CPU 416-3 DP STOP Event 16#4303: Buffer Decode and V5.3.5 Fix

Problem Statement: S7-400 CPU 416-3 DP Drops to STOP Without Operator Action

An S7-400 station built around a CPU 416-3 DP (order number 6ES7 416-3XR05-0AB0, hardware release 4, firmware V5.3.1, boot loader V5.3.0) was observed to drop from RUN to STOP (internal) while the keyswitch was physically in the RUN position. The diagnostic buffer did not contain any application OB or programming-error entries; the only STOP entries were two related events generated within 2 ms of each other:

• Event 7 at 21:01:33.462 — Event ID 16# 4303, "STOP caused by stop switch being activated"
• Event 6 at 21:01:33.464 — Event ID 16# 530D, "New startup information in STOP mode — startup prevented by STOP request"

Subsequent attempts to restart the CPU produced the same pair of entries with no change in plant state. The CPU was replaced and the original was bench-tested: MRES produced a clean reset, the keyswitch showed no chatter on a vibration bench, yet firmware V5.3.1 retained the spontaneous-STOP behavior. The vendor-supplied operating-system update to V5.3.5 cleared the fault, and the CPU has since run continuously without re-entering STOP. This article documents the diagnostic-buffer decoding, the root-cause analysis, the precise firmware package required, and the procedure that returns the affected controller to service.

Affected Hardware and Firmware Versions

• CPU 412-1
• CPU 412-2
• CPU 414-2
• CPU 414-3
• CPU 416-2
• CPU 416-3 (the failed unit)
• CPU 416-3 PN/DP
• CPU 414-3 PN/DP
• CPU 416F-2 (F-CPU)
• CPU 416F-3 PN/DP
• CPU 417-4

Diagnostic Buffer Decode

The diagnostic buffer of an S7-400 CPU is a ring buffer of 120 entries, each carrying a 12-byte event coding and a wall-clock timestamp derived from the CPU's internal time-of-day clock. Entries 6 and 7 on the failed unit (read via SIMATIC Manager → PLC → Diagnostic/Setting → Diagnostic Buffer) decode as follows.

Event 7 — Event ID 16# 4303 (Cause of STOP)

The qualifier FF84 in the second word is the S7-400 internal "STOP reason" mask: bit 15 set indicates an internal (firmware-driven) STOP request rather than an externally asserted STOP, and bit 2 set indicates that the source path is the keyswitch / SFB20 STOP branch. The crucial field for distinguishing a hardware keyswitch problem from a firmware-induced STOP is the way this qualifier pairs with the next event: on a true keyswitch STOP the next event is a clean 16# 530D, on firmware V5.3.0–V5.3.4 the same pair is produced spontaneously without any operator action.

Event 6 — Event ID 16# 530D (Startup Information)

The 2-millisecond spacing between Event 7 and Event 6 is the time the firmware spends after the STOP entry before it writes the startup-inhibition record. If you see this pair within <5 ms of each other and no OB84 / OB85 / OB86 / OB121 / OB122 entries between them, the STOP was generated by the firmware itself rather than by any application error or peripheral fault.

Root Cause: Phantom-STOP Race Condition in Firmware V5.3.x

The diagnostic buffer shows every signature of a firmware-issued STOP, not a hardware STOP:

1. No OB70–OB87, OB121, or OB122 diagnostic entries appear in the buffer.
2. No rack failure (OB86) or distributed-I/O failure (OB82) precedes the STOP.
3. The keyswitch was confirmed mechanically sound on a vibration bench.
4. The 2-ms pairing of 16# 4303 and 16# 530D is reproduced deterministically every time the fault is triggered.
5. Operator-induced STOP via SIMATIC Manager (Operating mode → Stop) and via SFB20 STOP on a healthy CPU produces an identical pair, confirming the buffer signature is the firmware's normal path — but on V5.3.1 the same signature is produced without any operator or application request.

Vendor analysis identified a race condition in the operating system's keyswitch / SFB20 polling logic in firmware V5.3.1: under specific timing relationships between the cyclic OB1 tick and a peripheral interrupt (typically from a DP-slave diagnostic or from the internal time-of-day interrupt at the top of a second), the firmware misreads the keyswitch input register and enters its STOP handler. The fault is non-deterministic in the field — it can appear minutes or days apart — but is reproducible on the bench with carefully timed interrupt load. The fix is contained in operating-system update V5.3.5, which resequences the keyswitch read and adds an N-sample debounce to the STOP-path input register. The firmware update is non-disruptive to the user program: the loaded blocks, the retentive flags/timers/counters, and the parameter set are preserved across the update.

Resolution: Apply Operating-System Update V5.3.5

Step 1 — Capture the User Program and Diagnostic Buffer

1. Connect the programming device to the CPU via MPI / PROFIBUS or Industrial Ethernet.
2. Open the project in SIMATIC Manager; select the S7-400 station.
3. PLC → Upload Station to PG to back up the entire project (blocks, HW Config, symbols, comments).
4. PLC → Diagnostic/Setting → Diagnostic Buffer → Save As Text File for archive purposes.
5. Note the current firmware version in PLC → Diagnostic/Setting → Module Information → "Firmware" tab.

