Resolving Siemens ET200S Profibus FC105 Read Error and Event

Overview

This article addresses a class of intermittent, ~1-second "Read error I/O" alarms reported on Siemens HMI systems that point to the SCALE function block (FC105) and a Profibus DP ET200S station based on a 6ES7 151-1CA00-3BL0 IM151-1 interface module. The error is accompanied by a user-defined event 16#A217 appearing in the CPU diagnostic buffer. Engineers frequently misread the symptom as an I/O hardware fault, while in practice the fault chain spans three layers: the ET200S Profibus DP slave, the FC105/FC106 scaling block in the STEP 7 program, and the SFC52 WR_USMSG call that emits the A217 entry. Resolving the alarm requires a coordinated check of all three layers, plus verification of the field wiring and the HMI tag configuration.

System Architecture and Affected Components

The reference configuration in the field report is a Profibus DP network with the following ET200S station:

Slot	Module	Order Number	Function
0	IM151-1 STANDARD	6ES7 151-1CA00-3BL0	Profibus DP slave interface
1	PM-E 24 VDC	6ES7 138-4CA00-0AA0	Power module for electronics
2-3	16 DI / 16 DO module pair	6ES7 131-1BL00 / 6ES7 132-1BL00	Discrete signals
4	4 AI (2-wire)	6ES7 134-4FB00-0AB0	Analog input bank
5	2 AO	6ES7 135-4GB00-0AB0	Analog output pair
6	2 AI (4-wire)	6ES7 134-4GB00-0AB0	Additional analog inputs

The IM151-1 STANDARD (6ES7 151-1CA00-3BL0) supports up to 63 I/O modules per station with Profibus DP-V0/V1 communication. The "BL0" suffix denotes a custom variant; verify the firmware is current against the Siemens support catalog entry. Reference: ET200S Distributed I/O System Manual.

Input address 768 (decimal) is the typical I/O base address of the analog input region assigned in HW Config. When FC105 is called with IN = PIW 768, the block reads the process image of the analog input, scales it, and returns a REAL value at OUT.

Decoding the HMI Error Message

The full text — S7$Dryer/@(2)/AS_Dryer_2 Read error I/O: FC105 Addr: 768 — is composed of three distinct fields that the WinCC flexible / TIA Portal runtime generates when it cannot refresh a tag value within the configured acquisition cycle:

Field	Value	Meaning
Connection	S7$Dryer	Configured S7 HMI connection to the S7-300/400 CPU
Tag path	@(2)/AS_Dryer_2	Tag at HMI area index 2, name "AS_Dryer_2"
Error detail	Read error I/O: FC105 Addr: 768	Tag PLC address was unreachable or invalid at scan time

Important: the "Read error I/O" message is generated by the HMI runtime, not by FC105. FC105 has no diagnostics buffer and only returns a status word. The HMI tag "AS_Dryer_2" is configured with a polling address that points to the FC105 output (for example DBx.DBDy where the scaled value is stored), and the HMI loses the value whenever the PLC connection drops, when the polled address returns an invalid word, or when the tag acquisition cycle is shorter than the PLC response time. The HMI error is therefore a downstream symptom, not the root cause. Reference: STEP 7 System and Standard Functions Reference Manual.

Understanding FC105 and FC106 Scaling Function Blocks

FC105 (SCALE) and FC106 (UNSCALE) are the standard STEP 7 library blocks used to normalize raw analog I/O words to engineering units. The relevant interface of FC105 is:

Parameter	Type	Range	Description
IN	INT	0–27648 (unipolar); -27648…+27648 (bipolar)	Raw input value from PIW
HI_LIM	REAL	Engineering unit	Upper scale limit
LO_LIM	REAL	Engineering unit	Lower scale limit
BIPOLAR	BOOL	0 = unipolar, 1 = bipolar	Range mode
OUT	REAL	LO_LIM…HI_LIM	Scaled engineering value
RET_VAL	WORD	0x0000 = OK	Error return word

RET_VAL reports the following states:

• W#16#0000: no error
• W#16#0007: invalid input; IN = 16#8000 (underflow) or 16#7FFF (overflow / wire break marker from the analog module)
• W#16#0008: invalid LO_LIM or HI_LIM (equal, or LO_LIM greater than HI_LIM)

When the ET200S analog input module reports overflow or wire break, it writes 16#7FFF into the corresponding PIW. FC105 interprets this as a bad value, sets OUT to the upper limit, and raises RET_VAL = W#16#0007. The HMI polling that PIW — or a memory location copied from FC105 OUT — will then display a "Read error I/O" alarm until the analog signal recovers. Reference: STEP 7 — Standard and System Functions.

