Retrieve S7-300 MPI Address from Ladder Logic using SFC51

1. Problem Overview and Engineering Use Case

Many S7-300 deployments use identical program files across multiple CPUs that differ only in their MPI address (station number). Examples include:

• Machine series with 4 to 32 identical cells, each with its own CPU 312C/313C/314C/315-2 DP/317-2
• Modular conveyor segments where the HMI/PG must poll the "correct" PLC
• Hot-standby or peer-to-peer MPI networks where the CPU needs its own node number to build routed messages
• Asset-tracking systems that need to embed the MPI station number into a barcode, alarm, or DB string for traceability

Hard-coding the station number in the program defeats the purpose of a single project. The correct approach is to read the address at runtime from the CPU's own system data and place it in a global DB or output word.

The Siemens tool for this is SFC 51 "RDSYSST" (Read System State), which queries the System Status List (SSL) of the CPU. The S7-300/400 System Software for S7-300/400 System and Standard Functions Reference Manual documents SFC 51 in detail (Siemens Entry ID 1214574). The companion FAQ on reading system states is at 11774682.

2. Prerequisites

Before implementing the read, confirm the following:

• CPU family: S7-300 with firmware >= V2.0. All 31x, 31xC, 31xT, and 31xF variants support SFC 51. S7-400 uses the same call, but some SZL_IDs differ.
• STEP 7 version: STEP 7 V5.4 SP5 or later (or TIA Portal V13 SP1+ for S7-300 in the older TIA port). SFC 51 is in the standard library under Standard Library > System Function Blocks.
• Hardware configuration: The CPU must have its MPI interface enabled in HW Config (Properties > MPI/DP > Parameters > MPI address). Default = 2.
• Program capacity: A 34-byte buffer is sufficient for the standard partial lists (SZL partial lists are returned in 32-byte data records plus 2 bytes of header).
• Authorization: SFC 51 does not require a special password; it runs in OB 1, OB 100, and cyclic OBs without security attributes.

3. SFC 51 (RDSYSST) Fundamentals

SFC 51 reads a System Status List (SSL) or a partial list (SZL) from the CPU. The call signature is:

// SFC 51 - RDSYSST - Read System State
// STL / English keyword form
CALL  "RDSYSST"
REQ    := TRUE                  // BOOL  - 1 = start read on each call (use edge for one-shot)
SZL_ID := W#16#0111             // WORD  - System Status List identifier
INDEX  := W#16#0002             // WORD  - object index (e.g. slot 2 for S7-300 CPU)
RET_VAL:= MW100                 // INT   - return value (0 = OK, see error table)
BUSY   := M101.0                // BOOL  - 1 while SFC is working
SZL_HEADER := P#M 110.0 BYTE 6 // ANY   - 6-byte header (SZL ID, partial list length, count)
DR     := P#M 116.0 BYTE 32    // ANY   - 32-byte data record buffer

Key parameters:

The SZL_HEADER returns 6 bytes:

Bytes 0-1 : SZL_ID (echo of the requested ID)
Bytes 2-3 : Length of one data record in bytes (N)
Bytes 4-5 : Number of data records returned (COUNT)

The CPU supplies 32 bytes per data record when the actual record length is shorter; the rest is padded with zero.

4. SSL IDs Relevant to the MPI/PROFIBUS Address

The S7-300/400 manual lists more than 100 SZL_IDs. Only a handful carry interface address information. The table below summarizes the working IDs for retrieving the CPU's integrated MPI/PROFIBUS address.

5. Reading the MPI Address - Step-by-Step STL Implementation

The complete, copy-paste-ready STL block reads the MPI station number at startup, stores it in a global DB, and exposes it as an integer output for the rest of the program.

Step 1 - Allocate a global DB (e.g. DB 200 "CPU_Identity") with the following layout:

DATA_BLOCK "CPU_Identity"
VERSION : 0.1
  STRUCT
   MPI_Address      : INT;     // station number 0..31 (MPI) / 1..126 (DP)
   Interface_ID     : BYTE;    // 0=MPI, 1=DP, 2=PN
   SZL_Header_Valid : BOOL;    // 1 = read finished OK
   SZL_Error        : INT;     // RET_VAL from SFC 51 last call
   Read_Done        : BOOL;    // first scan finished
  END_STRUCT;
END_DATA_BLOCK

Step 2 - Call SFC 51 in OB 100 (startup) or the first scan of OB 1:

// OB 100 - Startup - One-shot read of own MPI station number
// Uses SZL_ID W#16#0019, INDEX 0 = integrated MPI interface
      SET
      =     "CPU_Identity".SZL_Header_Valid      // reset ready flag

