S7-300/400 Module Diagnostics: OB82, OB86, and SFC51 Programming

1. Problem Overview: Analog Values Collapse to 0 When an I/O Rack Loses Power

On a STEP 7 V5.x project with an S7-400 CPU (CPUs 412/414/416/417) in the central rack and S7-300 stations connected over PROFIBUS-DP (or PROFINET IO), operators frequently report the following symptom:

• An analog input module (e.g. 6ES7 331-7KF02-0AB0) in a remote ET200M station is powered off or disconnected.
• Inputs in the STEP 7 program that should hold the last valid process value or a configured substitute value are read as 16#0000 instead.
• The HMI/SCADA picture shows all channels of that module at 0, which the control logic treats as a real process value (e.g. 0 °C, 0 bar, 0 %, or even 0 mA which trips a low-low alarm).
• The fault is invisible in the standard program flow because the cyclic OB1 simply reads PIW and continues; no error flag is raised.

On S7-300/400, this is the documented default behaviour: when a station is missing, the I/O area is either filled with 0 (default) or with a configured substitute value depending on how the process image is configured and whether the OB associated with the failure is loaded or not. The clean fix is to install the proper diagnostic organization blocks (OB82, OB85, OB86, OB122) and to read the system status lists (SZL) with SFC51 RDSYSST so the user program knows exactly which module is missing, why, and where in the topology the failure occurred.

2. Why the Inputs Read 16#0000: Substitute Value, Process Image, and OB Priority

When a PROFIBUS-DP slave or PROFINET IO device drops out, the S7-400 CPU executes the following sequence:

1. The PROFIBUS master (integrated DP interface or CP443-5 Ext.) detects a station failure (SF LED on the master interface) and reports the event to the CPU via an OB86 call.
2. If OB86 is not loaded, the CPU continues in RUN, and the input process image for the missing station is cleared to 0. PIW access in OB1 returns W#16#0000.
3. If OB86 is loaded but no substitute value handling is programmed, the default substitute value (0) is written to the process image.
4. If the module is configured with "Value status" (QI = Quality Information, available on most 6ES7 33x and ET200S modules from firmware V1.x onward), the value-status bit goes to 0 to indicate "bad value", but the program must read it explicitly (e.g. via SFC51 or by evaluating the PII byte).

For an analog module configured in STEP 7 Hardware Configuration with the "Enable value status" option, an additional byte is mapped in the process image input area. The first bit of that byte (bit 0) goes to 0 when the channel value is invalid. Without this check, the program cannot distinguish a real 0 mA signal from a "module is gone" condition.

3. Diagnostic Organization Blocks Available in S7-300/400

The S7-300/400 CPU raises a specific OB for each error class. The block priority, the local-data layout, and the way the program should react differ per OB. The complete diagnostic OB family is summarized in the table below.

The fault ID byte (first byte of the local data, e.g. OB82_MDL_ADDR or OB86_MDL_ADDR) carries the logical base address of the failing module. This address is the same address you see in STEP 7 Hardware Configuration under the slot properties of the module and is what SFC51 returns in the partial SZL lists.

4. OB86 Programming: Detecting a Failed DP Slave or PROFINET IO Device

OB86 is the most important block for the problem described in this article. It is called both at the entry of the failure (incoming event) and on the recovery (outgoing event). The CPU distinguishes the two cases via the OB86_FLT_ID byte.

• B#16#01 ... Initial fault call - entering event (a slave/IO device just disappeared)
• B#16#02 ... Fault update (a previously missing slave is reporting again but still has an issue)
• B#16#03 ... Fault cleared - outgoing event (the slave/IO device is back)
• B#16#11 ... Initial fault call, for S7-300 DP master (older 31x CPUs)
• B#16#12 ... Fault update, S7-300 DP master
• B#16#13 ... Fault cleared, S7-300 DP master

Sample STL implementation (STEP 7 V5.x, OB86) - this code raises a flag per DP station number so that the operator screen can highlight the affected area:

