SIMOCODE Profibus Bus Fault Diagnostics: SFC13 vs Cyclic Signal

Overview

When integrating Siemens SIMOCODE pro motor management devices on a PROFIBUS DP network, engineers must distinguish between two distinct fault signals that both indicate a problem with the field device:

• The bus fault bit inside the SIMOCODE cyclic I/O data, configured in HW Config / TIA Portal device configuration.
• The DP slave diagnostic frame retrieved acyclically with the SFC 13 (DPNRM_DG) system function block in STEP 7 / TIA Portal.

Both originate from the slave, but they report different things and have different latency, reliability, and applicability. Selecting the wrong one for an emergency stop chain, an alarm, or a maintenance page is a common source of misleading fault displays in the HMI. This article explains the underlying PROFIBUS mechanism, contrasts the two signals at the bit and frame level, and shows how to wire them into STEP 7 with verified behavior. Reference documentation is the SIMATIC S7-300/400 System and Standard Functions reference manual and the SIMOCODE pro PROFIBUS System Manual.

SIMOCODE Profibus Interface Architecture

SIMOCODE pro is the Siemens motor management system (3UF7 generation) that replaces classical overload relays and contactor-control wiring. The PROFIBUS-capable variants (SIMOCODE pro V DP, 3UF7010-1AU00-0; SIMOCODE pro S DP, 3UF7020-1AU01-0; SIMOCODE pro C DP, 3UF7000-1AU00-0) expose a class-1 PROFIBUS DP-V0/V1 slave on the RS-485 isolated front bus port.

The device implements the standard PROFIBUS DP slave state machine and supports the following communication services relevant to fault detection:

• Cyclic data exchange (MS0, DP-V0): 1 byte of consistent input, 2 bytes of consistent output in the default configuration; can be expanded up to 32 bytes input / 32 bytes output by adjusting the SIMOCODE pro parameter set in SIMOCODE ES (TIA Portal) or the legacy SIMOCODE pro parameterization tool.
• Acyclic read/write (MS1, DP-V1): Used by SIMOCODE ES for parameterization, online diagnostics, and firmware updates via data records in the range 0–255.
• Diagnostic telegram (MS0, DP-V0): Standard 6-byte diagnostic frame plus device-specific extension of up to 238 bytes, automatically transmitted by the slave on state change.
• Sync/Freeze (DP-V0): Supported but rarely used in motor control.

The PROFIBUS interface is galvanically isolated (test voltage 707 V DC for 1 minute per IEC 61131-2) and terminates the segment with a built-in 220 Ω resistor that can be switched in/out of circuit via the rotary switch on the device base unit.

Conceptual Difference: Bus Fault vs. Slave Diagnostics

A bus fault on PROFIBUS DP means the physical or data-link layer has failed. Typical causes are broken cable, missing or wrong termination, EMC injection, address conflict, master failure, repeater loss of power, or a slave whose transceiver has died. While a bus fault is active, the master cannot exchange user data with that slave and cannot read its diagnostic frame either: the DP-V0 master polls each configured slave, and if the slave does not respond within the slot time, the master sets a slave-local "station failure" flag and reports it through its own diagnostic resources.

By contrast, slave diagnostics are an application-level report generated by the still-functional slave firmware when it detects an internal anomaly: motor overload, phase failure, thermistor trip, ground fault, number of starts exceeded, blocked rotor, or a process-side warning. The slave pushes a 6-byte (or extended) DP diagnostic frame to the master, which the master stores in the slave's diagnostic buffer. The user code then pulls this frame with SFC 13 (DPNRM_DG) for parsing.

The two states are not equivalent and do not exclude each other:

• During a bus fault there is no communication, so SFC 13 returns RET_VAL = 0x8091 ("bus communication error") and the destination buffer is unchanged. Only the master's "slave failed" flag is updated, which propagates into the cyclic bus fault bit of other slaves if the segment is shared.
• During a slave diagnostic event (e.g., overload trip), PROFIBUS is healthy, cyclic data flows normally, and the diagnostic frame is queued for SFC 13 to read.

The Cyclic Bus Fault Bit in SIMOCODE Pro

The SIMOCODE pro cyclic input area always carries a "Status / Bus Fault" bit independent of the user-configured process data. The bit position depends on the configured telegram length, but in the default 1-byte input / 2-byte output telegram the layout is:

The Bus Fault (BF) bit in input byte 0 is set by the SIMOCODE firmware when the PROFIBUS state machine has not reached Data Exchange within T_trdy (typically 100 ms after power-up) or when the cyclic watchdog has expired. It is not a reflection of the master's view: SIMOCODE derives it from the local chip-level bus monitor, which makes the bit useful even if the PLC is in STOP and the segment is shared with other controllers on a Y-link.

Because the cyclic bus fault bit is part of the standard SIMOCODE cyclic profile, no extra configuration is needed; it is always present from firmware version E03 (3UF7010/3UF7020) onward. The bit is updated on every DP cycle, so the detection latency equals the configured PROFIBUS bus cycle time (1.5–10 ms in a typical plant).

