Siemens ET200S PM Power Module Diagnostics: SFC 13 RET_VAL 35 Fix

Problem Overview

When polling diagnostics from a Siemens ET 200S distributed I/O station with SFC 13 (DPNRM_DG), the function block returns a value of 35 (decimal) in the RET_VAL output. Engineers familiar with Siemens S7-300 / S7-400 diagnostic programming often misinterpret this value as an error code. In reality, when RET_VAL is greater than zero, SFC 13 reports the actual length, in bytes, of the diagnostic data frame that was read from the addressed DP slave. A return of 35 indicates that the standard PROFIBUS DP diagnostic frame has been received — but the channel-specific diagnostic area is not populated. The PM (Power Module) status, fuse state, and voltage-availability information that the programmer expects are missing from the buffer.

This article documents the root cause of the missing data, the parameter assignment that must be enabled in HW Config (STEP 7) to release the channel diagnostics from the IM 151-1 / IM 151-3 interface module, and the event-driven pattern (OB82 / OB86 / OB1) that guarantees the diagnostic buffer is correctly cleared when faults depart. A complete alternative — FB125 for full network-wide DP diagnostics — is also documented.

ET 200S Distributed I/O Architecture

The ET 200S is a modular, bit-modular PROFIBUS DP slave with the following slot population (left-to-right on the DIN rail):

The PM module is the entry point for the 24 V supply that feeds the electronic modules. Starting with firmware V2.0 of the IM 151-1 and firmware V3.0 of the IM 151-3, the PM module supports the channel-specific diagnostic events listed in the table below. Prior to these firmware revisions, the PM slot is opaque to SFC 13.

SFC 13 (DPNRM_DG) Fundamentals

SFC 13 "DPNRM_DG" is the standard STEP 7 system function for reading the slave diagnostic frame. The call interface is:

CALL SFC 13
  REQ    := TRUE              // Rising edge starts the read
  LADDR  := W#16#03FF          // Diagnostic address of the DP slave (HW Config)
  RET_VAL:= MW100              // Return value / length in bytes
  RECORD := P#DB20.DBX 0.0 BYTE 64  // Receive buffer (typ. 32-64 bytes)
  BUSY   := M101               // Operation in progress

Per the STEP 7 System and Standard Functions manual, the following RET_VAL semantics apply:

• RET_VAL > 0: Read successful. The value equals the number of bytes transferred into RECORD.
• RET_VAL = 0: Slave reachable but no new diagnostic data pending.
• RET_VAL < 0: W#16#8xxx / W#16#Fxxx class error — see STEP 7 help for the decode table.

RET_VAL 35: Understanding the Diagnostic Frame Length

The PROFIBUS DP slave diagnostic frame has a layered structure. A fully populated frame is 64 bytes (the maximum that fits the standard record). When RET_VAL = 35 is returned, the buffer is filled as follows:

Byte 35 is one past the end of the last valid byte, which is why SFC 13 reports 35. The frame has stopped at the end of the channel-specific diagnostic region but is not longer than the minimum expected 6 bytes. This is not a configuration error of the buffer size — the buffer can be 64 bytes; the slave itself is reporting only 35 bytes of meaningful data.

Configuring the PM Power Module for Diagnostics

The PM module is not diagnostic-active by default. Two parameters must be enabled in HW Config:

1. Open the ET 200S station in STEP 7 HW Config.
2. Double-click the PM-E module in slot 1.
3. Select the "Parameter Assignment" tab (German: Parametrierung).
4. Tick the checkboxes for:
   • Diagnostic interrupt — enables OB82 entry on PM events
   • Wire break / fuse blown — required for fuse diagnostics
   • Voltage monitoring (24 V missing) — required for load-voltage diagnostics
5. Save & compile (Station > Save and Compile), then download HW Config to the CPU.

Once these boxes are ticked, the IM 151-1 (or IM 151-3) reports a channel-specific diagnostic event to the DP master whenever the PM changes state (load voltage OK → missing, fuse OK → blown, etc.). The OB82 is called and the diagnostic buffer in the IM 151 is populated. SFC 13, when called next, will read this frame and RET_VAL will grow to 35 bytes (or more) with the channel-specific data visible at offsets 18..34.

Per the Siemens Support entry 32118798, this is one of the most common commissioning issues with the ET 200S as a PROFIBUS DP slave — diagnostic interrupts must be enabled per slot, and the IM 151 will silently mask channel data from the master otherwise.

Activating the Status Byte for Voltage and Fuse Monitoring

The most efficient way to retrieve PM module status in OB1 is to map the PM status byte directly into the process image. This is configured in the same PM module dialog:

1. In HW Config, double-click the PM-E module.
2. Open the "Addresses" tab.
3. Tick "Status byte" (sometimes labelled Statusbyte).
4. STEP 7 will assign the next free input byte; the default is IB 0 for a station with no DI modules.

Once enabled, the status byte layout is fixed:

The downside, as the original Siemens responder notes, is the loss of a full input byte for only two or three useful bits. The benefit is the elimination of the SFC 13 call cycle entirely — the PLC program can simply read IB x in OB1 with no asynchronous logic.

Channel Diagnostic Update Behavior

A critical behavior of the ET 200S (and indeed of every PROFIBUS DP slave) is documented in the ET 200S manual at section 6-27: channel-specific diagnostics are written into the slave's diagnostic buffer only when an event occurs. Once a fault departs, the buffer is not automatically rewritten to indicate the all-clear state.