// In OB86 temporary data:
//   OB86_EV_CLASS   = BYTE  (B#16#38 incoming, B#16#39 outgoing)
//   OB86_FLT_ID     = BYTE  (B#16#01..B#16#13)
//   OB86_PRIORITY   = BYTE
//   OB86_OB_NUMBR   = BYTE  (86)
//   OB86_MDL_ADDR   = WORD  (logical base address of the missing station's I/O)
//   OB86_RACKS_FLTD = ARRAY[0..31] of BOOL (bits set for failed racks/slaves)
//   OB86_RACKS_STAD = ARRAY[0..31] of BOOL (bits set for stations that came back)

      L     #OB86_MDL_ADDR        // logical base address
      T     "Diag".LastMdlAddr      // WORD marker for SCADA

      L     #OB86_FLT_ID
      L     B#16#1                 // initial fault?
      ==I
      JC    INCOM
      L     #OB86_FLT_ID
      L     B#16#3                 // fault cleared?
      ==I
      JC    OUTGO
      JU    ENDOB

INCOM: S     "Diag".StationFault      // raise latched fault flag
      S     "Diag".RefreshSCADA        // trigger SFC51 read in OB1
      JU    ENDOB

OUTGO: R     "Diag".StationFault
      R     "Diag".ModuleMissing       // clear per-channel "0 value" mask
      S     "Diag".RefreshSCADA

ENDOB: BE

The OB86_MDL_ADDR on PROFIBUS gives the logical base address of slot 0 of the failing DP slave. On PROFINET it gives the device number offset. The byte/word is what you compare against the configured start addresses in HW Config (e.g. PIW 256, PIW 272) to find the affected module.

5. OB82 Programming: Channel-Level Diagnostic from the Module Itself

While OB86 only tells you "the station is gone", OB82 tells you "the station is alive but a specific channel has a problem". This is the block to load if you want to detect wire break on a 6ES7 331-7TF01 analog input, open circuit on a 6ES7 332-5HF00 output, or overrange on a thermocouple module.

Channel-level diagnostic data is read with SFC59 RD_REC (read data record) using the local data from OB82 as the entry point. The relevant fields are:

• OB82_MDL_ADDR ... logical base address of the slot that raised the interrupt
• OB82_IO_FLAG ... B#16#54 = input, B#16#55 = output
• OB82_IN_FAULT / OB82_OUT_FAULT ... bit field showing which channel is at fault

// OB82 STL excerpt - capture channel-level fault into a global buffer
      L     #OB82_MDL_ADDR
      T     "Diag".LastMdlAddr

      L     #OB82_IO_FLAG
      L     B#16#54                // input module
      ==I
      JC    IS_IN
      L     B#16#55                // output module
      ==I
      JC    IS_OUT
      JU    END82

IS_IN:L     #OB82_IN_FAULT
      T     "Diag".InChanFault     // bit n = channel n+1 has fault
      S     "Diag".ChanFaultEvent
      JU    END82

IS_OUT:L    #OB82_OUT_FAULT
      T     "Diag".OutChanFault
      S     "Diag".ChanFaultEvent

END82:BE

To get the human-readable error text (e.g. "wire break", "overrange", "short circuit") call SFC59 RD_REC with record number 0 and use the standard Siemens diagnostic data record layout. For most S7-300 analog modules the data record 1 contains a 16-byte diagnostic frame; bytes 6/7 of that record are the channel-specific error number.

6. OB85 and OB122: Defensive Programming for Hidden Access Errors

OB85 fires when the operating system cannot update the process image because the slot is missing. OB122 fires when the program performs a direct I/O access (e.g. L PIW 256) on a slot that is currently down. Both are useful as a safety net: if a programmer reads an input that belongs to a missing module and forgets to check the validity first, OB122 traps the access and the program can decide what to write to the application variable.

