S7-400 PROFINET Station Failure: HMI Alarm via OB 86

Resolving PROFINET Station Failure Alarms on S7-400 with TIA Portal

Engineer field notes: when an S7-400 CPU 414-3 supervises a PROFINET IO line of ET 200S stations and Festo valve terminals, the diagnostic buffer captures the loss-of-station event in OB 86 but the operator sees nothing on the TP2200 Comfort HMI. The objective is to translate every station failure into an indexed trigger bit and surface that bit as a discrete alarm with the station name. This reference documents three implementation paths that work in TIA Portal V12 SP1 and later, and ends with a commissioning checklist and a troubleshooting matrix.

1. Problem Statement

A discrete-machine line is controlled by a SIMATIC S7-400 (CPU 414-3 PN/DP, MLFB 6ES7414-3EM05-0AB0). Six ET 200S heads (IM 153-4, MLFB 6ES7153-4AA01-0XB0) and nine Festo CTEU/CPV valve terminals are spread on PROFINET. The PROFINET diagnostic buffer records the rack failure in OB 86, but the operator cannot distinguish "Station 3 dropped" from "Station 5 dropped" because no dedicated alarm is configured. The required outcome is one alarm per station with a stable station number and timestamp, displayed in the active alarm window of both TP2200 Comfort panels (MLFB 6AV2124-1MC01-0AX0).

Constraints encountered in the original project:

• Engineering tool: TIA Portal V12 SP1 (no S7-1500-style Program_Alarm by default; SCL is available).
• No external diagnostics server (no PNIODiag FB126) is available unless migrated from STEP 7 V5.5.
• Two TP2200 Comfort panels are on the same PROFINET subnet; alarms must be visible on both.
• The HMI must not require project-specific scripts; standard "Bit-triggered" alarms with text lists are preferred.

2. System Architecture and Component Identification

Use the exact part numbers below to validate that the firmware and hardware features referenced in the article are present on the running plant.

Confirm the device name assigned in the PROFINET topology editor: im153_4_st1 through im153_4_st6 for the ET 200S heads, and vt1 through vt9 for the valve terminals. The PROFINET device name is the canonical identifier used by OB 86 and is recommended for the alarm text.

Network topology (logical view):

              +---------------------------+
              |   CPU 414-3 PN/DP        |
              |   6ES7414-3EM05-0AB0    |
              |   PROFINET IO Controller |
              +-------------+-------------+
                            |
        +-------------------+--------------------+
        |                   |                    |
   +----+----+         +----+----+         +----+----+
   | IM 153-4|         | IM 153-4|   ...   | Festo  |
   | st1     |         | st2     |         | vt1..9 |
   +---------+         +---------+         +---------+

   +-- TP2200 Comfort #1 (TCP/IP to CPU)
   +-- TP2200 Comfort #2 (TCP/IP to CPU)

3. PROFINET IO Diagnostics Architecture

Per the PROFINET alarm definition, an alarm is "an abnormal or unexpected event within an IO-Device" reported acyclically to the IO-Controller. The controller forwards the alarm to the CPU, which calls a designated Organization Block. The mapping for Siemens S7-400 is:

OB 86 is the central entry point for "rack or station failed" and "rack or station returned". Each station has a bit position inside the word OB86_RACKS_FLTD; for distributed I/O the bit position is derived from the device number assigned in the PROFINET topology editor (slot 0 of the device = bit 0 of the head, etc.). TIA Portal V12 SP1 uses the same naming convention as STEP 7 V5.5, so the OB 86 temporary variables (EV_CLASS, FLT_ID, PRIORITY, OB_NUMBR, RESERVED_1, RESERVED_2, RACKS_FLTD, MDL_ADDR, Z_INFO, DATE_TIME) are directly accessible from STL or SCL.

If OB 86 is not present in the S7-400 program, the CPU enters STOP the moment a station drops. The diagnostic buffer will then show the entry "STOP caused by missing OB 86". This is the most common commissioning error for new S7-400 / PROFINET systems and is the first thing to verify before any other troubleshooting step.

State diagram for the alarm-bit lifecycle:

4. Solution Strategy

Three independent paths exist. Pick by project constraints.

Path 1 is the recommended baseline for the described system because TIA V12 SP1 ships with the standard S7-400 blocks and does not require an additional library. Path 2 is included as the modern alternative for projects that can upgrade the engineering tool. Path 3 is referenced for completeness; PNIODiag is the historical Siemens recommendation and is the answer the original investigation produced, but it requires STEP 7 V5.5 sources to migrate from.

