S7-400H CPU 414-4H LED Status via SFC51: Fix 16#8085

Reading S7-400H CPU 414-4H LED Status via SFC51: Fix 16#8085 Error

Field-procedure for resolving SFC51 "RDSYSST" SSL read errors on a Siemens S7-400H fault-tolerant PLC. Reference platform: CPU 414-4H (order number 6ES7414-4HM14-0AB0), STEP 7 V5.5 SP2, WinCC V7.0 SP3. The same procedure applies to other 414H/417H CPUs. Refer to the SIMATIC S7-400H Fault-Tolerant Systems manual on the Siemens Industry Online Support for the authoritative description of all SSLs and H-system status semantics.

1. Problem Description

The H system has two CPUs in rack 0 — slot 3 (master) and slot 4 (standby) — connected by a fiber-optic sync module. The application must display the front-panel LED states of both CPUs in WinCC: RUN, STOP, MAST, STBY, REDF, LINK, RX/TX, BF1, BF2, INTF, EXTF.

Calling SFC51 with SSL_ID = W#16#0019 returns RET_VAL = 16#8085 (length error) instead of the expected 16#8082. The destination SZL buffer is not filled, the standby CPU cannot be monitored, and the WinCC alarm logging for H-system faults does not trigger. The same call works on a non-H S7-400 CPU, which is why the symptom appears only after a CPU swap to the 414-4H.

2. S7-400H Front-Panel LED Architecture

The CPU 414-4H front panel exposes the following LEDs, all of which can be read programmatically through SFC51:

The MAST and STBY LEDs are mutually exclusive: only one CPU in the H pair lights MAST, the other lights STBY. REDF lights when the redundancy link is broken, when one CPU is stopped while the other is RUN, or when the two CPUs have inconsistent memory image. The H system re-evaluates the LED bitmask every 100 ms (typical OB1 scan), so a 500 ms WinCC update cycle gives smooth animation without flooding the bus.

3. SFC51 and SSL_ID Reference for the S7-400H

SFC51 "RDSYSST" reads a partial list of the System Status List (SSL) of the CPU. The S7-400H operating system implements additional H-system partial lists that the standard S7-400 does not have. The relevant SSL_IDs for CPU/LED diagnostics are:

The combination SSL_ID + INDEX is what the H-system CPU validates. An invalid combination on the H system produces RET_VAL 16#8085 (length/parameter error) rather than 16#8082 (SSL not supported). The H system is stricter than the standard S7-400 because the SZL sublists are partially dynamic (rack/slot dependent). The two-stage workflow — W#16#0091 first, then W#16#00AE — gives the CPU a chance to populate the H system context before the LED read.

4. SFC51 Error Code Reference

SFC51 returns RET_VAL as a 16-bit signed value. The following are the documented error codes per the STEP 7 V5.5 online help for SFC51 "RDSYSST":

5. Root Cause Analysis

The 16#8085 error on W#16#0019 on the CPU 414-4H has three likely root causes:

1. Invalid INDEX parameter. W#16#0019 on the H system expects a specific INDEX that the standard S7-400 does not require. If the program was copied from a non-H example, INDEX is left at the default and rejected by the H CPU.
2. LENGTH mismatch. The LENGTH parameter is set too small or too large for the H-system partial list. The H system returns a 34-byte module identification, but a different LENGTH may be needed depending on the firmware version of the CPU 414-4H.
3. H-system operating mode. If the H system is in solo mode (one CPU stopped) and SFC51 is called on the standby CPU, the call may be rejected with 16#8085 because the standby CPU's SSL access is restricted until the master establishes the redundancy link.

For the most common case (16#8085 on W#16#0019), root cause 1 dominates. The H-system CPU 414-4H firmware 4.5 and later (order suffix 0AB0) implements the SZL with strict parameter validation. The fix is to use a different SSL workflow: first read W#16#0091 to establish the H-system context, then read W#16#00AE for the LED data of the specific CPU.

6. Solution: Two-Stage SSL Read Sequence

The recommended procedure to read the LED state of the H-CPU pair is a three-call sequence inside a single function block.

Stage 1 — Identify the H system role

Call SFC51 with SSL_ID = W#16#0091, INDEX = W#16#0000, SZL_INDEX = W#16#0000, LENGTH = 12. The 12-byte response describes the H system: byte 0-1 = H state word, byte 2 = master rack, byte 3 = master slot, byte 4 = standby rack, byte 5 = standby slot. For the CPU 414-4H default configuration, master is at slot 3 and standby is at slot 4.