// OB122 - I/O access error
      L     #OB122_IO_ADDR
      T     "Diag".BadAccessAddr

      L     0
      T     "Diag".LastGoodAnalogW   // force last good value into a DB
      S     "Diag".SuppressZeroRead
      BE

Standard practice is to put a copy of the last good PIW value into a DB on every successful cycle, and to fall back to that DB value when OB122 fires. This is the cleanest way to replace the "0 mA equals 0 °C" bug.

7. SFC51 RDSYSST: Reading the System Status Lists (SZL)

SFC51 RDSYSST reads the partial system status list of the CPU. For the I/O diagnostic problem, the relevant SZL IDs are:

Call signature of SFC51:

       CALL  "RDSYSST"  , DB10        // instance DB or SFB-callable FB
        REQ   := TRUE                // start the read on rising edge
        SZL_ID := W#16#0F31          // or W#16#0019, W#16#00A0
        INDEX  := W#16#0000
        RET_VAL := MW 200            // error code (W#16#0000 = OK)
        BUSY   := M 202.0
        SZL_HEADER := P#DB11.DBX0.0 BYTE 20   // 20-byte header
        DR     := P#M 300.0 BYTE 200         // destination buffer

The RET_VAL is a 16-bit word. W#16#0000 means success. W#16#80A1 means SZL_ID is invalid, W#16#80A2 means access error, W#16#80B1 means the list is empty for the requested index. When working with partial lists, you have to call SFC51 twice: once with SZL_ID = W#16#0XYZ and a 20-byte header to learn the actual length, then again to read the data record.

8. SFC13 DPNRM_DG and PROFINET IO Diagnostics

For PROFIBUS-DP, the standard call to get a slave's full diagnostic frame is SFC13 DPNRM_DG. For PROFINET IO, the equivalent is SFC51 with SZL W#16#0131 (PROFINET IO status) plus FB126 or the standard library block "PNIO" from the STEP 7 NCM library for detailed record reads.

// SFC13 - read PROFIBUS slave diagnostic buffer
       CALL  "DPNRM_DG"
        REQ     := M 100.0         // start on positive edge
        LADDR   := W#16#100        // logical base address of the slave
        RET_VAL := MW 102
        BUSY    := M 104.0
        RECORD  := P#M 200.0 BYTE 64

On the S7-300 side, the SFC13 data starts with 6 bytes of standard DP diagnosis followed by ID-related diagnosis blocks. Decode byte 1 = station status 1, byte 2 = station status 2, byte 3 = station status 3. On PROFINET, channel-level errors come through record index 0x800A (multiple) and 0x800B (single) of the device.

9. Substituting the "0" with a Last-Good-Value or Substitute Value

The cleanest solution to the original problem is to use the value-status (QI) bit that S7-300/400 supports on most analog modules from 6ES7 33x-7xx series. When "Enable value status" is set in HW Config, the lowest bit of the status byte in the process image is:

• 1 ... the channel value is valid (use PIW directly)
• 0 ... the channel value is bad (module is missing, channel is faulty, or out of range)

Programming pattern in OB1 / a watchdog FB:

// FB100 "SafAnalog" - safe analog scaling with QI check
// Inputs:  iRawAddr := 256   // PIW address of the analog channel
//          iQIAddr  := 257   // PII address of the value-status byte (same slot)
// Output:  rOutVal  := 0.0   // engineering value in REAL

      L     PII[iQIAddr / 8]      // 8 bits per byte, index of the status byte
      SRW   (iQIAddr AND 7)       // shift to the channel's QI bit
      SPB   USEVAL                // QI = 1: value is good
      L     "LastGoodDB".Value[iQIAddr]  // QI = 0: substitute
      T     "LastGoodDB".Value[iQIAddr]
      JU    END
USEVAL:L    PIW[iRawAddr]
      T     "LastGoodDB".Value[iQIAddr]
END:   ITD
      DTR
      T     rOutVal

This pattern must be reworked for the actual compiler (SCL or LAD is far more readable). The key idea is that every PIW read is gated by the QI bit and a "last-good-value" DB is used as fallback.

10. SCL Implementation of an OB86 Handler with SFC51

For engineers working in SCL, the same logic is significantly shorter. The block below demonstrates the recommended pattern for OB86 in SCL on a CPU 416-3 DP with a centralized diagnostic DB.

