Problem Description
An S7-300 station built around a CPU 314C-2DP (order number 6ES7 314-6CG03-0AB0 or compatible) drops into STOP mode with the SF LED illuminated on the CPU and on the newly inserted CP 343-1 Lean communications processor. Removing the CP returns the CPU to RUN immediately. Reinserting the module after the station has been de-energized for two to three days silently restores Industrial Ethernet connectivity, then the fault reappears on the next cold start. STEP 7 V5.5 + SPx is the engineering environment.
The CPU diagnostic buffer records Event ID 16# 49A2 — STOP caused by parameter assignment error or unpermissible difference between preset and actual configuration: startup disabled with the supplementary fields:
| Field | Value | Meaning |
|---|---|---|
| Event ID | 16# 49A2 | STOP due to parameter assignment error / configuration mismatch |
| SDB No. | 100 | System Data Block 100 — CP 343-1 Lean configuration |
| Z2 | 0005 | Error class: parameter assignment error in OB1 / startup |
| Z3 | 000B | Cause code: configuration/SDB mismatch |
| Previous mode | STARTUP (warm restart) | Failure occurred during startup OB execution |
| Requested mode | STOP (internal) | CPU forced to STOP after parameter error |
The fact that the CP eventually works without re-downloading hardware points to a timing-dependent parameterization issue: the CPU's startup sequence occasionally accepts the SDB, while most cold starts reject it. Typical root causes are listed below.
Affected Components and Versions
| Component | Order Number (MLFB) | Firmware | Notes |
|---|---|---|---|
| CPU 314C-2DP | 6ES7 314-6CG03-0AB0 | V3.3 / V3.4 | Integrated DP master + DI16/DO16/AI5/AO2 onboard I/O |
| CP 343-1 Lean (early) | 6GK7 343-1CX00-0XE0 | V1.0 | Single-port, no PG/OP routing |
| CP 343-1 Lean (mid) | 6GK7 343-1CX10-0XE0 | V2.5 / V2.6 | Most common in retrofit installs |
| CP 343-1 Lean (current) | 6GK7 343-1CX30-0XE0 | V3.0 / V3.1 | Replacement module, ISO-on-TCP only |
| STEP 7 | 6ES7 810-4CC10-0YA5 | V5.5 + SP2/HF | HW Config must include the matching GSD/CP entry |
| FM350-1 counter | 6ES7 350-1AH03-0AE0 | — | Slot configuration must be preserved |
| IM153-1 (DP slave) | 6ES7 153-1AA03-0XB0 | — | ET200M on PROFIBUS DP |
Reference the official CP 343-1 Lean operating instructions on the Siemens support portal for the exact firmware-feature matrix.
Diagnostic Buffer Interpretation
Open the diagnostic buffer in STEP 7 via PLC > Module Information > Diagnostic Buffer. Sort by time and isolate the entry preceding STOP. The Z2/Z3 codes for the most frequent S7-300 STOP events related to CP 343-1 Lean are summarized below.
| Event ID | Plain Text | Typical Root Cause |
|---|---|---|
| 16# 49A1 | STOP due to STOP command | Operator / program OP command |
| 16# 49A2 | STOP caused by parameter assignment error | CP SDB mismatch, MPI/DP address conflict |
| 16# 49A3 | STOP caused by invalid OB | OB missing for active event class |
| 16# 49A4 | STOP due to communication error | CP rejected SDB during startup |
| 16# 49A5 | STOP due to priority class error | OB85/OB86 access during startup |
| 16# 494E | Status of DP master changed | DP master lost sync with slave |
| 16# 38B4 | PROFIBUS DP slave diagnostics | IM153 station failure |
Root Cause Analysis
Five independent failure mechanisms can produce the exact symptom described. Investigate them in this order — they are listed by probability for this specific machine topology (CPU 314C-2DP with HMI, DP master, and a retrofitted CP).
1. MPI Address Conflict
The CP 343-1 Lean is delivered with MPI address 3. The CPU also reserves MPI address 2 and the HMI/PG socket typically uses address 1 or a free high address. If two nodes share address 3, the CPU rejects the SDB at startup. The acceptance on a later power-up is non-deterministic because the bus arbitration timing changes once the CP has been physically removed for several minutes.
Verify: From STEP 7 Hardware Configuration, open Properties > CP 343-1 Lean > Interfaces > MPI and read the configured address. Then read the actual address of the HMI/OP via PLC > Accessible Nodes. They must be unique.
2. Parameter Assignment / SDB Mismatch
SDB 100 (and SDB 90/100/101 family on S7-300) carries the parameter record for the CP. If the SDB in the CPU's load memory does not exactly match the CP's expected parameter set — for example because the CP was hot-swapped, because the previous project used a different CP variant, or because the project was last compiled against an older STEP 7 catalog — the CP rejects it during startup and the CPU enters STOP.
The intermittent success after the station has been off for days is a strong indicator of residual data in the CP's persistent memory colliding with the new SDB. The CP accepts the SDB on the second insertion because its internal RAM has discharged below the threshold where the checksum compares equal.
