S7-1500 Web Server Adding the Diagnostic Buffer to a User Web

David Krause12 min read
SiemensTIA PortalTutorial / How-to
Licensed PE Working through this on a live machine? A Maine-licensed engineer can take it from here — included with IMD hardware, by the hour for everything else. Book an engineer

Overview

The SIMATIC S7-1500 web server exposes a fully functional diagnostic surface that mirrors the entries stored in the CPU's internal diagnostic buffer. Engineers typically wire custom HTML dashboards to visualize live tag states for a machine such as a conveyor, but the CPU's diagnostic buffer remains one of the most valuable troubleshooting resources and is normally reserved to the standard Siemens web page reached at https://<CPU-IP>/diagbuffer. Embedding the same diagnostic buffer into a user-defined web page is a documented, supported capability: it uses the S7-1500 user-defined web pages mechanism together with the JavaScript framework file S7_framework.js shipped with the TIA Portal installation.

The CPU's diagnostic buffer records every diagnostic event issued by the operating system, by the user program, by PROFINET, and by I/O modules. Each entry carries a timestamp, a category (information, warning, error), a unique event identifier, and a localized description. On a S7-1500 CPU the buffer is implemented as a ring buffer and typically retains 3200 entries (firmware dependent). Making this buffer available on the same page that already displays live variables shortens troubleshooting time significantly because the operator no longer has to switch contexts.

This article walks through the complete procedure: TIA Portal configuration of the web server, creation of the user-defined web page fragment, integration of S7_framework.js, invocation of the diagnostic-buffer API, and the access-rights settings required to expose the buffer through the custom page.

Prerequisites

Component Requirement Notes
CPU family S7-1500, ET 200SP CPU, ET 200pro CPU, S7-1200 (V4.0+) Web server must be supported by the firmware
Firmware ≥ V2.0 for S7-1500 (full diag buffer access); ≥ V2.5 recommended Earlier firmware lacks certain functions in S7_framework.js
TIA Portal V15.1 / V16 / V17 / V18 / V19 Web-server template and S7_framework.js are part of the TIA Portal installation directory
Web server license None required The diagnostic buffer is part of the standard web page set
Browser HTML5 / JavaScript enabled, modern Chromium, Firefox, Edge AJAX polling requires XHR support
User rights "Read diagnostic buffer" or full administrator Configured in TIA Portal > CPU > Web server > User management
Network TCP 80 (HTTP) or 443 (HTTPS) reachable Port and HTTPS certificate configured in the CPU properties

Reference the official Siemens entry point for the S7-1500 user-defined web pages application example at SIMATIC S7-1500 / ET 200SP Webserver Application Examples. This single support entry contains the downloadable archive with HTML, CSS, JavaScript samples and the live S7_framework.js reference that the diagnostic buffer extension is built on.

Important: The diagnostic buffer is read-only from the web server. Entries cannot be cleared, deleted, or modified through the user page. The web server only renders a snapshot of the buffer maintained inside the CPU firmware.

How the Standard Diagnostic Buffer Page Is Built

The standard diagnostic buffer web page served by the CPU at https://<CPU-IP>/diagbuffer is itself generated server-side. The CPU runs a CGI-style endpoint that streams the buffer as a JSON-like structure. The web page then formats each entry into a table row containing:

  • Sequence number (1 = newest)
  • UTC timestamp in yyyy-mm-dd hh:mm:ss.sss form
  • Event category (icon + text: Information, Warning, Error)
  • Event ID (for example 0x0001, 0x1151, 0x39B1)
  • Event description (multi-line, localized)
  • Source (module / OB / user program)

When you create a user-defined web page, the same endpoint is available to the browser through the JavaScript framework. The framework's diagnostic buffer functions perform a request to the internal path /diagbuffer and convert the response into a JavaScript array of objects that can be iterated and rendered on a custom table.

