STEP 5 KY Constant and Profibus-DP Diagnostics on S5-95U

Overview

The SIMATIC S5 family (S5-95U, S5-100U, S5-115U, S5-135U, S5-155U) programs in STEP 5 using a small, fixed instruction set with explicit constant-form qualifiers. Two qualifiers appear constantly in legacy Profibus-DP (SINEC L2-DP) diagnostic blocks: KB (1-byte constant) and KY (2-byte packed constant), loaded with L and transferred to output/process words with T or to data words with T DW / T DR / T DL.

This reference decodes the instructions seen in real S5-95U and S5-135U CPU 928 diagnostic programs — specifically L KY 127, 0, L KY 127, 1, and the surrounding DB 253 MONITORING block — and explains the relationship to Profibus-DP broadcast/multicast address 127, the IM 308-B master interface, and ET200U slave diagnostics.

Prerequisites

• Working knowledge of STEP 5 STL (Statement List) — segments, accumulators 1 and 2, condition codes.
• Access to the appropriate S5 programming manual for the CPU family in use. The most cited references are:
  • S5-100U programming manual: 6ES5 998-0UB23
  • S5-115U programming manual: 6ES5 998-0UF23
  • S5-95U SINEC L2-DP interface manual: 6ES5 998-8MD21
• STEP 5 programming tool (PG 720/740/760/685/615U or PC with original STEP 5 V6.x or V7.x).
• Configured Profibus-DP master (IM 308-B, IM 308-C, or CP 5431) and at least one DP slave (ET200U, ET200B, ET200L, ET200M, or third-party).

STEP 5 Constant Qualifiers — Reference Table

STEP 5 constants always begin with K, followed by a format letter that defines how the subsequent value is interpreted. The table below covers the qualifiers that appear in STEP 5 STL documentation across the S5 CPU families.

Worked example — KY 127, 1: The first byte (127) occupies the low byte of the 16-bit accumulator word; the second byte (1) occupies the high byte. The hex representation is 0x017F, with 0x7F = 127 as the LSB. This is the typical Profibus-DP encoding for "address 127, identifier 1".

The KY Constant in Practice

A KY constant loads two absolute numbers simultaneously into a single 16-bit word. Both numbers must be in the range 0 to 255, which makes KY ideal for parameters that pair a small index with a small selector, such as:

• Profibus station number (0-127) plus diagnostic request code (0-7).
• CP channel number (0-255) plus sub-function code (0-255).
• Block number (0-255) plus offset (0-255).

The example program below shows the canonical "request a slave's diagnostic frame" sequence for an S5-95U used as a DP slave on a SINEC L2-DP network:

:C DB 253            
:L KB 48             
:T OY 255            
:L KY 127, 0         
:T OW 252            
:L OY 252            
:T DR 19             
:L OY 253            
:T DL 19             

Segment 2 of this block is interpreted as follows:

Segment 3 is structurally identical except that KY 127, 1 requests diagnostic codes 16-31 from the same station — 0 = "outline 0-15", 1 = "outline 16-31", and so on. This mirrors the request format described in the S5-95U SINEC L2-DP manual (6ES5 998-8MD21).

Why Station Address 127?

Profibus-DP reserves station address 127 for special addressing modes. The two cases documented in the S5-95U and S7 manuals are:

Because address 127 never receives a response, L KY 127, 0 in a diagnostic-request context is unusual — a normal slave-diagnostic request is addressed to the slave's own station number (3 to 125 according to the S5-95U manual; 0 to 126 according to the wider DP standard, with 126 reserved for "fail-safe" slaves in some configurations). The pattern in the user's listing is therefore one of two things:

1. A diagnostic broadcast that asks every slave simultaneously to expose its outline on input word 252 — the master then reads back responses one station at a time using individual poll telegrams.
2. A literal 127 written by the programmer as a placeholder while commissioning, intended to be replaced with the real station number once each station's address is known.

DP Slave Diagnostic Request Format (S5-95U)

From the S5-95U SINEC L2-DP manual, the diagnostic request sequence is:

:L KY (station number), (code)
:T PW 252

Where:

• station number: 3 to 125 (per 6ES5 998-8MD21). For broadcast/multicast, the source uses 127.
• code: 0 to 7, selecting which block of device-related diagnostics is to be returned.