5. Implementation Path 1 — OB 86 with Indexed Bit Array

The principle: every time OB 86 fires, write the station number into a global data block and set the corresponding bit in an array of trigger words. The HMI subscribes to the bit array; each bit drives one alarm text. The bit clears when OB 86 reports the station return.

5.1. Define the data block DB100 (alarm status, non-retain):

DATA_BLOCK "DB_Alarm_ProfiNet"
{ S7_Optimized_Access := 'FALSE' }
VERSION : 0.1
  STRUCT
   Station_Failed      : WORD ;   // bit 0..15 -> stations 1..16
   Station_Return      : WORD ;   // bit 0..15 -> return edge from OB 86
   Station_Number      : WORD ;   // last station number reported
   Fault_ID            : WORD ;   // copy of OB86_FLT_ID
   LADDR               : WORD ;   // logical address of affected device
   Station_Timestamp   : DWORD ;  // tick count from TIME_TCK()
  END_STRUCT;
END_DATA_BLOCK

5.2. OB 86 SCL body (paste into OB 86 in TIA Portal):

// __________________________________________________________________
// OB 86 - PROFINET station failure / return -> indexed trigger bits
// Temp variables of OB 86 are referenced symbolically:
//   #OB86_FLT_ID     : WORD   (W#16#73A3 failure / W#16#73A4 return)
//   #OB86_MDL_ADDR   : WORD   (PROFINET logical address of device)
//   #OB86_Z_INFO     : DWORD  (high byte = station number, low byte = slot)
//   #OB86_DATE_TIME  : DATE_AND_TIME
// __________________________________________________________________

CASE WORD_TO_INT(#OB86_FLT_ID) OF
  W#16#73A3:   // -------- STATION FAILURE --------
    "DB_Alarm_ProfiNet".LADDR    := #OB86_MDL_ADDR;
    "DB_Alarm_ProfiNet".Fault_ID := #OB86_FLT_ID;
    "DB_Alarm_ProfiNet".Station_Number :=
        WORD_TO_INT(SHR(IN := WORD_TO_DWORD(#OB86_Z_INFO), N := 8)
                    AND DWORD#16#000000FF);
    "DB_Alarm_ProfiNet".Station_Timestamp := TIME_TCK();
    CASE "DB_Alarm_ProfiNet".Station_Number OF
      1:  "DB_Alarm_ProfiNet".Station_Failed.%X0  := TRUE;
      2:  "DB_Alarm_ProfiNet".Station_Failed.%X1  := TRUE;
      3:  "DB_Alarm_ProfiNet".Station_Failed.%X2  := TRUE;
      4:  "DB_Alarm_ProfiNet".Station_Failed.%X3  := TRUE;
      5:  "DB_Alarm_ProfiNet".Station_Failed.%X4  := TRUE;
      6:  "DB_Alarm_ProfiNet".Station_Failed.%X5  := TRUE;
      7:  "DB_Alarm_ProfiNet".Station_Failed.%X6  := TRUE;
      8:  "DB_Alarm_ProfiNet".Station_Failed.%X7  := TRUE;
      9:  "DB_Alarm_ProfiNet".Station_Failed.%X8  := TRUE;
      10: "DB_Alarm_ProfiNet".Station_Failed.%X9  := TRUE;
      11: "DB_Alarm_ProfiNet".Station_Failed.%X10 := TRUE;
      12: "DB_Alarm_ProfiNet".Station_Failed.%X11 := TRUE;
      13: "DB_Alarm_ProfiNet".Station_Failed.%X12 := TRUE;
      14: "DB_Alarm_ProfiNet".Station_Failed.%X13 := TRUE;
      15: "DB_Alarm_ProfiNet".Station_Failed.%X14 := TRUE;
      ELSE ; // outside mapped range - record to diagnostic buffer
    END_CASE;