3. Hardware Catalog / Firmware Version Mismatch
STEP 7 V5.5 ships with hardware catalog entries for older CP 343-1 Lean revisions. If the configured CP is V2.6 and the installed module is V3.x (or vice-versa), parameter records differ in length and the CPU rejects SDB 100.
Verify: Read the module's firmware version directly via Accessible Nodes > Online > Module Information. Compare against the version listed in HW Config > Properties > CP 343-1 Lean > Version. They must match exactly (e.g. V2.6.7).
4. Slot / Configuration Discrepancy
The CP 343-1 Lean must be inserted in the slot configured in HW Config. Adding it in the "last slot" while the actual chassis has a different physical ordering will yield a presupplied configuration != actual configuration error during startup. Even a one-slot shift will fail.
5. PROFIBUS DP Master / Slave Sync Loss
Simultaneous presence of an IM153 slave and an Omron servo controller on the integrated DP port creates additional diagnostic events. If the DP master has not fully sync'd before the CP SDB is evaluated, secondary errors may mask the CP fault. Resolve the CP issue first, then re-evaluate DP stability.
Prerequisites for the Repair Procedure
- STEP 7 V5.5 with the latest Hardware Support Package (HSP) installed for CP 343-1 Lean V2.6 / V3.0.
- Online connection to the S7-300 via MPI/USB or Ethernet routing.
- Administrator access to read the diagnostic buffer and force STOP/RUN.
- Current offline backup of the project (S7 program + HW Config) on a separate drive.
- The module's actual MLFB printed on the front (visible behind the door).
Step-by-Step Resolution
-
Capture the baseline project. Archive the current S7 project (
File > Archive) before any modification. Note the project revision, the HW Config version string, and the last successful download date. -
Identify the installed CP. Open the CPU door, read the MLFB (e.g.
6GK7 343-1CX10-0XE0), the firmware label, and the MAC address. -
Read the diagnostic buffer. Connect online, open PLC > Module Information > Diagnostic Buffer, and export the complete buffer to a text file. Cross-reference every
16# 49xxand16# 39xxentry against the table above. -
Resolve MPI conflicts. In HW Config, change the CP 343-1 Lean MPI address from the default
3to a free address such as5,10, or15. Confirm with the HMI's configured MPI address that there is no overlap. - Align firmware with catalog. In HW Config, open Properties > CP 343-1 Lean and confirm the catalog entry matches the MLFB and firmware. If the catalog does not contain the exact revision, install the matching HSP via Options > Install HW Updates.
- Re-compile and download hardware. Station > Save and Compile, then PLC > Download to Target > Complete. Do not deselect any SDB. Confirm the dialog shows "Download system data blocks including SDB 100."
- Reset the CP's persistent state. Power down the S7-300 rack, wait at least 30 seconds for the CP's supercap-backed RAM to discharge, then power up.
- Reinsert the CP in the configured slot. Verify the slot number physically matches HW Config (Properties > Slot).
- Monitor startup. Watch the CPU's RUN/STOP LED, the CP's SF / Link / Rx/Tx LEDs, and the diagnostic buffer in parallel. Allow at least 60 seconds for the CP's parameter negotiation to complete.
-
Ping the CP. From the SCADA engineering station, issue
ping <CP IP address>. A successful reply within 5 seconds confirms Industrial Ethernet connectivity. - Force a cold start. Perform PLC > Clear/Reset > Cold Restart to verify the configuration survives a true cold start, not just a warm restart from the backup capacitors.
CP 343-1 Lean Parameter Settings Reference
| Parameter | Recommended Value | Notes |
|---|---|---|
| IP address | Static, project-aligned | Avoid DHCP unless DCP server present |
| Subnet mask | 255.255.255.0 (or per plant) | Must match SCADA subnet |
| Router address | Empty unless inter-segment | Routing not supported on Lean variant |
| MPI address | 5 (avoid 1, 2, 3) | 1=PG default, 2=CPU, 3=CP default conflict |
| Highest MPI address | 31 / 126 | Match STEP 7 PG/PC interface |
| Baud rate (MPI/DP) | 1.5 Mbit/s or 187.5 kbit/s | All DP nodes must agree |
| Connection mode | S7 / PG / OP | Enable only required connection types |
| Keep-alive | 30 s | Lower values may trigger SF on transient loss |
Configuration Diff Worksheet
When the working and failing projects exist side-by-side, compute the diff to isolate the regression. Use the following template:
| Item | Working Project | Failing Project | Match? |
|---|---|---|---|
| CPU MLFB | Y / N | ||
| CPU firmware | Y / N | ||
| CP slot number | Y / N | ||
| CP MLFB | Y / N | ||
| CP firmware | Y / N | ||
| CP MPI address | Y / N | ||
| HMI MPI address | Y / N | ||
| DP master system baud rate | Y / N | ||
| SDB 100 version | Y / N | ||
| STEP 7 version (incl. HSP) | Y / N |
Verification
- Diagnostic buffer contains no
16# 49A2after a cold restart. A normal cold restart emits only16# 4900(power on) and16# 4911(startup complete). - CP LEDs steady: SF off, Link green, optional Rx/Tx flashing on SCADA polling.
