Resolving SFC13 Error 8093 on ET200M PROFINET IM153-4

An ET200M station built around an IM 153-4 PN (PROFINET interface module) reports module and channel faults correctly inside the STEP 7 / TIA Portal "Online > IO Device Diagnostics" view, but the same information never reaches the user program. Engineers typically call SFC 51 (RDSYSST) with SSL_ID = W#16#0C91 and get a partial rack/slot state, then try SFC 13 (DPNRM_DG) — which comes back with RET_VAL = W#16#8093 on every call. The fix is not a wiring change or a different LADDR; it is replacing DPNRM_DG with the PROFINET record read service exposed as SFB 52 (RDREC) and reading the standardized IEC 61784-2 diagnostic records (0x8000, 0x800A, 0x8028) the IM 153-4 already publishes on the PROFINET stack.

1. Problem Definition: SFC 13 8093 on PROFINET

Two symptoms occur together on an ET200M with IM 153-4 PN, DI32 and DO32 modules and a fiber laser coupler:

1. SFC 51 (RDSYSST) with SSL_ID W#16#0C91 returns a 4-byte slot record per module (rack / slot / status / channel count). It is correct, but it does not contain the channel-level fault bytes that STEP 7 displays in the IO Device Diagnostics tab — "Module missing in slot 0.2", "Wire break on DO32 channel 5", "Short circuit on DI32 channel 1". Those bytes live in a different layer of the PROFINET IO model.
2. SFC 13 (DPNRM_DG) returns RET_VAL = W#16#8093 (LADDR specifies a module that does not support this SFC, or the LADDR is not a DP slave address). The block will never succeed for that LADDR no matter how the parameters are set.

The IO Device Diagnostics tab in STEP 7 / TIA reads the same records that the user program can read with SFB 52 (RDREC). RDREC exists on every S7-300/400 CPU as a system function block (SFB 52) and on every S7-1500/1200 CPU as an instruction with the same semantics. With the right record numbers and the right slot address, RDREC exposes everything the IO Device Diagnostics tab shows: missing module, wrong module, channel fault, maintenance event, and port/interface diagnostics.

2. ET200M IM 153-4 PN Variants and Required Firmware

Several IM 153-4 variants exist. Confirm the part number, hardware release and firmware before reading diagnostics, because record support was added incrementally.

For deeper details on the diagnostics chain inside the ET200M, see the official operating instructions: IM 153-2 / IM 153-4 ET 200M Operating Instructions (Siemens) and the SIMATIC ET 200M product finder (PI / Profibus & PROFINET International).

3. SFC 51 SSL_ID W#16#0C91 Output Structure

SFC 51 (RDSYSST) reads a System State List (SZL / SSL) sub-list. For PROFINET IO devices, the relevant sub-list is W#16#0C91. Each call to SFC 51 returns the partial list starting at the supplied INDEX. The output block is a 4-word / 8-byte record per slot:

STATUS word bit assignments (subset of W#16#0C91):

That is the limit of W#16#0C91. It does not tell you which channel is in fault, which channel has a wire break, or why the DO32 reports a short circuit. For that, move to SFB 52.

4. Why SFC 13 (DPNRM_DG) Returns 8093 on PROFINET

DPNRM_DG reads the PROFIBUS DP slave diagnostic buffer using the "Read Slave Diagnosis" service (SDN). The call sequence is:

1. SFC 13 issues a PROFIBUS DP layer-2 read on the LADDR.
2. The PROFIBUS DP master cycles the slave, retrieves the 6-byte standard diagnosis header, and returns it to the caller's RECORD buffer.
3. The PROFINET IO stack on the same CPU has no such read service; it has a record-read (RDBREC).

When the LADDR is a PROFINET IO device address (which is the case for the IM 153-4 PN in HW Config — "PROFINET interface" slot 0 with a diagnostic address in the 0..1023 PROFINET range, e.g. 1536 or whatever is configured), the call cannot be routed to a PROFIBUS DP master. SFC 13 therefore returns:

5. PROFINET IO Diagnostic Record Map

PROFINET IO defines a fixed set of record numbers that any IO device must (or may) support. The IM 153-4 PN implements the records in the table below. Calling SFB 52 with RECNUM set to one of these values gives the data STEP 7 displays in the IO Device Diagnostics tab.

The two records that answer the original "Module missing in slot 0.2" and "channel fault on DI32 / DO32" questions are 0x8028 (configuration mismatch) and 0x800A / 0x800B (channel diagnostics). Read them in this order:

1. 0x8000 — header; tells you how many channel diagnostic blocks are pending.
2. 0x8028 — expected vs. actual; tells you which slots differ from configuration.
3. 0x800A — single channel fault; repeat as long as the device returns data, then 0x800B for chained faults.