Stage 2 — Read the LED bitmask of the master CPU

Call SFC51 with SSL_ID = W#16#00AE, INDEX = W#16#0300 (rack 0, slot 3), SZL_INDEX = W#16#0000, LENGTH = 12. Bytes 2-3 of the response carry the LED bitmask of the master CPU.

Stage 3 — Read the LED bitmask of the standby CPU

Call SFC51 with SSL_ID = W#16#00AE, INDEX = W#16#0400 (rack 0, slot 4), SZL_INDEX = W#16#0000, LENGTH = 12. Bytes 2-3 of the response carry the LED bitmask of the standby CPU.

The SZL response for W#16#00AE has the following documented structure (per the S7-400H System Manual):

7. STEP 7 V5.5 SP2 Implementation (FB100 "H_LED_READ")

Create a function block FB100 with the following interface and state machine. The block is cyclically called from OB35 (100 ms cyclic interrupt) to keep bus load low.

FUNCTION_BLOCK FB100
VAR_INPUT
  iExecute : BOOL;          // Trigger one read cycle
END_VAR
VAR_OUTPUT
  oBusy    : BOOL;          // Read in progress
  oDone    : BOOL;          // Last cycle completed OK
  oError   : BOOL;          // SFC51 returned a non-recoverable error
  oStatus  : WORD;          // Last SFC51 RET_VAL
  oMasterLED  : DWORD;      // LED bitmask of master CPU
  oStandbyLED : DWORD;      // LED bitmask of standby CPU
  oMasterSlot : INT;        // Master slot (3 default)
  oStandbySlot : INT;       // Standby slot (4 default)
END_VAR
VAR
  sSZL1 : ARRAY[0..23] OF BYTE;   // W#16#0091 buffer
  sSZL2 : ARRAY[0..23] OF BYTE;   // W#16#00AE buffer
  sBusy1, sBusy2, sBusy3 : BOOL;
  sState : INT;
END_VAR

BEGIN
  CASE sState OF
    0:  // Idle
      oBusy := FALSE; oDone := FALSE; oError := FALSE;
      IF iExecute THEN oBusy := TRUE; sState := 10; END_IF;

   10:  // Read H system status (W#16#0091)
      SFC51(REQ:=TRUE, SSL_ID:=W#16#0091, INDEX:=W#16#0000,
            SZL_INDEX:=W#16#0000, RET_VAL:=oStatus,
            BUSY:=sBusy1, SZL:=sSZL1);
      IF NOT sBusy1 THEN
        IF oStatus = W#16#0000 THEN
          oMasterSlot  := 3;
          oStandbySlot := 4;
          sState := 20;
        ELSE
          oError := TRUE; oBusy := FALSE; sState := 0;
        END_IF;
      END_IF;

   20:  // Read master LED (W#16#00AE, slot 3)
      SFC51(REQ:=TRUE, SSL_ID:=W#16#00AE, INDEX:=W#16#0300,
            SZL_INDEX:=W#16#0000, RET_VAL:=oStatus,
            BUSY:=sBusy2, SZL:=sSZL2);
      IF NOT sBusy2 THEN
        IF oStatus = W#16#0000 THEN
          oMasterLED := DWORD#16#00000000
            OR SHL(DWORD#1, BYTE_TO_DWORD(sSZL2[3]))
            OR SHL(DWORD#1, BYTE_TO_DWORD(sSZL2[2]))
            OR SHL(DWORD#1, BYTE_TO_DWORD(sSZL2[3]+8))
            OR SHL(DWORD#1, BYTE_TO_DWORD(sSZL2[2]+8));
          sState := 30;
        ELSIF oStatus = W#16#80C2 OR oStatus = W#16#80C4 THEN
          oMasterLED := 0; sState := 30;
        ELSE
          oError := TRUE; oBusy := FALSE; sState := 0;
        END_IF;
      END_IF;

   30:  // Read standby LED (W#16#00AE, slot 4)
      SFC51(REQ:=TRUE, SSL_ID:=W#16#00AE, INDEX:=W#16#0400,
            SZL_INDEX:=W#16#0000, RET_VAL:=oStatus,
            BUSY:=sBusy3, SZL:=sSZL2);
      IF NOT sBusy3 THEN
        IF oStatus = W#16#0000 THEN
          oStandbyLED := DWORD#16#00000000
            OR SHL(DWORD#1, BYTE_TO_DWORD(sSZL2[3]))
            OR SHL(DWORD#1, BYTE_TO_DWORD(sSZL2[2]))
            OR SHL(DWORD#1, BYTE_TO_DWORD(sSZL2[3]+8))
            OR SHL(DWORD#1, BYTE_TO_DWORD(sSZL2[2]+8));
          oDone := TRUE; oBusy := FALSE; sState := 0;
        ELSIF oStatus = W#16#80C2 OR oStatus = W#16#80C4 THEN
          oStandbyLED := 0; oDone := TRUE; oBusy := FALSE; sState := 0;
        ELSE
          oError := TRUE; oBusy := FALSE; sState := 0;
        END_IF;
      END_IF;
  END_CASE;
END_FUNCTION_BLOCK

