CP343-1 Lean SF Fault: S7-300 CPU 314C-2DP STOP Troubleshooting

David Krause11 min read
S7-300SiemensTroubleshooting
Licensed PE Working through this on a live machine? A Maine-licensed engineer can take it from here — included with IMD hardware, by the hour for everything else. Book an engineer

Problem Description

An S7-300 station built around a CPU 314C-2DP (order number 6ES7 314-6CG03-0AB0 or compatible) drops into STOP mode with the SF LED illuminated on the CPU and on the newly inserted CP 343-1 Lean communications processor. Removing the CP returns the CPU to RUN immediately. Reinserting the module after the station has been de-energized for two to three days silently restores Industrial Ethernet connectivity, then the fault reappears on the next cold start. STEP 7 V5.5 + SPx is the engineering environment.

The CPU diagnostic buffer records Event ID 16# 49A2 — STOP caused by parameter assignment error or unpermissible difference between preset and actual configuration: startup disabled with the supplementary fields:

Field Value Meaning
Event ID 16# 49A2 STOP due to parameter assignment error / configuration mismatch
SDB No. 100 System Data Block 100 — CP 343-1 Lean configuration
Z2 0005 Error class: parameter assignment error in OB1 / startup
Z3 000B Cause code: configuration/SDB mismatch
Previous mode STARTUP (warm restart) Failure occurred during startup OB execution
Requested mode STOP (internal) CPU forced to STOP after parameter error

The fact that the CP eventually works without re-downloading hardware points to a timing-dependent parameterization issue: the CPU's startup sequence occasionally accepts the SDB, while most cold starts reject it. Typical root causes are listed below.

Affected Components and Versions

Component Order Number (MLFB) Firmware Notes
CPU 314C-2DP 6ES7 314-6CG03-0AB0 V3.3 / V3.4 Integrated DP master + DI16/DO16/AI5/AO2 onboard I/O
CP 343-1 Lean (early) 6GK7 343-1CX00-0XE0 V1.0 Single-port, no PG/OP routing
CP 343-1 Lean (mid) 6GK7 343-1CX10-0XE0 V2.5 / V2.6 Most common in retrofit installs
CP 343-1 Lean (current) 6GK7 343-1CX30-0XE0 V3.0 / V3.1 Replacement module, ISO-on-TCP only
STEP 7 6ES7 810-4CC10-0YA5 V5.5 + SP2/HF HW Config must include the matching GSD/CP entry
FM350-1 counter 6ES7 350-1AH03-0AE0 Slot configuration must be preserved
IM153-1 (DP slave) 6ES7 153-1AA03-0XB0 ET200M on PROFIBUS DP

Reference the official CP 343-1 Lean operating instructions on the Siemens support portal for the exact firmware-feature matrix.

Diagnostic Buffer Interpretation

Open the diagnostic buffer in STEP 7 via PLC > Module Information > Diagnostic Buffer. Sort by time and isolate the entry preceding STOP. The Z2/Z3 codes for the most frequent S7-300 STOP events related to CP 343-1 Lean are summarized below.

Event ID Plain Text Typical Root Cause
16# 49A1 STOP due to STOP command Operator / program OP command
16# 49A2 STOP caused by parameter assignment error CP SDB mismatch, MPI/DP address conflict
16# 49A3 STOP caused by invalid OB OB missing for active event class
16# 49A4 STOP due to communication error CP rejected SDB during startup
16# 49A5 STOP due to priority class error OB85/OB86 access during startup
16# 494E Status of DP master changed DP master lost sync with slave
16# 38B4 PROFIBUS DP slave diagnostics IM153 station failure

Root Cause Analysis

Five independent failure mechanisms can produce the exact symptom described. Investigate them in this order — they are listed by probability for this specific machine topology (CPU 314C-2DP with HMI, DP master, and a retrofitted CP).

1. MPI Address Conflict

The CP 343-1 Lean is delivered with MPI address 3. The CPU also reserves MPI address 2 and the HMI/PG socket typically uses address 1 or a free high address. If two nodes share address 3, the CPU rejects the SDB at startup. The acceptance on a later power-up is non-deterministic because the bus arbitration timing changes once the CP has been physically removed for several minutes.

Verify: From STEP 7 Hardware Configuration, open Properties > CP 343-1 Lean > Interfaces > MPI and read the configured address. Then read the actual address of the HMI/OP via PLC > Accessible Nodes. They must be unique.

2. Parameter Assignment / SDB Mismatch

SDB 100 (and SDB 90/100/101 family on S7-300) carries the parameter record for the CP. If the SDB in the CPU's load memory does not exactly match the CP's expected parameter set — for example because the CP was hot-swapped, because the previous project used a different CP variant, or because the project was last compiled against an older STEP 7 catalog — the CP rejects it during startup and the CPU enters STOP.