SFC13 (DPNRM_DG) – Acyclic Slave Diagnostics Read

SFC 13 "DPNRM_DG" is the STEP 7 system function block that reads the most recent DP diagnostic frame from a slave. It is defined in IEC 61131-3 as part of the SIMATIC standard library and documented in the SIMATIC S7-300/400 System and Standard Functions reference manual (entry ID 44240604). The call interface is:

// SFC 13 call (English keyword form)
CALL "DPNRM_DG"
REQ    := TRUE                       // rising edge triggers read
LADDR  := W#16#0104                   // PROFIBUS diagnostic address of slave (HW Config)
RET_VAL := MW100                      // return value (0 = OK, see error table)
RECORD := P#M 200.0 BYTE 26           // destination ANY pointer (>= 6 bytes for std. diag, up to 244 for extended)
BUSY   := M110.0                      // TRUE while read is in progress

Key parameters:

• LADDR – diagnostic address (not the I/O address) of the DP slave, as assigned in HW Config. For a SIMOCODE pro at PROFIBUS address 4 the LADDR is typically W#16#0104 (decimal 260 = 256 + address). Mixing I/O address with diagnostic address is a common commissioning error and causes RET_VAL = 0x8090.
• RECORD – destination ANY pointer with byte length ≥ 6 (standard DP diagnostic) and ideally ≥ 26 to accommodate the SIMOCODE-specific extension. SFC 13 writes exactly the number of bytes present in the diagnostic buffer of the slave; it never truncates, but it does not return more than the buffer length.
• RET_VAL – 0 on success; otherwise one of the error codes listed below.
• BUSY – must be polled; the read takes 1–3 PROFIBUS cycles.

RET_VAL error codes for SFC 13 (per the Siemens standard reference):

SFC 13 is acyclic: it does not run on every OB1 scan, only when REQ has a rising edge. For SIMOCODE, a 500 ms poll from OB35 (cyclic interrupt) is sufficient; faster polling does not yield new data and steals bus bandwidth.

Technical Comparison: SFC13 vs. Cyclic Bus Fault

When to Use Each Method (Decision Matrix)

Use the cyclic bus fault bit for:

• Indication in the HMI/SCADA top-level status page ("Device not communicating").
• Automatic input to the alarm subsystem where only the binary "communicating / not communicating" state is needed.
• PLC logic that depends on data validity, e.g., gating setpoints to zero when bus fault is active.
• Code paths that must work while the master CPU is in STOP (e.g., transferring the signal to a Y-link partner's HMI).

Use SFC 13 (DPNRM_DG) for:

• Detailed diagnostic display in the HMI: which SIMOCODE event caused the trip (overload, phase failure, thermistor, ground fault, blocked rotor, asymmetry, number-of-starts limit, etc.).
• Centralized maintenance station: log the diagnostic frame with timestamp when the bus fault toggles.
• Cross-checking whether the cyclic bus fault bit is genuine or merely a transient retry failure.

For maximum coverage, use both: the cyclic bit drives the "device OK" indicator and the safety latch; SFC 13 enriches the operator message with the cause. The two signals are independent and complementary — using one does not make the other redundant.

STEP 7 / TIA Portal Implementation

Drop the SIMOCODE pro GSD file (Siemens file name SIMOCODE_0B11.GSD for pro V/S, SIEM8171.GSD for older releases; current rev. ~V2.5) into TIA Portal under Options → Manage Device Description Files. In the device configuration, place the SIMOCODE in the PROFIBUS subnet, set the station address, and accept the default 1-byte input / 2-byte output module. The cyclic bus fault bit is exposed at %IB<slot> in the PLC tag table.

For SFC 13, declare a tag array of at least 26 bytes in a global DB:

DATA_BLOCK "DB_Diag_SIMOCODE"
{ S7_Optimized_Access := 'FALSE' }
VERSION : 0.1
STRUCT
  StdDiag : ARRAY[0..5]  OF BYTE;   // bytes 0..5, standard DP-V0 diagnostic
  ExtDiag : ARRAY[0..19] OF BYTE;   // bytes 6..25, SIMOCODE-specific extension
END_STRUCT;
END_DATA_BLOCK

Call SFC 13 from OB1 (or OB35 if you want to throttle to 100 ms):

// LADDR = 256 + PROFIBUS address
// Example: address 4 -> LADDR = 260 (W#16#0104)
CALL "DPNRM_DG"
REQ    := "Diag_Trig"                       // 1-Hz pulse from clock memory
LADDR  := W#16#0104
RET_VAL := "Diag_RET"
RECORD := P#"DB_Diag_SIMOCODE".StdDiag
BUSY   := "Diag_Busy"
IF "Diag_Busy" = FALSE AND "Diag_RET" = 0 THEN
  // bytes 4..5 carry the standard DP diagnostic
  "Diag_StationFailure" := "DB_Diag_SIMOCODE".StdDiag[4].%X0;
  "Diag_ExtDiagPresent" := "DB_Diag_SIMOCODE".StdDiag[4].%X3;
  "Diag_PrmFault"       := "DB_Diag_SIMOCODE".StdDiag[5].%X0;
  // bytes 6..25 are SIMOCODE-specific; see next section
END_IF;