Interpreting Event ID 16#A217 in the CPU Diagnostic Buffer

Event IDs in S7-300/400 are 16-bit hex codes with a defined structure:

High Nibble	Range	Class	Origin
1	0x1xxx	Standard OB events	System
2-3	0x2xxx–0x3xxx	Extended diagnostics	System
4-7	0x4xxx–0x7xxx	Mode transitions, sync errors	System
8-F	0x8xxx–0xFxxx	Fault classes	System
A	0xAxxx	User-defined (warning class)	SFC52 WR_USMSG
B-E	0xBxxx–0xExxx	User-defined (other classes)	SFC52 WR_USMSG

Event 16#A217 belongs to the "user-defined event, warning class" group. It is generated by an SFC52 (WR_USMSG — Write User-Defined Diagnostic Message) call. The leading 'A' is the class indicator for warnings, the '2' is part of the high byte, and '17' is the user event number. Searching the STEP 7 program for SFC52 instances and inspecting the EV_ID input will reveal which OB or FC fires the 16#A217 entry. Reference: SFC52 WR_USMSG documentation.

A typical pattern in dryer and HVAC applications is to issue a user warning whenever an analog scaling block returns RET_VAL not equal to 0, or when the Profibus slave enters a temporary diagnostic state. The 1-second coincidence is consistent with a Profibus retry cycle: when the DP master misses a slave frame, the slave temporarily reports a station failure, OB82/OB86 fire, and the SFC52-driven user message is queued to the diagnostic buffer with a one-cycle time-stamp.

Common Root Causes

Layer	Root cause	Indicator	Probability
Profibus DP slave	Connector or cable intermittent	OB86 station failure, A217 burst	High
Profibus DP slave	Terminating resistor missing or duplicated	CRC errors, sporadic retries	High
Profibus DP slave	IM151-1 firmware down-level on BL0 variant	Recurrence after firmware update	Medium
Analog module	4–20 mA wire break or overflow	PIW = 16#7FFF / FC105 RET_VAL = 0x0007	High
STEP 7 program	FC105 called with wrong IN, BIPOLAR flag, or limits	RET_VAL = 0x0007 or 0x0008	Medium
STEP 7 program	SFC52 fired in OB1 / OB82 with EV_ID = 16#A217	Diagnostic buffer A217 always	Certain (by definition)
HMI	Tag polling address points to invalid memory	Persistent Read error I/O	Medium
HMI	Tag acquisition cycle faster than slave response	Sub-second timeouts only	Medium

Profibus DP Diagnostic Procedure

1. Open STEP 7 → HW Config, right-click the IM151-1 slave, and select "DP Slave Diagnostics" to read the current station status. Note the diagnostic buffer entries inside the IM151-1 itself.
2. From PG/PC online, open the CPU diagnostic buffer (PLC → Diagnostics/Settings → Diagnostic Buffer) and filter for "DP" and "Station Failure".
3. Use "PLC → PROFIBUS → Diagnose" to log all live DP frames and identify CRC, repeat, and timeout counters.
4. Inspect the OB82 (I/O point fault) and OB86 (rack/station failure) start info. The rack number 0 and slot pointer in OB86 identify the ET200S station that lost communication.
5. Check terminating resistors at the physical bus end. There must be exactly two terminators enabled, one at each physical extremity of the bus segment. A third terminator anywhere on the segment causes reflections that mimic the symptom described.
6. Measure the voltage on the Profibus cable. The idle voltage on data lines A and B should be approximately 1.1 V differential, with A = green, B = red per the standard Profibus color code.
7. If the 6ES7 151-1CA00-3BL0 IM151-1 is older than the latest firmware revision published on the Siemens support portal, upgrade using SIMATIC Automation Tool or directly via PG with the appropriate firmware file. Verify the version is not down-level relative to the rest of the DP network.

