Resolving ET200S 1SI Modbus Master SF Fault on S7-400H Y-Link

1. Problem Overview

The ET 200S 1SI Modbus/USS module (order number 6ES7 138-4DF01-0AB0 or 6ES7 138-4DF11-0AB0) functions as a serial Modbus RTU master for energy meters, scales, and other RS-485 field devices. When deployed in an ET 200S distributed I/O station that is interconnected to a SIMATIC S7-400H high-availability controller through a Y-Link (6ES7 197-1LA04-0XA0 or 6ES7 197-1LA12-0XA0), a recurring failure mode has been observed in the field:

• The 1SI module's SF LED (red) latches ON, and Modbus RTU traffic ceases.
• The associated S_SEND / S_RCV or Modbus master FB (FB 7/FB 8, or the MODBUS_MASTER/MODBUS_SLAVE blocks from the "Modbus_Master_V2" / "Modbus_PN_CPU" libraries) returns a status word of 0000h, masking the real error.
• Y-Link diagnostic buffer and online diagnostics show no entry for the failed 1SI slot.
• A rack power cycle does NOT clear the SF; the fault persists until the 1SI module is physically unplugged and reinserted in the ET 200S terminal block.
• The same 1SI module, on a non-redundant S7-300/S7-400 station wired to PROFIBUS-DP directly (no Y-Link), operates reliably for months.

This article consolidates Siemens official diagnostic procedures, Y-Link behavior under ET 200S sub-slots, and the recommended fault-clearing workflow.

2. System Architecture Context

A typical affected topology is shown below.

The Y-Link acts as a DP/DP coupler between the S7-400H redundant PROFIBUS and the single-channel DP slave side. The ET 200S station (with its 1SI sub-modules) is not visible as a DPV0 station to the S7-400H; only the Y-Link's aggregated I/O image is mapped. This architectural detail is the root of the diagnostic gap.

3. Affected Hardware and Module Identifiers

Verify the exact module version before applying the procedures below. The 1SI order numbers and firmware behavior differ across revisions.

Reference: ET 200S Serial Interface Modbus/USS Module User Manual.

4. SF LED Definitions on the 1SI Module

Per the ET 200S 1SI manual (Chapter 6, "Diagnostics and interrupts"), the SF (red) LED on the 1SI module indicates a group error / system fault:

Per the manual, "The access error is recognized by the FB and the function is ended with an error response to the Modbus master. ... SF (system fault) supplied." This matches the symptom: the SF latches because the internal event buffer of the 1SI has logged a non-recoverable state.

5. Root Cause Analysis

The combination of latched SF + 0000h status word + invisible Y-Link diagnostic entry + required physical re-plug points to a small set of recurring root causes. Rank them by likelihood based on field reports:

5.1 Transient PROFIBUS Slot Synchronization under Y-Link

The Y-Link's DP-V0 bridge replicates I/O images but does not fully forward DPV1 diagnostic interrupts from sub-modules behind an ET 200S IM. If the 1SI's internal Modbus state machine throws a "no response from slave within timeout" event while the DP cycle is being rebuilt on a Y-Link H-switchover, the 1SI enters a state where:

• The cyclic DP I/O image remains nominal (no slot diagnostic interrupt at IM 151 level).
• The 1SI's internal "diagnostics pending" bit is set, lighting SF.
• The standard MODBUS_MASTER FB is not informed because the slot-level diagnostic was suppressed by the Y-Link.
• Status word reads 0000h because no user-level error has yet been generated.

Subsequent DP cycles do not clear the bit; the 1SI requires a power-on reset of its own ASIC, which is achieved only by a complete module reinsertion.

5.2 Incorrect Parameter Assignment of the 1SI

Common STEP 7 HW Config mistakes that produce exactly this pattern:

• Frame timeout set below the slave's response time (energy meters often need 500–1500 ms).
• Number of retries set to 0 or 1 in the 1SI "Modbus" parameter dialog.
• "Inter-character timeout" set lower than the 3.5 character gap the Modbus RTU spec mandates.
• Operating mode "Modbus Master" not actually activated in HW Config (the module falls back to a frozen state with SF latched).

5.3 RS-485 Physical Layer

Even after visual inspection, three issues frequently hide in cabinets:

• Common-mode voltage between the ET 200S grounding point and the meter grounding point exceeding ±7 V DC. The 1SI RS-485 transceiver can latch into protection and trip SF.
• Single-point termination: termination resistor ON at every node. The 1SI manual requires exactly two terminations at the line ends; intermediate nodes must be off.
• Shield not bonded at both ends with low-impedance clamps, or bonded only at the cabinet entry.

5.4 Redundant H-System Event Storm

During H-switchover or link-up, a burst of DP cycles from the partner CPU can leave the Y-Link's slave-side buffer over-written faster than the ET 200S can sample. The 1SI sees a momentary "configuration mismatch" and latches SF.

