S7-414H PROFIBUS Diagnostics via Y-Link: FC125 Replacement

S7-414H PROFIBUS Diagnostics via Y-Link: Replacing FC125 in a Redundant H-System

The legacy FC125/FB125 block that scans PROFIBUS node status on a standard S7-300/S7-400 does not behave reliably on an S7-414H fault-tolerant CPU when the PROFIBUS segment downstream of the CPU is reached through a Y-Link. The block internally calls SFC51 (RDSYSST) and assumes a single DP master system, an assumption that breaks on the H-system where two CPUs own a switched DP master system and the slaves behind the Y-Link live in a transparent DP master system with its own ID (commonly 5980 in the field). This reference documents the root cause, the available S7-400H diagnostics primitives, the parameter set required to read slave status, and a step-by-step recipe to build a replacement block that returns the same status list FC125 produced on the pre-H machine.

1. Problem Description

After migrating a single-CPU S7-400 application to a redundant S7-414H configuration, the engineering team observed that the diagnostics FC used on the previous machine no longer reported node failures during commissioning. The affected PROFIBUS network is reached through a Y-Link (Siemens DP/PA link with PROFIsafe/y-proxy capability, order number 6GK1 416-3AB00 etc., depending on variant) and is configured with DP master system number 5980. The symptom is consistent across the H-system:

• FC125 returns an empty station list when called on the active CPU.
• No fault bits are set for slaves known to be in diagnostic state during forced fault tests.
• The same FC, when run on the reserve CPU during a master failover, returns inconsistent results (different SZL header values for the same slave).
• Direct ET200M slaves on the same CPU (without Y-Link) may or may not be reported, depending on whether the FC was called with DP_MASTERSYSTEM = 1 or = 2.

Engineers familiar with classic S7-400 expect FC125/FB125 to enumerate every node in the local DP master system. The H-system's switched DP master, the Y-Link's transparent lower-level master, and the way SFC51 indexes system state lists by DP master system all interact to break that assumption.

2. H-System PROFIBUS Topology and the Y-Link

An S7-414H contains two CPUs (CPU 0 and CPU 1) that share a synchronized DP master system through the IF module pair. A Y-Link (PROFIBUS Y-Link, e.g., 6GK1 416-3AB00 or 6ES7 197-1LB00-0XA0) sits between the redundant DP master and a lower-level, non-redundant DP master system that carries the field devices. From the perspective of the CPU, the slaves behind the Y-Link live in a different DP master system ID than the slaves connected directly to the CPU's PROFIBUS interface.

Step 7 assigns DP master system IDs in the range 1..32 by default, but the H-system tools often allocate higher IDs (for example 5980 as in the case described) to the Y-Link's lower-level master. The figure below illustrates the topology:

The critical fact: in the H-system, the active CPU owns the DP master at any one time, and SFC51 reports slave status from the perspective of the CPU executing the call. If you call FC125 with DP_MASTERSYSTEM = 1, the block queries the switched master; with = 2, the backup CPU's master. The Y-Link itself is not a slave in either list - it is the gateway to a separate DP master system (ID 5980) that the CPU sees only as an attached device.

3. Root Cause: Why FC125 Fails on an H-System with a Y-Link

FC125 (and the functionally identical FB125) is a thin wrapper around SFC51 (RDSYSST) that requests partial system state lists with the following SZL IDs:

The parameter DP_MASTERSYSTEM is passed to the SZL INDEX. The SFC51 documentation for the S7-400 CPU states that INDEX = 0 returns the list for the local DP master system of the CPU executing the call. INDEX = 1 or 2 selects the corresponding switched master in the H-system. INDEX = <DP master system number> (e.g., 5980) is, for several S7-414H firmware versions, not accepted: the SFC returns RET_VAL = 808Ah (SZL index not allowed) or 80A2h (SZL_ID cannot be read for this object). The reported symptoms in the field match this failure mode exactly.

The Y-Link complicates the picture further. From the CPU, the Y-Link is a regular DP slave on master system 1 (or 2, depending on which CPU is active). Its lower-level PROFIBUS segment is not visible to SFC51 as a list of slaves - it appears only as a single slave entry pointing at the Y-Link. There is no SZL that returns the sub-network of a transparent slave. Siemens documents this gap in the manual for the Y-Link (entry ID 19243932 in the Siemens Support knowledge base and the manual for 6GK1 416-3AB00): diagnosis of slaves downstream of the Y-Link must be performed with record-based reads, i.e., SFC13 (DPNRM_DG) or SFC58 (RD_REC) against the Y-Link's own records, or with the dedicated DP/PA slaves diagnostics addon.

The combination of these two constraints - SFC51 refusing to read slave lists for the lower-level master system, and the Y-Link being a transparent gateway - is the definitive reason FC125 returns nothing on the H-system.

4. Available Diagnostics Primitives in STEP 7 for S7-400H

STEP 7 V5.5 (and the matching TIA Portal V16+ for legacy S7-400H support) exposes four primitives that can substitute for FC125 on an H-system. Each has trade-offs in latency, supported slave types, and CPU load.

