Resolving FB126 PNIODiag System Number Mapping on S7-300/400

The FB126 "PNIODiag" function block is the Siemens-bundled diagnostic interface for reading operational and diagnostic data from PROFINET IO and PROFIBUS DP stations on S7-300/S7-400 controllers. The most frequent field problem with this block is confusion between two distinct numbering schemes that look similar but mean different things:

• HW Config system ID — the number STEP 7 assigns to a DP master or PROFINET IO system when the network is inserted into the hardware configuration (typically 1, 2, 5, 12 for DP, and 100, 101, 102, 107 for PROFINET IO).
• FB126 system number — the index FB126 uses internally to address up to 5 systems and 256 stations per system. This index is always 1..5, regardless of what the HW Config ID is.

This reference describes the exact mapping, the byte-address formula FB126 uses, the block's I/O interface, the DPV1 mode requirement, and the commissioning checks that prevent the classic "system number default 1" symptom reported when the example project is copied into a new installation without adjustment.

FB126 Block Identification and Compatible CPUs

The official Siemens documentation package "PROFINET IO Diagnostics with FB126" (Siemens entry ID 19289992) is shipped as a STEP 7 library containing FB126, the associated instance DB, and an example S7 program. The library is compatible with the following controller families:

• S7-300 CPUs with integrated PROFINET interface (CPU 315-2 PN/DP, CPU 317-2 PN/DP, CPU 319-3 PN/DP)
• S7-300 CPUs with CP 343-1 PROFINET (6GK7 343-1GX30, 6GK7 343-1EX30)
• S7-400 CPUs with integrated PN interface (CPU 414-3 PN/DP, CPU 416-3 PN/DP, CPU 416F-3 PN/DP)
• S7-400 with CP 443-1 PROFINET (6GK7 443-1EX20, 6GK7 443-1GX20)

The block is intended for STEP 7 V5.5 and earlier. TIA Portal users should use the equivalent "PNIODiag" instruction in the TIA Portal libraries, which uses a different parameterization method but follows the same underlying principle.

Library version 2.x is the most current field-deployed version. The version can be verified in the FB properties dialog in STEP 7. Key version history:

• V1.x — initial release, supports up to 4 systems total
• V2.x — extended to 5 systems (3 DP + 2 PN), adds MODE 6/7 for cyclic PROFINET data readout
• V2.1+ — improved DPV1 error reporting in the STATUS word, additional RET_VAL codes

System Number Concept: HW Config vs FB126

The numbering of a network in HW Config is determined by the order in which the DP/PN subnets are inserted and by the slot numbers assigned by STEP 7. The user has no direct control over the HW Config system number; STEP 7 assigns it at insertion time. Typical values observed in the field:

• PROFIBUS DP master system: HW Config numbers 1, 2, 3, … 15 (default for first integrated interface is 1)
• PROFINET IO system: HW Config numbers 100, 101, 102, 103, … 127 (default for first integrated PN is 100)

FB126, however, accepts a system number from 1 to 5 only at its SYSNR input. Internally the block maintains a fixed 5-slot table where each slot can hold one of the configured systems. The user must populate this table — usually through the example program that ships with the library, or by manually mapping the SYSNR input to the correct internal slot. The mapping is therefore not automatic; it is your responsibility to know:

1. Which HW Config system corresponds to which FB126 system number
2. The byte address where the diagnostic data for each station lives

Default System Mapping Table from the FB126 Example Project

The FB126 manual defines a default mapping for the example project it ships with. This default is the source of the "system number default 1" confusion reported in the field, because the example project uses one specific HW Config and many engineers copy it into a different project without updating the table.

Determining System Numbers from HW Config

To find the HW Config system ID for a given network, follow this procedure in STEP 7 V5.x:

1. Open HW Config in SIMATIC Manager.
2. Double-click the DP master (CPU or CP) or the PROFINET IO system (PN interface or CP) in the station window.
3. In the properties dialog, the field "PROFIBUS address" or "PROFINET IO system number" displays the system ID.
4. Alternatively, right-click the subnet line in the station window and select "Properties" — the system number is shown at the top of the dialog under "Subnet: PROFIBUS(1): …" or "PROFINET IO system (100): …".

For PROFINET IO systems on an S7-300 CPU 31x PN/DP, the default system number is 100. For a second PROFINET interface (e.g., on a CPU 319-3 PN/DP with two PN ports), it is 101. PROFINET IO system numbers are reserved in the range 100..127. For PROFIBUS DP master systems on the CPU's integrated interface, the default is 1 for the first interface and 2 for the second. CP-attached DP masters use higher numbers assigned by STEP 7.

