Siemens Industry Online Support
Siemens AG
Entry type: FAQ Entry ID: 2190197, Entry date: 08/21/2012

How do you read out the diagnosis data of a PROFIBUS DP slave with the SFC13 "DPNRM_DG" and how do you evaluate the data in the user program?

  • Entry
  • Associated product(s)

JEach DP slave has slave diagnostic data that is structured in compliance with EN 50 170 Volume 2, PROFIBUS. You use the system function SFC13 "DPNRM_DG" to read the diagnostics data of a DP slave in the form defined by EN 50 170 Volume 2, PROFIBUS.

The following table shows the structure of the slave diagnostics data.

Byte Description
0 Station status 1
1 Station status 2
2 Station status 3
3 Master station number
4 Manufacturer ID (high byte)
5 Manufacturer ID (low byte)
6 ... More slave-specific diagnostics
Table 01

The DP slave manual contains detailed information about the structure of the slave diagnostics data.

If a PROFIBUS DP slave that supports diagnostics detects a change in its diagnostics status, it sends a diagnostics alarm request to the CPU:

  • There is a fault or a component must be serviced or both (incoming event)
  • There is no longer a fault and no component must be serviced anymore (outgoing event)

The operating system then calls OB82. In its local tags the OB82 has the logical basic address and four bytes of diagnostics information of the DP slave that sent the diagnostics request.

In the sample program below the diagnostics data of an ET 200S is read out and evaluated.

Description of sample program

System function SFC13 "DPNRM_DG" is called in OB1 to read out the diagnostics data of the ET 200S..

The table below shows the inputs of SFC13 "DPNRM_DG".

Input Data type Description
REQ BOOL REQ=1: Request to read
LADDR WORD Configured diagnostics address of the DP slave (logical basic address)
Table 02

The table below shows the outputs of SFC13 "DPNRM_DG".

Output Data type Description
RET_VAL INT If an fault occurs during processing of the function, the return value includes the relevant error code. In no fault occurs, in RET_VAL is the length of the data actually transferred.
RECORD ANY Target area for the diagnostics data read. Only the BYTE data type is permissible. The minimum length of the data record to be read or the target area is 6. The maximum length of the data record to be read is 240.
BUSY BOOL BUSY=1: Read job has not yet finished.
Table 03

The reading procedure is started when the REQ input has the value 1 when SFC13 "DPNRM_DG" is called. The REQ input of SFC13 "DPNRM_DG" has the value 1 when OB82 is called.
At the RECORD input of SFC13 "DPNRM_DG" you specify the target area in which the diagnostics data read is to be stored after data transfer has been completed successfully. In this example the diagnostics data is stored in data block DB82.
When the reading procedure is completed, the REQ once again has the value 0 to enable a new reading procedure to be started.

Fig. 01

If the ET 200S sends a diagnostics request, the REQ input of SFC13 "DPNRM_DG" has the value 1. When the SFC13 "DPNRM_DG" is called in OB1, the REQ input now has the value 1 so that the reading procedure is started.
The logical basic address of the ET 200S is in then stored in the local tags of the OB82. In OB82 you assign the logical basic address of the ET 200S to the LADDR input of the SFC13 "DPNRM_DG".

Fig. 02

Evaluation of the diagnostics data in the user program
The diagnostics data read out with SFC13 "DPNRM_DG" and stored in DB82 is evaluated in OB1.

In this example the ET 200S consists of the modules below:

  • Module 1: Power module
  • Module 2: Digital output module (DO)
  • Module 3: Digital input module (DI)

In the user program, evaluation of the diagnostics produces the statuses below for each of the modules mentioned above.

  • Module is OK
  • Module fault
  • Incorrect module 
  • No module slotted

The download includes the "Diagnose.zip" project.
Copy the "S7_Project.zip" file into a separate directory and then start the file with a double-click. You can then use STEP 7 to open and process the extracted project.

Diagnose.zip ( 10710 KB )

Additional Information
Detailed information about system function SFC13 "DPNRM_DG" and OB82 is available in the manual "System and Standard Functions for S7-300/400 Volume 1 and Volume 2" in Entry ID 44240604.
More information on the structure of the slave diagnostics data is available in the DP slave manual, for example in the manual of the interface module of the ET 200S in Entry ID 25548014.

Security information
In order to protect technical infrastructures, systems, machines and networks against cyber threats, it is necessary to implement – and continuously maintain – a holistic, state-of-the-art IT security concept. Siemens’ products and solutions constitute one element of such a concept. For more information about cyber security, please visit