5. Solution A: SFC51 with Correct SZL/INDEX for the H-System Switched Master

If you only need diagnostics for the slaves on the H-system's switched master (i.e., everything connected to the CPU's DP port including the Y-Link itself but not the slaves downstream of it), call SFC51 directly with the correct SZL and INDEX. The legacy FC125 cannot be parameterised to do this reliably; you should write a small FB that wraps SFC51 per the pattern below.

5.1 Parameter table for SFC51 on S7-414H

5.2 STL code pattern

// FB1900 - H-Profibus node status
CALL "RDSYSST"        // SFC51
REQ    := #startJob
SZL_ID := W#16#0094   // PN+DP combined master diagnostic list
INDEX  := #activeMasterId  // 1 or 2 derived from SZL W#16#0019
RET_VAL:= #sfcStatus
BUSY   := #busy
SZL_HEADER := #header
DR     := #stationList

When #sfcStatus = W#16#0000, evaluate #stationList. For SZL W#16#94 the structure of each entry is documented in the S7-400 system and standard functions reference manual:

This is exactly the data FC125 was exposing on the pre-H machine, so the HMI faceplate can be reused unchanged.

6. Solution B: SFC58 Against the Y-Link for Downstream Slaves

For slaves behind the Y-Link, the recommended approach is record-based diagnostics. The Y-Link exposes the lower-level PROFIBUS segment as a set of records. According to the Y-Link manual (Siemens entry ID 19243932), records in the range 1..7 contain the diagnostic records of the connected PA/DP slaves.

6.1 Parameter table for SFC58 against the Y-Link

A single SFC58 call to the Y-Link with record 0 returns the Y-Link's own diagnostic state, but the downstream PA/DP slave diagnostics are accessed differently: the Y-Link multiplexes the lower-level master's records. To obtain diagnostics for a specific PA slave, you issue a SFC58 call routed through the Y-Link by setting the LADDR to the Y-Link's diagnostic address and RECNUM to the index that corresponds to the downstream station. The Y-Link manual provides a table mapping downstream PROFIBUS addresses to record numbers.

7. Solution C: System Diagnostics DP/PA Slaves Addon

Siemens ships a free addon named "System diagnostics DP/PA Slaves" that is explicitly tested on the S7-400H. It packages SFC51, SFC13, and SFC58 access into a pre-built FB library with faceplates for WinCC flexible and ProTool. The addon downloads from the Siemens Support site (entry ID 22681001 in the Siemens Industry Online Support, search keyword "Systemdiagnose DP/PA-Slaves"). It is the path of least resistance for plants that already have a ProTool/WinCC flexible HMI. On the H-system the addon distinguishes between CPU 0 and CPU 1 active state and reads both masters in alternation, eliminating the FC125 ambiguity.

8. Step-by-Step Replacement Recipe

1. Confirm firmware. Open SIMATIC Manager > PLC > Module Information. Verify the S7-414H firmware is >= V5.3 (recommended V5.4 or V6.0 for full Y-Link record support). CPU 6ES7 414-4HM14-0AB0 is the most common variant in this generation.
2. Capture the active master ID. In OB1, call SFC51 with SZL_ID = W#16#0019, INDEX = 0. The returned byte 0 contains the active master (1 or 2). Cache this in a global data block (e.g., DB1900.DBD0 = active master ID).
3. Write a new FB (e.g., FB1901) that contains a single CALL to SFC51 with SZL_ID = W#16#94 (or W#16#42 for DP-only CPUs) and INDEX = DB1900.DBD0. The DR must be at least 256 bytes; size it to 512 to be safe across firmwares. Mark the FB as "Multi-Instance Capable" and set the instance DB to be non-removable (via SFC82 or by retaining).
4. Decode the SZL in the same FB. Walk the DR array, copy each entry's logical base address, PROFIBUS address, state, and vendor ID into a structured DB (e.g., DB1902 with UDT1902 per-slave). FC125 used offset 22 in the FC return DB for the state byte - preserve that layout so the existing HMI screens do not need changes.
5. For the Y-Link downstream slaves, instantiate a second FB (e.g., FB1902) that schedules SFC58 calls against the Y-Link's diagnostic address in a round-robin fashion (one slave per OB1 cycle). Use a 10-s scheduler via a timer pulse so you do not load the PROFIBUS during process scans.
6. Wire the new blocks in OB1. Remove FC125. Wire FB1901 to the HMI tag "DP.SlaveCount" and FB1902 to "DP.Downstream.SlaveCount".
7. Download to both CPUs. On an H-system, both CPUs need the new blocks, otherwise the reserve CPU will revert to old code on a failover.
8. Verify in Monitor/Modify with the PROFIBUS cable intentionally disconnected from one ET200M. The state byte in the corresponding DB1902 entry must read 02h (not reachable) within 10 s of disconnect.

