CP 443-1 Factory Reset: Restoring Network and MPI Access

Problem Statement: CP 443-1 Unreachable After NCM S7 Factory Reset

After a Reset to Factory Settings command is executed from the NCM S7 diagnostic toolbox in STEP 7 V5.x against a SIMATIC S7-400 CP 443-1 (typical order code 6GK7 443-1EX10-0XE0), the module erases its volatile configuration block. The previously assigned IP address, subnet mask, router, S7 connection partners, ISO-on-TCP TSNs, port parameters, MAC address learned from configuration data, NTP/SNTP servers, and any PROFINET device name (on EX20 and later) are wiped from the CP's working RAM. The CP then behaves as if pulled from the box: it does not respond to ARP, does not boot with any project IP, and is no longer reachable on Ethernet.

What is preserved through that reset, per the Siemens CP 443-1 EX30 device manual (function manual GH_CP443-1-EX30) and the CP 443-1 RNA manual (GH_CP443-1-RNA), is the factory-burned MAC address stored in the network controller's non-volatile memory. The same Siemens manuals state verbatim: "After resetting to factory defaults, the CP always retains the factory set MAC address (as supplied). The IP address and the configuration data in the CP RAM..." This single fact is the basis of any field recovery.

Common field symptoms following a misguided factory reset:

• CP not visible in NCM S7 / STEP 7 Accessible Nodes over Ethernet or MPI.
• STEP 7 reports "The CP is not accessible / no response from the CP" during download.
• CPU continues to run user program, but the CP cannot establish TCP/ISO connections.
• PG/PC cannot open an Online connection to the CP, although CPU download still works.
• CP-LED pattern shows RUN/STOP status LED green, but the LINK and RX/TX activity on the Ethernet port never pulse.

This article walks through a deterministic field procedure that does not require the original packaging or the printed MAC sticker to be present, and clarifies when the module must be replaced.

CP 443-1 Hardware Identification and Variants

The CP 443-1 family spans several releases. The recovery procedure in this article applies to the 6GK7 443-1EX10-0XE0 and is largely transferrable to later siblings. The MAC address is hardware-defined per module and not project-configurable, which is why the factory-burned address survives every reset.

The Siemens OUI prefix for CP 443-1 modules of this vintage is typically 08:00:06. The remaining 24 bits are unique per module and assigned during module production. Always record the full 12-hex-digit address before any reset operation, ideally with a barcode-scanned photograph of the front faceplate.

Factory Reset Behavior: What NCM S7 Actually Erases

The NCM S7 menu path Diagnostics > Reset to Factory Defaults (German: Werkszustand herstellen) issues an internal command over the S7 backplane (K-bus on EX10/EX11, P-bus on EX20/EX30) that re-initializes the CP's RAM file system to an empty state. Specifically, the CP erases:

• IP address, subnet mask, default router
• PROFINET device name (EX20 and later)
• Configured S7 / ISO-on-TCP / TCP connections and their partner TSAPs / ports
• All passive/active connection tables
• FTP credentials, NTP server list, SNMP communities
• Time-of-day synchronization settings
• Logging buffer and diagnostic buffer retained in volatile storage

The CP retains, per the cited Siemens manuals:

• The factory-burned MAC address (silicon-stored in the Ethernet PHY controller, not in CP-RAM)
• The bootloader firmware
• The module's serial number (printed on the housing, also stored electronically)
• Any firmware update installed via the SIMATIC Automation Tool or STEP 7 (firmware image is in flash, not RAM)

A factory reset is therefore not destructive to firmware but is destructive to project configuration. To restore configuration, you must re-download the HW Config and the connection configuration. The CP only accepts that download through a known path - which is the recovery problem described next.

Locating the Factory-Burned MAC Address

The burned-in MAC address is the only stable network identity the CP has after a factory reset. You need it to address the CP via Ethernet, even if you are using a temporary IP for commissioning. There are three places to look, in order of preference:

1. Front-faceplate label: The CP 443-1 has a printed label on the front plate, typically just below the order number. The MAC is shown in the canonical form XX-XX-XX-XX-XX-XX or sometimes XXXXXXXXXXXX. On EX20/EX30 modules two MAC addresses are printed, one per port.
2. Rear connector side label: On some early EX10 modules the MAC was printed on a separate sticker applied to the rear of the housing. This sticker is sometimes missed during installation.
3. Step 7 / NCM S7 readout over the backplane: If the CP is still responding to the CPU over the backplane, you can sometimes read its MAC via PLC > Diagnostics > Module Information > Identification. This works only when the CPU-CP link is intact.

If the front-faceplate MAC is unreadable (label worn, painted over by a vendor during a panel rebuild, or peeled off), the burned-in MAC can still be obtained via the CPU backplane - see the recovery procedure below.

Prerequisites for Recovery

• STEP 7 V5.5 SP4 or later with matching HSP (Hardware Support Package) for the CP variant in question.
• NCM S7 installed (component of STEP 7 V5.x).
• PC adapter: either a Siemens 6ES7 972-0CB20-0XA0 (USB-MPI) or 6ES7 972-0BA12-0XA0 (USB-MPI/DP), or an Ethernet PG/PC interface connected to the CPU's PROFINET or Ethernet port (for S7-400 CPUs with integrated Ethernet such as 6ES7 416-3FR05-0AB0).
• The STEP 7 project that was last downloaded to the S7-400 station - or at minimum, the HW Config of the station (rack layout and CP slot).
• Administrative rights on the engineering PC to set PG/PC interface parameters.

