%d,%d,%d,%d\n",
                    *(unsigned long*)&buf[8],   /* ts_ms */
                    *(short*)&buf[12],          /* ai0 */
                    *(short*)&buf[14],          /* ai1 */
                    *(short*)&buf[16],          /* ai2 */
                    *(short*)&buf[18],          /* ai3 */
                    *(short*)&buf[20],          /* ai4 */
                    *(short*)&buf[22],          /* ai5 */
                    *(short*)&buf[24],          /* ai6 */
                    *(short*)&buf[26]);         /* ai7 */
            fflush(f);
        }
        Sleep(POLL_MS);
    }
    fclose(f);
    prodave_disconnect(CONN);
    return 0;
}

5. Compile with MSVC (any 2015+ works). Run the .exe on the PG; the CSV grows at 10 lines/s with 8 channels - 36 KB/min, 2 MB/h.

Pros: zero loss, bit-exact, can survive a CPU stop/start because the call returns an error code that the script catches. Cons: requires a C/VB dev environment on the PG, and ProDave is licensed (dongle or registry key). The H station's standby CPU is invisible to ProDave: connect to the active rack's IP only.

7. Method 3 - SIMATIC NET OPC DA Server

Where ProDave couples the program tightly to the S7 protocol, OPC decouples it. SIMATIC NET ships an OPC DA 2.05 / 3.0 server ("OPC.SimaticNET") that exposes every DB, M, PE, PA, and PAE item by symbolic name once STEP 7 has been imported.

1. Install SIMATIC NET (V12 or V13 is typical for STEP 7 V5.5+).
2. Launch Station Configuration Editor, add the OPC server and an S7 channel; assign the TCP/IP interface to the same NIC used by STEP 7.
3. Download the PC station to the local PG. SIMATIC NET now advertises itself on the S7 network.
4. In NetPro on the H station, add a "S7 connection - partner: PC station (SIMATIC NET OPC)". Compile and download.
5. From any OPC client (Excel + the "OPC DA Auto 2.0" add-in, Matrikon, KEPware, or a 30-line VB script), subscribe to the items S7:[DB100]head, S7:[DB100]ts_ms, S7:[DB100]ai[0..7] with a 100 ms update rate.

The client application receives a callback whenever the server detects a value change (Data Change notification). For a forced 100 ms tick regardless of value change, set the deadband to 0 and the sampling rate in the OPC group header to 100. CSV write logic mirrors §6 but is now driven by the OPC event sink rather than a sleep loop.

OPC UA is supported from SIMATIC NET V14 onward; it is the preferred path on a TIA Portal V13+ PC station. For STEP 7 V5.5 + SIMATIC Manager, OPC DA is the realistic target.

8. Method 4 - SymTrace, SPS Analyzer, and Vendor Curve Recorders

Specialized tools such as SymTrace (evosoft) and SPS Analyzer (AUTEM) are designed for exactly this requirement: tap the S7 protocol at the PG, decode the variables, and write a CSV without writing code. They are not Siemens products, but the S7 interface they use is documented and they integrate with STEP 7 projects (the symbol table can be imported).

1. Install the tool on the PG, license it.
2. Open the STEP 7 project (.s7p), let the tool import the symbol table.
3. Select the AI symbols and the timestamp source, set the recording to 100 ms, choose a CSV output folder.
4. Start recording. Stop produces a .csv per channel plus a master timeline.

Sampling inside these tools is typically faster than 100 ms (often 1-10 ms) because they use the S7 Read SZL or subscribed BSEND mechanisms. This is a plus for capturing transients, but be aware that 100 ms on the S7-400H may be aliased by the OB35 quantizer - the recorded values change in 100 ms steps even if the recorder polls faster.

9. Method 5 - ProTool / WinCC Flexible Archiving on the PG

Running a ProTool or WinCC flexible runtime on the PG and pointing its archive at a local drive is technically possible, but the practical limitations are severe:

• The minimum archiving cycle in ProTool/WinCC flexible is 1 s; sub-second is not officially supported, so 100 ms is not achievable.
• Running a runtime on a PG without a valid license triggers a popup nag screen every few minutes, breaking the recording.
• The runtime must establish an MPI/TCP connection to the CPU; the H standby is not seen, and rack failovers abort the archive segment.

Use this method only if the cycle can be relaxed to 1 s and an engineering license is available; otherwise it is the wrong tool for the 100 ms requirement.

10. Real-Time PG Storage, File Format, and Capacity Sizing

File format choices for PG-side storage:

CSV is the canonical exchange format. Use a 64 KB write buffer in the recording program and flush every 1 s (10 records per write) to avoid the PG disk becoming the bottleneck. On an SSD this is a non-issue; on a rotating disk, disable indexing on the log folder (right-click → Properties → Allow files in this folder to have contents indexed = unchecked).

Capacity sizing: 1 AI tag at 100 ms = 86,400 records/day. With 8 tags, that is 691,200 records/day or roughly 14 MB of CSV per day. A one-month test campaign needs ~420 MB plus 20 % headroom = 500 MB per PG. Plan a separate logical drive for this data so the disk-fill alarm does not collide with the Windows partition.

11. Verification, Acceptance Test, and Field Checks

After implementation, perform the following acceptance checks before signing off the recording function:

1. Timebase test. Force a 1 Hz square wave (0/27648) on one of the AI channels and confirm the CSV contains exactly 10 samples per rising edge at the 100 ms setting. Deviation of more than one sample per 60 s points to OB35 priority or bus-load issues.
2. H failover test. On the active H-CPU, pull the power or trigger a stop. Within 2 s the standby takes over; the recording must continue without time jump larger than the failover window (typical < 250 ms). If a time jump appears, the recorder is on the wrong connection and must be repointed at the plant bus (PROFINET ring) rather than a direct rack cable.
3. Backpressure test. Generate 100,000 records (about 16 min at 8 ch / 100 ms). Confirm the CSV has no gaps when read with wc -l. A mismatch indicates a missed poll - check for NIC offload settings (LSO must be disabled for ISO-on-TCP) and re-test.
4. Range and scaling test. Apply 0 %, 25 %, 50 %, 75 %, 100 % of the analog range. The recorded integer values must match 0, 6912, 13824, 20736, 27648 within ±1 LSB. Off-by-one errors usually trace to byte-swap mistakes in the ProDave read buffer.
5. File integrity. Open the CSV in Excel and sort by timestamp; the delta between consecutive rows must be 100 ms ± 1 ms. A 200 ms delta indicates a missed OB35 instance (often caused by OB80 time-error overflow when another OB blocks the cyclic interrupt for > 100 ms).

Common S7-400H error codes encountered during this work, with their meaning for the recording path:

12. FAQ