5.5 Firmware Bug in 1SI V1.x with Y-Link

Siemens released firmware V2.0 for 6ES7 138-4DF11-0AB0 specifically to address SF latch behavior under DP-V0 bridges (Y-Link, DP/DP coupler). V1.x modules occasionally enter the stuck-SF state described in this article. Verify the FW version in the module's diagnostics (online → Module Information → "Firmware" tab).

6. Diagnostic Procedures

Because the Y-Link hides the ET 200S sub-slot diagnostics, the standard "PLC → Accessible Nodes → Module Information" path returns nothing useful. Use the multi-layer procedure below.

6.1 Capture the 1SI Send/Receive Status with a Timestamp DB

Create a dedicated error DB (e.g., DB 200) of 100 entries. In OB1 (or OB35), whenever the status word of the Modbus master FB changes or the 1SI SF input rises, push the data. Sample structured data type:

TYPE UDT_ModbusErr :
STRUCT
  dtTimestamp  : DATE_AND_TIME;     // 8 bytes
  wStatus      : WORD;              // 1SI FB status word
  wErrCode     : WORD;              // 1SI FB error code (e.g. 0x0007, 0x001A)
  wExtErr      : WORD;              // 1SI FB extended error
  wReqCount    : WORD;              // Total requests since last reset
  wFailCount   : WORD;              // Consecutive failures
  bSfInput     : BOOL;              // Raw SF input image bit
  bBfInput     : BOOL;              // Raw BF input image bit
  iSlot        : INT;               // Logical slot in ET 200S
END_STRUCT;
END_TYPE

Call example (SCL) for the 1SI master FB (FB 102 "S_MODB" in the Modbus library, or FB 121 in newer libraries):

// In OB1 or OB35
#instModbus(REQ := bTrigger, ...);
IF #instModbus.ERROR THEN
  gdbError[iIndex].dtTimestamp := RTC();   // from IEC function
  gdbError[iIndex].wStatus     := #instModbus.STATUS;
  gdbError[iIndex].wErrCode    := #instModbus.STATUS;  // alias
  gdbError[iIndex].wExtErr     := DWORD_TO_WORD(#instModbus.STATUS);
  gdbError[iIndex].bSfInput    := ibSf1SI;
  gdbError[iIndex].bBfInput    := ibBf1SI;
  gdbError[iIndex].iSlot       := 4;     // 1SI slot in ET 200S
  iIndex := (iIndex + 1) MOD 100;
END_IF;

After the next SF event, open the DB in STEP 7 (online → Monitor/Modify) and inspect the captured wStatus and timestamp. A pattern of 0000h confirmed at the time of SF confirms hypothesis 5.1 / 5.5 (bridge / firmware).

6.2 Read the Y-Link Diagnostic Buffer

Open Y-Link online diagnostics per the Y-Link manual, chapter 12.1.3. Filter for "Slave diagnostics" and "Diagnostic interrupt". A healthy system will show the ET 200S station entering/leaving; a faulty system will show no entries when the 1SI SF latches — this negative result is itself a useful clue.

6.3 Read the 1SI Slot Diagnostics Directly via DPV1

If the IM 151 supports DPV1 (firmware ≥ V3.0 and 1SI MLFB ending in 0AB0 with V2.0+), use the RDREC / WRREC SFBs to read diagnostic record index 0x0010 (channel diagnostics) and 0x00F1 (manufacturer-specific) from the 1SI slot. Sample call:

CALL "RDREC"  // SFB 52
  REQ       := TRUE
  ID        := W#16#0C   // logical address of the 1SI slot
  INDEX     := 16        // 0x0010 decimal
  MLEN      := 20
  VALID     := bValid
  BUSY      := bBusy
  ERROR     := bError
  STATUS    := wStatus
  LEN       := iLen
  RECORD    := pBuf;     // ANY to a 20-byte buffer

Decode the returned bytes per the 1SI manual. Typical findings that correlate with this issue:

• Byte 0–5 = standard DPV1 header, channel number 0xFF (no channel-specific diag).
• Byte 6 = 0x11 (parameter assignment error).
• Byte 7 = 0x12 (module-internal watchdog).

6.4 Bus Monitor Capture

Tap the RS-485 segment with a protocol analyzer (e.g., Siemens COM PROFIBUS tap or a generic Modbus sniffer such as a MOXA UPort 1450 with Modbus Poll). Look for:

• Requests sent with no response (timeout) immediately before SF latch.
• Garbled frames (wrong baud rate, parity mismatch).
• Collision — two devices transmitting within 1.5 character time (CT).

