Siemens S7 RTM SFC2/3/4/101 Limits and Report System Error Setup

Overview

The Siemens S7-300 and S7-400 families expose operating-hour counters as Runtime Meters (RTM). The standard SFCs that drive these counters are SFC 2 SET_RTM, SFC 3 CTRL_RTM, and SFC 4 READ_RTM. A fourth block, SFC 101 RTM_USAGE, is reserved for CPUs that implement a 32-bit RTC and returns the count of used/available RTM channels. CP (Communication Processor) faults, on the other hand, are not reported through the RTM system; they are exposed through diagnostic interrupts and the Report System Error (RSE) wizard, which formats them for ProTool, WinCC flexible, and TIA Portal HMIs.

This reference covers three problem domains that are frequently mixed in field service tickets:

1. Why SFC 2/3/4 appears to stop responding after seven runtime meters are written.
2. Why SFC 101 compiles on one CPU and is rejected on another.
3. How to read CP fault data and surface it on a Siemens HMI without writing a custom diagnostic FB.

RTM Architecture in S7 CPUs

Each S7 CPU reserves a non-retentive word (16-bit RTC) or double-word (32-bit RTC) per runtime meter. The hardware stores the meter value in the system memory area of the CPU; the user program can only access it indirectly through the SFC interface. The RTC oscillator keeps the meter running even when the PLC is in STOP, so total operating hours are preserved across power cycles.

Key architectural constraints enforced by the firmware:

• Channel count: Most S7-300 CPUs expose 8 RTM channels (indices 0..7). Some low-end CPUs expose 4, and a few expose only 1. The count is a CPU property, not a project property.
• Bit width: 16-bit RTC CPUs hold each meter as 16 bits; 32-bit RTC CPUs hold it as 32 bits.
• Granularity: The least significant bit represents 1 hour. Sub-hour timing must be done in the application with a cyclic interrupt OB (e.g., OB35 at 1 s) and a software counter.
• Retentivity: The meter value itself is retained; the RTM instance data block is not. Always re-trigger SFC 2 on cold restart.

Maximum RTM Count per CPU Family

*S7-1200 and S7-1500 do not expose the legacy SFC2/3/4/101 interface; the equivalent is the RTM instruction in the TIA Portal instruction list and the SysHourMeter tag in the system diagnostics.

SFC 2 SET_RTM

Set the runtime meter at index 0..7 (or 0..15 on S7-400) to a defined hour count. Use this to align multiple meters after a CPU replacement or to seed a maintenance counter.

Call signature (SCL):

IF "FirstScan" THEN
  "FirstScan" := FALSE;
  RET_VAL := SET_RTM(
    NR       := 0,         // RTM index 0..7
    HOURS    := 0,         // initial hours
    RET_VAL  := RET_VAL);  // error code
END_IF;

RET_VAL error codes (subset):

SFC 3 CTRL_RTM

Start or stop the meter without changing the stored hours.

Call signature (ST):

// Stop RTM 0 when maintenance is in progress
IF "bMaintenanceActive" THEN
  RET_VAL := CTRL_RTM(NR := 0, MODE := 0, RET_VAL := RET_VAL);
  // MODE 0 = stop, 1 = start, 2 = set+start
ELSE
  RET_VAL := CTRL_RTM(NR := 0, MODE := 1, RET_VAL := RET_VAL);
END_IF;

MODE values: 0 = stop, 1 = start, 2 = set to HOURS and start. RET_VAL codes are identical to SFC 2.

SFC 4 READ_RTM

Read the current hour count plus a STATUS bitfield that reports the run state. STATUS is a WORD with the layout shown below.

RET_VAL := READ_RTM(
  NR      := 0,
  RET_VAL := RET_VAL,
  HOURS   := "rtHours",
  STATUS  := "rtStatus");

STATUS bitfield:

SFC 101 RTM_USAGE (32-bit RTC only)

SFC 101 is implemented only on CPUs whose RTC is 32 bits wide. On a 16-bit RTC CPU the call returns W#16#8081 (RTM does not exist) and the output structure is left untouched. The block returns the number of RTMs that have been started, and the number of RTMs available on the CPU.

RET_VAL := RTM_USAGE(
  RET_VAL := RET_VAL,
  USAGE   := "rtUsage",   // INT, number of active meters
  MAX_USG := "rtMax");    // INT, max meters on this CPU

Field-proven note: Do not treat MAX_USG as a project constant. It changes when the CPU is replaced by a smaller variant during service, which is one of the most common causes of the "I can only see 7 meters" symptom. Always read MAX_USG at startup and store it in a global tag.

Why You See Only 7 Working RTMs

The "only 7" symptom is almost always a mix of two conditions:

1. The CPU has 8 RTM slots (indices 0..7). The user program is writing to indices 1..7 and reading index 0, so the maximum is 7 visible meters.
2. One RTM was started by the project (e.g., a default from a copied block) and the SFC 2 call overwrites it, but the user expects it to be additive.

To verify the actual upper bound, call SFC 101 on a 32-bit RTC CPU, or read the system data word SD 11 in the CPU's system data (STEP 7 HW Config → CPU Properties → Diagnostics/Clock) where the firmware exposes the installed RTC width.