  W#16#73A4:   // -------- STATION RETURN --------
    "DB_Alarm_ProfiNet".LADDR    := #OB86_MDL_ADDR;
    "DB_Alarm_ProfiNet".Fault_ID := #OB86_FLT_ID;
    CASE WORD_TO_INT(SHR(IN := WORD_TO_DWORD(#OB86_Z_INFO), N := 8)
                     AND DWORD#16#000000FF) OF
      1:  "DB_Alarm_ProfiNet".Station_Failed.%X0  := FALSE;
      2:  "DB_Alarm_ProfiNet".Station_Failed.%X1  := FALSE;
      3:  "DB_Alarm_ProfiNet".Station_Failed.%X2  := FALSE;
      4:  "DB_Alarm_ProfiNet".Station_Failed.%X3  := FALSE;
      5:  "DB_Alarm_ProfiNet".Station_Failed.%X4  := FALSE;
      6:  "DB_Alarm_ProfiNet".Station_Failed.%X5  := FALSE;
      7:  "DB_Alarm_ProfiNet".Station_Failed.%X6  := FALSE;
      8:  "DB_Alarm_ProfiNet".Station_Failed.%X7  := FALSE;
      9:  "DB_Alarm_ProfiNet".Station_Failed.%X8  := FALSE;
      10: "DB_Alarm_ProfiNet".Station_Failed.%X9  := FALSE;
      11: "DB_Alarm_ProfiNet".Station_Failed.%X10 := FALSE;
      12: "DB_Alarm_ProfiNet".Station_Failed.%X11 := FALSE;
      13: "DB_Alarm_ProfiNet".Station_Failed.%X12 := FALSE;
      14: "DB_Alarm_ProfiNet".Station_Failed.%X13 := FALSE;
      15: "DB_Alarm_ProfiNet".Station_Failed.%X14 := FALSE;
      ELSE ;
    END_CASE;
END_CASE;

If the IM 153-4 head variant you are using reports the station number in a different byte of Z_INFO, swap the SHR argument or fall back to MDL_ADDR by comparing against the configured PROFINET base addresses (a CASE on the configured addresses is straightforward to add). On the 6ES7153-4AA01-0XB0 with the standard slot mapping, the high byte of Z_INFO is the device number (1-15) when the head is configured as device 1-15 in the PROFINET topology.

Edge case: the S7-400 calls OB 86 with the priority of the failure event. The CASE in OB 86 must not block — keep the logic lean (no function calls, no loops). If you need a longer computation, post the values into DB100 and process them in OB1 (priority 1) the next cycle.

6. Implementation Path 2 — Program_Alarm Instruction (TIA V16+)

The Program_Alarm instruction monitors a boolean signal SIG and emits a PLC-side program alarm when the signal changes. The alarm text is declared inside the FB call, and the HMI receives the alarm via the standard WinCC alarm mechanism — no manual text list wiring required. This is the cleanest path on S7-1500 / S7-1200 / newer S7-400 firmware (FW ≥ V6.4 with TIA V16+).

// One Program_Alarm call per station in OB1
"inst_Program_Alarm_St1"(
  SIG              := "DB_Alarm_ProfiNet".Station_Failed.%X0,
  ID               := 0,
  EV_ID            := 16#0001_0001,   // unique per station
  SEVERITY         := 1,
  MSG_TYP          := 1,              // 1 = Acknowledgement required
  ACK_STATE_REQ    := FALSE,
  ENABLE           := TRUE,
  ...);

For the operator, the alarm text appears in the active alarm window of both TP2200 panels and can be filtered by EV_ID. No DB is required for the bit. The drawback is that TIA Portal V12 SP1, used in the original project, does not expose Program_Alarm in the instruction catalog for S7-400. Migrate to TIA V16+ or V18 to use this path.

Cross-reference: the PROFINET alarm definition describes an alarm as "an abnormal or unexpected event within an IO-Device" reported to the IO-Controller. The Program_Alarm instruction creates a similar construct on the controller side: an event the controller reports to the HMI, with the same "alarm comes in, must be acknowledged" semantics.

7. Implementation Path 3 — PNIODiag FB126 (STEP 7 V5.5 Migration)

PNIODiag is a free diagnostics library that contains FB126 PNIO_DIAG, FB127 PNIO_BASIC, FB128 PNIO_ANA and others. The library is shipped as STEP 7 V5.5 source and is the historical answer to the question "how do I get a single error bit out of PROFINET". It works on S7-300, S7-400, and S7-1500. To use it in a TIA Portal project:

1. Open the original STEP 7 V5.5 project that contains PNIODiag.
2. Use the TIA Portal "Migrate project" wizard; the FB126 / FB127 / FB128 source containers move into the TIA project as "External sources".
3. Compile the migrated sources; the FBs are added to the master program.
4. Call PNIO_DIAG in OB1 (cyclically) or in OB 86. The FB writes one bit per station into an output array.
5. Map the output array to the TP2200 alarm tags exactly as in Path 1.

