SFC 51 RDSYSST in S7-300: Reading SSL for CPU and Module Faults

Overview: SFC 51 'RDSYSST' and the System Status List Concept

SFC 51 'RDSYSST' (Read System Status List) is the standard firmware block in every S7-300 and S7-400 CPU that exposes the internal System Status List (SSL) to user programs. The SSL is a virtual, structured database the operating system maintains in real time. It contains entries describing the CPU operating mode, the state of every plugged module, the LED states, the diagnostic buffers, and the state of every PROFIBUS DP or PROFINET IO slave configured under the CPU or its interface modules.

Compared to evaluating the diagnostic interrupt OBs (OB 82, OB 83, OB 85, OB 86, OB 100, OB 121, OB 122) reactively, SFC 51 reads the SSL on demand, returning a snapshot of the entire station. That makes it the right tool for a WinCC 'system architecture fault' screen, because the HMI can poll the status of every module and slave from one cyclic block and the HMI needs no module-specific interrupt wiring. The SFC 51 interface and the SSL structure are documented in the Siemens manual 'System Software for S7-300/400 System and Standard Functions Volume 1 and Volume 2', sections 13.3 (Reading a System Status List or Partial List with SFC 51 'RDSYSST') and 34 (System Status Lists - SSL).

This article focuses on the canonical SSL IDs for the equipment described in the source: CPU 315-2 PN/DP, IM 153 (ET 200S), 6ES7 331-1KF02-0AB0 (SM 331 AI 8x13 bit), and 6ES7 323-1BH01-0AA0 (SM 323 DI 16/DO 16). The same calls apply to any S7-300/S7-400 CPU that supports the relevant SSL partial list.

System Architecture Context

The target station is a SIMATIC S7-300 with a CPU 315-2 PN/DP (6ES7 315-2EH14-0AB0 or similar index) as the central controller. The PROFIBUS DP master is the integrated DP interface of the CPU, and the PROFINET IO controller is the integrated PN interface. An ET 200S distributed station is connected via PROFIBUS through the IM 153-1 (6ES7 153-1AA03-0XB0 or later). The SM 331 AI and the SM 323 DI/DO are mounted in the central rack of the CPU.

Faults to surface in WinCC fall into four categories:

1. CPU faults - SF (group error), BF/BA (bus fault at DP or PN interface), INTF (internal error), EXTF (external error), FRCE (force active), RUN/STOP/MRES transition, diagnostic buffer overflow.
2. IM faults - station failure on PROFIBUS, configuration mismatch, IM 153 SF LED lit.
3. Module faults - channel fault on SM 331 (broken wire, overrange, underrange), short circuit on SM 323 DO, missing module, parameter assignment error.
4. Communication faults - loss of PG/OP connection, S7 connection drop to WinCC, OPC UA failure (if used), PN IO device failure.

Each category maps to one or more SSL partial lists. SFC 51 calls, organized in a single FB ('FB_Diag_Scan'), are issued cyclically in OB 1 (slow tick, e.g., 1 s) and the results are written to a global DB that WinCC reads via an S7 connection.

Prerequisites

Before writing the SFC 51 calls, confirm the following:

• CPU firmware supports the SSL partial list. The CPU 315-2 PN/DP supports all SSL IDs referenced here from firmware V2.0 and higher; the 6ES7 315-2EH14-0AB0 ships with V3.3. Check the CPU faceplate or Module Information > Firmware in STEP 7 / TIA Portal.
• STEP 7 V5.5 SP2 or higher, or TIA Portal V13+ for S7-300. The block library must include SFC 51 (always present), SFC 59 'RD_REC' (recommended backup), and optionally FB 125 / FB 126 for richer DP and PN diagnostics.
• FB 125 'DETAIL_DP_DIAG' (Siemens entry ID 387257) and FB 126 'PNIODiag' (entry ID 26996747) are available as instance DBs. They are not part of the standard library; they are downloaded from the Siemens Industry Online Support and registered in the S7 program as a separate family.
• The WinCC project must have an S7 HMI connection to the CPU and the connection diagnostic tags must be enabled in WinCC Explorer > Tag Management > S7 > Connection Properties > Connection Diagnostics.
• The PG/PC has read access to all relevant SSL partial lists. This is the default; no password is required for read access, only for protected partial lists (e.g., password-protected SSL ID W#16#1132 - protection level of the CPU operating system).

