S7-400 ET200M Module Diagnostics with OBs and FB126 PNIODiag

System Architecture Overview

The configuration discussed combines a fault-tolerant SIMATIC S7-400H station with distributed I/O over PROFIBUS DP, ring-redundant PROFINET, and optical PROFIBUS networking. Components in scope:

• Two CPU 414-4H controllers (6ES7414-4HM14-0AB0, firmware V6/V7), each with X1/X2 MPI/DP and one or more PROFINET interfaces. The 414-4H provides X1 (MPI/DP master) and X2 (DP master) as PROFIBUS interfaces and an integrated PN interface on the CPU when the IF964-DP or PN/IE option is fitted.
• Two PROFINET fibre links that carry the PROFINET ring between the H-CPUs and the SCALANCE switches. The H-system also uses a dedicated fibre pair for the H-sync interface when configured with the IF964-H sync module (6ES7964-0AA04-0AB0).
• Three SCALANCE XC308-2 / X308-2 managed switches (e.g., 6GK5308-2FL00-2AA3) wired in a closed MRP ring. The X308-2 provides two fibre-optic ports (LC) and six RJ45 ports, supporting MRP, MRPD, PROFINET real-time (RT/IRT), and standard Ethernet traffic.
• ET200M stations on PROFIBUS DP, each with an IM 153-2 High Feature (6ES7153-2BA10-0XB0) or IM 153-2BA02 (6ES7153-2BA02-0XB0) interface module. The IM 153-2 supports PROFIBUS DP V0/V1/V2 and offers fibre-optic ports for the DP ring; it also provides channel-level diagnostic data and module status bytes that the CPU can read.
• An ET200M/Link (6ES7153-2BA00-0XB0) used as a PROFIBUS DP-to-PA or DP-to-DP bridge for the remote I/O segment.
• 6ES7 321-1BH02 SM 321 digital-input module (16 DI, 24 V DC, source/sink) installed in the ET200M rack. The -1BH02 revision is a 16-point group-fault-reporting input, which signals module-level diagnostics but not individual channel diagnostics.

ET200M Hardware Components and Order Numbers

Diagnostic OB Family in STEP 7 for PROFIBUS DP and ET200M

When a DP slave (the ET200M with IM 153) or a module within a DP slave changes state, the S7-400H operating system triggers an organisation block. The following OBs are central to ET200M diagnostics:

OB 82 — Diagnostic Interrupt

OB 82 is the workhorse for ET200M module diagnostics. It fires in two cases: when a module reports an incoming diagnostic event (FLT_ID = 0x10, event entered) and when the event is outgoing (FLT_ID = 0x11, event cleared). The temporary local data OB82_LOCAL_DIAG contains the standard diagnostic data record format described in the PROFIBUS/IEC 61158 specification. The first byte (byte 0) is the station status, byte 1 is the station status 2, byte 2 is the station status 3, and byte 3 contains the master's PROFIBUS address. For ET200M, the more useful content is in the channel-related diagnostic bytes that follow.

To read the extended diagnostic data for a DP slave you must use SFC 13 (DPNRM_DG) for PROFIBUS DP and the corresponding PNIO blocks (SFB 52 / 53 / 54) for PROFINET. SFC 13 reads the standard diagnostic frame (6 bytes) plus any device-specific diagnostic record (DS0 / DS1) for the affected station.

Code Pattern: Reading Diagnostic Data in OB 82

// OB 82 temporary local-data references
#OB82_MDL_ADDR        // WORD  – logical base address of the module that raised the interrupt
#OB82_IO_FLAG         // BYTE  – 0 = input, 1 = output
#OB82_FLT_ID          // BYTE  – 0x10 incoming, 0x11 outgoing
#OB82_LOCAL_DIAG[4]   // standard PROFIBUS DP diagnostic bytes

// Read the full diagnostic record (DS0 and DS1) for the affected DP slave
CALL  "DPNRM_DG"           // SFC 13
  REQ    := TRUE
  LADDR  := #OB82_MDL_ADDR
  RETVAL := #iRetVal
  RECORD := P#DBX 0.0 BYTE 32
  BUSY   := #bBusy
  RECORD_LEN := #iRecLen

The first 6 bytes returned by SFC 13 are the standard diagnostic per IEC 61158-6, with the same meaning as OB82_LOCAL_DIAG but updated from the current DP slave state. Bytes 6+ contain the device-specific diagnostic. For the IM 153-2, byte 6 (identifier-related diagnostic) and bytes 7+ (channel-related diagnostic) hold the module and channel status; for the SM 321 1BH02, no channel-specific diagnostic is produced.

OB 83 — Insert / Remove Module Interrupt

OB 83 fires for central racks on S7-300/400 and for distributed modules under an IM 153 (ET200M). OB83_FLT_ID encodes the reason: 0x10 = operation, no fault; 0x11 = module parameterisation error; 0x12 / 0x13 / 0x14 = module pulled / inserted / both; 0x15 / 0x16 / 0x17 = module not OK / OK after error; 0x18 / 0x19 = module reconfigured; 0x1A = no parameterisation; 0x1B = module in wrong slot; 0x1C = module without parameter set; 0x1D = module substitution by fault-tolerant; 0x51 / 0x52 / 0x53 = return of submodule / module / submodule; 0x54 = submodule slot OK; 0x55 = submodule update.