FC105 Validation and Code Analysis

Use cross-references in STEP 7 to locate every call to FC105 (or its renamed copy). For each call instance, verify:

1. IN is wired to a valid PIW that belongs to the analog input module of the ET200S station. The address must match the slot address assigned in HW Config — typically 768, 770, 772, 774 for the first four AI channels.
2. HI_LIM and LO_LIM are constants with LO_LIM less than HI_LIM and a non-zero range. If LO_LIM = HI_LIM, FC105 returns W#16#0008.
3. BIPOLAR is set true for ±10 V, ±20 mA, ±5 V, 4–20 mA; false for 0–10 V, 0–20 mA, 1–5 V. Wrong selection produces a "Read error" the moment the signal goes negative or below zero.
4. The HMI tag "AS_Dryer_2" polls a memory location, not PIW 768 directly. If the tag is configured to PIW 768, FC105 is bypassed and the HMI sees a 16-bit word that may be 16#7FFF on overflow, which WinCC interprets as a read error.

Insert a temporary debug network with a MOVE to a marker word and a comparison of FC105 RET_VAL. Example ST code for offline analysis:

// FC105 call (call-by-value pattern)
L     PIW 768
T     "AS_Dryer_2_Raw"   // INT storage of raw value
CALL  "SCALE"            // FC105
IN   := "AS_Dryer_2_Raw"
HI_LIM := 100.0
LO_LIM := 0.0
BIPOLAR := FALSE
OUT  := "AS_Dryer_2_Eng" // REAL, engineering unit
RET_VAL := "AS_Dryer_2_Ret"   // WORD

// Optional: trap RET_VAL
L     "AS_Dryer_2_Ret"
L     W#16#0
<>I
S     "AS_Dryer_2_Bad"    // set flag for OB82 / SFC52 user message

Tracing the SFC52 WR_USMSG Call Responsible for A217

1. Right-click the CPU in the project tree and choose "Find in Program → SFC52". STEP 7 will list all blocks containing the call.
2. Open each candidate. Locate the SFC52 invocation; note the EV_ID, SFC_NUM (always 52), and TINFO / AINFO parameters. Confirm EV_ID = W#16#A217.
3. If A217 is not produced by your own program, the most likely explanation is that an SFC52 call in a library FB, a Drive ES library block, or a PCS 7 APL block is firing automatically. Open the cross-reference for SFC52 and check all blocks in the "Standard Library → System Function Blocks" path.
4. Once located, evaluate the condition that enables the call. Common conditions are: "OB82_IF1.FLT_ID <> B#16#0", "OB86_IF1.EV_CLASS = B#16#39", or "FC105.RET_VAL <> W#16#0".

Reference: SFC52 WR_USMSG — Write User-Defined Diagnostic Event.

Step-by-Step Resolution Procedure

1. Capture a Profibus trace with the PB Softnet / Softbus diagnostic tool or with the Siemens Profibus Diagnostics Repeater. Look for retry count, faulty frames, and slave address.
2. Open the CPU diagnostic buffer online. Filter for all entries with Event ID 0xA217 and 0x39xx (station failure). If they always co-occur within ±200 ms, the root cause is Profibus.
3. Physically inspect the Profibus connector at the IM151-1. Confirm the terminating switch is in the correct position (only at the first and last stations of the segment).
4. Verify the analog wiring. Use a process clamp meter to confirm 4–20 mA is present at the channel terminals. If the value drops below 3.6 mA, the analog module sets the PIW to 16#7FFF and the HMI alarm triggers.
5. Open the STEP 7 program and verify every FC105 call as described in the FC105 Validation and Code Analysis section.
6. Locate the SFC52 call producing A217 and confirm whether the condition is intended or a side-effect of a transient DP fault.
7. If A217 is a legitimate warning, keep the call but route the text to a WinCC alarm that distinguishes "transient" from "persistent" — a single ~1-second A217 is consistent with one DP retry, not a hard fault.
8. If the alarm is a nuisance, change SFC52 EV_ID to a different free ID, or remove the SFC52 call until the FC105 / DP fault has been eliminated.