      CALL  "RDSYSST" , DB1                       // DB1 = SFC 51 instance
       REQ          := TRUE
       SZL_ID       := W#16#0019
       INDEX        := W#16#0000                   // 0 = MPI, 1 = DP, 2 = PN
       RET_VAL      := "CPU_Identity".SZL_Error
       BUSY         := M200.0
       SZL_HEADER   := P#M 50.0 BYTE 6
       DR           := P#M 56.0 BYTE 32

      AN    M200.0                                // BUSY 0 = finished
      JC    _end

// Extract station number from DR:
//   Bytes  0-1 : SZL_ID echo
//   Bytes  2-3 : reserved
//   Bytes  4-5 : own station address (MPI/PB/PN)
      L     MB 60                                 // low byte of own address
      T     "CPU_Identity".MPI_Address

      L     MB 57                                 // interface ID byte
      T     "CPU_Identity".Interface_ID

      SET
      S     "CPU_Identity".SZL_Header_Valid
      S     "CPU_Identity".Read_Done
_end: NOP 0

Step 3 - Use the value in the rest of the program:

// Ladder fragment in FBD form
      L     "CPU_Identity".MPI_Address
      T     MW 120                                // expose at output word 120
      T     DB100.DB[DB100.Offset_Base]            // optional: copy to recipe header DB

The same pattern works in LAD with a single contact to enable the SFC 51 box and a MOVE block to copy bytes 60-61 into the DB.

6. Alternative Methods for Reading the Station Number

If SFC 51 does not return the expected data (CPU firmware too old, SZL not implemented on that CPU), use one of the following approaches.

6.1 SFB 52 "RDREC" - Read Data Record 0 of the Integrated Interface

The CPU's integrated MPI/PROFIBUS interface responds to a DP slave diagnostic request even when no DP slaves are connected. The diagnostic data record (DS 0) contains the station number.

CALL  "RDREC" , DB52
 REQ      := M210.0
 ID       := DW#16#0FFF                          // own logical address of interface
 INDEX    := 0                                   // DS 0
 MLEN     := 32                                  // read up to 32 bytes
 VALID    := M211.0
 BUSY     := M211.1
 ERROR    := M211.2
 STATUS   := MW212
 LEN      := MW214
 RECORD   := P#M 220.0 BYTE 32
// First 6 bytes = standard DP-V0 diagnostic; byte 4 = station number
      L     MB 224
      T     "CPU_Identity".MPI_Address

ID parameter: Use the diagnostic address of the integrated DP interface. In HW Config, open the Properties of the CPU's DP interface and copy the "Diagnostic address" of slot 0. Typical value: 2046 (CPU 315-2 DP) or 16382 (CPU 317-2 DP). Refer to the S7-300 CPU manual at 8859629 for the exact default address of your CPU.

6.2 SFC 5 "GADR_LGC" - Get Logical Address of a Slot

SFC 5 returns the I/O base addresses of a module in a given rack/slot. It does not return the MPI station number, but combined with the interface properties in SZL_ID W#16#0011 it can be used to derive the interface's logical address. Use this when the application must build direct I/O access to the integrated interface.

CALL  "GADR_LGC"
 IOID      := B#16#54                            // 54h = input area of interface
 LADDR     := W#16#7FFE                          // any address in interface area
 RET_VAL   := MW230
 SUBSLOT   := MW232
 SUBADDR   := MD234

6.3 Pointer-Based Access to the System Data Block (SDB)

The interface parameters are stored in SDB 1 (PROFIBUS DP master) and SDB 2 (MPI). Reading these directly from user logic is not supported; configure via HW Config instead. SFC 51 is still the correct runtime path.

6.4 System Function Block SFB 81 (RD_SBL) - Read Slave Diagnostics

For DP slave station numbers (e.g. an ET 200S), use SFB 81 instead of SFC 51. The S7-300 manual 18652056 covers distributed I/O diagnostics.

7. Multi-PLC Project Strategy

When the same project must be downloaded to many CPUs with different station numbers, follow the workflow below.

1. Compile once in STEP 7 / TIA Portal with a placeholder MPI address (typically 2).
2. Distribute the program via SD card, Ethernet download, or the S7 Memory Card.
3. On first power-up, the program reads the real address from SFC 51 and stores it in DB 200.
4. Use the value in all peer-to-peer (S7 communication "PUT/GET"), broadcast messages, and alarm tags.

