Resolving BF2 Bus Fault on S7-400 CPU 414-2DP with KTP600-DP

Problem Overview: BF2 Bus Fault When Integrating KTP600-DP HMIs

Integrating additional KTP600-DP panels into a Profibus segment that already hosts a SIMATIC S7-400 CPU 414-2DP (order number 6ES7414-2XG03-0AB0), a PC station, nine SIMOVERT MASTERDRIVES with CBP2 communication boards, and eleven ET 200 distributed I/O stations can produce a class of faults that look contradictory: the HMI buttons operate the program logic, ET 200 outputs toggle correctly, yet the CPU's BF2 (Bus Fault on interface 2) and EXTF (External Fault) LEDs flicker continuously. The diagnostic buffer intermittently reports one of the master drive addresses as missing, even though no cable change has been made.

This is a classic multi-master token-passing conflict on a Profibus DP segment. The KTP600-DP, when configured by default in WinCC flexible 2008, acts as an active DP class-1 master. Adding four such devices to a segment whose DP master is the CPU 414-2DP overloads the token ring and corrupts the poll cycle, which is exactly what the diagnostic buffer is reporting. The fix is to take the four HMIs out of the active master pool and place them on the bus as DP slaves behind a DP/DP coupler, or to operate them in passive DP slave mode against the CPU as the sole master.

System Architecture and Hardware Identification

The starting point for any diagnosis is to lock down the exact order numbers, firmware versions, and tool versions. The configuration in this scenario is:

Engineering software in use:

• STEP 7 V5.5 SP1 for the S7-400 hardware configuration and program.
• WinCC flexible 2008 SP3 for the KTP600-DP image and connection table.

Profibus segment parameters currently set:

Understanding the BF2 and EXTF LED Indicators

The S7-400 CPU 414-2DP has two Profibus-capable interfaces:

• IF1 (X1): combined MPI / DP, indicator BF1.
• IF2 (X2): dedicated DP master, indicator BF2.

The meaning of the indicators, per the Siemens SIMATIC S7-400 CPU 414-2 DP manual (entry ID 10869717 on the Siemens Industry Online Support portal):

The pattern observed — high-frequency BF2 flicker, intermittent EXTF, and a single master-drive address missing in the diagnostic buffer — is the fingerprint of token-cycle jitter caused by competing active DP masters on the same physical segment.

Profibus DP Master vs. Slave Topology Rules

Profibus DP uses a logical token ring. Only active stations (class-1 and class-2 masters) participate in token passing. Slaves do not hold the token; they only respond when polled by the master that currently holds the token. The protocol rules that govern this are defined in IEC 61158 / EN 50170 (Profibus DP) and are summarized operationally in the Siemens Profibus Network Manual:

• A Profibus DP segment may contain multiple active masters, but each one consumes a portion of the token rotation time (T_TR).
• At 1.5 Mbps with HSA = 126, the target rotation time for a stable bus is tight. Every additional active master adds a non-trivial per-master overhead (TID1 + TID2 + slot time per polled slave).
• HMIs such as the KTP600-DP default to active master mode because they implement their own data-acquisition cycle (read inputs, write outputs from the HMI image, update tags). The WinCC flexible connection table is essentially a small polling engine.

The two valid integration patterns for a KTP600-DP into an existing CPU-414-2DP master segment are:

Root Cause: Multiple Active DP Masters on a Single Segment

The four KTPs are being added to a segment that already contains the S7-400 CPU 414-2DP as a class-1 master and a PC station that is also running an active connection. With the HMI connection's "only master on the bus" checkbox cleared, WinCC flexible 2008 configures the KTP600-DP as a class-1 master that joins the token ring.

The diagnostic evidence matches a token-handoff problem:

1. The diagnostic buffer shows a single CBP2 master drive address as missing intermittently. A master drive is a pure DP slave; it is polled by the CPU. If the CPU misses one poll, the diagnostic buffer logs a Station Failure entry with event ID 0x0E32 (DP slave diagnostics: station failure) for that slave's Profibus address.
2. The EXTF LED toggles in lockstep with the BF2 flicker, because the OB86 / OB82 error / fault organization blocks trigger on every transient station loss.
3. The high-frequency flicker of BF2 (versus the slow 0.5 Hz flicker of a hard bus break) is the signature of a poll response timeout — the master drive slave did not answer in time because the previous token holder (one of the KTPs) used more than its allocated slot.

The reason the buttons still work is that the HMI's write requests are still landing at the CPU — they arrive on a different cycle than the poll that the master drive missed. The bus is degraded but not dead. Adding the fourth KTP pushes the token rotation time over the limit for the 1.5 Mbps configuration.

Diagnostic Buffer Analysis Procedure

Open the online diagnostic buffer of the CPU in STEP 7 (PLC → Diagnostic/Setting → Diagnostic Buffer) and read the most recent events in order. Filter for the following Event IDs, which are the most relevant for Profibus master/slave events on S7-400 CPUs:

In addition, in WinCC flexible 2008 open the HMI's Connections editor, select the S7-400 connection, and verify the Bus mode field. The two values that matter are:

• "Only master on the bus" checked → the KTP tries to be the sole DP master; the CPU 414-2DP is configured only as a passive target → fatal for S7-400 master operation.
• "Only master on the bus" cleared, Number of masters set to 1 → KTP still joins the token ring as one of N masters; this is the configuration causing the present symptoms.