Address Calculation Formula

FB126 stores the diagnostic status of each station in a contiguous byte array. The position of a station's data in the array is computed by:

Address [Byte] = (SYSNR - 1) * 256 * 2 + (DEVNO - 1) * 2

Where:

• SYSNR = FB126 system number (1..5)
• DEVNO = device/station number within the system (1..256)
• 256 = maximum number of stations per system
• 2 = bytes per station (status word, 16 bits)

Each station occupies 2 bytes. The 2 bytes represent the station's diagnostic status word (bit-coded: station OK, station faulty, station disabled, etc.). The ANY pointer passed to FB126 must point to a data area of at least:

DATA_AREA_SIZE = 5 * 256 * 2 = 2560 bytes

This is the size of the full diagnostic buffer. The example project ships with a DB of this size pre-allocated. The byte order is little-endian, consistent with S7 convention: the low byte is at the lower address.

Worked Address Examples

Example 1 — Default example project, PN system 107, device 12, mapped to FB126 SYSNR 5:

Address = (5 - 1) * 256 * 2 + (12 - 1) * 2
       = 4 * 512 + 22
       = 2048 + 22
       = 2070 bytes

Reading 2 bytes at DB address 2070 yields the status word for PN device 12 on system 107.

Example 2 — PN system 100, device 1, mapped to FB126 SYSNR 4:

Address = (4 - 1) * 256 * 2 + (1 - 1) * 2
       = 3 * 512 + 0
       = 1536 bytes

Example 3 — DP master system 1, device 5, mapped to FB126 SYSNR 1:

Address = (1 - 1) * 256 * 2 + (5 - 1) * 2
       = 0 + 8
       = 8 bytes

Example 4 — DP master system 2, device 17, mapped to FB126 SYSNR 1 (deviation from default example):

Address = (1 - 1) * 256 * 2 + (17 - 1) * 2
       = 0 + 32
       = 32 bytes

FB126 Block Interface

FB126 has a fixed interface defined by the Siemens library. The exact set of inputs/outputs depends on the library version, but the standard V2.x interface is:

MODE Parameter Values

RET_VAL Error Codes

Diagnostic Data Structure

The 2-byte status word stored at the calculated address has the following structure for PROFIBUS DP:

For PROFINET IO, the same 2-byte word represents the port/data status. Detailed channel and module diagnostics are read separately via MODE 2 and MODE 3, which return PROFINET-format data records per IEC 61784-2.

Step-by-Step Configuration in STEP 7 V5.x

The configuration sequence for a project with one PROFIBUS DP master and one PROFINET IO system:

1. Insert hardware. In HW Config, add the S7-300 station with a PN-CPU. STEP 7 will create a PROFIBUS DP master system (default ID 1) and a PROFINET IO system (default ID 100).
2. Insert the FB126 library. Open the library from the Siemens download (entry ID 19289992) and copy FB126, the instance DB, and the example DBs into your S7 program.
3. Adjust the data DB. Allocate a DB with at least 2560 bytes (5 systems * 256 stations * 2 bytes). Set the initial values to zero. Use a separate, non-optimized DB to ensure byte-level addressing.
4. Map SYSNR to HW Config ID. Decide on your FB126 numbering. The simplest convention is SYSNR 1 = first DP system, SYSNR 4 = first PN system. Note this in the program documentation header.
5. Call FB126 in OB1. Use a one-shot edge on REQ to trigger a diagnostic read. Pass MODE, SYSNR, and DEVNO. Wire the DATA parameter to the data DB you created in step 3.
6. Set up DPV1 (DP master only). In HW Config, open the DP master properties and check "DPV1" under "Operating Mode". This is required for FB126 to access DPV1 services.
7. Configure PROFINET IO update time. For PN systems, ensure the IO update time in HW Config is set to a value that allows the diagnostic read to complete (typically 1 ms or higher; 2 ms is a safe default for mixed loads).
8. Compile and download. CPU must be in STOP for hardware download. The S7 program can be downloaded in RUN if the FB126 call signature has not changed.
9. Verify online. Open the data DB online and confirm the status words at the calculated addresses are populated for the expected stations.

DPV1 Mode Configuration

The DPV1 mode is the PROFIBUS extension that allows acyclic read/write services to DP slaves. FB126 uses DPV1 to read diagnostics, configuration, and parameter data from the DP stations. If DPV1 is not enabled in HW Config, the block will return RET_VAL = 80C1 ("DPV1 not active").

To enable DPV1:

1. Open HW Config.
2. Double-click the DP master (the CPU or CP that owns the DP interface).
3. Go to the "Operating Mode" tab.
4. Check the box "DPV1".
5. Confirm and recompile the hardware configuration.
6. Download to the CPU (STOP required for hardware changes).