TIA Portal Configuration of the Web Server

  1. Open the project in TIA Portal and select the S7-1500 CPU in the project tree.
  2. Navigate to Properties > Web server (Webserver).
  3. Enable Activate web server on this module (Aktivieren Sie den Webserver auf diesem Baugruppen).
  4. Decide on HTTP (port 80) and/or HTTPS (port 443). For production machinery, HTTPS is strongly recommended so that diagnostic data is encrypted on the wire.
  5. Open User management (Benutzerverwaltung) and add at least one user. The user role must include the right Read diagnostic buffer (Diagnosepuffer lesen). The "Administrator" role grants this right by default; the "Viewer" or read-only role can also be granted the right explicitly.
  6. If your project is at least at firmware V2.6, enable the new User-defined web pages directory and add the path under Web server > User-defined pages. TIA Portal stores a default fragment directory you can extend.
  7. Compile the hardware configuration and download to the CPU.
Tip: If the user-defined web page option is greyed out, the CPU firmware is too old. Upgrade to firmware V2.0 or higher; ideally V2.6 or later for full S7_framework.js coverage.

Locating and Shipping S7_framework.js

The framework file is delivered with the Siemens support entry referenced above. Inside the downloadable ZIP archive you will find a file named S7_framework.js (and often S7_framework.css plus sample HTML). Copy S7_framework.js into the user-defined web page directory in your TIA Portal project, typically:

C:\Users\<user>\Documents\Automation\<project>\<CPU>\Webserver\Userdefined\

Keep the file naming identical to S7_framework.js because the framework is loaded by the CPU's web server when the custom page requests it. The same script is automatically injected by the standard pages, but in a user-defined page you must reference it explicitly in your HTML:

<script type="text/javascript" src="S7_framework.js"></script>

Calling the Diagnostic Buffer API from JavaScript

The S7_framework.js library exposes a high-level helper that wraps the internal HTTP request and returns an array of buffer entries. The exact public method is documented inside the framework file and is typically called getDiagBuffer or referenced through the S7WebAppFramework.DiagBuffer namespace in newer framework revisions.

A working skeleton for the user page looks like this:

<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="UTF-8">
  <title>Conveyor HMI</title>
  <link rel="stylesheet" href="S7_framework.css">
  <script type="text/javascript" src="S7_framework.js"></script>
  <style>/* page-specific styles */</style>
</head>
<body>
  <header><h1>Conveyor Status</h1></header>
  <section id="live">Live tags go here</section>

  <section id="diag">
    <h2>CPU Diagnostic Buffer</h2>
    <table id="diagTable" border="1">
      <thead>
        <tr><th>#</th><th>Time</th><th>Category</th><th>Event ID</th><th>Description</th></tr>
      </thead>
      <tbody></tbody>
    </table>
    <button onclick="refreshDiag()">Refresh</button>
  </section>

  <script type="text/javascript">
    // Buffer cache
    var lastDiag = [];

    function refreshDiag() {
      if (typeof S7WebAppFramework === "undefined" ||
          typeof S7WebAppFramework.getDiagBuffer !== "function") {
        console.warn("S7_framework.js not loaded or getDiagBuffer missing");
        return;
      }
      S7WebAppFramework.getDiagBuffer(0, 100, function(entries) {
        lastDiag = entries || [];
        renderDiag(lastDiag);
      });
    }

    function renderDiag(entries) {
      var tbody = document.querySelector("#diagTable tbody");
      tbody.innerHTML = "";
      for (var i = 0; i < entries.length; i++) {
        var e = entries[i];
        var tr = document.createElement("tr");
        tr.innerHTML = "<td>" + e.Number +
                       "</td><td>" + e.TimeStampString +
                       "</td><td>" + e.Category +
                       "</td><td>0x" + Number(e.EventID).toString(16).toUpperCase() +
                       "</td><td>" + e.Description + "</td>";
        tbody.appendChild(tr);
      }
    }

    // Auto refresh every 5 s
    setInterval(refreshDiag, 5000);
    refreshDiag();
  </script>
</body>
</html>

The function call getDiagBuffer(startIndex, count, callback) requests up to count entries starting at startIndex (0 = most recent). Newer framework versions support a synchronous variant getDiagBufferSync() that returns the array directly. Always check the framework version you have: open S7_framework.js in a text editor and search for "DiagBuffer" to confirm the method names available in your build.