SFC 51 'RDSYSST' - Interface and Parameters

The SFC 51 call signature is identical in SCL, STL, FBD, and LAD. The parameter set is:

Because the read can take several OB 1 cycles (the SSL is rebuilt by the operating system between ticks), invoke SFC 51 in a small state machine that issues a new partial list when the previous one goes BUSY = FALSE. Cycling through the required partial lists every 1-2 s is enough for a WinCC fault screen and keeps the cycle time extension well below 1 ms on a CPU 315-2.

SSL Partial List Reference

The SSL is partitioned into partial lists. Each partial list is identified by a 16-bit ID. The high byte indicates the family (module, CPU, DP, PN, ...), the low byte indicates the specific list. The following table lists the IDs needed to build a complete WinCC fault screen.

Step 1: Read CPU LED State (SSL W#16#0171)

SSL W#16#0171 with INDEX W#16#0000 returns a fixed 4-byte LED status record of the CPU. The first two bytes are the LED bitmask, the second two bytes are a status code. Use the bitmask to drive a graphic LED on WinCC.

STL implementation in OB 1 (CPU 315-2 PN/DP):

// One-shot per call
CALL SFC 51 (
    REQ            := TRUE,
    SSL_ID         := W#16#0171,     // CPU LED state
    INDEX          := W#16#0000,     // all
    RET_VAL        := "dbDiag".retVal_CPU_LED,
    BUSY           := "dbDiag".busy_CPU_LED,
    SSL_HEADER     := "dbDiag".hdr_CPU_LED,
    DR             := "dbDiag".raw_CPU_LED);

// Evaluate on next scan (BUSY = FALSE, RET_VAL = 0)
A "dbDiag".raw_CPU_LED[0].BIT0;       // SF (group error)
= "dbDiag".cpu_LED_SF;
A "dbDiag".raw_CPU_LED[0].BIT1;       // BF1 (DP bus fault)
= "dbDiag".cpu_LED_BF_DP;
A "dbDiag".raw_CPU_LED[0].BIT2;       // BF2 (PN bus fault, if PN CPU)
= "dbDiag".cpu_LED_BF_PN;
A "dbDiag".raw_CPU_LED[0].BIT5;       // INTF
= "dbDiag".cpu_LED_INTF;
A "dbDiag".raw_CPU_LED[0].BIT6;       // EXTF
= "dbDiag".cpu_LED_EXTF;
A "dbDiag".raw_CPU_LED[0].BIT7;       // FRCE (force active)
= "dbDiag".cpu_LED_FRCE;
A "dbDiag".raw_CPU_LED[1].BIT0;       // RUN
= "dbDiag".cpu_LED_RUN;
A "dbDiag".raw_CPU_LED[1].BIT1;       // STOP
= "dbDiag".cpu_LED_STOP;

The exact bit assignment is documented in the Siemens standard functions manual section 34. Some firmware versions swap BF1 and BF2; verify against the CPU 315-2 PN/DP faceplate LEDs by unplugging the PROFIBUS connector and confirming only BF1 toggles, then unplugging the PROFINET cable and confirming only BF2 toggles.

Step 2: Read Module Status Information (SSL W#16#0A91 / W#16#0D91)

For the SM 331 AI (slot 4) and SM 323 DI/DO (slot 5) in the central rack, read SSL W#16#0A91 (module LEDs) and W#16#0D91 (module diagnostic data) per slot. The returned record length varies; always read SSL_HEADER.length first and verify the buffer is large enough.

SCL implementation in a diagnostic FB:

// Block: FB_Diag_Scan
// Cyclic, called from OB 1 once per second
FOR #iSlot := 1 TO 8 DO
    // Module LED state
    CALL SFC 51 (
        REQ        := #req_LED,
        SSL_ID     := W#16#0A91,
        INDEX      := INT_TO_WORD(#iSlot),
        RET_VAL    := #retVal,
        BUSY       := #busy,
        SSL_HEADER := #hdr,
        DR         := P#DB_Diag.raw_mod_LED BYTE 256);
    IF NOT #busy AND #retVal = 0 THEN
        "dbDiag".mod[ #iSlot ].LED_SF := "dbDiag".raw_mod_LED[0].BIT0;
        "dbDiag".mod[ #iSlot ].exist  := "dbDiag".raw_mod_LED[0].BIT7;
    END_IF;