For the operator-replacement scenario, OB 83 is the key event: a 1BH02 SM 321 pulled from a powered ET200M rack triggers OB 83 with FLT_ID = 0x13 ("module removed") and FLT_ID = 0x14 ("module inserted"). To know whether the replacement is "proper", compare the type identifier and the slot configuration read from SZL 0x0131 via SFC 51.

Code Pattern: Capturing OB 83 Events

// Each call to OB 83 must be quick; offload heavy work to a flag/byte that OB 1 polls
L     #OB83_MDL_ADDR        // logical base address
T     MW   100              // store in flag word for OB 1 to process
L     #OB83_FLT_ID
T     MB   102
L     B#16#1
S     M    103.0            // set "module event pending" flag for OB 1
BEU

Once M 103.0 is set, OB 1 calls SFC 51 with SZL ID 0x0131 (or 0x0091 / 0x0092) to enumerate the slot status of the affected ET200M and check whether a different module is now present than the configured one.

OB 86 — Rack / DP Station Failure

OB 86 fires for two main cases in a PROFIBUS DP environment: a DP slave enters or leaves the not reachable state (FLT_ID = 0x10 / 0x11), or an expansion rack (centralised) fails. The relevant locals for distributed I/O are:

• OB86_FLT_ID = 0x10 (initial failure), 0x11 (return), 0x12 (differences in submodule), 0x13 / 0x14 (H-system: stand-by / master failure)
• OB86_MDL_ADDR = logical base address of the DP slave / diagnostic repeater
• OB86_IO_FLAG = 0x80 (input), 0x81 (output), 0x82 (input/output), 0xC0 (not assigned)
• OB86_LOCAL_DIAG[4] = station status bytes + master PROFIBUS address (same layout as OB 82)

A complete loss of the ET200M rack power supply typically shows up as an OB 86 with FLT_ID = 0x10 because the entire DP slave disappears from the bus. A single SM 321 losing 24 V sensor power may not trigger OB 86 — the IM 153-2 remains responsive on the bus — instead you will see an OB 82 only if the SM 321 supports group diagnostics, which the 6ES7321-1BH02 does not by default for sensor-supply loss. A separate 24 V feed monitoring relay or the IM 153-2 diagnostic of the 1BH02 module's "sensor supply fail" bit (in DS0) is required.

OB 85 and OB 122 — I/O Update and Access Errors

OB 85 is the bouncer. If the user's OB 82 / OB 83 / OB 86 are not loaded, the S7-400H reports a priority-class error and the SF LED on the CPU lights up. If a program tries to read the I/O of a missing or failed module without going through process-image update rules, OB 122 fires synchronously in the calling block (e.g., in OB 1, OB 35, FB 126).

Recommended best practice for ET200M: load all of OB 82, OB 83, OB 85, OB 86, OB 121, and OB 122 in both H-CPUs. Each OB should be 1–2 bytes long, just setting a flag for OB 1 to poll, so that diagnostics remain responsive under H-by-pass conditions.

FB 126 / PNIODiag — Siemens Diagnostic Package

The PNIODiag package (FB 126 and supporting data types) is Siemens' library for evaluating PROFINET IO and PROFIBUS DP diagnostic data without writing all the SFC 13 / SZL calls by hand. The package is delivered as a STEP 7 add-on and is available on the Siemens Industry Online Support portal (see PNIODiag entry ID 1137083 and PNIODiag manual 14726363). It contains:

• FB 126 PNIO_DIAG — collects the diagnostic data of a PROFINET IO device or PROFIBUS DP slave
• FB 125 PNIO_CHECK_HF — high-frequency check of PNIO status
• FB 127 PNIO_DIAG_BUF — buffers diagnostic events for HMI display
• UDT 126 / UDT 127 — diagnostic data structures (PORT, INTERFACE, MODULE, CHANNEL, etc.)

FB 126 returns, among other things, the device status, the slot status for every submodule, the channel diagnostic bytes, and the maintenance / qualification status. The PNIODiag block can be instantiated once per DP slave or per PROFINET device. For ET200M with the 1BH02 SM 321, the channel-level UDT shows "no diagnostic" and the module-level UDT shows the operating state.

Code Pattern: FB 126 on a PROFIBUS DP Slave

// Instance for ET200M DP slave with diagnostic address 1023
CALL  "PNIO_DIAG"         // FB 126
  MODE       := 0          // 0 = PROFIBUS DP, 1 = PROFINET IO
  LADDR      := 1023       // diagnostic address of the DP slave
  RETVAL     := MW   200
  BUSY       := M    210.0
  DIAG_TYPE  := 0          // 0 = standard, 1 = extended
  DATA       := DB90.DIAG  // UDT 126 target

DB 90 is a shared DB of type UDT 126 that the HMI / WinCC project polls. With one FB 126 call per ET200M station, the engineer can display module status, slot status, channel status, and maintenance state in WinCC without writing a single SFC 13 call in the user code.