Diagnostic Data Record Layout

The standard DP-V0 diagnostic frame returned by SFC 13 is parsed per IEC 61158-6 / EN 50170. The first 6 bytes are fixed; bytes 7 onward are vendor-specific. For SIMOCODE pro the layout is:

Byte 4 bit 3 ("ext_diag") is the master telltale that further bytes contain a vendor extension. The SIMOCODE-specific bytes 6–25 then carry the detailed cause. Refer to the SIMOCODE pro PROFIBUS System Manual (entry ID 109750635) for the exact mapping in your firmware revision (the layout is stable from E03 firmware onward, but the bit positions for new events such as "Number of starts limit reached" were extended in E05).

Configuration Procedure

1. Open TIA Portal (V16 or later recommended for the latest SIMOCODE pro GSD). Open the device configuration of the S7-300/400/1500 CPU.
2. Open the PROFIBUS subnet and add SIMOCODE pro from the catalog. Assign the PROFIBUS address matching the rotary switch on the device (default 126; change to 3, 4, 5, … as required).
3. Insert the standard "SIMOCODE pro 1 Byte In / 2 Byte Out" module (or the larger 4-byte / 8-byte variant if your user data requires it). Confirm the cyclic I/O addresses.
4. Open the PLC tag table and create tags for the input byte and the bus fault bit. The bus fault bit is at %IX<slot>.1.
5. For SFC 13 diagnostics, note the diagnostic address shown in the device view under "PROFIBUS address → Diagnostic address" (default 256 + PROFIBUS address). This is the value to pass to SFC 13's LADDR input.
6. Add SFC 13 to the project (Libraries → Standard Library → System Function Blocks → SFC 13). Drop it into OB1 or a cyclic interrupt OB.
7. Create a global DB of at least 26 bytes to receive the diagnostic frame. Allocate the DB at a non-optimized access area (or with "Set in IDB" disabled) so it can be addressed by SFC 13.
8. Wire the REQ input to a clock-memory bit (e.g., M10.7 for 0.5 Hz) so the call rate is throttled to once per 2 s — this is sufficient for diagnostic refresh and keeps the PROFIBUS acyclic load below 1% on a 1.5 Mbit/s segment.
9. Download the project to the CPU and the SIMOCODE. Cycle power to the SIMOCODE so it re-parameterizes from the new GSD.
10. Open the SIMOCODE ES online view (PROFIBUS → Online → Assign PROFIBUS address if needed). Confirm that the device shows the green "Device OK" LED and the cyclic "Status" bit is 1.

Verification and Field Commissioning

After the project has been loaded, perform the following checks in order:

1. Healthy state check: With the motor stopped and SIMOCODE powered, the cyclic status bit (input byte 0, bit 0) should be 1 and the bus fault bit (bit 1) should be 0. The "DEVICE" LED on the SIMOCODE basic unit should be solid green, and the "BUS" LED should be off.
2. Offline simulation: In PLCSIM (TIA Portal) or the S7-PLCSIM advanced, force the PROFIBUS diagnostic to simulate a slave failure and confirm that the cyclic bus fault bit goes high within one OB1 cycle, and that SFC 13 returns RET_VAL = 0x80B0 with BUSY = 0.
3. Live test – pull the bus connector: Disconnect the PROFIBUS connector at the SIMOCODE end. The "BUS" LED should flash red, the cyclic bus fault bit should go high within 200 ms, and SFC 13 should return RET_VAL = 0x8091 within one poll cycle.
4. Live test – force a trip: Cause a real overload or use the SIMOCODE ES "Test → Trip" function. The cyclic status bit should go to 0 (fault), the bus fault bit should remain 0 (PROFIBUS is healthy), and SFC 13 should return a non-zero extended diagnostic with the overload flag set in byte 7.
5. Diagnostic latching: Confirm that the diagnostic is latched in the master even after the SIMOCODE returns to healthy state. The standard DP-V0 diagnostic is buffered per slave until read; once SFC 13 reads it, the next read may return zeros until the next event. Implement a latching block in the PLC that captures the diagnostic on the rising edge of "ext_diag" so the HMI does not show a blank screen after the event is acknowledged.
6. Bandwidth check: With all slaves polling SFC 13 at 1 Hz, observe the PROFIBUS utilization via the diagnostic counters of the CP 443-5 Extended or CM 1542-5. Utilization should remain below 50% on a 1.5 Mbit/s segment; if it is higher, throttle the poll to 0.5 Hz or 0.2 Hz.
7. Cold start test: Power-cycle the SIMOCODE. The bus fault bit should be high during the boot phase (T_trdy = 100 ms typical), then clear once the DP state machine reaches Data Exchange.

Troubleshooting Matrix

FAQ