6. SFB 52 RDREC Implementation Flow

SFB 52 is the read-data-record function block. Signature (S7-300 / S7-400 / WinAC):

The SFB must be called twice per record read: once with REQ = TRUE to start, then again with REQ = FALSE to poll BUSY / RET_VAL until the job completes. This is mandatory on S7-300 / S7-400 because the SFB does not run asynchronously in the same cycle.

LADDR choice is the most common error. For:

• Header / device records (0x8000, 0x8028, 0xF841, 0xC00A): use the IO device diagnostic address (e.g. 1536) and IOID = B#16#00.
• Channel records (0x800A, 0x800B) that target a specific slot: use the slot's input or output address (e.g. 0 for slot 1 DI32 if that module starts at IW 0) and IOID = B#16#54 (input) or IOID = B#16#55 (output).

7. Reading Channel Diagnostics (0x800A) and Module Status (0x8028)

The 0x800A channel diagnostic record is the one engineers want when the IO Device Diagnostics tab says "Wire break" or "Short circuit" for a single channel. Layout:

Common ChannelErrorType values for DI32 (6ES7321-1BL00-0AA0) and DO32 (6ES7322-1BL00-0AA0):

Record 0x8028 (Expected/Actual) layout: a 4-byte header followed by n 4-byte slot records (where n = number of slots in the configuration). Each slot record contains:

Decoding "Module missing in slot 0,0,0,2" from the user's original report: the path is 0.0.0.2 — PROFINET IO device 0, slot 0, submodule 0, channel 2. After reading 0x8028, locate the slot record with slot = 0, flags bit 2 set (= missing). That is the "missing in slot 0,0,0,2" entry shown in TIA / STEP 7.

8. SCL Code: FB_ET200M_PROFINET_DIAG

The following SCL block reads all three primary diagnostic records for a single ET200M station with one IO device diagnostic address. It is designed to run in a low-priority OB (OB 1 / OB 35) on an S7-300/400 with the IM 153-4 PN configured in HW Config.

FUNCTION_BLOCK FB_ET200M_PROFINET_DIAG
TITLE = 'ET200M PROFINET Diagnostic Reader (IM 153-4 PN)'

VAR
  // --- inputs ---
  i_LADDR_DEVICE  : INT := 1536;   // IO device diagnostic address
  i_LADDR_DI32    : INT := 0;      // DI32 start address (input slot)
  i_LADDR_DO32    : INT := 4;      // DO32 start address (output slot)
  i_CYCLE_TRIGGER : BOOL;          // edge-triggered start from OB1

  // --- RDREC instances (one per record) ---
  sfb52_hdr   : SFB52;            // reads 0x8000 header
  sfb52_cfg   : SFB52;            // reads 0x8028 expected/actual
  sfb52_chan  : SFB52;            // reads 0x800A channel diag

  // --- state machine ---
  s_state     : INT := 0;
  s_done      : BOOL;
  s_err       : BOOL;
  s_status    : WORD;
  s_len       : INT;

  // --- target buffers ---
  b_hdr       : ARRAY[0..63]  OF BYTE;
  b_cfg       : ARRAY[0..127] OF BYTE;
  b_chan      : ARRAY[0..63]  OF BYTE;

  // --- decoded ---
  i_pending_chan  : INT;          // pending channel events from 0x8000
  w_channel_err   : WORD;         // last channel error type
  b_slot_missing  : BOOL;         // one of the slots is missing
END_VAR

BEGIN
  IF i_CYCLE_TRIGGER THEN
    s_done := FALSE;
    s_err  := FALSE;
    CASE s_state OF

      // ---------------------------------------------------------------
      // 0: read 0x8000 (header) - tells us if events are pending
      // ---------------------------------------------------------------
      0:
        sfb52_hdr(REQ := TRUE,
                  IOID := B#16#00,             // header / device
                  LADDR := INT_TO_WORD(i_LADDR_DEVICE),
                  RECNUM := B#16#80,            // 0x8000 low byte (high byte via MLEN/proc)
                  // Note: some tools expose RECNUM as DWORD; pass DW#16#8000 if so
                  MLEN := 32,
                  RET_VAL := s_status,
                  BUSY := s_done,
                  RECORD := b_hdr);
        s_state := 1;

      1:
        sfb52_hdr(REQ := FALSE,
                  IOID := B#16#00,
                  LADDR := INT_TO_WORD(i_LADDR_DEVICE),
                  RECNUM := DW#16#8000,
                  MLEN := 32,
                  RET_VAL := s_status,
                  BUSY := s_done,
                  RECORD := b_hdr);