Verifying the Page from a Browser

  1. Download the project to the CPU and confirm the user-defined web page is reachable at https://<CPU-IP>/<your-page>.html.
  2. Open the page in a browser. The web server will respond with an authentication dialog because the page is in the protected area.
  3. Log in with a user account that holds the Read diagnostic buffer right. A read-only user with that right is sufficient.
  4. Watch the browser network tab: the first GET of your page is followed by an XHR to an internal path similar to /awp/DiagBuffer/?start=0&count=100. A HTTP 200 response means the CPU accepted the request and returned JSON. A HTTP 401 means the authenticated user lacks the diagnostic buffer right.
  5. The table populates within a few hundred milliseconds even on a fully populated buffer.

Access-Rights and Security Considerations

Displaying the diagnostic buffer on a user-defined page brings the same security model that the standard diagnostic page uses. Review the following before going into production:

Setting Where to Configure Recommendation
HTTPS only CPU properties > Web server > HTTPS Enable; upload a CA-signed certificate where possible
User accounts Web server > User management One account per operator, no shared passwords
Role right "Read diagnostic buffer" Per-user role assignment Grant only to maintenance and engineering accounts, not to operators
Automatic logout Web server > Session timeout Keep at the default 15 minutes or shorter
Permitted IP ranges Firewall / VPN topology Restrict the web server port to the maintenance subnet
Disable FTP/Telnet CPU properties > Services Disable unneeded services to reduce attack surface

For additional guidance on displaying system diagnostics through the web server of the ET 200 family, the same concepts apply: refer to Diagnostics information using the web server in the TIA Portal documentation.

Error Handling and Troubleshooting Matrix

Symptom Likely Root Cause Corrective Action
Table stays empty, no XHR in network tab S7_framework.js not loaded Verify the file is in the user-defined web pages directory and is referenced with a relative src path
XHR returns HTTP 401 Authenticated user lacks the diagnostic buffer right Add the right to the role or assign an administrator account
XHR returns HTTP 404 Firmware older than V2.0, or the user-defined pages feature is disabled Update CPU firmware, enable user-defined web pages in TIA Portal
Entries shown but timestamps are wrong CPU clock is unsynchronized Configure NTP or S7 time synchronization; web server returns CPU local time
Description field shows hexadecimal Framework older than V2.6 returns raw event ID; description needs a localization step Upgrade TIA Portal project, or interpret the event ID against the manual list
Browser console shows "getDiagBuffer is not a function" Custom build of framework has different API name Inspect the framework source, use the method that actually exists (e.g. getDiagBufferList)
Page loads but constant re-login Session cookie is rejected due to mixed HTTPS/HTTPS Force HTTPS across the entire site and serve all assets with HTTPS
Events that should be present are missing Ring buffer wrapped; older events have been overwritten Increase the buffer retention by clearing low-severity entries from the user program, or by archiving the buffer to a log file from the PLC
Buffer overflow: The diagnostic buffer is a ring buffer. If the PLC generates events faster than you read them, the oldest entries are overwritten silently. The web server does not raise an alarm when this happens. Use the user program to count overflows (event ID 0x1A0E for buffer overflow on S7-1500) and surface it on the custom page.

Performance and Polling Cadence

Every call to getDiagBuffer() performs an authenticated HTTP request and JSON parsing. The CPU can answer hundreds per second, but the web server was not designed for high-rate polling. Field-tested values:

  • 2 to 5 second refresh cadence: smooth, no measurable CPU load.
  • 1 second refresh: works on a S7-1515 / S7-1516, may show delays on S7-1511 or S7-1511C.
  • <500 ms refresh: not recommended. Use PROFINET or OPC UA for high-speed diagnostics.

If you need sub-second diagnostics, do not poll the diagnostic buffer at high rate. Instead, push critical events from the user program into a tag array that the custom web page reads in a single, lightweight call. Use the diagnostic buffer for the human-readable history, and use tag-based alarms for the real-time portion of the HMI.