Critical engineering points:

• The address is read once at startup. Re-read it in OB 100 (warm restart) and OB 101 (hot restart) to capture any HMI-driven address change. STEP 7 allows the MPI address to be reassigned online via the PG; OB 100 will see the new value after the next restart.
• For PN CPUs (e.g., 315-2 PN/DP), the IP address is not in SZL_ID 0019. Use SZL_ID W#16#0131 (own IP parameters) or the system function blocks of Open Communication (FB 65/66) for IP retrieval.
• Avoid calling SFC 51 in a fast OB (e.g. OB 35 at 100 ms). The call typically completes in 1-2 ms but is not deterministic; restrict to OB 1, OB 100, and OB 101.
• If the program must change its own MPI address at runtime, use SFC 5 (GADR_LGC) to find the interface, then write the new value with the PG function "Assign MPI Address". SFC 51 cannot write the address; this is a hardware-configuration function.

8. Verification and Commissioning

Add a VAT (Variable Table) to the project to verify the read result.

1. Open the S7 program in STEP 7 and create a VAT named "CPU_ID_Check".
2. Insert the following monitor entries:

   DB200.DBW0   INT   // MPI_Address (decimal 0..31 = MPI, 1..126 = DP)
   DB200.DBB2   BYTE  // Interface_ID
   DB200.DBB3   BOOL  // SZL_Header_Valid
   DB200.DBW4   INT   // SZL_Error (should be 0000 after successful read)
   MW 60        BYTE  // raw byte from SFC 51 DR buffer (offset 4)
   MW 50        WORD  // SZL_ID echo (should be 0019)
   MW 52        WORD  // record length (should be 0006 or 0008)
   

3. Download the project, perform a CPU restart (STOP -> RUN), and switch the VAT to "Monitor".
4. Confirm the following:
   • DB200.DBW0 equals the value set in HW Config under "MPI/DP Properties > Address".
   • DB200.DBB3 = 1 (read complete).
   • DB200.DBW4 = 0 (no error).
   • MW 50 = W#16#0019 (SZL_ID echo matches request).
5. Change the MPI address in HW Config, re-download, restart, and verify DB200.DBW0 changes to the new value.

9. Troubleshooting Matrix

10. Edge Cases and Field Notes

Firmware-dependent SZL support. S7-300 CPUs with firmware V2.0 implement SZL_IDs 0000, 0011, 0012, 0013, 0014, 0015, 0019, 0111, 0F31, 0F32. CPUs with firmware V3.x add 001C, 001E, 001F, 0131, 0F33, 0132, 0424, 0F82. Always consult the CPU's Module Information in STEP 7 (online > Module Information > Diagnostic Buffer) when an SZL_ID returns 80A1.

Multi-processor S7-400 caveat. On an S7-400 with multiple CPUs, SFC 51 returns the SSL of the CPU on which it executes. If the project uses CPU-to-CPU communication, the program must run on the CPU whose address is being read.

PROFIBUS DP master vs. slave role. When the integrated interface is configured as DP master, INDEX = 1 in SZL_ID 0019H returns the master's own station number. When the interface is configured as DP slave, the same INDEX returns the slave's own station number, which differs from the master's. Verify the role in HW Config > Properties > "Operating Mode".

Cyclic re-read with watchdog. Some commissioning engineers re-execute SFC 51 every hour to catch operator-driven address changes. Wrap the call in an FB with a TON timer; if the read fails (RET_VAL <> 0) for three consecutive attempts, raise a maintenance alarm and revert to the cached value in DB 200.

Memory card migration. When a project is moved between CPUs of different type (e.g., 313C -> 314C), the MPI default address may revert to 2 on the new CPU. The SFC 51 read in OB 100 will pick up the new value automatically, but the assignment of the address in the new CPU's HW Config is the integrator's responsibility.

SFC 51 in a fail-safe (F) CPU. SFC 51 is not a safety function and must not be used in the F-runtime group. Reading the MPI address for a diagnostic purpose is acceptable; using it to make a safety decision is not. The S7-300F system manual 19088450 defines the boundary.

Comparison with TIA Portal. In TIA Portal V13 and later, SFC 51 still works inside S7-300 programs; the call is identical. For S7-1500, the equivalent instruction is "RD_SBL" (read S7 system state) under "System diagnostics" or the GET_DIAG system block. S7-1500 uses a different SZL concept; the program must be ported manually if migrating.

Why the manual does not list "MPI address" by name. The S7-300/400 manual groups SZLs by category (module identification, status, communication). The interface station number lives under "Communication Status". Engineers searching the manual index for "MPI" sometimes miss it; searching for "station number" or "interface ID" returns the right page.

11. Frequently Asked Questions