CM1242-5 Disables HMI on PROFIBUS: Token Conflict Troubleshooting

1. Problem Overview

A PROFIBUS DP segment headed by a SIMATIC S7-416-3 DP (master, address 2) loses its OP170B HMI (master, address 1) the moment a third-party device equipped with a Siemens CM 1242-5 communications module (slave, address 99) is brought online. Tags on the HMI collapse to ##### and the operator panel stops refreshing the values read from the master's DB49. Pulling the new device off the bus restores normal HMI behavior immediately.

The fault is not triggered by a defective CM 1242-5: the same CM 1242-5 module has been running for months on three other S7-400 master systems that include their own HMIs. The fault is also not triggered by a bad cable: a PROFIBUS tester confirms signal levels are within the RS-485 mask and both nodes (1 and 99) are present on the wire. The fault is triggered by an incorrect PROFIBUS token passing situation on the segment.

2. Affected Components and Configuration

Master process image is set to the maximum 1600 bytes for inputs and 1600 bytes for outputs, well above the 64-byte payload of the new device, so the I/O size is not the limiting factor.

3. PROFIBUS Token Passing Background

On a multi-master PROFIBUS DP segment, only DP Master Class 1 (DPM1) and DP Master Class 2 (DPM2) stations participate in the token ring. The active master that holds the token has the right to poll its assigned slaves; the token is then passed in ascending address order to the next active master, wrapping from the highest address back to address 0 (the passive station). Slaves never emit token frames.

An HMI such as the OP170B running WinCC flexible is a typical DPM2 on PROFIBUS: it never owns slaves but exchanges acyclic read/write services with the S7-416. A device that has been configured in STEP 7 as a DP slave must not be visible on the wire as an active master. If it is, the token passing list built by the active masters will include a "phantom" master and the gap update (GAP) mechanism will time out when the station that owns the GAP list does not receive an answer from the phantom master at the expected slot.

4. Root Cause Analysis

From the discussion trace, three independent observations converge on a single root cause:

1. OP170B disappears from the segment the instant node 99 starts to cycle. Bus diagnostics (PROFIBUS tester in monitor mode) confirm node 1 vanishes from the live device list while nodes 2 and 99 remain.
2. Three active masters are seen on the wire: the S7-416 (address 2), the OP170B (address 1) and the S7-300 with CP 342-5. The CP 342-5 was configured as a slave in HW Config on the S7-300, but is transmitting token request / token pass frames, which is a slave-config violation.
3. The third-party vendor left the CM 1242-5 master assignment as "undefined master". The slave therefore accepts any active master that talks to it, including the rogue CP 342-5.

Combining the three: the S7-300 + CP 342-5 behaves as a stray master. When the new device at address 99 enters the bus, the token ring expands to a three-master ring; the OP170B, which is at the lowest address and the slowest DPM2, loses its gap-update window and is reported offline by the S7-416. The HMI tags fall back to ##### because the OPC-style or S7 connection to DB49 breaks at the cyclic layer.

The other three plants are unaffected because they do not have an S7-300 with a mis-configured CP 342-5 on the same segment.

5. CM 1242-5 Technical Reference

The CM 1242-5 (Siemens article number 6GK7242-5DX30-0XE0) is a communications module that turns an S7-1200 CPU into a PROFIBUS DP slave. Key electrical and protocol parameters for the diagnostics in this article:

The fact that the new device uses the maximum 64/64 byte slot and that the master's process image is sized to 1600 bytes confirms that the slot assignment itself is not the issue. The remaining variable is master assignment.

6. Step-by-Step Diagnostic Procedure

1. Capture a passive bus trace with a PROFIBUS class-2 analyzer (e.g. Softing PROFIbus Diagnostics, Indu-Sol ServiceTool, Siemens BT 200, or any diagnostic tool that decodes SD1/SD2/SD3 telegrams and lists the live device table). Record the trace for at least 30 s with node 99 offline and again for 30 s with node 99 online.
2. Diff the two live device lists. Expected: identical lists, only addresses 1, 2 and 99 should be active. If node 1 disappears only after node 99 enters, the problem is bus arbitration, not a broken cable.
3. Decode the token sequence. The analyzer should show the token walking in the order 1 → 2 → next active master → 1. Insert the new device and re-check. If the CP 342-5 appears as a master in the token ring, the CP 342-5 has been mis-configured at the S7-300 project level.
4. Verify the CP 342-5 operating mode. Open the S7-300 project in STEP 7, locate the CP 342-5, double-click the DP slave symbol, and confirm the operating mode is set to DP Slave (FC FC1 / FC2 in the S7-300 program must be loaded; AG_SEND / AG_RECV for FDL). If the mode field shows DP Master or No DP mode, the CP 342-5 will appear as an active master regardless of the slave wiring in HW Config.
5. Verify the CM 1242-5 master assignment. On the S7-1200 side, open TIA Portal, go to Devices & Networks > CM 1242-5 > Properties > Operating mode, and change the Master field from "undefined master" to the specific S7-416 master (DPM1 class 1, station address 2). The S7-300 is then no longer accepted as a master of this slave.
6. Check bus termination and signal levels. A PROFIBUS segment must be terminated at both physical ends with 220 Ω between the two data lines and 390 Ω from each line to the reference ground (the 9-pin D-sub "terminator on" switch on PROFIBUS connectors and on the CM 1242-5 activates this network). Measure the A-B differential voltage on every segment; a healthy idle level is approximately 1.0 V to 1.2 V (logical "1") with a mark space ratio between 40 % and 60 %.
7. Count devices against the segment budget. With 40 slaves plus the masters on a single segment, the repeater rule applies: a maximum of 32 stations per segment and a maximum of 126 stations total on the bus when repeaters are used. If you are above 32, the segment must be split with a PROFIBUS repeater (e.g. 6GK1500-0AA10) and the new device should be placed on a fresh segment.
8. Eliminate the S7-300 as a sanity check. With the plant's permission, pull the S7-300 / CP 342-5 connector and re-power the segment. If the OP170B and the CM 1242-5 then coexist, the CP 342-5 is confirmed as the source of the rogue master.