        IF NOT s_done THEN
          IF s_status = 0 THEN
            // Byte 8-9 of header: number of pending channel diagnostics
            i_pending_chan := WORD_TO_INT(BYTE_TO_WORD(b_hdr[8]));
            s_state := 10;
          ELSE
            s_err := TRUE;
            s_state := 99;       // jump to error handler
          END_IF;
        END_IF;

      // ---------------------------------------------------------------
      // 10: read 0x8028 (expected/actual)
      // ---------------------------------------------------------------
      10:
        sfb52_cfg(REQ := TRUE,
                  IOID := B#16#00,
                  LADDR := INT_TO_WORD(i_LADDR_DEVICE),
                  RECNUM := DW#16#8028,
                  MLEN := 128,
                  RET_VAL := s_status,
                  BUSY := s_done,
                  RECORD := b_cfg);
        s_state := 11;

      11:
        sfb52_cfg(REQ := FALSE,
                  IOID := B#16#00,
                  LADDR := INT_TO_WORD(i_LADDR_DEVICE),
                  RECNUM := DW#16#8028,
                  MLEN := 128,
                  RET_VAL := s_status,
                  BUSY := s_done,
                  RECORD := b_cfg);

        IF NOT s_done THEN
          IF s_status = 0 THEN
            // Decode slot records from b_cfg starting at offset 4
            s_len := WORD_TO_INT(BYTE_TO_WORD(b_cfg[2]));
            b_slot_missing := FALSE;
            // Loop over slot records; simplify to 1..32 slots here
            FOR n := 1 TO 32 DO
              IF (b_cfg[4 + (n-1)*4 + 3] AND B#16#04) <> 0 THEN
                b_slot_missing := TRUE;  // bit 2 = missing
              END_IF;
            END_FOR;
            s_state := 20;
          ELSE
            s_err := TRUE;
            s_state := 99;
          END_IF;
        END_IF;

      // ---------------------------------------------------------------
      // 20: read 0x800A (channel diagnostics) - single channel
      // ---------------------------------------------------------------
      20:
        sfb52_chan(REQ := TRUE,
                   IOID := B#16#54,            // input slot (DI32)
                   LADDR := INT_TO_WORD(i_LADDR_DI32),
                   RECNUM := DW#16#800A,
                   MLEN := 32,
                   RET_VAL := s_status,
                   BUSY := s_done,
                   RECORD := b_chan);
        s_state := 21;

      21:
        sfb52_chan(REQ := FALSE,
                   IOID := B#16#54,
                   LADDR := INT_TO_WORD(i_LADDR_DI32),
                   RECNUM := DW#16#800A,
                   MLEN := 32,
                   RET_VAL := s_status,
                   BUSY := s_done,
                   RECORD := b_chan);

        IF NOT s_done THEN
          IF s_status = 0 THEN
            // Channel error type at bytes 10..11
            w_channel_err := SHL(IN := BYTE_TO_WORD(b_chan[10]), N := 8)
                           OR BYTE_TO_WORD(b_chan[11]);
            s_state := 30;     // continue with DO32 (separate block / re-trigger)
          ELSIF s_status = DW#16#80D5 THEN
            // No diagnostic data on this slot - normal if DI32 is healthy
            s_state := 30;
          ELSE
            s_err := TRUE;
            s_state := 99;
          END_IF;
        END_IF;

      30:
        s_state := 0;          // cycle complete, wait for next trigger

      99:                    // error handler - re-arm
        s_state := 0;

    END_CASE;
  END_IF;
END_FUNCTION_BLOCK

9. STL Code: Direct RDREC Call in OB 1

For engineers who prefer STL, the same record read in OB 1 with call-by-value REQ and the cycle-synchronous pattern looks like this. The pattern is identical to the SCL block above but expressed in AWL/STL for S7-300/400.

// OB 1 - cyclic, run once per PLC cycle
      CALL  SFB  52, DB_DIAG
       REQ   :=M  100.0          // start flag from edge detection
       IOID  :=B#16#0            // header / device
       LADDR :=W#16#600          // 1536 (example IO device diagnostic address)
       RECNUM:=B#16#0            // 0x00 header index (see note below)
       MLEN  :=32
       RET_VAL:=MW 110           // status
       BUSY  :=M  110.0
       RECORD:=P#DB_BUF.DBX 0.0 BYTE 64

// continuation: poll BUSY until FALSE, then check RET_VAL
      U   M  110.0
      SPB END1                    // BUSY = TRUE, exit and re-enter next cycle

      L   MW 110                  // RET_VAL
      L   W#16#0
      <>I                         // RET_VAL <> 0
      SPB ERR1

// success - parse record at DB_BUF
// RECORD 0x8000 starts at DBX 0
// header block type = DBW 0
// header block length = DBW 2
// header block version = DBW 4
// pending channel count = DBB 8

END1: BE
ERR1: // error handling - log RET_VAL and clear BUSY
      ...