The intermittent success after the station has been off for days is a strong indicator of residual data in the CP's persistent memory colliding with the new SDB. The CP accepts the SDB on the second insertion because its internal RAM has discharged below the threshold where the checksum compares equal.

3. Hardware Catalog / Firmware Version Mismatch

STEP 7 V5.5 ships with hardware catalog entries for older CP 343-1 Lean revisions. If the configured CP is V2.6 and the installed module is V3.x (or vice-versa), parameter records differ in length and the CPU rejects SDB 100.

Verify: Read the module's firmware version directly via Accessible Nodes > Online > Module Information. Compare against the version listed in HW Config > Properties > CP 343-1 Lean > Version. They must match exactly (e.g. V2.6.7).

4. Slot / Configuration Discrepancy

The CP 343-1 Lean must be inserted in the slot configured in HW Config. Adding it in the "last slot" while the actual chassis has a different physical ordering will yield a presupplied configuration != actual configuration error during startup. Even a one-slot shift will fail.

5. PROFIBUS DP Master / Slave Sync Loss

Simultaneous presence of an IM153 slave and an Omron servo controller on the integrated DP port creates additional diagnostic events. If the DP master has not fully sync'd before the CP SDB is evaluated, secondary errors may mask the CP fault. Resolve the CP issue first, then re-evaluate DP stability.

Prerequisites for the Repair Procedure

  • STEP 7 V5.5 with the latest Hardware Support Package (HSP) installed for CP 343-1 Lean V2.6 / V3.0.
  • Online connection to the S7-300 via MPI/USB or Ethernet routing.
  • Administrator access to read the diagnostic buffer and force STOP/RUN.
  • Current offline backup of the project (S7 program + HW Config) on a separate drive.
  • The module's actual MLFB printed on the front (visible behind the door).

Step-by-Step Resolution

  1. Capture the baseline project. Archive the current S7 project (File > Archive) before any modification. Note the project revision, the HW Config version string, and the last successful download date.
  2. Identify the installed CP. Open the CPU door, read the MLFB (e.g. 6GK7 343-1CX10-0XE0), the firmware label, and the MAC address.
  3. Read the diagnostic buffer. Connect online, open PLC > Module Information > Diagnostic Buffer, and export the complete buffer to a text file. Cross-reference every 16# 49xx and 16# 39xx entry against the table above.
  4. Resolve MPI conflicts. In HW Config, change the CP 343-1 Lean MPI address from the default 3 to a free address such as 5, 10, or 15. Confirm with the HMI's configured MPI address that there is no overlap.
  5. Align firmware with catalog. In HW Config, open Properties > CP 343-1 Lean and confirm the catalog entry matches the MLFB and firmware. If the catalog does not contain the exact revision, install the matching HSP via Options > Install HW Updates.
  6. Re-compile and download hardware. Station > Save and Compile, then PLC > Download to Target > Complete. Do not deselect any SDB. Confirm the dialog shows "Download system data blocks including SDB 100."
  7. Reset the CP's persistent state. Power down the S7-300 rack, wait at least 30 seconds for the CP's supercap-backed RAM to discharge, then power up.
  8. Reinsert the CP in the configured slot. Verify the slot number physically matches HW Config (Properties > Slot).
  9. Monitor startup. Watch the CPU's RUN/STOP LED, the CP's SF / Link / Rx/Tx LEDs, and the diagnostic buffer in parallel. Allow at least 60 seconds for the CP's parameter negotiation to complete.
  10. Ping the CP. From the SCADA engineering station, issue ping <CP IP address>. A successful reply within 5 seconds confirms Industrial Ethernet connectivity.
  11. Force a cold start. Perform PLC > Clear/Reset > Cold Restart to verify the configuration survives a true cold start, not just a warm restart from the backup capacitors.

CP 343-1 Lean Parameter Settings Reference

Parameter Recommended Value Notes
IP address Static, project-aligned Avoid DHCP unless DCP server present
Subnet mask 255.255.255.0 (or per plant) Must match SCADA subnet
Router address Empty unless inter-segment Routing not supported on Lean variant
MPI address 5 (avoid 1, 2, 3) 1=PG default, 2=CPU, 3=CP default conflict
Highest MPI address 31 / 126 Match STEP 7 PG/PC interface
Baud rate (MPI/DP) 1.5 Mbit/s or 187.5 kbit/s All DP nodes must agree
Connection mode S7 / PG / OP Enable only required connection types
Keep-alive 30 s Lower values may trigger SF on transient loss

Configuration Diff Worksheet

When the working and failing projects exist side-by-side, compute the diff to isolate the regression. Use the following template:

Item Working Project Failing Project Match?
CPU MLFB Y / N
CPU firmware Y / N
CP slot number Y / N
CP MLFB Y / N
CP firmware Y / N
CP MPI address Y / N
HMI MPI address Y / N
DP master system baud rate Y / N
SDB 100 version Y / N
STEP 7 version (incl. HSP) Y / N

Verification

  1. Diagnostic buffer contains no 16# 49A2 after a cold restart. A normal cold restart emits only 16# 4900 (power on) and 16# 4911 (startup complete).
  2. CP LEDs steady: SF off, Link green, optional Rx/Tx flashing on SCADA polling.
  3. ping round-trip < 5 ms on the local subnet.
  4. SCADA acquires all configured tags without timeout for at least one hour.
  5. Power-cycle the machine three times consecutively. The CP must come up every cycle.
  6. Perform a true cold restart (MRES sequence on the CPU) and re-verify steps 1–4.