16-bit vs 32-bit RTC Differences

Report System Error (RSE) for CP Faults

CP faults (CP 340, CP 341, CP 343-1, CP 443-1, etc.) are signalled to the CPU as diagnostic interrupts. The CPU then triggers the corresponding error OB. Report System Error is a STEP 7 / TIA Portal wizard that generates a set of standardized FBs and a text library that translate the raw SF (system fault) data into human-readable messages consumable by ProTool, WinCC flexible, and TIA Portal WinCC.

Hardware Configuration Path (STEP 7 V5.5)

1. Open HW Config and select the CPU.
2. Open the menu Options → Report System Error.
3. Choose the supported OBs: OB 82 (diagnostic interrupt), OB 83 (insert/remove), OB 84 (CPU fault), OB 85 (priority class fault), OB 86 (rack/CP failure), OB 87 (communication fault), OB 121 (programming error), OB 122 (I/O access error).
4. Click Generate. STEP 7 creates FB 49 (background), the SFB 100 / FB 126 diagnostic instance, and a DB 126 error text DB.
5. Compile and download the hardware and the generated blocks.

Hardware Configuration Path (TIA Portal V13+)

1. Open the device view of the CPU.
2. Right-click the CPU → Properties → Report System Error.
3. Enable Report System Error, select the error OBs to monitor, and confirm. TIA Portal generates FB 1040 (or RSE_FB on newer versions) and an associated instance DB.
4. Download hardware and software to the CPU.

Reading the CP Fault and Routing It to the HMI

Once RSE is generated, two data paths are available:

1. Diagnostic buffer: Every CP fault produces an entry in the CPU diagnostic buffer (accessible via Online → Accessible Nodes → Module Information in STEP 7, or via RDSYSST instruction in TIA). The text library generated by RSE turns the SZL ID 0x0131 / 0x0132 entries into readable strings.
2. Acknowledgement tag: RSE provides a single Boolean tag (e.g., RSE_CP1_Fault) per monitored module. The HMI displays the tag's status, and the operator can read the full text from the WinCC alarm log.

Programmatic Read via SFC 51 RDSYSST

If you need a custom HMI screen rather than the WinCC alarm view, read the partial system list yourself:

// Read SSL 0x0131 (diagnostic buffer, oldest entry) in OB 82
RET_VAL := RDSYSST(
  REQ     := TRUE,
  SSL_ID  := W#16#0131,
  INDEX   := 1,
  RET_VAL := RET_VAL,
  BUSY    := busy,
  SSL_RECORD := "diagBuffer",   // 34-byte record
  DR      := dr);

The 34-byte record contains the event ID, the affected slot, the channel, and the diagnostic data. Parse the first two DWORDS to derive event class (W#16#01 = standard, W#16#02 = CPU fault, W#16#05 = communication) and then surface the string to the HMI over an OP-readable DB.

HMI Integration

ProTool / ProAgent

1. Enable ProAgent in the ProTool project options.
2. Insert a System Diagnostics screen; ProAgent populates it from the text library generated by RSE.
3. Assign a single tag to the HMI polling address for the CP diagnostic bit.

WinCC flexible

1. Open the HMI tags and confirm the System Diagnostics area pointer is enabled (default on most Siemens panels).
2. Configure alarm routing: Alarms → Settings → System Events → enable System Error.
3. Insert the System Diagnostics View control on a screen; WinCC flexible renders the CP fault and the slot number automatically.

TIA Portal WinCC

1. In the HMI project, set the HMI connection to the S7 CPU.
2. Add a System Diagnostics screen from the Controls palette.
3. Compile and download. The control binds itself to the diagnostic buffer and to the RSE-generated tags without further configuration.

Alternative Timing Without RTM

When a project exceeds the available RTM channels, or runs on an S7-1200/1500 that does not expose the SFC interface, fall back to a software integrator. The integral of a constant 1 over a known cyclic interval equals the elapsed time:

// In OB35 (1 s cyclic interrupt)
IF "bEnable" THEN
  "swSeconds" := "swSeconds" + 1;
  IF "swSeconds" >= 3600 THEN
    "swSeconds" := 0;
    "swHours"   := "swHours" + 1;
  END_IF;
END_IF;

Store swHours in a retentive DB so the value survives STOP/RUN and power cycles. For sub-second precision, replace the implicit 1 s with the configured OB35 period and divide the increment by it.

Verification Checklist

1. Open Online → Accessible Nodes → Module Information → Diagnostic Buffer and confirm that a CP 1 Fault Incoming event is recorded when the CP is unplugged.
2. In OB 82, set a breakpoint on the first line and verify that OB82_MDL_ADDR matches the CP's diagnostic address (default for CP 343-1: 2047).
3. On the HMI, open the System Diagnostics view; the CP slot and the standard text "CP 343-1 (1) communication failure" should appear within one polling cycle.
4. From the HMI, acknowledge the fault and confirm that the corresponding bit in DB 126 (STEP 7) or the RSE instance DB (TIA) clears.

Troubleshooting Matrix