Localizing the Event Description

The CPU stores diagnostic events with internal event IDs and a language-neutral description. The standard pages translate the description based on the browser language. The framework returns the raw text. To localize on a user page, you can either:

  1. Set the HTML lang attribute to the desired language and let the framework translate automatically when the framework's localization is loaded.
  2. Maintain a lookup table in your JavaScript for the event IDs that you care about most (for example, 0x1151 = "STOP triggered by user").

The lookup-table approach is preferred for OEM machinery where the same diagnostic page is shipped worldwide and the page text must be controlled, not delegated to the browser locale.

Exporting the Buffer from the Custom Page

Because the framework already retrieves the buffer into a JavaScript array, exporting it as CSV requires a few lines of code:

function exportDiagCSV() {
  var rows = ["Number;Time;Category;EventID;Description"];
  for (var i = 0; i < lastDiag.length; i++) {
    var e = lastDiag[i];
    rows.push([e.Number, e.TimeStampString, e.Category,
               "0x" + Number(e.EventID).toString(16).toUpperCase(),
               e.Description].join(";"));
  }
  var blob = new Blob([rows.join("\n")], { type: "text/csv" });
  var url = URL.createObjectURL(blob);
  var a = document.createElement("a");
  a.href = url;
  a.download = "diagbuffer.csv";
  a.click();
  URL.revokeObjectURL(url);
}

Wire the function to a button on your user page so the operator can save a snapshot before sending it to engineering support.

Relationship to TIA Portal Diagnostics

The same data shown by your custom web page is also displayed in the TIA Portal online view under Online & diagnostics > Diagnostics buffer. For an in-depth description of the buffer structure, the event categories, and the meaning of each event ID, consult the TIA Portal function manual CPU diagnostics buffer. The web-server representation is a strict subset of the TIA Portal representation: every entry visible in TIA Portal is also visible on the web page, but the web page does not allow navigation into the call stack of a user-defined OB.

Verification Checklist

  • Web server is enabled and the page is reachable over HTTPS.
  • User-defined web pages are enabled in the CPU properties and the directory contains S7_framework.js and the new HTML file.
  • The logged-in user has the Read diagnostic buffer right.
  • Browser network tab shows a 200 response on the internal /awp/DiagBuffer/... request.
  • Table renders at least one entry from the buffer (for example the latest OB100 startup entry).
  • No JavaScript errors in the console; S7WebAppFramework is defined as a global object.
  • The CSV export button downloads a syntactically valid file.

Which Siemens CPUs expose the diagnostic buffer through the web server?

S7-1500 CPUs from firmware V2.0, ET 200SP CPUs, ET 200pro CPUs, and S7-1200 CPUs from firmware V4.0 expose the diagnostic buffer. The feature is part of the standard web pages, so no license is required.

What is S7_framework.js and where is it located?

S7_framework.js is the JavaScript helper library provided by Siemens for building user-defined web pages on the S7-1500 web server. It is shipped inside the ZIP archive of the support entry at SIMATIC S7-1500 / ET 200SP Webserver Application Examples, and is placed in the user-defined web pages directory of the TIA Portal project.

Can I clear or modify diagnostic buffer entries from the custom page?

No. The diagnostic buffer is strictly read-only from the web server. Clearing or modifying entries is a CPU-level operation, typically performed by going to STOP/RUN, by power-cycling, or by executing a user program that calls the appropriate system function.

Why does the diagnostic table stay empty even though the user is logged in?

The most common reason is that the user account does not have the Read diagnostic buffer right. Open the CPU properties in TIA Portal, go to Web server > User management, and add the right to the user role. After a project recompile and download, the buffer becomes visible.

How many diagnostic buffer entries does an S7-1500 keep?

The default ring buffer holds up to 3200 entries on a standard S7-1500 CPU. Once full, the oldest entry is overwritten by the next diagnostic event. The number can vary slightly by CPU model and firmware version, so check the device manual for the exact figure of your hardware.

Back to blog