7. Solution

Apply the following actions in order. They are independent and can be applied one at a time to confirm the diagnosis without a plant shutdown.

7.1 Constrain the CM 1242-5 master assignment (primary fix)

On the S7-1200 project of the new device, change the CM 1242-5 "Master" parameter from undefined master to a specific DPM1. The configuration path in TIA Portal is:

1. Project tree > [CPU 121x] > Properties > Communication interfaces > CM 1242-5
2. Switch to the Operating mode tab
3. Set Master to the actual DPM1 (the S7-416 at address 2)
4. Compile and download the S7-1200 project, then power-cycle the CM 1242-5

Result: the CM 1242-5 only accepts the S7-416 as its master and rejects any token frame from the CP 342-5. The token ring is now a clean two-master ring (S7-416 + OP170B).

7.2 Fix the CP 342-5 operating mode

On the S7-300 station, open STEP 7 HW Config, double-click the CP 342-5, and verify the Operating mode selection:

• For a pure slave: DP Slave
• For FDL S7 communication only: No DP, FDL S7 connection (the CP 342-5 is then invisible to the DPM1)

If the S7-300 only uses PUT/GET or S7 connections to the S7-416, change the CP 342-5 to No DP, FDL S7 connection to remove it from the token ring entirely.

7.3 Split the segment if the station count is too high

If the segment carries 32 or more stations, install a PROFIBUS repeater and place the new device on a downstream segment. The repeater electrically isolates the two segments and the OP170B is no longer in the same arbitration domain as the rogue master.

7.4 Verify wiring and termination

Ensure PROFIBUS connectors at the two physical ends of each segment have the termination switch set to ON and that all intermediate connectors are OFF. Use a 9-pin D-sub connector with integrated termination (e.g. 6GK1500-0FC10) and confirm the shield is bonded to ground at every cabinet entry.

8. Verification

After applying any of the fixes above, perform the following checks before restoring production:

1. Re-take the bus trace with the new device online. The live device list should now show all four expected addresses (1, 2, the S7-300 CP 342-5 as a slave or absent, and 99) with no token passing from a non-master station.
2. Watch the OP170B tags for at least one hour of normal production. The values in DB49 must refresh continuously and never collapse to #####.
3. Confirm diagnostics on the S7-416: DP Diagnostics in STEP 7 (or RD_REC on the diagnostic slot of the CM 1242-5) should report no Station failure or Diagnostic interrupt events related to node 1.
4. Cycle the test: power-cycle the CM 1242-5 a few times. The OP170B must keep its connection every time, confirming the master constraint is permanent.

9. Prevention and Best Practices

• Always assign a specific DPM1 to a CM 1242-5 in vendor projects. The "undefined master" setting is intended for use cases where the slave is on a single-master bus; on multi-master segments it must be tightened to a real DPM1 address.
• Audit every PROFIBUS segment for its master list at commissioning. Tools such as Softing PROFIbus Diagnostics, Indu-Sol PROFINET/PROFIBUS Diagnostics and Siemens SINEC NMS produce a master list from a passive trace; compare the trace to the planned topology and resolve any extra master immediately.
• Respect the 32-station rule. PROFIBUS DP EN 50170 caps the address space at 126 but a single electrical segment is limited to 32 stations. With 40 slaves in the original plant, segmentation with repeaters is mandatory.
• Document the segment: keep a single line drawing with the addresses, masters and the location of the terminators. Reviewers can spot a stray master much faster when the topology is current.
• Schedule an annual PROFIBUS health check with a class-2 analyzer. Repeater counters, signal levels and error counters per station will surface degrading terminations or rogue masters before they take a station down.

10. Diagnostic Flowchart

11. Key Technical Values Reference