9. Verification Procedure

1. Open the HMI diagnostic page. The total slave count must equal the count configured in HW Config on master 1 (or 2) for the active CPU.
2. Disconnect one PROFIBUS connector. Within 10 s the corresponding row turns red, and the state field reads "Fault" or "Not reachable" depending on the encoding you chose.
3. Reconnect the connector. The state clears within 5 s (PROFIBUS default retry timing).
4. Force a CPU failover. Hot-swap the master role from CPU 0 to CPU 1 (via STEP 7 > PLC > Operating Mode > Switch Master). The SFC51 INDEX must flip to 2 within one OB1 cycle; otherwise your active-master detection has a bug.
5. With the system on CPU 1, repeat steps 2-3 to confirm the diagnostics work identically on the reserve master.
6. For the Y-Link downstream segment, disconnect a PA segment. The corresponding entry in DB1903 must change to "Not reachable" within 30 s (record reads are slower than direct SFC51 reads).

10. Common Errors and Their Meanings

11. Performance and CPU-Load Considerations

SFC51 with SZL W#16#94 returns up to 128 slaves per call on a typical S7-414H. The call itself takes 8-15 ms when 64 entries are populated. Call it once per OB35 (100 ms cycle) on the active CPU only - calling it on both CPUs wastes CPU time and can confuse the HMI if both are broadcasting updates. SFC58 record reads are slower: a single record read against the Y-Link takes 30-60 ms plus the Y-Link's internal round-trip to the downstream slave (another 30-200 ms). Schedule downstream reads at 1-Hz or slower; the DP/PA Slaves addon uses a 2-s cycle by default, which is a good starting point.

12. Migration Checklist

• Document the DP master system IDs of every PROFIBUS network in HW Config (Export > Station Configuration). Y-Link downstream segments are usually in the 5x range (e.g., 5980); direct slaves are in 1..4.
• Identify which FC/FBs in the existing project read DP slave status. FC125, FB125, FB126, and any project-specific blocks that call SFC51 with a hard-coded INDEX are candidates for replacement.
• Add a global data block for the active master ID; subscribe both CPUs to it.
• Replace FC125 with the new FB on both CPUs. The download must be to the H-station (both CPUs in a single operation); do not download to CPU 0 and CPU 1 separately, as this desynchronises the program level.
• Test a forced failover with diagnostics active. Confirm that the HMI does not freeze or show stale data during the switchover.
• Update the plant's HMI tag list. If the new FB uses a different DB layout than FC125, run a HMI variable export/import or recompile the HMI project.

13. Field-Proven Notes and Caveats

The S7-414H firmware versions most often encountered in production plants are V5.3, V5.4, and V6.0. The 5980 DP master system ID is not special from the firmware's perspective - it is simply the next free ID that HW Config allocated when the Y-Link was added. On V5.3 firmware, SFC51 with INDEX > 32 always returns 808Ah. On V5.4, INDEX up to 256 is accepted, but the lower-level slaves are still not enumerated - only the Y-Link itself appears in the result list. On V6.0, the behaviour is the same as V5.4 but with a higher SZL size, allowing the entire network in one call. Do not assume the SZL_HEADER N_DR value means "all slaves" - it is the number of records in the SZL, not the number of slaves you care about.

For PA slaves downstream of the Y-Link, the Siemens DP/PA coupler profile requires record routing through the Y-Link. Trying to call SFC13 directly against a PA slave's logical address fails with 80A0 because the CPU does not have a direct connection to the PA segment. The Y-Link documentation explicitly states: "Diagnostics of DP/PA slaves downstream of the Y-Link is performed via records read from the Y-Link itself."

If the plant has a mix of ET200M (DPV0) and ET200S with DPV1, use SFC59 (WR_REC) and SFC58 (RD_REC) for the DPV1 records and SFC13 only for DPV0. The SZL W#16#94 returns the slave type, which you can use to branch the diagnostics routine.

Finally, in H-systems, SFC51 calls must be issued on the active CPU only. If you wire SFC51 to OB1 in both CPUs, the reserve CPU will consume cycles reading SZLs that are then discarded when the master switches. The active-master detection in step 2 of the recipe (SZL W#16#0019) gates the call and prevents the wasted work.

14. References to Official Documentation

• Siemens Industry Online Support, "PROFIBUS diagnostics (S7-300, S7-400) - STEP 7" - S7-300/S7-400 PROFIBUS diagnostics
• Siemens Function Manual "System and Standard Functions for S7-300/400" - SFC51 RDSYSST (SZL list parameters and SZL_ID constants)
• Siemens Manual "S7-400H Fault-Tolerant Systems" - section on diagnostics on the switched DP master and active-master detection
• Siemens Manual "Y-Link (6GK1 416-3AB00)" - record routing for DP/PA slaves
• Siemens Industry Online Support entry ID 22681001 - "System diagnostics DP/PA Slaves" addon for STEP 7 V5.5 (download and application note)