Step 2 — Download the V5.3.5 Firmware Package

1. Open the Siemens Industry Online Support page for the V5.3.x operating-system update. Search the portal for the entry titled "Operating system update V5 for CPU412-1 / CPU412-2 / CPU414-2 / CPU414-3 / CPU416-2 / CPU416-3 / CPU417-4 / CPU414-3 PN/DP / CPU416-3 PN/DP / CPU 416F-2 / CPU 416F-3 PN/DP" and download the latest V5.3.5 or later revision.
2. Unpack the package to a known directory; SIMATIC Manager references the directory during the update wizard.
3. Verify the package checksum against the value published on the Siemens Industry Online Support page.

Step 3 — Perform the Operating-System Update

1. Place the CPU in STOP (keyswitch to STOP).
2. In SIMATIC Manager: PLC → Update Operating System.
3. Select the target CPU and verify the order number matches 6ES7 416-3XR05-0AB0.
4. Browse to the unpacked firmware directory and select the matching image file.
5. Click Update. The CPU executes the update autonomously; the SF / BATF LEDs flash alternately during the update and the RUN / STOP LEDs go dark.
6. Wait for the "Update completed successfully" dialog — typically 60–180 s for a CPU 416-3, depending on the boot-loader revision.
7. Confirm the new firmware version in Module Information: it should read V 5.3.5, boot loader V 5.3.0 (unchanged).

Step 4 — Perform a Memory Reset (MRES)

1. Turn the keyswitch to MRES; hold for at least 3 s until the STOP LED flashes slowly.
2. Release; turn back to MRES within 1 s; the STOP LED flashes rapidly.
3. Wait for the STOP LED to settle (constant ON); the CPU is now in factory state with no user program loaded.

Step 5 — Reload the User Program and Verify

1. PLC → Download to push the previously uploaded blocks and HW Config back into the CPU.
2. Warm-restart the CPU (keyswitch to RUN, or PLC → Operating Mode → Warm Restart).
3. Confirm the diagnostic buffer's first event after the restart is the standard "Restart completed" entry (Event ID 16# 4302) and no 16# 4303 entries appear unless the keyswitch is moved to STOP.

Alternative Recovery: Remote STOP via SFB20

If a firmware update cannot be performed immediately and the plant must keep running, the only operator-side workaround is to issue a controlled remote STOP followed by a warm restart whenever the fault occurs. The diagnostic buffer on a healthy V5.3.x CPU shows an identical 16# 4303 + 16# 530D pair when the operator issues a deliberate STOP via SFB20, so this path is known-good:

// Call SFB20 "STOP" in OB100 (restart) or OB1 (cyclic)
// Input:  STOP    := TRUE
// Output: STATUS  := WORD
// Notes:  SFB20 only works if the CPU key is in RUN-P

      CALL  SFB20 , DB20
        STOP   := TRUE
        STATUS := MW100

After the remote STOP, cycle the keyswitch from RUN-P → STOP → RUN-P to perform a warm restart. This is a workaround, not a fix. The phantom-STOP will recur unpredictably until V5.3.5 is installed.

Verification Procedure After Firmware Update

Field-Proven Diagnostics: How to Tell Firmware-STOP from Hardware-STOP

When you see Event ID 16# 4303 on an S7-400 CPU and want to know whether it is the firmware-issued STOP described in this article or a genuine keyswitch event, run through the following matrix:

Diagnostic Buffer Mechanism on the S7-400 CPU

The S7-400 diagnostic buffer is a non-volatile ring buffer of 120 entries held in the CPU's internal flash-backed RAM. Each entry contains:

• Event ID (2 bytes) — the symbolic event code (for example, 16# 4303 or 16# 530D).
• Qualifier / Information bytes (10 bytes) — sub-classification of the event, time stamp of the last backed-up POWER ON, the requested and actual operating modes, and CPU state flags.
• Timestamp — CPU local time, hour-resolution with millisecond fraction, taken at the moment the event is written.

The buffer is read with SIMATIC Manager → PLC → Diagnostic/Setting → Diagnostic Buffer (or via TIA Portal online → Diagnostics → Diagnostic buffer) and exported to a text file with Save As Text File. Always export the buffer before opening the offline/online comparison or performing any MRES — both operations will refresh the buffer.

SFB20 STOP — Detailed Semantics

SFB20 STOP (background OB, instance DB20) is the application-side path for forcing the CPU into STOP. Pre-conditions:

• CPU keyswitch in RUN-P.
• CALL of SFB20 from OB1, OB100, or any priority class < 26.
• Input STOP = TRUE.

Output STATUS reports the result of the call: 0000 = STOP request accepted, 8080 = keyswitch not in RUN-P, 8081 = illegal call context. SFB20 is the only legitimate application-side path that produces Event ID 16# 4303 on a healthy CPU; any other SFC that triggers a STOP (for example, SFC46 STP) is implemented on top of SFB20 and produces an identical buffer signature.

Safety and Operational Notes

Related CPUs and Cross-References

• Siemens Industry Online Support — portal home for S7-400 documentation, firmware updates, and Knowledge Base articles.
• S7-400 CPU Data Manual (Siemens Industry Online Support, manual collection) — section "Diagnostic Buffer of the CPU" for the canonical Event ID list.
• System Software for S7-300 / 400 — System and Standard Functions — reference manual covering SFB20 STOP semantics and the OB-startup matrix.
• SIMATIC S7-400 Automation System — Installation and Hardware — section on MRES, keyswitch operation, and CPU memory model.

FAQ