Siemens S7-300 PROFINET Station Return OB86 Troubleshooting

1. Fault Profile and OB86 Event Decode

The diagnostic block emitted by the S7-300 CPU on a station return event typically reports the following parameters, which are taken from the standard local data of OB86 and from the diagnostic buffer entry that triggers the call:

OB86 is the Rack Failure OB. Although the name derives from central rack failures, the S7-300 uses OB86 for all distributed I/O station diagnostics on PROFINET IO and PROFIBUS DP. Two distinct event IDs are emitted by PROFINET IO:

Pair the OB86 call with the CPU diagnostic buffer (online > PLC > Diagnostic/Setting > Diagnostic buffer) to confirm whether the message is station failure followed within a short window by station return, or only a station return. A pure-return pattern is typical of a brief PROFINET RT cycle loss followed by recovery: the device never actually left the network, but the controller's cyclic watchdog expired before the next valid frame arrived.

2. Reading the OB86 Start Information

Capture the standard local data inside OB86 and log it to a DB for trending. In STL / SCL:

FUNCTION_BLOCK FB_DiagOB86
VAR_TEMP
    sEvClass : BYTE;     // OB86_EV_CLASS
    sFltID   : WORD;     // OB86_FLT_ID
    sIOFlags : BYTE;     // OB86_IO_FLAGS
    sMdlAddr : WORD;     // OB86_MDL_ADDR - logical base address
    sZInfo   : DWORD;    // OB86_Z_INFO / OB86_RACKS_FLTD
END_VAR
BEGIN
    sEvClass := OB86_EV_CLASS;   // B#16#38 = incoming, B#16#39 = outgoing
    sFltID   := OB86_FLT_ID;     // W#16#3900 fail, W#16#3901 return
    sIOFlags := OB86_IO_FLAGS;
    sMdlAddr := OB86_MDL_ADDR;
    sZInfo   := OB86_Z_INFO;
    // Write to ring-buffer DB for trending from HMI / OPC
END_FUNCTION_BLOCK

EV_CLASS B#16#38 plus FLT_ID W#16#3901 means a station return; pair with the preceding W#16#3900 in the diagnostic buffer to identify the actual outage window. The CPU does not expose a "frames lost" counter directly; OB86 + the diagnostic buffer is the canonical record for PROFINET station health.

3. Why Devices Stay Pingable While PROFINET Drops

ICMP and PROFINET RT frames travel on completely different timing assumptions. The Cisco IE3000, like any store-and-forward switch, services traffic from separate queues:

• Best-effort traffic (ICMP, HTTP, SSH, engineering) - serviced whenever the output port is free.
• Real-time PROFINET RT - serviced under a strict priority based on the VLAN PCP (Priority Code Point) and DSCP markings used by PROFINET RT class 1.

The reported symptom (nodes remain pingable while OB86 fires) implies that the switch is occasionally failing to forward a PROFINET RT frame within the controller's configured watchdog window. Common mechanisms include:

1. PROFINET QoS not enabled. The Cisco IE3000 supports a dedicated PROFINET mode (per the Cisco IE3000 Software Configuration Guide - PROFINET) that maps the PROFINET multicast MAC range 01-0E-CF-00-00-00 to a high-priority CoS queue. Without it, RT frames compete with broadcast storms or Spanning-Tree BPDUs on the same egress port.
2. Store-and-forward latency bursts. Even a 200-500 ms latency spike will exceed the typical ET200 watchdog (3x update time) when the update time is configured < 100 ms. ICMP has a default Windows timeout of 1-4 s, so a 500 ms blip is invisible to ping.
3. IGMP / PROFINET multicast flooding. Without IGMP snooping configured for the PROFINET multicast MAC range, the switch floods multicast frames - PROFINET IO frames still arrive, but late and out of order, breaking the controller's AR.
4. Autonegotiate mismatch. PROFINET IO copper requires 100 Mbit/s full duplex. If a transient duplex mismatch occurs (one end forces 100/Full, the other negotiates 100/Half), late collisions and CRC errors appear on the PROFINET stream while ICMP still passes. Hard-set 100/Full on both ends.
5. Storm control / broadcast suppression. Storm-control set at low thresholds on PROFINET ports stalls RT frames during broadcast bursts.

4. Cisco IE3000 PROFINET Feature Enablement

The Cisco IE3000 supports a PROFINET conformance mode in IOS 12.2(55)SE and later. The required configuration is documented in the Cisco IE3000 Software Configuration Guide - PROFINET:

Verify with show profinet and show running-config | include profinet. If the profinet keyword is missing from running-config, the switch is treating PROFINET RT frames as best-effort traffic. This is the single most common cause of intermittent OB86 with Cisco IE3000 nodes.

5. Tuning Update Time and Watchdog in STEP 7 HW Config

Each ET200 device has its own PROFINET interface module (IM151-3 PN for ET200S, IM155-6 PN for ET200SP, IM151-3 PN HF for ET200S HF). Update time and watchdog are configured per device, not per channel. In SIMATIC Manager > HW Config, select the PROFINET IO device > Properties > PROFINET Interface > Update Time / Watchdog:

Set the update time to a fixed value (e.g. 64 ms or 128 ms) rather than leaving it on automatic. On a 1-2 km fibre run with a 3rd-party managed switch in the path, 64 ms is a reasonable starting point. Increase to 128 ms or 256 ms if the latency distribution is wider.