Verification and Monitoring

1. Open WinCC flexible / TIA Portal online. Watch the "AS_Dryer_2" tag value and confirm it no longer flips to "###" or "Read error" during a normal production cycle.
2. In the CPU diagnostic buffer, count the number of 0xA217 entries over 24 hours. A persistent nonzero count indicates the alarm is still firing.
3. Force a controlled Profibus break (disconnect the Profibus cable at the IM151-1 for 5 seconds, then reconnect) and confirm the HMI alarm appears once and clears once the slave is back. The A217 count should increase by exactly one entry per break.
4. Use the ET200S IM151-1 diagnostic LEDs: SF (red) = group fault; BF (red) = bus fault; ON (green) = power OK. The BF LED flickering during the alarm confirms the Profibus link is dropping.
5. Run the S7-300 CPU in RUN with OB82, OB83, OB86, OB87, OB121, OB122 loaded. Missing error OBs cause the CPU to STOP on the first transient — a hard STOP at the same moment as a "Read error" indicates an unloaded error OB.

Preventive Measures

• Apply a shielded Profibus cable with proper 360° bonding at the cabinet entry. Use Siemens 6XV1 830-0EH10 or 6XV1 830-3EH10 cable, with 6GK1 500-0EA02 connectors and 6ES7 972-0BA50-0XA0 terminating connectors.
• Set the HMI tag acquisition cycle to a value no smaller than 500 ms for analog tags. Profibus default retry time on a one-frame drop is typically 100–200 ms, so a 100 ms acquisition cycle will surface transient retries that a 1 s cycle will absorb.
• Wrap every FC105 call with a validity check on RET_VAL, and store the scaled output in a separate word that the HMI tags reference. This way the HMI never reads the raw 16#7FFF value directly.
• Document the SFC52 user-defined events in the project's diagnostic matrix. Each EV_ID should have an associated meaning and a recovery procedure.
• Keep the IM151-1 firmware current. The 6ES7 151-1CA00-3BL0 can be updated to the latest firmware shipped with later IM151-1 revisions; cross-check with the ET200S System Manual.

Field-Commissioning Checklist

1. Confirm the GSD file imported for the 6ES7 151-1CA00-3BL0 matches the firmware on the device. Mismatched GSD revisions produce intermittent configuration errors after power-up.
2. Set the Profibus slave address on the IM151-1 DIP switch to match HW Config. The default is 3, but a duplicate address is a common commissioning mistake that yields identical symptoms.
3. Verify the maximum bus address. If a DP master is configured for address 32 but the IM151-1 is set to 33, the master never polls the slave, and the slave is invisible to the CPU diagnostic buffer even when the cable is connected.
4. Load all required error OBs (OB82, OB83, OB85, OB86, OB87, OB121, OB122) before commissioning. A CPU without OB85 will STOP on the first access to a non-existent module — a likely cause of the 1-second drop being followed by a brief process image gap.

Troubleshooting Matrix

Symptom	Likely Layer	First Check	Tool
Read error for 1 s, no other diagnostic	Profibus	OB86 count, BF LED	STEP 7 online / PB Softnet
PIW = 16#7FFF on one channel only	Analog	Field signal, wiring	Multimeter / clamp meter
RET_VAL = 16#0008 from FC105	STEP 7	LO_LIM / HI_LIM / BIPOLAR	Cross-reference FC105
A217 fires continuously	STEP 7	SFC52 EV_ID = 0xA217 call site	Find in Program
CPU goes to STOP on alarm	STEP 7	Missing error OB	CPU diagnostic buffer
HMI never recovers, CPU is fine	HMI	Tag acquisition cycle, address	WinCC flexible / TIA Portal

Frequently Asked Questions