FUNCTION_BLOCK FB_DIAG
VAR
  sFaultText : STRING[80];
  sRackState : ARRAY[0..31] OF BOOL;
END_VAR

BEGIN
  // detect transition
  IF OB86_EV_CLASS = B#16#38 THEN // incoming event
    // Force substitution: 0 for missing station, last good for bad channel
    gDiag.StationFailed := TRUE;
    gDiag.FailedAddr    := WORD_TO_INT(OB86_MDL_ADDR);
    gDiag.FailedRack    := WORD_TO_INT(OB86_MDL_ADDR) / 16;
    // Read SZL for full module list
    iRetVal := RDSYSST(SZL_ID := W#16#0019,
                       INDEX  := W#16#0,
                       RET_VAL := iSfcRet,
                       BUSY    := bSfcBusy,
                       SZL_HEADER := sHeader,
                       DR := aSzl19);
  ELSIF OB86_EV_CLASS = B#16#39 THEN // outgoing event - back online
    gDiag.StationFailed := FALSE;
    gDiag.FailedAddr    := 0;
  END_IF;
END_FUNCTION_BLOCK

11. SCADA Integration with WinCC / TIA Portal / OPC

Once the diagnostic DB is built, the SCADA side is a simple data mapping. The recommended layout in the global DB "gDiag" is:

In WinCC (classic) bind the tags to your PCS7 OS or WinCC Runtime tags with an update cycle of 250 ms. In TIA Portal with a Comfort Panel or WinCC Professional, the same DB can be exposed as an OPC UA server via the S7-1500/400 OPC server. For S7-300/400 the recommended way is the SIMATIC NET OPC server (SNMP-aware) or the Softnet S7 OPC server. On a 3rd-party HMI such as iFIX, InTouch, or Citect, map the S7 DB to the HMI driver with the same item name.

12. Step-by-Step Commissioning Procedure

1. Open the STEP 7 V5.5 project, right-click the S7-400 CPU in HW Config and select Object Properties > Diagnostics. Confirm that "Report as station failure" is enabled for every DP slave / PROFINET device.
2. Insert OB82, OB83 (only if you have active backplane hot-swap), OB85, OB86, OB121, and OB122 in the Blocks folder. The default empty OBs from the standard library are sufficient as long as the diagnostic logic is inside the global FB.
3. In the analog module's slot properties enable "Enable value status". This adds the QI byte to the process image and lets the program detect "bad value" without polling SZL.
4. Add a global FB "FB_DIAG" with the OB86 logic shown above. Use a separate instance DB per station if you have many DP slaves.
5. In OB1, call a "watchdog FB" that reads SZL W#16#0019 once a second and updates the operator display. This is the redundancy for OBs that may be missed during a CPU restart.
6. Export the diagnostic DB tags to the SCADA / HMI. Create a top-level "Plant Diagnostic" screen showing each DP slave / IO device with a green/red colour and the textual error from SZL W#16#00A0 (the diagnostic buffer).
7. Test the path: pull the PROFIBUS connector on a slave with the line running. Verify that the SCADA picture switches from green to red within one second and that the affected channels show "---" or "BAD" instead of 0. Verify that re-inserting the connector clears the alarm automatically.
8. Document the OB86/OB82 handlers in the FBD/CFC of the project so that they are part of the formal functional safety documentation if the project is later audited.

13. Common Configuration Mistakes to Avoid

• OB86 missing. Without OB86, the CPU will not call any block on a station failure. The fault is silent and the process image is forced to 0. This is the root cause of the original problem.
• DP alarm mode set to "CPU goes to STOP". This is wrong for most process applications where the rest of the plant must continue to run. Use "Continue RUN, replace with substitute value".
• QI not enabled. Without "Enable value status", the analog module always reports a numeric value; the program cannot tell whether the value is real or a substitute.
• PIW read in OB1 without gating. Reading PIW directly in cyclic code without checking the QI bit and without an OB86 handler is the classic source of the 0-value bug.
• Substitute value left at 0. In HW Config, the analog module's "Substitute value" field can be set per channel. Set it to a real engineering default (e.g. 4 mA = 0% on a 4-20 mA loop, or the last good value stored in a DB).
• SFC51 polled without checking BUSY. Issuing SFC51 every cycle without BUSY gating leads to W#16#80A2 "busy with previous request" and the application data never updates.

