Troubleshooting Siemens FB126 PNIODiag Distance Errors

Problem Overview

The Siemens FB126 PNIODiag function block is supplied with STEP 7 V5.x as the official interface for reading diagnostic data from PROFIBUS Diagnostic Repeaters (DR). In several field deployments — particularly those with an S7-300 CPU fronting an Ethernet CP for HMI traffic — the block returns corrupted distance telemetry. The classic symptom: WinCC Flexible displays a faulty station at 32388 dm (3,238.8 m) when the actual physical distance is on the order of 1.5 m. The status word simultaneously reports "The overflow bit is set in the norm diagnostics! The data is incomplete."

This article documents the failure modes of FB126 on a 315-2 DP / CP 343-1 Lean configuration, isolates the architectural reasons the block fails, and presents two proven alternatives: the SFC51 "Read System Status" approach and the lower-level FB99 FB_READ_DR_CTRL from the Siemens diagnostic repeater library.

Affected Hardware and Software Versions

Root Cause Analysis

Three independent root causes converge in this configuration:

1. Architectural legacy of FB126. FB126 was originally written two decades ago and patched repeatedly as Siemens added features. Internal scratch buffers, pointer arithmetic, and asynchronous OB1 calls share state with the rest of the user's cycle. Under any unusual cycle load — for example when an Ethernet CP is consuming OB1 time slices for HMI keep-alive — the block's internal handshake state can de-synchronize from the actual diagnostic repeater polling cycle. The overflow bit in the normalized diagnostics is FB126's own error flag, not the DR's.
2. Distance telemetry format mismatch. PROFIBUS DR distance frames are returned in decimeters (dm), not meters. A value of 32388 in the FB126 distance word corresponds to 3238.8 m, which exceeds the maximum PROFIBUS segment length of 1,200 m and is therefore a sentinel for "invalid / not yet measured" or "overflow". When FB126 fails to capture a valid topology entry, it leaks the previous-cycle or default-max value into the output word. WinCC Flexible multiplies by 0.1 m for display but does not clamp; the result is the absurd distance observed on screen.
3. Multi-segment DR chaining. Two DRs in series require FB126 to merge two topology lists into one consolidated view. The block was not designed for that case in the original 6GK1500-0AA00 generation and shows inconsistent behavior on chained segments. The diagnostic repeater topology table in STEP 7 is correct because that view is read directly from the DR's diagnostic buffer; FB126 is doing its own re-assembly on top and is where the corruption enters.

FB126 PNIODiag Architecture and Interface

FB126 lives in the standard STEP 7 library under PROFIBUS DP / Diagnostic Repeater / FB126 PNIODiag. The default instance data block is DB126. Per the official Siemens documentation (FB126 PNIODiag manual, entry ID 98278878), DB126 holds:

The overflow bit is bit M7 of STATUS (value 16#0080) and is set whenever FB126's internal normalization exceeds the configured segment length. Once set, the entire DIAG array must be considered invalid for that cycle. WinCC Flexible cannot distinguish this case from a valid 32388-dm reading because the tag it polls is just the raw WORD value.

Confirming the Fault in OB1 / VAT

Before replacing FB126, confirm the overflow bit in a VAT table:

1. Open the S7 project online with the test bench CPU.
2. Insert a VAT and monitor DB126.STATUS, DB126.ERROR, and DB126.DIAG[1].DISTANCE.
3. Force a topology refresh: DB126.REQ edge from FALSE to TRUE on a one-shot.
4. Observe: if STATUS bit 7 toggles to 1 and DISTANCE jumps to 32388, FB126 is the source. If STATUS remains 0 but the value is still wrong, the corruption is downstream in the WinCC tag pointer.

Solution Path A — Replace FB126 with SFC51 "Read System Status"

SFC51 is a standard system function available on every S7-300 / S7-400 CPU. It reads CPU-internal system status lists (SSLs) without the buffer-merge logic that breaks FB126. The SSL IDs relevant to PROFIBUS DR diagnostics are listed below. See the Siemens entry 19951051 — Reading out system status lists with SFC51.

Sample call in STL

// Call SFC51 to read DR distance for PROFIBUS address 33 (DR #1)
CALL  SFC51   // READ_SSL
     REQ      :=TRUE                       // trigger
     SSL_ID   :=W#16#00B3                  // DR diagnostic record
     INDEX    :=33                         // DR PROFIBUS address
     RET_VAL  :=MW100                      // return code (0 = OK)
     BUSY     :=M101                       // 1 while read in progress
     SSL_RECORD:=P#DB120.DBX0.0 BYTE 32    // target area, 32 bytes

// After RET_VAL = 0, parse bytes 6..7 of SSL_RECORD as distance in dm
L     DB120.DBW6                          // distance word, big-endian
T     MW102                               // hand off to WinCC tag

Parameter checklist

• REQ must be a rising edge; SFC51 ignores level-triggered calls.
• SSL_RECORD must be at least 32 bytes (W#16#00B3 returns up to 26 bytes of DR payload plus 6 bytes of header).
• RET_VAL = 0 means success. 80A1 means SSL_ID/INDEX combination invalid for this CPU firmware.
• Stagger calls — issue one SFC51 call per OB1 scan to a single DR; otherwise BUSY collisions corrupt the buffer.