Watchdog formula:

T_watchdog = N x T_update,    N in [3 ... 192]

The standard Siemens ratio is 3, but for noisy lines or 3rd-party switches, 6-10 is conservative. Multiply the maximum observed ICMP round-trip time (e.g. 15 ms) by 6-10 to obtain the minimum acceptable watchdog. If max RTT is 15 ms and update time is 64 ms, configure the multiplier so that N x T_update >= 90 ms; N = 2 is too tight, N = 3 (192 ms) is the safe minimum. The field-proven fix from the operator's experience was to set the watchdog to roughly twice the average max ping latency.

6. PROFINET Real-Time Class Selection

Two real-time classes are available in PROFINET IO:

For a system reading up to 128 DI / 28 DO per node with no isochronous drive sync, RT Class 1 with a 32-128 ms update time is the correct choice. Forcing IRT on a Cisco IE3000 will cause failures - IRT support on IE3000 is limited and not recommended for new designs; in those cases use a Siemens SCALANCE XC-216 or equivalent PROFINET IRT-certified switch.

7. Network Topology, Physical Layer, and Latency Sources

At 1-2 km between sites the physical medium must be fibre. Validate each leg:

1. Fibre type. Single-mode 9/125 µm for runs > 2 km, multi-mode 50/125 µm (OM3) up to ~550 m at 100 Mbit/s. The Cisco IE3000 supports both with the appropriate SFP (GLC-LH-SM for single-mode, GLC-SX-MM for multi-mode).
2. Optical budget. PROFINET over fibre has effectively unlimited distance compared to copper; the limiting factor is the SFP optical budget (typically 8-15 dB). OTDR-test any link that has been added or moved recently.
3. Autonegotiate. Hard-code 100 Mbit/s Full Duplex on the ET200 PROFINET port and on the Cisco IE3000 port. Verify with show interface <if> status on the switch and via the ET200 web diagnostics page (browser to PROFINET device IP).
4. Storm control. Disable storm-control on PROFINET-dedicated ports, or raise the threshold above 5% broadcast / multicast. Even 1% suppression will stall a PROFINET frame burst.
5. Spanning Tree. RSTP reconvergence is sub-second but still exceeds the default PROFINET watchdog (3 ms at 1 ms update). On a ring topology, even a single link bounce triggers OB86 unless the watchdog is sized for at least 500 ms.
6. VLAN and IP subnet. Confirm every ET200 has a unique IP, the same subnet mask as the S7-300 PROFINET interface, and the same PROFINET device name (assigned via PRONETA or HW Config > Assign PROFINET device name).

The fact that 5 of 9 nodes show the issue points to a shared upstream segment rather than 5 individual device failures: same fibre run, same uplink switch, same VLAN configuration error, or same storm-control threshold. Compare the running-config of the failing 5 against the passing 4 to isolate the common factor.

8. Verification Steps and Long-Term Diagnostics

1. Read the S7-300 diagnostic buffer (online). Confirm OB86 events are station return (W#16#3901) preceded within ~1 s by station failure (W#16#3900). If only returns appear with no failure entry, suspect the controller-side AR timeout rather than a physical drop.
2. Read the ET200 diagnostic buffer. ET200S / ET200SP support RDREC / WRREC against the PROFINET interface module index 0. Poll with SFB52 (RDREC) from the controller or from an HMI. Record index 0x8028 (channel diagnostics) and 0x802A (module status) reveal which submodule reports the fault.
3. Capture a Wireshark trace on a SPAN port of the Cisco IE3000 for the affected node. Filter for pn_rt (PROFINET RT) and inspect: (a) frame bursts where multiple RT frames queue behind a single broadcast, (b) gaps > watchdog time between successive RTC1 frames, (c) PROFINET alarm frames (alarm type 0x0001 = process alarm, 0x0002 = diagnostic alarm).
4. Trend ping latency. Run ping -t <node IP> from the engineering station for 24-72 hours and record minimum, average, and max RTT. Use max RTT as the basis for the watchdog.
5. Verify Cisco IE3000 PROFINET mode with show profinet. The output must show PROFINET mode: enabled. If absent, run profinet in global configuration and reload the switch.
6. CPU diagnostic buffer write protection. In TIA Portal / STEP 7, under Online & Diagnostics > Diagnostic buffer, set the trigger to "OB86" specifically so the buffer is not overwritten by other events.

After applying the fix (QoS enable + extended watchdog), OB86 events should stop within one full PROFINET update cycle. If they persist, escalate to OTDR testing on the failing fibre legs and review RSTP topology-change logs on the Cisco switches.

9. Hardening Checklist

• Hard-code 100/Full on every ET200 PROFINET port and every Cisco IE3000 port; disable autonegotiate.
• Enable Cisco PROFINET conformance mode on every switch in the path.
• Move PROFINET traffic to a dedicated VLAN, separate from office / business traffic.
• Set PROFINET RT update time to a fixed 64-128 ms; raise watchdog to 3-6x observed max RTT.
• Configure IGMP snooping with explicit PROFINET multicast MAC allowance; do not flood multicast.
• Disable or raise storm-control thresholds on PROFINET ports.
• Replace IE3000 with SCALANCE XC-216 (or equivalent) if IRT or isochronous PROFIdrive is later required.
• Log OB86_FLT_ID, OB86_MDL_ADDR, OB86_Z_INFO into a circular DB and trend from WinCC or OPC.
• Document the assigned PROFINET device name, IP, and station number for each ET200 in a plant topology drawing.

10. Frequently Asked Questions