14. PROFINET-Specific Differences

For projects migrated from PROFIBUS to PROFINET (typical on S7-400 V6 CPU firmware 6.0+ with integrated PN interface), the same OB86 fires, but the SZL IDs change:

• W#16#0019 (DP slave status) is replaced by W#16#0121 (PROFINET IO status) and W#16#0131 (PROFINET IO device diagnostic).
• For channel-level PROFINET diagnostics, use the "PNIO_Initiate" / "PNIO_ReadRecord" blocks of the SIMATIC PROFINET library (FB500 series in older projects, or the new "PROFINET IO" library in STEP 7 V5.6 / TIA V18).
• The SZL W#16#0F31 "module identification" returns a 38-byte record per module on PROFINET, with the order number as a 20-character ASCII field. Cross-reference this against the configured module in HW Config to identify the exact physical module type that has failed.

15. Migration Path to S7-1500 / TIA Portal

The same logic is preserved on S7-1500 with the modern equivalent blocks:

• OB82, OB86, OB122 exist on S7-1500 with the same priorities. The local data layout is similar but uses named access (e.g. OB82_MDL_ADDR still exists).
• SFC51 is replaced by the instruction "RD_SINFO" and the SZL access is done via the standard "GetIOError" FB. For device-level diagnostic on PROFINET, the standard block is "PROFINET_diagnostics" in the TIA Portal library.
• Quality Information (QI) is always enabled on S7-1500 analog modules and is part of the process image - no manual activation is required.

The diagnostic DB design, however, can be ported 1:1 because the value semantics are identical. The same SCADA tag list works for an OPC UA client targeting the modern PLC.

16. Verification Checklist

1. Power up the system. Force the analog input value to 0 (short-circuit the input) and confirm that the engineering value displayed on SCADA is the configured substitute (e.g. 4.0 mA / 0%) and not a random 0.
2. Pull the PROFIBUS connector on slave 2. Confirm that OB86 fires, that gDiag.StationFailed becomes TRUE within 1 second, and that the SCADA picture turns red for slave 2 only.
3. Reinsert the connector. Confirm that the "outgoing" event fires, the red icon clears, and the analog values resume the real process value.
4. Read SFC51 with SZL W#16#00A0 after each event and confirm the diagnostic buffer entries are present with a valid date/time stamp.
5. Check that no PIW read in OB1 returns W#16#0000 for a missing module once the QI gating is in place.
6. Confirm that an OB122 (I/O access error) is never raised during normal operation - if it fires, a programmer is reading a slot that does not have a valid QI or OB86 protection.
7. Push the SCADA tag list to the customer and have them sign off the diagnostic display with at least one real failure simulation per rack.

17. Field-Proven Tips

• Always put OB86, OB82, OB85, OB121, and OB122 in the program from the very first commissioning. Adding them later is risky because code written assuming "PIW is always valid" can be very hard to refactor.
• For S7-300 with IM 153 slaves, OB86 raises a "module slot failure" when only one slot inside the ET200M is dead. Use OB86_MDL_ADDR to identify which slot.
• For S7-300 firmware V3.x and earlier, the diagnostic data record layout is different. Use the older SFC59 record numbers (DS0 = 0 for general module diagnostic, DS1 = 1 for channel-specific).
• Tag the "outgoing" OB86 event as a separate SCADA event (info, not alarm) so that the operator does not lose a history entry when the fault clears.
• Use the value "B#16#FF" in the substitute value field of HW Config to indicate "keep last value" - this is supported on most analog modules from 6ES7 33x-1KF02 and newer.