This is the path that the original investigation produced. It works, but it requires the STEP 7 V5.5 sources to be available; without them the FBs must be sourced separately from the Siemens Industry Online Support portal. Note that PNIODiag was developed for PROFIBUS and PROFINET alike and is robust on both, but it does not surface per-channel diagnostics on the ET 200S — use the Path 1 combination of OB 86 and OB 82 for per-channel faults.

8. HMI Alarm Configuration on TP2200 Comfort

The TP2200 (6AV2124-1MC01-0AX0) is configured in TIA Portal under "HMIs". Once the PLC tag DB_Alarm_ProfiNet.Station_Failed.%X0..%X14 exists, configure the alarms as follows.

1. Open the HMI device in the project tree → Alarms → Bit-triggered alarms.
2. For each station, add one row with:
   • Trigger tag: DB_Alarm_ProfiNet.Station_Failed.%X0 (and X1..X14).
   • Alarm text: e.g. "PROFINET station ET200S-1 unreachable", "PROFINET station ET200S-2 unreachable", …
   • Alarm class: "Errors" (the default red class with acknowledgement).
3. Set PLC → HMI tag update to "Cyclic" with a 500 ms polling interval; the Comfort panel handles 500 ms comfortably for 15 tags.
4. In the screen, place an Alarm view (Controls → Alarm view) bound to the "Errors" class. Both TP2200 panels inherit the same alarm configuration when the HMI is synchronised in TIA Portal (Project → HMI synchronisation).
5. Optional: bind a tag-logger to DB_Alarm_ProfiNet.Station_Timestamp to record the moment of the event in an Excel/CSV archive for post-incident review.

Bit-triggered alarms and the Program_Alarm path produce the same UX (the alarm text appears in the "Errors" window with a timestamp and the operator must acknowledge it). The difference is who owns the text: with bit-triggered alarms the text lives in the HMI text list; with Program_Alarm the text lives in the PLC source as a multi-language comment on the FB instance, which is the more portable approach when the same alarm must appear on multiple HMIs in different languages.

9. Verification and Commissioning Procedure

Walk the following test plan before signing off the engineering package.

1. Compile the project (TIA Portal → Project → Compile all). Resolve any address-resolution errors before downloading.
2. Download to the CPU in RUN (the S7-400 supports run-time download of OBs and DBs without a stop). The CPU must be in "Run" with the key switch to RUN or RUN-P.
3. Online → Monitoring and force: force DB_Alarm_ProfiNet.Station_Failed.%X0 = TRUE from the watch table. The "Errors" alarm window on both TP2200 panels must show "PROFINET station ET200S-1 unreachable" within 1 s.
4. Reset the bit. The alarm must clear (move to history).
5. Physical disconnect test: pull the PROFINET cable from the ET 200S head #3. Within 1 s OB 86 should fire, the CPU should call the failure branch, and the TP2200 should display "PROFINET station ET200S-3 unreachable".
6. Reconnect: the failure alarm must clear within 1 s; an informational "Station 3 returned" message is optional but recommended.
7. Test all 6 ET 200S heads and 9 valve terminals. Note the timestamp in the diagnostic buffer (Online → Diagnostics → Diagnostic buffer) and compare to the HMI alarm time. The delta must be ≤ 2 s; anything above 5 s indicates polling latency, not OB 86 latency.
8. Test simultaneous failures: pull two cables. Both bits must set independently; the alarm window must show two entries, not one overwritten entry. This validates the indexed-bit design rather than a single shared bit.
9. Power-cycle test: turn off an ET 200S at the head (24 V off). This is a more aggressive failure than a cable pull — the head power supply LED is off and the CPU must still log the failure within 5 s. If the failure is not reported, the PROFINET device name on the head is missing; re-assign the device name via PRONETA or the topology editor.
10. Cold restart: MRES the CPU. The bit array in DB100 must be initialised to all-zero (the DB must be set to "non-retain" or the bit clearing will not take effect on restart). If the DB is retain, the bits will survive the MRES and the HMI will continue to show stale alarms — add a CLEAR call in OB100 that sets the WORD to 16#0000 on every restart.

10. Troubleshooting Matrix

11. Frequently Asked Questions