    // Module diagnostic data record 1
    CALL SFC 51 (
        REQ        := #req_DIAG,
        SSL_ID     := W#16#0D91,
        INDEX      := INT_TO_WORD(#iSlot),
        RET_VAL    := #retVal,
        BUSY       := #busy,
        SSL_HEADER := #hdr,
        DR         := P#DB_Diag.raw_mod_DIAG BYTE 256);
    IF NOT #busy AND #retVal = 0 THEN
        // Bytes 0-3 = standard diagnostic header
        // Byte 0 bit 0 = module fault
        // Byte 0 bit 1 = internal fault
        // Byte 0 bit 2 = external fault
        // Byte 0 bit 3 = channel fault present
        "dbDiag".mod[ #iSlot ].mod_fault    := "dbDiag".raw_mod_DIAG[0].BIT0;
        "dbDiag".mod[ #iSlot ].int_fault    := "dbDiag".raw_mod_DIAG[0].BIT1;
        "dbDiag".mod[ #iSlot ].ext_fault    := "dbDiag".raw_mod_DIAG[0].BIT2;
        "dbDiag".mod[ #iSlot ].chan_fault   := "dbDiag".raw_mod_DIAG[0].BIT3;
    END_IF;
END_FOR;

For the SM 331 (6ES7 331-1KF02-0AB0), the channel fault bits in the diagnostic data record identify which analog channel is broken-wire or out of range. The SM 323 (6ES7 323-1BH01-0AA0) digital module surfaces a short circuit on a DO via the same channel fault bit and the channel number in the diagnostic data record. Always cross-check with the diagnostic buffer (SSL W#16#0C91) for the textual event text, which WinCC can also display.

Step 3: Read PROFIBUS DP Slave Status (SSL W#16#0094) and FB 125

SSL W#16#0094 returns the operational state of every configured DP slave as a 32-bit station status byte. The bit encoding is standard PROFIBUS:

For richer diagnostics (which channel, which slot, manufacturer-specific records), use FB 125 'DETAIL_DP_DIAG' (Siemens entry ID 387257). Call once per second per DP master:

// Block: FB_Diag_Scan (continued)
CALL FB 125, "idb_DETAIL_DP_DIAG" (
    DP_MASTER_SYS   := 1,                       // DP master system 1 (integrated DP)
    EXTERNAL_DP_IF := FALSE,                   // internal DP interface on CPU
    REQ            := "dbDiag".req_FB125,
    BUSY           := "dbDiag".busy_FB125,
    RET_VAL        := "dbDiag".retVal_FB125,
    DP_SLAVE       := "dbDiag".dpSlaveTab,
    DP_FAULT       := "dbDiag".dpFault);

The instance DB idb_DETAIL_DP_DIAG contains the full slave table with slot-level error descriptors. On the ET 200S with IM 153, this includes the AI/DI/DO module-level errors and channel numbers. The DP_SLAVE output is a multi-row table where each row carries a station address, the station status, and a list of slot-level diagnostic descriptors (manufacturer ID, channel number, error type).

Step 4: Read PROFINET IO Diagnostics (FB 126)

For the PN side of the CPU 315-2 PN/DP, use FB 126 'PNIODiag' (Siemens entry ID 26996747). It exposes the PROFINET IO device state and channel-level error descriptors without having to interpret raw PROFINET records manually.

// Block: FB_Diag_Scan (continued)
CALL FB 126, "idb_PNIODiag" (
    MODE            := 1,                      // 1 = cyclic, 2 = one-shot
    REQ             := "dbDiag".req_FB126,
    BUSY            := "dbDiag".busy_FB126,
    RET_VAL         := "dbDiag".retVal_FB126,
    PN_IO_DEVICE    := "dbDiag".pnDeviceTab,
    DIAG_INFO       := "dbDiag".pnDiagInfo);

For a CPU 315-2 PN/DP there is normally one PN IO system (system 100 or 0 depending on indexing) and up to 64 PROFINET devices depending on the configuration. FB 126 returns the per-device state (AR established / not established / wrong submodule / maintenance / fault) and the per-channel diagnostics for the IO devices that the CPU sees as PROFINET IO controllers.