Neither option implements true DP slave behaviour for the HMI. The correct setting is to switch the connection type in WinCC flexible to a Profibus-DP slave connection, which is a different object than the master connection.

Resolution Path: Two Accepted Configurations

There are two reliable ways to remove the multi-master conflict:

1. Pattern A — Run the KTP600-DP as a DP slave against the CPU. Use the WinCC flexible option "Use HMI as DP slave" in the connection's Properties dialog. The CPU then polls the KTP as if it were any other DP slave. No token is given to the HMI. Bus becomes single-master again.
2. Pattern B — Isolate the HMIs behind a DP/DP coupler. Wire the four KTP600-DP devices onto a separate Profibus segment terminated by a 6ES7158-0AD01-0XA0 DP/DP coupler. The CPU 414-2DP sees the coupler as a single slave; the HMIs see the coupler as a single master. Each segment has one active master.

For this scenario, Pattern A is the lower-cost, lower-effort fix and should be applied first. Pattern B is the correct choice if the HMIs must read data directly from a Profibus slave that is not the CPU (e.g., a third-party encoder or a remote I/O island that the CPU does not own).

Step-by-Step Resolution: WinCC flexible 2008 DP-Slave Configuration

The procedure below converts one of the KTP600-DP panels from DP master to DP slave. Repeat it for the remaining three panels, assigning each a unique Profibus address (120 / 121 / 122 / 123) and a unique slot in the CPU's DP slave I/O map.

1. Open the WinCC flexible 2008 project that is already downloaded to the KTP600-DP. Go to Project → Change device type and confirm that the configured device is 6AV6647-0AD11-3AX0 (KTP600-DP color, basic panel).
2. Open Project → Connections. Delete any existing S7-400 connection that has Bus mode = DP master (the field will be visible in the connection's Properties dialog under Network).
3. Right-click in the empty Connections list and add a new connection. In the wizard, choose the PLC family SIMATIC S7 300/400 and the connection type PROFIBUS (DP Slave). Confirm with Next.
4. In the connection's Properties → Network tab:
   • Set Profibus address to the panel's HW address (e.g., 120). The DIP switches on the back of the KTP must match.
   • Set Baud rate to 1.5 Mbps and HSA to 126.
   • Set Profile to DP, Master / Slave to Slave.
   • Enable the slot configuration table that defines the input and output areas the CPU will read / write. The KTP exposes a fixed I/O footprint (typically 16 bytes of inputs and 16 bytes of outputs, slot 0). This is the area used to exchange tag values between the CPU and the HMI.
5. Open Project → Device → Communication → Connections, select the new slave connection, and click Tag connection test. Tags are now read / written by the CPU through the slave I/O area, not by the HMI driving the bus.
6. Compile the project (Project → Compiler → Generate) and download to the KTP600-DP. Power-cycle the panel after the download so the DP slave interface re-initialises cleanly.

STEP 7 V5.5 SP1 Hardware Configuration: Adding the KTP as a Slave

After converting the HMI to a slave in WinCC flexible, the CPU's hardware configuration in STEP 7 must add a matching DP slave entry. Without this, the CPU will not poll the HMI and the connection will not establish.

1. Open the STEP 7 V5.5 SP1 project. Open HW Config and navigate to the Profibus subnet that connects to the CPU 414-2DP's IF2 (X2 port). Confirm that the existing nine CBP2 master drives and eleven ET 200 stations are present on the same subnet.
2. Open the PROFIBUS DP catalog folder in the right pane. Browse to DP-Slaves → HMI → KTP600-DP. The exact catalog entry varies with the HSP installed; if the device is not listed, use DP-Slaves → Other → Generic DP slave and import the GSD file SIEM815C.GSD shipped with WinCC flexible 2008.
3. Drag the KTP600-DP device onto the Profibus subnet. Assign it the same Profibus address used in the WinCC flexible project (e.g., 120). Confirm the slot table: input slot 0 (16 bytes) and output slot 0 (16 bytes).
4. Double-click the CPU 414-2DP and open the Communication tab. Under PG/OP Communication confirm that the OP connection resource is still available. Each HMI consumes one OP connection resource; four KTPs require four free OP connections. The CPU 414-2DP provides 16 OP connections maximum — if all are used, the connection will fail with resource error.
5. Click Save and Compile, then PLC → Download to Target. When the download completes, the BF2 LED should go off, the EXTF LED should clear, and the diagnostic buffer should stop logging 0x0E32 events for the master drives.