Field-Proven Caveats

  • Diagnostic buffer ordering. The 16# 49A2 entry is the symptom, not the cause. Scroll upward — the original fault typically appears 50–80 ms earlier as a 16# 39xx module diagnostic from the CP itself.
  • Persistent CP memory. After a parameterization error the CP may retain stale configuration in its supercap-backed RAM. A 30-second power-down is the minimum discharge window. In hot climates add a 60-second window.
  • MPI vs. DP port. The CPU 314C-2DP has two physical ports — MPI/DP combined and onboard DP. Assigning the same MPI address to two logical interfaces will produce 16# 49A2 on every cold start.
  • Hot removal safety. Never remove the CP 343-1 Lean while the CPU is in RUN without first calling PLC > Stop. Hot swap of an actively parameterized module corrupts SDB 100.
  • STEP 7 catalog staleness. A clean STEP 7 V5.5 install without the latest HSP does not contain CP 343-1 Lean V3.x. The catalog will silently substitute a V2.6 profile, which compiles successfully but generates an SDB the V3.x hardware rejects.

Related Error Codes and Cross-References

Error Code Source Recommended Action
16# 0E1F CP 343-1 Lean module diagnostic SDB length mismatch — re-download HW Config
16# 0E20 CP 343-1 Lean module diagnostic IP parameter invalid — check IP/Subnet
16# 0E21 CP 343-1 Lean module diagnostic MPI address conflict — change CP address
16# 0E22 CP 343-1 Lean module diagnostic Connection resources exhausted — reduce configured connections
16# 0E23 CP 343-1 Lean module diagnostic Firmware mismatch — install matching HSP
16# 494E CPU DP master DP slave sync lost — verify IM153 termination

When to Escalate

If the diagnostic buffer continues to show 16# 49A2 after completing all eleven resolution steps with verified MPI, firmware, and slot parameters, escalate to Siemens Industrial Technical Support with the full diagnostic buffer export, the HW Config screenshots of both CPU and CP slots, and the CP's MAC address. Provide the project archive without the HMI passwords or PLC program source if the customer requires confidentiality.

FAQ

Why does the CP 343-1 Lean work after sitting unpowered for two days but fail on the next cold start?

The CP's supercapacitor-backed parameter memory holds the previous SDB. After 24–72 hours the supercap discharges below the operating threshold, the CP reverts to factory-default empty parameter state, and accepts the CPU's SDB 100 cleanly. On the next cold start the supercap has recharged, the residual SDB collides with the new one, and the CPU rejects the parameter assignment with Event 16#49A2. Discharging the rack for at least 30 seconds before reinsertion is the deterministic workaround.

What is the difference between Event 16#49A2 and 16#49A4?

16#49A2 indicates a parameter assignment error or a difference between the preset and actual configuration detected during startup. 16#49A4 indicates a communication error that caused STOP, typically after the CPU has already entered RUN. If 16#49A4 appears, the CP rejected or lost the SDB mid-cycle, which points to a connection or firmware problem rather than a slot/address mismatch.

Can I assign MPI address 3 to the CP 343-1 Lean if my CPU 314C-2DP also uses address 3?

No. MPI addresses on a single PROFIBUS segment must be unique. CPU 314C-2DP defaults to MPI address 2 and reserves a second logical address for the combined MPI/DP port. Assign the CP to a free address between 4 and 31, with 5, 10, or 15 being the most common field-proven choices.

Which STEP 7 V5.5 HSP contains the CP 343-1 Lean V3.0 module entry?

The CP 343-1 Lean V3.0 module (6GK7 343-1CX30-0XE0) is added through the Hardware Support Package released by Siemens after the V3.0 module launch. Install it via Options > Install HW Updates in STEP 7 V5.5 with the latest Service Pack applied. Without this HSP the catalog silently falls back to V2.6 and the SDB is rejected by V3.x hardware.

How do I confirm the CP is actually responding on Industrial Ethernet without SCADA online?

Issue an ICMP ping from the SCADA engineering station to the configured CP IP address. A reply within 5 ms with zero packet loss on the local subnet confirms Layer 3. For Layer 2, watch the CP front-panel LEDs — steady green Link LED plus periodic green Rx/Tx flicker indicates live Ethernet traffic. The STEP 7 Accessible Nodes function over Ethernet also confirms S7 routing paths are intact.

Back to blog