Instantiate FB100 in OB1 (or OB35 for deterministic 100 ms polling) as a single instance with DB100. The SZL buffers are sized at 24 bytes to accommodate both W#16#0091 and W#16#00AE responses; undersized buffers (e.g., 14 bytes) are silently truncated by firmware ≥ 4.5.

Ladder Logic Equivalent (LAD/FBD)

Network 1: H system status read (stage 1)
  |--[ iExecute ]--[ CALL SFC51 ]--|
       SSL_ID = W#16#0091
       INDEX  = W#16#0000
       RET_VAL = MW100
       BUSY   = M101.0
       SZL    = DB100.SZL1[0..23]

Network 2: Wait for completion and branch
  |--[ NOT M101.0 ]--+--[ MW100 = 0 ]--( S M102.0 )--|
                     +--[ MW100 > 0 ]--( S M103.0 )--|

Network 3: Master LED read (stage 2)
  |--[ M102.0 ]--[ CALL SFC51 ]--|
       SSL_ID = W#16#00AE
       INDEX  = W#16#0300
       RET_VAL = MW104
       BUSY   = M105.0
       SZL    = DB100.SZL2[0..23]

Network 4: Standby LED read (stage 3)
  |--[ NOT M105.0 ]--[ CALL SFC51 ]--|
       SSL_ID = W#16#00AE
       INDEX  = W#16#0400
       RET_VAL = MW108
       BUSY   = M109.0
       SZL    = DB100.SZL2[0..23]

8. WinCC V7.0 SP3 Integration

To display the LED states in WinCC:

1. Install the S7H Connectivity option in WinCC. This adds the H system driver required for redundant connections to the S7-400H.
2. Open WinCC Explorer → Tag Management → add the "SIMATIC S7 PROTOCOL SUITE" driver.
3. Right-click "S7H" → New Connection. Set the connection parameters to point to the CPU 414-4H master at rack 0 slot 3 (the active CPU is identified through the H driver, not by the slot).
4. Add a second redundant S7H connection to the standby CPU. Use the WinCC wizard Tools → Wizards → Create Redundant Connection. Both connections are bound to the same H system; the wizard configures the WinCC redundancy tags automatically.
5. Add tags that read DB100.DBD0 (master LED DWORD), DB100.DBD4 (standby LED DWORD), and DB100.DBW8 (status WORD). Use the S7H driver with the corresponding DB number and byte offset.
6. Set the update cycle to 500 ms for the LED tags. Cycles longer than 1 s introduce visible lag during LED transitions; cycles shorter than 250 ms add unnecessary load to the H sync link.
7. In Graphics Designer, add 11 LED graphic objects per CPU (RUN, STOP, MAST, STBY, REDF, LINK, RX/TX, BF1, BF2, INTF, EXTF). For each object, configure the "Appearance" property with a bitmask on the corresponding tag bit. For example, the master RUN LED has its visibility bound to bit 0 of the master LED DWORD.

For non-redundant mode, the standby slot returns 0x80C2 (SSL currently unavailable) or 0x80C4 (SSL does not exist). WinCC must be configured to interpret these responses as "CPU not present" and grey out the corresponding LEDs. Use a status text field next to the LED group driven by a string tag that returns "Master / Standby", "Master / Standby (offline)", or "Master / Standby (starting)" depending on the SFC51 status word.

9. Distinguishing Master and Standby in Non-Redundant Mode

When the H system runs in non-redundant mode (one CPU stopped, missing, or starting), the SZL workflow adapts as follows:

1. Call SFC51 with W#16#0091. The response indicates which CPU holds the role of "master" (the only running CPU) and which is "not present" or "stopped."
2. Read the LED of the master CPU with W#16#00AE and INDEX = W#16#0300 (or W#16#0400, depending on which slot is currently active). The response will show RUN lit (bit 0) and MAST lit (bit 2).
3. Read the LED of the stopped/missing CPU with W#16#00AE. The CPU returns 0x80C2 (SSL currently unavailable, e.g., during startup) or 0x80C4 (SSL does not exist, e.g., module not physically present). In the WinCC logic, treat these RET_VAL values as "CPU not present" and display all standby LEDs as off (grey).
4. When the second CPU returns to RUN, the SZL call succeeds, the STBY LED lights, and the H system transitions to RUN-REDUNDANT. The transition is reported in the H system state word (bit 1 = redundant).