Step-by-Step Recovery Procedure

The strategy is to address the CP through the CPU backplane (not through Ethernet) so that a fresh HW Config download establishes the CPU-CP configuration handshake.

1. Power down the rack and reseat the CP. Remove the CP 443-1 from its slot, inspect the backplane connector for contamination or bent pins, and reseat firmly. A bad backplane contact is the most common cause of silent CP loss and is often the actual problem rather than the factory reset.
2. Try a different slot. Move the CP to a different free slot in the S7-400 rack. Note the new slot number; you must reflect it in HW Config before downloading. Also try the same slot on a sibling rack if one is available to rule out a defective rack.
3. Connect the engineering station to the CPU, not the CP. Use the MPI adapter on the CPU's MPI/DP port, or connect Ethernet to a CPU-integrated PROFINET interface. The goal is to reach the CPU, not the CP.
4. Set the PG/PC interface in STEP 7. Options > Set PG/PC Interface, select S7ONLINE (STEP7) -> PC Adapter (MPI) or the appropriate Ethernet variant. Apply.
5. Open the original STEP 7 project. Open SIMATIC Manager > your project > S7-400 Station > Hardware. If the project is unavailable, create a new station with the same order numbers at the same slots; the CP order code must match exactly.
6. Update CP slot in HW Config if needed. If you moved the CP in step 2, drag the CP 443-1 to the new slot. Verify the CPU order number and firmware version are correct - the CP must be compatible per the Siemens compatibility list.
7. Compile HW Config. Station > Save and Compile. Resolve any compile errors (typically caused by an obsolete HSP or by pointing the CP at an Ethernet subnet that does not exist in the project).
8. Download HW Config to the CPU only. Right-click the CPU object > Download to Target System. Do not right-click the CP and try to download it directly - the CP is still unreachable. The download target is the CPU, and the CPU will then forward the configuration to the CP via the backplane.
9. Verify the CPU-CP handshake. In PLC > Diagnostics > Module Information, select the CP and confirm that the diagnostic buffer shows the new configuration being accepted. The LINK LED on the CP Ethernet port should light when you connect a live Ethernet cable.
10. Open NCM S7 and address the CP via Ethernet. Start > SIMATIC > NCM S7 > Diagnostics. From the menu, choose the CP and set the IP address, subnet mask, and (if used) router. Save the configuration to the CP.
11. Download the connection configuration. NCM S7 > Connections, then Download to Target System. This pushes the S7 / ISO-on-TCP / TCP connection tables into the CP's RAM.
12. Verify with PING and Online diagnostics. From a workstation on the same subnet, ping <CP-IP>. In STEP 7, PLC > Diagnostics > Online should now show the CP as accessible.

Hardware Configuration Requirements

For the CP to come up after a factory reset, the HW Config download must contain a minimum set of parameters:

The MAC address field in HW Config is read-only. STEP 7 reads it from the module during configuration and displays it for reference. The user cannot set the MAC; that is a hardware-defined value that survives every reset, which is precisely why Siemens' recovery procedure works.

Commissioning the CP After Recovery

Once the CP is reachable on Ethernet, run the following commissioning checks in order:

1. Diagnostic buffer clean. PLC > Module Information > Diagnostic Buffer. No "Module rebooted due to factory reset" entries should remain after the next power cycle.
2. Firmware version check. Module Information > Identification. Confirm firmware matches the version specified by the project's HSP. Mismatched firmware can cause connection failures even when the CP comes up.
3. Connection test. Open each configured S7 connection in NCM S7 > Connections, right-click > Connection Status. Status should show "Established" with partner TSAP matching the remote endpoint.
4. Live data test. In a test HMI or online in STEP 7, monitor a process tag that crosses the CP (for example, a tag from a remote S7-300 station reached through this CP). Verify cyclic update.
5. Time synchronization check. If the CP is the plant NTP client, verify Time > Time of Day in the CPU after the next sync window.

Verification and Diagnostics Matrix

Edge Cases and Replacement Criteria

There are cases where no recovery is possible in the field, regardless of how systematic the procedure:

• Backplane connector damage. Bent pins or oxidized gold fingers on the rack or CP cannot be field-repaired; the CP or the rack must be replaced.
• Bootloader corruption. If the firmware was interrupted during a flash update (for example by a power loss), the CP may refuse to boot at all. Recovery requires Siemens Service or a SIMATIC Automation Tool firmware re-flash via the backplane, which STEP 7 V5.x cannot always drive.
• Persistent communication failure after reseating and slot change. If the CP fails in three different racks on three different slots, the module itself is defective.
• Missing front-faceplate MAC sticker and no CPU-CP backplane link. The burned-in MAC can then only be read by Siemens Service using a JTAG-level diagnostic fixture. In production-critical cases this typically justifies module replacement rather than service turnaround.

Before declaring the CP dead, document the diagnostic buffer contents, the LED state pattern (RUN/STOP/ERROR, LINK/ACT), the slot and rack positions tried, and the HW Config used. Submit a Support Request via the Siemens Industry Online Support portal with this data attached; the answer typically returns within 1-2 business days and confirms whether the module is repairable.

FAQ