The IM 308-B writes the requested diagnostic data into I/O word 252 ("diagnostic address"). The CPU then loads the result with L OY 252 / L OY 253 and stores it in the application DB (DB 253 in the example).

System Architecture Used in the Example

The user's hardware is a classic S5-135U station with central I/O and a Profibus-DP master interface, talking to ET200U remote I/O over SINEC L2-DP.

Reference topology (S5-135U / IM 308-B / ET200U)

Step-by-Step: Decoding and Rebuilding the Diagnostic Block

1. Identify the active DB. The first line of each segment (C DB 253) opens DB 253 so all subsequent T DR / T DL operations target data words in that block.
2. Identify the page selector. L KB 48 / T OY 255 writes 48 to the byte-level output process image at byte 255. On an S5-95U with integrated DP, byte 255 is the "page" or function index for the integrated L2 interface. The exact meaning depends on the CPU variant.
3. Build the diagnostic-request word. L KY 127, 0 packs (0, 127) into a single 16-bit value and writes it to OW 252, which is the input/output word used as the "diagnostic address" of the IM 308-B.
4. Read the response. The IM 308-B returns the slave's diagnostic frame in I/O word 252. The CPU pulls the low and high bytes separately with L OY 252 and L OY 253.
5. Store the result. T DR 19 overwrites the right (low) byte of DW 19; T DL 19 overwrites the left (high) byte. The next segment reuses the same pattern with a different request code to read the next 16 bits of diagnostic data.
6. Repeat per request code. Codes 0, 1, 2, … each retrieve 16 bits of the device-related diagnostic frame, so a complete read of a standard DP slave diagnostic frame requires 6-8 segments in the same DB.

STEP 5 Segments — Reference Block

A complete diagnostic-fetch block for an ET200U station typically looks like this. Replace the placeholder station number with the real address once the segment is verified.

FB 100
NAME : DIAG_FETCH
:C DB 253                   
:L KB 48                    
:T OY 255                   
:L KY 3, 0                  
:T OW 252                   
:L OY 252                   
:T DR 19                    
:L OY 253                   
:T DL 19                    
:L KY 3, 1                  
:T OW 252                   
:L OY 252                   
:T DR 20                    
:L OY 253                   
:T DL 20                    
:L KY 3, 2                  
:T OW 252                   
:L OY 252                   
:T DR 21                    
:L OY 253                   
:T DL 21                    
:BE

Diagnostic codes 0 through 7 cover:

Verification Procedure

1. Force a known fault. Disconnect one ET200U terminal block on a non-production station. The slave should pull its status byte to a non-zero value within one DP cycle.
2. Single-step the FB in PG online mode. Watch DR 19 in DB 253. With station 3, code 0, you should see the station status in the low byte of DW 19 within one PLC cycle of writing OW 252.
3. Check byte order. If DR 19 contains 0x0000 and the slave is known to be present, swap OY 252 and OY 253 in the read sequence — some IM 308-B firmware revisions return the high byte first.
4. Cross-check the SAP list. In COM PROFIBUS, open the master configuration and verify that the slave's diagnostic SAP (default 0x3C) is enabled. If it is not, no diagnostic frame will be returned to OW 252.

Common Pitfalls and Diagnostic Matrix

Related STEP 5 Constant Patterns

Other KY patterns seen in real S5 communications blocks:

Where to Read More

For the S5-95U Profibus interface and DP slave behavior, the canonical Siemens document is the S5-95U SINEC L2-DP manual (order number 6ES5 998-8MD21). For the S7 side of the same multicast behavior (which the legacy code is reusing) the Siemens Knowledge Base entry ID 20987711 covers FDL multicast via Profibus CPs. Older but still valid explanations of broadcast address 127 appear in the S5-95U manual and in the Siemens Knowledge Base entry 1091429. The full set of STEP 5 constant formats is in the S5-100U manual (6ES5 998-0UB23) and S5-115U manual (6ES5 998-0UF23). STEP 5 itself is documented in the S5 programming manual for the relevant CPU family.