-
pinground-trip < 5 ms on the local subnet. - SCADA acquires all configured tags without timeout for at least one hour.
- Power-cycle the machine three times consecutively. The CP must come up every cycle.
- Perform a true cold restart (MRES sequence on the CPU) and re-verify steps 1–4.
Field-Proven Caveats
-
Diagnostic buffer ordering. The
16# 49A2entry is the symptom, not the cause. Scroll upward — the original fault typically appears 50–80 ms earlier as a16# 39xxmodule diagnostic from the CP itself. - Persistent CP memory. After a parameterization error the CP may retain stale configuration in its supercap-backed RAM. A 30-second power-down is the minimum discharge window. In hot climates add a 60-second window.
-
MPI vs. DP port. The CPU 314C-2DP has two physical ports — MPI/DP combined and onboard DP. Assigning the same MPI address to two logical interfaces will produce
16# 49A2on every cold start. - Hot removal safety. Never remove the CP 343-1 Lean while the CPU is in RUN without first calling PLC > Stop. Hot swap of an actively parameterized module corrupts SDB 100.
- STEP 7 catalog staleness. A clean STEP 7 V5.5 install without the latest HSP does not contain CP 343-1 Lean V3.x. The catalog will silently substitute a V2.6 profile, which compiles successfully but generates an SDB the V3.x hardware rejects.
Related Error Codes and Cross-References
| Error Code | Source | Recommended Action |
|---|---|---|
| 16# 0E1F | CP 343-1 Lean module diagnostic | SDB length mismatch — re-download HW Config |
| 16# 0E20 | CP 343-1 Lean module diagnostic | IP parameter invalid — check IP/Subnet |
| 16# 0E21 | CP 343-1 Lean module diagnostic | MPI address conflict — change CP address |
| 16# 0E22 | CP 343-1 Lean module diagnostic | Connection resources exhausted — reduce configured connections |
| 16# 0E23 | CP 343-1 Lean module diagnostic | Firmware mismatch — install matching HSP |
| 16# 494E | CPU DP master | DP slave sync lost — verify IM153 termination |
When to Escalate
If the diagnostic buffer continues to show 16# 49A2 after completing all eleven resolution steps with verified MPI, firmware, and slot parameters, escalate to Siemens Industrial Technical Support with the full diagnostic buffer export, the HW Config screenshots of both CPU and CP slots, and the CP's MAC address. Provide the project archive without the HMI passwords or PLC program source if the customer requires confidentiality.
FAQ
Why does the CP 343-1 Lean work after sitting unpowered for two days but fail on the next cold start?
The CP's supercapacitor-backed parameter memory holds the previous SDB. After 24–72 hours the supercap discharges below the operating threshold, the CP reverts to factory-default empty parameter state, and accepts the CPU's SDB 100 cleanly. On the next cold start the supercap has recharged, the residual SDB collides with the new one, and the CPU rejects the parameter assignment with Event 16#49A2. Discharging the rack for at least 30 seconds before reinsertion is the deterministic workaround.
What is the difference between Event 16#49A2 and 16#49A4?
16#49A2 indicates a parameter assignment error or a difference between the preset and actual configuration detected during startup. 16#49A4 indicates a communication error that caused STOP, typically after the CPU has already entered RUN. If 16#49A4 appears, the CP rejected or lost the SDB mid-cycle, which points to a connection or firmware problem rather than a slot/address mismatch.
Can I assign MPI address 3 to the CP 343-1 Lean if my CPU 314C-2DP also uses address 3?
No. MPI addresses on a single PROFIBUS segment must be unique. CPU 314C-2DP defaults to MPI address 2 and reserves a second logical address for the combined MPI/DP port. Assign the CP to a free address between 4 and 31, with 5, 10, or 15 being the most common field-proven choices.
Which STEP 7 V5.5 HSP contains the CP 343-1 Lean V3.0 module entry?
The CP 343-1 Lean V3.0 module (6GK7 343-1CX30-0XE0) is added through the Hardware Support Package released by Siemens after the V3.0 module launch. Install it via Options > Install HW Updates in STEP 7 V5.5 with the latest Service Pack applied. Without this HSP the catalog silently falls back to V2.6 and the SDB is rejected by V3.x hardware.
How do I confirm the CP is actually responding on Industrial Ethernet without SCADA online?
Issue an ICMP ping from the SCADA engineering station to the configured CP IP address. A reply within 5 ms with zero packet loss on the local subnet confirms Layer 3. For Layer 2, watch the CP front-panel LEDs — steady green Link LED plus periodic green Rx/Tx flicker indicates live Ethernet traffic. The STEP 7 Accessible Nodes function over Ethernet also confirms S7 routing paths are intact.