This is the source of the second symptom: "the fault went away, but the status did not change in my diagnostic data block." The diagnostic frame is event-driven, not cyclic. To detect a fault-depart event, the PLC must:

1. Catch the OB82 call that occurs when the fault arrives.
2. Then either:
   • Re-read the diagnostic frame in OB1 (cyclically) until the new state is observed, or
   • Trust that the standard DP diagnostic bytes 0..5 will show the slave in "non-stationary" (station status 2, bit 0) until the all-clear OB82 fires — and use OB82 to clear the local status word.

Recommended pattern (ST):

// OB82 - Diagnostic Interrupt
IF "DB_Diag".FaultLatched THEN
    "DB_Diag".FaultActive := FALSE;       // Clear local fault on OB82 depart
    "DB_Diag".FaultLatched := FALSE;
END_IF;

// OB1 - Periodic SFC13 poll (every 200 ms is sufficient)
CALL "DPNRM_DG"
  REQ     := NOT "DP_RD_Busy"
  LADDR   := W#16#3FF
  RET_VAL := "Diag_RetVal"
  RECORD  := P#"DB_DiagFrame".DBX0.0 BYTE 64
  BUSY    := "DP_RD_Busy";

IF "Diag_RetVal" > 6 AND "Diag_RetVal" <> "Diag_PrevLen" THEN
    "DB_DiagFrame".HasNewEvent := TRUE;   // Edge to user program
    "Diag_PrevLen" := "Diag_RetVal";
END_IF;

Event-Driven Diagnostics with OB82, OB86, OB122

STEP 7 raises a different organisation block for each event class. The ET 200S — being a DP slave — generates the following OBs in the master CPU:

Best practice is to insert the SFC 13 call only in OB1 and use OB82 / OB86 to set flags that OB1 will inspect. Putting SFC 13 calls in all three OBs (as in the original symptom) leads to bus contention, multiple overlapping BUSY=TRUE reads, and inconsistent diagnostic frames. The Siemens responder explicitly warns against this pattern.

Alternative: FB125 for Full DP Network Diagnostics

For users who want to bypass the per-slave SFC 13 pattern entirely, Siemens ships FB125 — a function block that walks the entire DP network and reports the diagnostic state of every slave, including the ET 200S PM modules. FB125 is provided as free, fully documented example code on the Siemens Support site:

FB125 call interface:

CALL FB125, DB125
  DP_MASTERSYS   := 1               // DP master system number
  TIMEOUT        := T#2S            // Wait for slave response
  DIAG_FLAG      :=
  DIAG_OVERVIEW  := "DB_DiagOverw"  // UDT with one entry per slave
  ERROR          :=
  BUSY           :=
  STATUS         := ;

FB125 fills a UDT array with the live diagnostic snapshot — including PM voltage status, fuse status, and channel faults — for every slave on the master system. This is the recommended path for installations with more than three or four DP slaves.

SFC 13 Call Examples

For a single ET 200S station, the minimum-viable ladder logic looks like the following. The buffer is a standard DB of 64 bytes:

// FB100 "Poll_Et200s_Diag" - call in OB1 every scan
      U     "Start_Diag"            // First-scan or OB82 latch
      UN    "SFC13_Busy"
      =     "SFC13_Req"

      CALL SFC 13
        REQ    := "SFC13_Req"
        LADDR  := W#16#3FF
        RET_VAL:= "DB_Diag".RetVal
        RECORD := P#DB_Diag.DiagBuf BYTE 64
        BUSY   := "SFC13_Busy"

To inspect the channel-specific status from DB_Diag.DiagBuf, decode bytes 18..34 per the ET 200S manual. The PM status is in the first channel-specific entry: byte 18 = channel number, byte 19 = channel error type, bytes 20..34 = extended data.

Diagnostic Event Codes and Meanings

For the PM-E module, the channel-specific error codes in byte 19 of the channel-specific block are:

Verification and Commissioning Checklist

Use this checklist to confirm a working ET 200S PM-module diagnostic path on an S7-300 / S7-400 CPU with STEP 7 V5.5 or TIA Portal V14 and later:

1. Hardware: PM-E module order number supports diagnostics (see section 1).
2. IM firmware: IM 151-1 ≥ V2.0, IM 151-3 ≥ V3.0.
3. HW Config: Parameter Assignment tab on PM module — diagnostic interrupt, fuse, voltage monitoring all ticked.
4. HW Config: Status byte enabled in the Addresses tab if you want the OB1 fast path.
5. OB1: SFC 13 (DPNRM_DG) called on the configured diagnostic address; 64-byte receive buffer.
6. OB82: Inserted in the program (the SFC is automatically populated by STEP 7 — verify it is not empty / not replaced by OB80 fallback).
7. OB86: Present in the program to handle slave failure / return.
8. Fault simulation: Pull the load-voltage terminal on the PM and confirm:
   • OB82 fires (event class 0x39 → 0x38 sequence)
   • SFC 13 RET_VAL grows past 35 (typically 40..45 for PM-only faults)
   • Status byte (if enabled) shows bit 0 = 0
9. Fault depart: Re-apply 24 V, confirm OB82 fires a second time and SFC 13 reads the all-clear frame.
10. Optional: Integrate FB125 for a one-line diagnostic dashboard.

Troubleshooting Matrix

Reference Documents

For deeper study, consult the following official Siemens manuals:

• Siemens Support entry 32118798 — Diagnostics messages when commissioning ET 200S as PROFIBUS DP slave
• ET 200S Distributed I/O System Manual (6ES7151-1AA00-8BA0), section 6-27: "Channel-specific diagnostic behavior"
• STEP 7 System and Standard Functions Reference Manual — SFC 13 (DPNRM_DG) description
• SIMATIC S7-300 CPU 31xC and CPU 31x: Technical Specifications — diagnostic OB listing