Step 5: Interpret the CPU Diagnostic Buffer (SSL W#16#0C91)

The CPU diagnostic buffer is the canonical place to capture the textual reason for a fault event. SSL W#16#0C91 with INDEX W#16#0000 returns the most recent entries as fixed 20-byte records. Decode as follows:

For an SFC 51 read, the SSL returns the latest 10 entries by default; the count comes back in SSL_HEADER.n_record. To make the text visible in WinCC, copy the 12 bytes of ASCII per entry into the gDB_DiagStatus DB and bind a WinCC text list to it. Reading once per 5 s is sufficient; the diagnostic buffer itself is updated synchronously by the CPU operating system on every relevant event.

Step 6: WinCC HMI Tag Mapping

Build a single data block, e.g., DB 200 'gDB_DiagStatus', that aggregates every fault bit the WinCC screen needs. The structure of the DB mirrors the station layout:

DATA_BLOCK "gDB_DiagStatus"
STRUCT
    // CPU
    cpu_LED_SF      : BOOL;    // SF
    cpu_LED_BF_DP   : BOOL;    // BF on DP
    cpu_LED_BF_PN   : BOOL;    // BF on PN
    cpu_LED_INTF    : BOOL;
    cpu_LED_EXTF    : BOOL;
    cpu_LED_FRCE    : BOOL;
    cpu_LED_RUN     : BOOL;
    cpu_LED_STOP    : BOOL;
    // Module array 1..8
    mod : ARRAY[1..8] OF STRUCT
        exist          : BOOL;
        LED_SF         : BOOL;
        mod_fault      : BOOL;
        int_fault      : BOOL;
        ext_fault      : BOOL;
        chan_fault     : BOOL;
        chan_fault_no  : BYTE;   // first faulty channel
    END_STRUCT;
    // DP slaves 1..32
    dp_slave : ARRAY[1..32] OF STRUCT
        reachable      : BOOL;
        diag_pending   : BOOL;
        config_err     : BOOL;
        diag_ext       : BOOL;
    END_STRUCT;
    // PN devices 1..64
    pn_device : ARRAY[1..64] OF STRUCT
        ar_ok          : BOOL;
        fault          : BOOL;
        maint          : BOOL;
        chan_fault_no  : BYTE;
    END_STRUCT;
    // Diagnostic buffer (10 x 20 bytes)
    diag_buffer : ARRAY[1..10] OF STRUCT
        event_class : BYTE;
        event_id    : BYTE;
        ob_no       : INT;
        text        : STRING[12];
    END_STRUCT;
    // S7 connection state
    s7_conn_state   : BYTE;     // 0=down, 1=up, 2=reconnecting
    last_refresh_s  : TIME;
END_STRUCT;
END_DATA_BLOCK

Tag every BOOL field as a WinCC tag using the standard S7 driver, enable 'cyclic read 1 s', and place a graphic LED object on the screen. The MOD/DP/PN objects bind the BOOL field to a red/green/grey symbol. The channel fault number is the value WinCC can use to render a small numeric indicator ('CH 3') next to the SM 331 box on the system overview.

For textual diagnostic buffer entries, read the diag_buffer array once per 5 s in WinCC and display the most recent five in a list view. Color the rows by event_class: green for class 1, blue for class 2, yellow for class 4, red for class A or F.

For the HMI connection itself, enable the WinCC connection diagnostics and bind @S7_CONNECTION_STATE to s7_conn_state. A value of 4 means 'established'; a value of 1 means 'not connected'. Tag the connection state to a header on the system overview so the operator can distinguish a station fault from a network fault.

SFC 51 Return Value / Error Code Reference

Cyclic vs. Interrupt-Driven Polling

There are two valid strategies for collecting module diagnostics, and they are not mutually exclusive:

• Cyclic polling (SFC 51 from OB 1 or OB 35): simple to implement, scans the entire station, suitable for HMI display. Latency is the OB cycle time. Typical for a WinCC system architecture screen, where 1-2 s latency is acceptable.
• Interrupt-driven (SFC 59 in OB 82, OB 83, OB 85, OB 86, OB 100, OB 121, OB 122): fires immediately on a module event, fetches the diagnostic data record for the offending module only. Latency is sub-millisecond. Required for safety-related shutdowns and for any application that needs to react in <100 ms.