Solution Path B — Use FB99 FB_READ_DR_CTRL

The Siemens diagnostic repeater library ships a lower-level block, FB99 FB_READ_DR_CTRL, that talks directly to the DR via DPV1 read/write services without FB126's normalization layer. It is the block recommended by Siemens support when FB126 misbehaves on chained DRs or on CPUs with an Ethernet CP front-end. Import the library from Options → Install SIMATIC Bibliothek → Diagnostic Repeater.

FB99 call template

// FB99 instance DB99, called in OB1 with edge-triggered REQ
CALL  FB99, DB99
     REQ      :=M0.0                       // rising edge
     DR_ADDR  :=33                         // DR PROFIBUS address
     MODE     :=1                          // 1 = read topology
     RET_VAL  :=MW110
     BUSY     :=M111
     ERROR    :=M112
     STATUS   :=MW113
     TOPO_LEN :=24                         // expected topology length
     TOPO_PTR :=P#DB99.DBX20.0 BYTE 24     // topology record target

// Distance for station N is at TOPO_PTR + (N*8) + 6, in decimeters

Why FB99 works where FB126 does not

• Direct DPV1 acyclic read against the DR — no intermediate normalization step.
• Single-DR scope: each call addresses one DR explicitly, removing the chained-segment ambiguity.
• Returns native distance in dm; the conversion to meters is the integrator's responsibility, avoiding the silent sentinel leak that FB126 suffers.

Distance Conversion and Sentinel Handling

Both SFC51 and FB99 return distance in decimeters (dm). The PROFIBUS DR reserves the maximum 16-bit value (65535) for "not measured / overflow". Any value above the configured segment length (typically 1200 m = 12000 dm) is a sentinel, not a measurement. Implement this clamp in the WinCC Flexible tag or in a CFC block before display:

// In S7 ST: clamp distance before exposing to WinCC
L     MW102                              // raw distance in dm
L     12000                              // 1200 m segment cap
>I                                       // greater than?
JC    OVER                               // if yes, route to sentinel
T     MW104                              // else expose valid value
SPA    END
OVER: L     0
T     MW104                              // expose 0 = "no data"
END:  NOP   0

On the WinCC Flexible side, use a tag of type UINT and a scaling factor of 0.1. Add a value-range check: any reading > 1200 m or equal to the previous cycle's value for >10 cycles should be flagged as stale in the HMI faceplate.

WinCC Flexible Integration

1. Define the WinCC connection to the CP 343-1 Lean via Ethernet S7 (port 102). Use a separate connection from the programming connection to avoid priority conflicts with FB126/FB99 polling.
2. Create tags: DR1_Distance (UINT, address MW104), DR1_Status (WORD, address MW113), DR1_Error (BOOL, address M112.0).
3. In the visualization, use an IO field with a scaling factor 0.1 and a "unit" field of "m". Add an indicator lamp tied to DR1_Status bit 7 (overflow).
4. Poll the tag with a 500 ms update cycle; longer cycles (1–2 s) reduce CPU load but delay fault display.

Verification Procedure

1. Disconnect one PROFIBUS station physically and observe: DR1_Distance for the disconnected station should change from a valid value to 0 (sentinel) within 2 s; DR1_Status bit 7 should pulse.
2. Reconnect and confirm the value restores within one DR polling cycle (default 2 s for the 6GK1500-0AA00).
3. Power-cycle the second DR; topology should rebuild automatically; FB99 should report BUSY briefly, then DONE with STATUS = 0.
4. Run STEP 7 online → PLC → PROFIBUS → Diagnose Repeater and cross-check every distance value the HMI shows against the values in the topology table. They must match exactly.
5. Force a CPU STOP/RUN transition and verify FB99 restarts cleanly without leaving BUSY latched.

Troubleshooting Matrix

Performance and Cycle-Time Notes

A single SFC51 call with a 32-byte record takes 8–15 ms on an S7-315-2 DP at default OB1 priority. With two DRs polled every 500 ms, expect ~30 ms/s additional OB1 load, well within budget for a 150 ms minimum cycle time. FB99 is lighter (3–6 ms per call) because it skips the SSL machinery. Avoid polling both DRs in the same OB1 sweep — stagger by 250 ms to keep return-code interleaving clean.

Migration Checklist from FB126 to FB99

• Export the existing DB126 symbol table from the S7 project before deleting FB126.
• Install the Diagnostic Repeater library from the STEP 7 DVD under ...\Siemens\Automation\S7\Lib.
• Drop FB99 into OB1 with a new DB99 instance.
• Re-map every WinCC Flexible tag from DB126 to DB99 offsets. Confirm the new offsets match the FB99 documentation for entry ID 98278878.
• Run a parallel test for at least one full shift: WinCC reads both DB126 (frozen) and DB99 (live) and displays side-by-side distance and overflow status.
• Once parity is confirmed, delete FB126/DB126 and rebuild the WinCC tag list against DB99 only.

FAQ