10. S7-400H System Topology

11. Verification Procedure

1. Open DB100 in STEP 7 monitor mode. Force iExecute = TRUE on FB100 and watch the state machine progress. MW100, MW104, and MW108 should all return to 0 with no error bits set.
2. Confirm that DB100.DBD0 (master LED) shows bit 0 = RUN and bit 2 = MAST in RUN-REDUNDANT mode. The bitmask in HEX should be at least 0x05 (RUN + MAST).
3. Confirm that DB100.DBD4 (standby LED) shows bit 0 = RUN and bit 3 = STBY. The bitmask should be at least 0x09 (RUN + STBY).
4. Stop the standby CPU via STEP 7 (PLC → Operating Mode → STOP). Verify that DB100.DBD4 updates within 1 second to show bit 1 (STOP) and bit 3 cleared.
5. Start WinCC and open the LED display screen. Verify that the LED graphic objects update in real time as the CPU states change. There should be no lag greater than the 500 ms update cycle.
6. Disconnect the PROFIBUS DP cable from the master CPU. Verify that the BF1 LED lights within 2 seconds (one CPU scan time) in both STEP 7 monitor and WinCC display.
7. Power down the master CPU. Verify that the standby CPU takes over the master role within 100 ms and that the WinCC display shows the LEDs on the new master without losing the S7H connection.

12. Troubleshooting Matrix

13. Field-Proven Caveats

• FB100 call placement matters. Calling SFC51 in OB1 with a 100 ms cycle causes high bus load on the H sync link. Use OB35 (cyclic interrupt, 100 ms recommended) to spread the load and keep the OB1 cycle time within budget.
• Buffer size. The SZL buffer must be at least 24 bytes. A smaller buffer (e.g., 14 bytes) is silently truncated by firmware ≥ 4.5 and may return incomplete data without error. Always size for the worst case.
• RET_VAL display format. The VAT/ST display shows the value as a signed INT. To verify, switch the VAT format to HEX (View → Display Format → HEX) to see the actual bit pattern that the CPU is returning. The 0x8082 and 0x8085 codes look like negative numbers in signed view.
• Firmware dependencies. The W#16#00AE byte layout changed between firmware 4.0 and 4.5 of the CPU 414-4H. Check the firmware version in the hardware configuration (PLC → Properties → Diagnostic/Status) before interpreting the SZL response. The 6ES7414-4HM14-0AB0 ships with firmware 4.5 or later; older 0AA0/0AA1 versions use a slightly different layout.
• CPU 417-4H differences. The 417-4H uses the same SSL_IDs but with larger buffer sizes for some sublists (16 bytes for W#16#0091, 16 bytes for W#16#00AE). When migrating the FB to a 417-4H, increase the SZL buffer to 32 bytes and update the LENGTH parameter to 16.
• WinCC tag count. WinCC V7.0 SP3 limits each S7H connection to 64 tags by default. For an 11-LED display × 2 CPUs = 22 tags, plus status, error, and redundancy tags, this is well within the limit. If you add more tags, split the connection or use a multiplexer tag.
• PROFINET vs PROFIBUS LED behavior. The LINK LED on the CPU 414-4H reflects the PROFINET interface state, not PROFIBUS. For PROFIBUS bus faults, watch the BF1/BF2 LEDs. The CPU 414-4H with order number 6ES7414-4HM14-0AB0 has two integrated PROFINET interfaces; older revisions (0AA0) have only one.
• H system startup timing. The W#16#0091 SSL is unavailable for 2-5 seconds after the standby CPU enters RUN while the H link is being established. During this window, expect 0x80C2. Do not treat this as a fault; the read recovers automatically.

14. Related Siemens Documentation

• SIMATIC S7-400H Fault-Tolerant Systems, System Manual (Siemens Industry Online Support, entry ID 109740605)
• STEP 7 V5.5 System Software, System and Standard Functions Reference Manual (Siemens Industry Online Support)
• SFC51 "RDSYSST" online help, integrated in STEP 7 V5.5 SP2
• WinCC V7.0 SP3 Communication Manual — S7H driver section (Siemens Industry Online Support)
• CPU 414-4H (6ES7414-4HM14-0AB0) Device Manual, chapter "Status and Error LEDs"
• SIMATIC S7-400H Diagnostics of Fault-Tolerant Systems, application note (Siemens Industry Online Support, entry ID 77408544)