The standard pattern is: install OB 82 / OB 86 to capture the event into a local buffer (using SFC 59 on the slot in OB82_Zx), and additionally run SFC 51 in OB 1 for the WinCC overview. The two do not collide because SFC 51 reads the SSL while SFC 59 reads the per-module DS 0/1. For a CPU 315-2 PN/DP, OB 82 must be downloaded for the diagnostic interrupt to be visible; the CPU ships with OB 82 in the project but not always active.

Verification and Commissioning

1. Online connect to the CPU with STEP 7 or TIA Portal. Open PLC > Monitor/Modify > DB 200 and force a state to confirm the SFC 51 calls return data without leaving BUSY stuck on TRUE. If BUSY is stuck, the SFC 51 call is starved by the OB 1 cycle time - move the call to a slower OB (e.g., OB 35, OB 100) or split into multiple OBs.
2. Verify CPU_LED_RUN, CPU_LED_STOP update at the 1 s tick by toggling the CPU mode selector (MRES) and watching the bits in DB 200.
3. Unplug the PROFIBUS connector to the IM 153. CPU LED BF1 should light within 2 s; WinCC should display a red DP-fault icon and the slot of the IM 153 (typically slot 0 of the DP slave). Plug the connector back; the icon should clear within 5 s. If the icon never clears, check that the call sequence in FB_Diag_Scan cycles through all required SSL IDs at least once every 10 s.
4. Unplug one channel of the SM 331 (e.g., short-circuit the input). The SM 331 SF LED should light and the WinCC channel-fault number should match the channel.
5. Power off the PROFINET IO device connected to the CPU's PN port. PN LED BF2 should light; the corresponding pn_device[].ar_ok bit in DB 200 should drop to FALSE within 2 s.
6. In WinCC, verify the HMI connection is 'established' by switching to the connection diagnostics screen (right-click the connection -> Connection diagnostics). The connection should remain in 'connected' state even when the CPU has a fault - the S7 connection is independent of the diagnostic data.
7. Force a stop-and-restart of the CPU. After restart, confirm that the first cycle populates DB 200 cleanly (no leftover BUSY = TRUE from a previous scan) and that WinCC re-initializes its tags within the connection-timeout window (default 30 s).
8. Trigger a diagnostic buffer overflow by writing more than 100 events in 1 s (e.g., by toggling a DO 100 times in a test program). Confirm that the SFC 51 read of W#16#0C91 does not stall, and that the buffer entries wrap correctly without crashing the FB.

Troubleshooting Matrix

Performance and Cycle-Time Budget

A single SFC 51 call with a 256-byte destination buffer typically takes 0.2-0.4 ms on a CPU 315-2 PN/DP (6ES7 315-2EH14-0AB0). Calling all partial lists in the table above in a single OB 1 cycle will add 1.5-3.0 ms to the OB 1 cycle, which is well within the budget for a 150 ms OB 1 on a typical machine. The total is the dominant cost in this design pattern; FB 125 and FB 126 are the secondary cost, each at 0.1-0.3 ms per call.

For a system with a tight 10 ms cycle, split the scan across OB 35 (e.g., 100 ms cyclic) instead of OB 1, and reduce the number of partial lists to the ones actually displayed on WinCC. The CPU LED state (W#16#0171) and the DP slave status (W#16#0094) are the two most valuable; the per-slot module LEDs (W#16#0A91) and the diagnostic buffer (W#16#0C91) can be polled at a slower tick (1-5 s) without operator-visible impact.

Standards and Reference Documentation

The SSL structure, the partial list encoding, and the bit semantics for PROFIBUS station status are part of the PROFIBUS and PROFINET profile conventions. For PROFINET, the channel-level diagnostic record format is defined in IEC 61784-2 / PROFINET IO profile. The S7-300/400 SFC 51 documentation, the SSL structure, and the LED bit mapping are described in the Siemens manual 'System Software for S7-300/400 System and Standard Functions Volume 1 and Volume 2', sections 13.3 and 34.

For an authoritative reference on the SFC 51 call and its current revision in the TIA Portal documentation set, see the TIA Portal V20 extended instructions manual at the Siemens docs portal: RDSYSST: Read system status list (S7-300, S7-400) - STEP 7.

FAQ