For PROFINET records above 0x00FF, the RECNUM byte of SFB 52 is too small. The correct approach on S7-300/400 is to call SFB 52 twice — once for the low byte and once for the high byte — or, on newer CPUs, use the extended SFB 52 with a DWORD interface. S7-1500 and S7-1200 expose RDREC as an instruction with DWORD record numbers and accept 0x8000..0xFFFF directly.

10. SFC 51 SSL_ID W#16#0C92 - Per-Slot Status Extension

W#16#0C91 is the device-level PROFINET status list. W#16#0C92 is the slot-level extension. Calling SFC 51 with SSL_ID = W#16#0C92 returns one 16-byte record per slot, structured as:

0x0C92 gives you everything 0x0C91 gives you, plus the submodule number. It is the right SZL to read first if your goal is to find a "Module missing in slot 0.0.0.2" entry: locate the slot record with STATUS bit 2 = MOD_MISS set, then read the module's HW_ID, SLOT and SUB to build the diagnostic path the user program reports.

For slot-level data that is not channel-level (e.g. module type, manufacturer ID), the I&M (Identification & Maintenance) records are the right tool: read record 0xF841 + offset 0..3 for I&M0..3, which contain order number, serial number, hardware base, hardware version, firmware version, and the installation date.

11. WinCC OA / HMI Integration

The original requirement is to surface the ET200M diagnostics inside WinCC OA (or any HMI that polls the PLC over S7 / OPC). The pattern is straightforward:

1. Define a DB (e.g. DB 100) with a UDT of fixed length: 64 bytes for 0x8000, 128 bytes for 0x8028, 32 bytes per channel record for 0x800A, plus a header word (status, pending count, last RDREC status).
2. Trigger the FB_ET200M_PROFINET_DIAG block every N seconds from OB 35 (or a self-triggering cyclic interrupt OB).
3. Read the decoded fields from the DB at known offsets: DB100.DBW0 = status, DB100.DBB2 = pending channel count, DB100.DBX4 = slot-missing flag, DB100.DBW6 = last channel error type, etc.
4. On the WinCC OA side, map each field to a datapoint. For raw payload, expose the byte buffer as a binary tag and let the HMI parse the record structure.

For a 1-Hz scan rate, the block cycles through 0x8000, 0x8028, 0x800A, and DO32 0x800A in 4 seconds. The decoded w_channel_err is a 16-bit PROFINET error code; WinCC OA can translate it with a standard picklist (0x0001 = short circuit, 0x0006 = wire break, 0x0009 = configuration error, etc.).

12. Verification and Field-Proven Caveats

Checklist before going to production:

1. Confirm the diagnostic address. In HW Config, the IM 153-4 PN slot 0 has a "PROFINET interface" entry. The diagnostic address is the LADDR for header records (0x8000, 0x8028). For channel records, the LADDR is the slot's input/output start address.
2. Confirm the IM firmware. Versions below V3.0 do not support 0xC00A maintenance. Update via SIMATIC MMC before commissioning if maintenance events must be reported.
3. Confirm record 0x8028 is enabled. In HW Config, the slot properties for each module must have "Diagnosis: Module status" enabled; otherwise 0x8028 returns 0x80D5 (Index not available).
4. Confirm channel diagnostics are enabled per channel. For DI32 channel 7 wire break to appear in 0x800A, the channel properties must have "Diagnosis: Wire break" enabled. For DO32, "Diagnosis: Short circuit" must be enabled. Default STEP 7 settings do not enable these; the engineer must set them per channel in HW Config.
5. Poll BUSY, do not hold REQ. SFB 52 requires two calls per record: one to start, one to poll. Holding REQ = TRUE will not return until completion but will queue multiple jobs in the same call depth and return non-deterministic results.
6. Do not call SFC 13 on a PROFINET LADDR. It will return 8093 every time, regardless of LADDR value. Use SFB 52 instead.
7. Watch RET_VAL 80D5 and 80D2. 80D5 means the record index is not supported on this slot/module. 80D2 means the slot is not configured (wrong LADDR). Both are common during ramp-up when modules have not yet completed parameterization.
8. For fiber-coupled stations, port diagnostics (0x8029) are critical. A fiber break on port 1 or 2 of the IM 153-4 PN fiber variant is reported here, not in 0x800A. Read 0x8029 to catch FO link losses.

For deeper detail on the diagnostic stack inside the IM 153-4 and the active backplane, the official operating instructions are at IM 153-2 / IM 153-4 ET 200M operating instructions (Siemens). The PROFINET IO record layout and channel error type tables are derived from IEC 61784-2 and PI's PROFINET IO specification, mirrored in the Siemens function block help for SFB 52 / 53 / 81 / 82.