Reading Module Status Words and Diagnostic Data

For an ET200M station the engineer can read the per-slot module status through the System State List (SZL) using SFC 51:

To detect an "unauthorised module replacement" — i.e., a 6ES7321-1BH02 replaced by a 6ES7321-1BH10 — read SZL 0x0091 to capture the configured type identifier, then read SZL 0x0092 to capture the actually fitted module, and compare. SZL 0x0131 returns the slot status with the substituted-marker bit (bit 6) set when the IM 153-2 has detected a module other than the one in the STEP 7 configuration.

Code Pattern: Reading SZL 0x0091 via SFC 51

CALL  "RDSYSST"             // SFC 51
  SZL_ID    := W#16#91
  SZL_INDEX := W#16#0001
  RETVAL    := #iRetVal
  BUSY      := #bBusy
  SZL_HEADER:= P#DB100.DBX0.0 BYTE 4   // SZL header (length + number of records)
  SZL_DATA  := P#DB100.DBX4.0 BYTE 256 // payload area

PROFIBUS DP Standard Diagnostic Data Layout (DS0)

The first 6 bytes returned by SFC 13 follow the IEC 61158 standard diagnostic frame. For ET200M, the layout is:

For the IM 153-2 with a 1BH02 SM 321 in slot 4, byte 4 contains the module identifier 0x44 ("input 16 bits") and byte 5+ shows zero unless a SM with channel diagnostics is present. When the SM 321 reports a sensor-supply failure, the bit pattern in the channel-related diagnostic bytes identifies the failed sensor-supply line.

Implementation Pattern for the H-System with Two ET200M Stations

Best practice in an S7-400H with redundant PROFIBUS DP is to read each IM 153-2's status through FB 126 and to wire OB 82 / OB 86 outputs to a shared tag on the HMI. The recommended pattern:

1. Load OB 82, OB 83, OB 85, OB 86, OB 121, OB 122, OB 70, OB 72 in both H-CPUs. Each OB should be a 1–2 line routine that stores the address and the FLT_ID in a DB and sets a "diagnostic pending" flag.
2. Use OB 1 (slow OB) to call FB 126 per ET200M station once per cycle or once per second from OB 35. Avoid calling FB 126 from high-priority OBs (OB 40–47) — diagnostic data can be lengthy and blocks other interrupts.
3. Use DB 90 of type UDT 126 to share diagnostic data with the HMI. Do not directly pass SFC 13 result bytes to the HMI; let FB 126 normalise them.
4. For each ET200M station, declare a separate instance: DB_ET200M_A_PNIO for the first station, DB_ET200M_B_PNIO for the second.
5. Subscribe to the same data on the HMI in a "Device States" faceplate (WinCC V7) or use TIA Portal's "Diagnostics" control (TIA V15+).

SVG Flow Diagram — OB 82 / OB 83 / OB 86 Routing

Detection Coverage Matrix — What Each Event Can Tell You

Verification and Commissioning Steps

1. After loading all OBs, plug a single SM 321 1BH02 into slot 4 of the ET200M. Power down the rack's PS 307: confirm OB 86 fires in both H-CPUs, the SF LED lights, and DB 90 records the address with state = 0x10.
2. Restore power, watch for OB 86 with FLT_ID = 0x11 (return).
3. Pull the SM 321 under power, confirm OB 83 with FLT_ID = 0x13, then re-insert and confirm 0x14.
4. Insert a different MLFB in the same slot (e.g., 6ES7321-1BL00). Confirm OB 82 fires with channel-related diagnostic showing "substitute module"; confirm SZL 0x0131 has the substitution bit set.
5. Pull the front connector of the 1BH02 with the rack powered and 24 V sensor supply active. Confirm that no OB 82 / OB 83 fires and that the process image goes to 0. Document this limitation and add hardware mitigation.
6. In WinCC, open the PNIODiag "Device States" faceplate and verify that the green status changes to yellow / red and the slot icon flips to "module missing".
7. Run the S7-400H link-up check (LINK-UP) on the ET200M DP segment to ensure the redundant DP master does not cross-flood diagnostic events during failover.
8. Cycle the IM 153-2 24 V supply to verify OB 81 behaviour and that DB 90 records a power-supply error with the IM 153-2's diagnostic address.

Troubleshooting Quick Matrix

Alternate Platforms — S7-300 and S7-1500 Footnote

On an S7-300 station with an IM 153 (no H-system), OB 70 and OB 72 are not loaded. OB 82, OB 83, OB 85, and OB 86 are still required for full ET200M diagnostics. On an S7-1500 with PROFINET-based ET200MP (IM 155-5 PN), the diagnostics concept uses PNIO blocks (SFB 52 RDREC / SFB 53 WRREC / SFB 54 RALRM) and the standard PROFINET channel / slot / submodule alarms that are not directly compatible with PROFIBUS DP DS0/DS1 frames. The OB numbers, however, are analogous: OB 82 maps to PROFINET diagnostic interrupt, OB 83 to plug/pull, and OB 86 to PROFINET device failure. PNIODiag FB 126 supports PROFINET mode with MODE = 1.

Frequently Asked Questions