Physical Layer Verification: Shielding, Termination, and Cable Length

Once the protocol-level fix is in place, verify the physical layer so that the fix is stable. The Pro-face / Siemens integration note for the S7-200/300/400 family (GPW-SIE MPI manual) provides the canonical rules that also apply to the Profibus segment attached to the S7-400:

• Shielded cable is mandatory. The cable shield must be bonded to the connector backshell on both ends. The shield must contact the connector housing 360°, not via a drain wire pigtail.
• Functional Earth (FG) line of the shielded cable must be terminated at either the grounding point (GP) of the cabinet or the functional earth of the PLC, but never both. The selection depends on the cabinet's equipotential bonding. A double-ended FG termination that is not on a low-impedance equipotential surface will inject circulating currents and cause intermittent BF2 events that look like software problems.
• Termination: Profibus requires active termination at both physical ends of the segment. The CPU 414-2DP and the last slave each need a terminating resistor switched on. The four KTP600-DP panels must not be left in the middle of the segment with termination off; verify the order of devices along the cable so that the two end devices are terminated.
• Cable length at 1.5 Mbps: maximum trunk length per segment is 200 m with standard Profibus cable (Type A, characteristic impedance 150 Ω). The 9 master drives + 11 ET 200s + 4 KTP600s is well within that physical limit, but if repeaters are used, check the segment-by-segment length.
• Stubs: any unterminated drop cable longer than 1 m at 1.5 Mbps creates a reflection source. Use a Profibus repeater (6GK1500-0AA10) at the stub boundary if a star topology is unavoidable.

Verification Checklist and Commissioning Test

After reconfiguring the four KTP600-DP panels as DP slaves and downloading the new HW Config to the CPU 414-2DP, run the following checks. The pass criterion for each step is explicit.

If BF2 still flickers after step 1–7, the most likely residual cause is an address conflict. Open the Bus Nodes page in STEP 7 and verify that no address appears twice. A duplicate address causes the slave to be silently rejected by the master while the slave hardware does not flag a local error.

Why the Master Drives (CBP2) Were the First Symptom

The CBP2 board in a SIMOVERT MASTERDRIVES implements a PPO (Parameter Process Object) type 1 or type 4 profile with a 4-byte process data word (PKW) and a 4-byte or 12-byte process data field (PZD). The Profibus slave firmware on the CBP2 does not tolerate a long response timeout: the CBP2 returns a parameter error (P947 = 1, "no bus communication") and stops processing PZD, which is why one drive was reported as missing in the diagnostic buffer even though the cable was intact.

The ET 200 stations are more tolerant: their IM 153 / IM 151 interface modules hold the last valid process image for several hundred milliseconds, so a missed poll does not produce an external fault. The CB2 master drives react within one or two missed polls, which is why the EXTF LED tracks the BF2 LED even though only one drive is named in the buffer at a time.

Common Pitfalls and Field-Notes

• WinCC flexible 2008 number-of-masters setting: this setting is informational only. It tells the HMI how many masters to expect on the bus. It does not make the HMI a slave. Do not rely on it as a fix for a multi-master problem.
• DP/DP coupler orientation: a DP/DP coupler is direction-sensitive. The left Profibus port is typically the one connected to the CPU-414-2DP segment; the right port is the HMI segment. Swapping the two ports puts the CPU on the same segment as the HMI master and re-creates the original problem.
• KTP600 PN vs KTP600-DP: only the DP variant supports Profibus DP. The PN variant has Profinet only. Verify the part number on the back of the panel — 6AV6647-0AD11-3AX0 is DP; 6AV6647-0AE11-3AX0 is PN. The WinCC flexible device catalog must match the variant.
• GSD file version: the GSD SIEM815C.GSD shipped with WinCC flexible 2008 must be installed in STEP 7 V5.5 via Options → Install GSD file. A newer GSD may exist in STEP 7 V5.5 SP2 / SP3; use the one that matches the firmware of the HMI.
• STEP 7 SP upgrade: STEP 7 V5.5 SP1 is supported with WinCC flexible 2008 SP3. Mixing SP2 / SP3 hotfixes can produce catalog drift where the HMI is not visible in HW Config.
• OB86 programming: every DP slave event triggers OB86 start / end. If OB86 is not loaded, the CPU goes into STOP on the first 0x0E32 event. With OB86 loaded, the EXTF LED only flags the event and the CPU stays in RUN, which is the expected behaviour for a degraded-but-running segment.

Summary of the Resolution

The four KTP600-DP panels were added to a Profibus segment that already contained a CPU 414-2DP and a PC station as active class-1 masters, plus nine CBP2 master drives and eleven ET 200 stations as slaves. The default WinCC flexible 2008 connection made each KTP an additional active master, which loaded the token rotation time of a 1.5 Mbps segment beyond its stable limit. The result was intermittent poll-response timeouts on the CBP2 slaves, recorded as 0x0E32 events in the diagnostic buffer, with the CPU reporting a flickering BF2 and EXTF. The fix is to convert each HMI from DP master to DP slave (Pattern A) or to isolate the HMI segment with a DP/DP coupler (Pattern B). After the conversion, the segment returns to single-master operation, the diagnostic buffer clears, and the existing data exchange continues without modification to the user program.