Verification and Commissioning Checks

After configuration, run the following checks before declaring the system operational:

1. Hardware check — Open the online HW Config diagnostics view (PLC → Module Information → Diagnostic Buffer). All stations should show green status icons.
2. FB126 call check — Place a temporary variable watch on RET_VAL. The first call with a valid SYSNR/DEVNO should return 7001, then 0000 within 1-2 OB1 cycles.
3. Data area check — Set a watchpoint on the data DB at the calculated address for a known-good station. The 2-byte status word should be 0x0001 (station OK).
4. Faulty station check — Pull a PROFIBUS connector or disable a PN port in HW Config simulation. The status word for that station should change to 0x0002 (station faulty) within one diagnostic cycle.
5. RET_VAL range check — Force an invalid SYSNR (e.g., 6). RET_VAL should return 8090. Restore the valid SYSNR afterward.
6. DPV1 check — Disable DPV1 in HW Config, recompile, and download. Call FB126 with a DP station. RET_VAL should return 80C1. Re-enable DPV1 after the check.
7. OB82/OB83 check — Ensure diagnostic OBs are loaded. Without OB82 (diagnostic interrupt) and OB83 (insert/remove interrupt), diagnostic interrupts from the stations will not be processed, and FB126 will not see the events.
8. Scan time check — Monitor the OB1 scan time with a measurement block. If it exceeds 80% of the cycle monitoring time, reduce the number of stations queried per cycle.

Troubleshooting Matrix

System Number Defaults: Why the "Default 1" Symptom Appears

When engineers copy the FB126 example project into a new project that has only one DP master (system 1) and one PN system (100), the FB126 call parameters are not auto-adjusted. The example uses SYSNR 1..5 with specific values tied to its example HW Config. If you do not change anything, your call for "the only DP master" goes to SYSNR 1 — which in the example was used for a different system. The byte address formula still produces a valid address, but the data at that address is meaningless because it points to a different system than the one you intend.

Symptom: diagnostic data always shows the same value, or always 0, or always the same fault, even though the actual station status is different. The fix is to verify the SYSNR-to-HW-Config mapping for your project and update the FB126 calls accordingly. The "default 1" referenced in the original symptom is the example's default, not your project's default.

PROFINET IO System Number Assignment Rules

PROFINET IO system numbers in the range 100..127 are reserved by STEP 7. The assignment order is:

• 100 = first PROFINET interface (typically the CPU's integrated PN port)
• 101 = second PROFINET interface (e.g., CPU 319-3 PN/DP with two PN ports, or CP 343-1)
• 102 = third PROFINET interface
• … up to 127

The number is not user-selectable; it depends on the slot order in HW Config. If you add a second PROFINET CP in slot 4, its system number may be 100 if it is the first PN interface the CPU encounters, or 101 if a PN interface is already in an earlier slot. Reorder the slots to control the numbering, or use the FB126 SYSNR parameter to adapt to the actual numbering. The PROFINET IO system ID 102 in the example project corresponds to a CPU that has more than two PN interfaces (uncommon in S7-300 but possible on S7-400 with multiple CPs).

Integration with HMI/SCADA

The 2-byte status words produced by FB126 are typically read by an HMI/SCADA system for station-level diagnostics. Common mappings used in WinCC Flexible / WinCC / TIA Portal HMI tags:

For detailed channel-level diagnostics, use MODE 2/3 to read the corresponding data records and parse the structure defined by the PROFINET specification (IEC 61784-2). The FB126 example program includes parsing routines for channel diagnostic data records 0x8000..0x80FF.

Performance and Timing

FB126 is designed to be called cyclically in OB1. A single diagnostic read typically takes:

• DP master system: 10-50 ms per station (depends on baud rate and DPV1 service time)
• PROFINET IO: 5-20 ms per station (depends on update time and network load)

To avoid CPU scan time overruns, call FB126 only for stations that are flagged as faulty (interrupt-driven via OB82) or scan all stations over multiple OB1 cycles (round-robin scheduling). Calling FB126 for all 256 stations in all 5 systems in a single OB1 cycle is not recommended for any CPU. The example project uses a round-robin scheduler that spreads the calls over 256 OB1 cycles, keeping the per-cycle load under 1 ms on a CPU 317-2 PN/DP.

Compatibility with TIA Portal

TIA Portal does not use FB126 in the same form. The equivalent functionality in TIA Portal is the "PNIODiag" instruction in the TIA Portal library, which has a different parameter interface but the same underlying principle: SYSNR + DEVNO → diagnostic data area. The byte address formula remains the same, but the FB call signature changes — plan for parameter remapping during migration. For S7-1200/S7-1500 systems, the standard PROFINET diagnostic blocks (RDREC, WRREC) and the system status list (SSL) are the recommended path; FB126 is not used on these platforms.

Cross-Reference: FB126 vs SFC 13 DPNRM_DG vs RDREC/WRREC

Frequently Asked Questions