7. Recovery Procedure (Step-by-Step)

1. Confirm the SF LED is on and the energy meter data is stale (poll the meter's last-good timestamp from WinCC tag logging).
2. Open WinCC / PCS 7 OS and navigate to the diagnostics overview for the affected ET 200S. The Y-Link slot will show green; the 1SI sub-slot will not be represented (expected).
3. Open STEP 7 → "Accessible Nodes" → connect to the S7-400H → navigate to the Y-Link's slave-side DP master system.
4. If the 1SI diagnostic record is retrievable (RDREC index 0x0010), read it and record the channel/error bytes in your error DB.
5. Cycle the load voltage (24 V DC) to the ET 200S station via the PM-E, not the Y-Link. Wait 5 seconds. Re-apply. Observe the SF LED.
6. If SF is still latched (typical for this issue), physically remove the 1SI module from the terminal block, wait 10 seconds, and reinsert it. The module performs a full self-test; SF should clear after the next DP cycle (≤ 3 s).
7. Verify in the user program that the next MODBUS_MASTER call returns DONE := TRUE and the meter data is refreshed.
8. Log the event in the maintenance database. Compare timestamps against any S7-400H switchover logs (in the H-CPU diagnostic buffer) to detect correlation.

8. Status Word and Common Error Codes

The status word returned by the 1SI Modbus master FB (S_MODB, FB 102 in the Modbus library for STEP 7 V5.x) has the following important values for this fault pattern:

9. Parameter Verification (HW Config)

Open HW Config → ET 200S → 1SI slot → Properties → Modbus and verify each parameter against the meter datasheet:

10. Cabling and Shielding Verification Checklist

1. Confirm the shield is bonded at both ends with a 360° low-impedance clamp (e.g., Weidmüller KLBÜ or Phoenix Contact type).
2. Verify the cabinet ground bus and the meter ground bus have a measured resistance of < 1 Ω between them.
3. Measure common-mode voltage between RS-485 GND of the 1SI and the meter terminal — must be < ±7 V DC.
4. Confirm exactly two 120 Ω terminations: one at the 1SI terminal block, one at the farthest meter. Switch off any intermediate terminations.
5. If the run exceeds 10 m at 38400 baud, or 1000 m at 9600 baud, install a repeater (e.g., Phoenix Contact PSI-MOS-RS485).
6. Separate the RS-485 cable from VFD power cables by at least 200 mm; cross at 90° if intersection is required.

11. Firmware Upgrade Path

If a 1SI module is identified as V1.x (MLFB 6ES7 138-4DF01-0AB0) or V2.0 with the SF latch issue:

1. Download the latest firmware from the Siemens Industry Online Support article for the MLFB. Confirm the firmware is for the exact MLFB you have.
2. Open SIMATIC Manager → Options → "Firmware Update" → select the Y-Link's DP master system → select the ET 200S station → select the 1SI slot.
3. Load the firmware; do NOT power-cycle the ET 200S during the update.
4. After the update, perform an SF reset by removing and reinserting the module once.
5. Confirm the new firmware version on the "Module Information → Firmware" tab.

12. Redundancy-Aware Mitigation

To minimize unscheduled module reinsertion (which requires site attendance in many plants), the following programmatic mitigations help in S7-400H environments:

12.1 Watchdog Supervision

Implement a timer in OB35 (100 ms) that decrements a counter on every Modbus failure. If the counter reaches zero, raise a maintenance alarm requesting manual reset. The counter is reset to its nominal value on any successful reply.

12.2 Hot-Spare Module

Reserve a free ET 200S slot adjacent to the 1SI. Pre-configure a second 1SI in HW Config with its own logical address. The user program can be re-pointed to the spare when the primary latches SF. Note: this avoids the manual re-plug only for short-term recovery; the latched module still needs replacement.

12.3 H-System DP Cycle Tuning

In the S7-400H CPU properties → "Cycle / Clock Memory", set the DP master system to a longer base cycle (e.g., 20 ms instead of 5 ms). This reduces the rate at which the Y-Link's internal buffer is over-written, mitigating hypothesis 5.4.

13. Verification After Recovery

1. 1SI SF LED OFF; BF LED OFF or briefly flashing during poll.
2. RX/TX LEDs blink on every poll cycle.
3. First successful Modbus response (Function Code 0x03 / 0x04) within the configured response timeout.
4. Energy meter values updated in WinCC tag logging within 5 s of recovery.
5. Y-Link diagnostic buffer shows no new errors.
6. Status word in your error DB returns to 0000h and stays there.

14. Troubleshooting Matrix

15. Recommended Spare Parts and Sparing Strategy

• 1 × 1SI Modbus/USS module (V2.0+), e.g. 6ES7 138-4DF11-0AB0 per ET 200S rack containing one.
• 1 × terminal block for the 1SI (e.g., 6ES7 193-4CG30-0AA0) — these wear on repeated insertion.
• Spare 120 Ω RS-485 terminators (bus-connector type or D-Sub).
• Field service kit with protocol analyzer (e.g., MOXA UPort 1450I or ProfiHub diagnostic tap).

16. FAQ