Resolving CP 342-5 Profibus Communication Failure in S7-300 ESD Systems

When a Siemens CP 342-5 communication processor transitions to STOP, leaves RUN, or the S7-300 panel is restarted, Profibus DP I/O from distributed ET 200M stations becomes temporarily invalid. In an Emergency Shutdown (ESD) application for oil well RTUs, this window of invalid input data causes normally-closed (NC) field contacts to be interpreted as open, triggering a full process shutdown. This reference documents the root cause, the DP_RECV status-word mechanism, and the proven bypass logic used to suppress false shutdowns during CP restart.

1. Affected System Configuration

The fault pattern described in the field report applies to the following S7-300 / CP 342-5 topology:

The CP 342-5 is configured as a DP master (class 1) when inserted in the S7-300 rack, while the CPU 317-2DP may also act as an additional DP master for other sub-nets. The ET 200M stations are the DP slaves that carry the safety-relevant NC contacts used in the ESD chain.

Reference: Siemens CP 342-5 / CP 342-5 FO Communication Processor Manual (article number 8773570).

2. Problem Description

Symptom: After any of the following events, the ESD logic asserts a shutdown for 1 to 5 seconds even though no actual field trip condition exists:

• CP 342-5 transitions from RUN to STOP (operator request, programming stop, error).
• CPU 317-2DP performs a complete restart (OB100) after power-on or MRES.
• Panel is de-energized and re-energized, including TIM 3V-IE cold start.
• CP 342-5 firmware warm restart after a Profibus fault (e.g. short circuit on segment, missing terminator).

Observable evidence in the field report:

1. ET 200M inputs read as 0 for several seconds after CP restart.
2. NC field contacts (wired to ET 200M DI modules) are interpreted as open in the application.
3. The shutdown block evaluates these false opens as a valid trip condition.
4. The CPU issues a close command to the well once the CP has re-established communication.

Internally, during the CP startup window the DP master is in CLEAR mode, then transitions to OPERATE. While in CLEAR, output data is forced to safe state and input data is not refreshed. See Siemens manual section "Responder functionality of the DP master (class 1)" and the DP state machine for CP 342-5.

3. Root Cause Analysis

The CP 342-5 acts as a DP master class 1 on the segment connecting the ET 200M stations. During the CP's own startup, three distinct phases occur in sequence:

1. Power-on / OB100 phase: CPU 317-2DP executes restart OB; CP 342-5 powers up and runs self-test. No DP frames are exchanged.
2. Parameterization and configuration phase: CP 342-5 sends parameterization and check-config telegrams to each ET 200M. Inputs are not yet valid.
3. Data exchange (DX) phase: CP 342-5 enters cyclic data exchange with each station that passed parameterization. Inputs become valid.

During phases 1 and 2, the application program reads input image bytes that have not been refreshed by the CP. In S7-300, the process image (PAE/PAA) retains its previous values, but the data received from the CP through DP_RECV still contains the last valid user frame - until the CP clears it on entering CLEAR mode. When the CP returns to OPERATE, the input data is flagged as "not updated" by setting the corresponding DP status bits in the DP_RECV status output.

Because the user program reads the input area directly (PII / PEW) rather than from a separate data validity flag, the NC contacts appear open. The ESD logic, designed to treat any open contact as a trip, fires.

4. The DP_RECV Status Word

The CP 342-5 user interface uses two standard function blocks:

FC 2 (DP_RECV) returns a DWORD status in addition to the user input data. The most relevant bits, per the CP 342-5 manual (chapter on DP status bits), are:

If any of bits 1, 2, 4, or 5 is set, the input data area returned by DP_RECV must be considered not valid and must not be used in safety-relevant decision logic. This is the diagnostic the engineer in the discussion thread is referring to.

5. Solution: Bypass the ESD Logic on CP Stop

The corrected pattern uses the CP stop bit (commonly available from the CP's diagnostic or from the DP status word) to suppress the ESD block call until the CP has re-established data exchange with all ET 200M stations. Two viable implementations exist.

5.1 Method A - Use the DP_RECV status word directly

Build a validity mask in the application and only allow the ESD logic to evaluate inputs while the mask is 0.

// STL / SCL example for S7-300
// dp_recv_status : DWORD returned by FC 2 DP_RECV
// esd_inhibit   : BOOL coil, latched
// esd_inhibit_t : TON timer, 5 s

// Mask the bits that indicate invalid input data
IF (dp_recv_status AND 16#00000036) <> 0 THEN   // bits 1,2,4,5
    esd_inhibit := TRUE;
else
    esd_inhibit := FALSE;
END_IF;

// Additional safety: hold the inhibit for at least 5 s after
// validity returns, to ride out late slave rejoin
TON_DB.esd_inhibit_t(IN := NOT esd_inhibit,
                     PT := T#5S);
IF TON_DB.esd_inhibit_t.Q THEN
    esd_inhibit := FALSE;
END_IF;

5.2 Method B - Use the CP stop / fault bit (CP-internal)

// CP-STOP bit (e.g. from CP 342-5 diagnostic DB or from
// SFC 51 / SSL on the CP slot)
// + DP_RECV status mask
// + 5 s sustained-valid timer

IF cp_stop OR ((dp_recv_status AND 16#00000036) <> 0) THEN
    bypass_esd := TRUE;
ELSE
    bypass_esd := FALSE;
END_IF;

6. Step-by-Step Implementation

6.1 Prerequisites

• STEP 7 V5.5 or TIA Portal V16+ with CP 342-5 GSD / HSP support.
• CP 342-5 firmware version visible in HW Config (right-click CP -> Module Information). For 6GK7 342-5DA02, firmware V5.x is typical.
• FC 1 (DP_SEND) and FC 2 (DP_RECV) imported from the SIMATIC NET library: SIMATIC_NET_CP -> CP 300 -> Blocks.
• Configured DP master system in HW Config with at least one ET 200M slave.

6.2 Procedure

1. Verify DP configuration. In HW Config, confirm the CP 342-5 is the master of the segment that contains the ET 200M with the NC-contact DI modules. Save and compile (Station -> Consistency Check).
2. Insert FC 1 / FC 2 calls in OB 1. Use one DP_SEND and one DP_RECV per configured DP interface. The CALL interface exposes the STATUS output as DWORD.
3. Create a global validity DB. Add tags: dp_recv_status : DWORD, cp_stop : BOOL, bypass_esd : BOOL, validity_timer : TON.
4. Implement the mask logic from section 5 above. Place it in OB 35 (cyclic 100 ms) or at the start of the ESD FB.
5. Gate the ESD block call with bypass_esd. When bypass_esd is true, hold the previous ESD state and skip the input-evaluation ladder. Do not clear the trip latch - the trip latch should only be set on a real field event, never on a CP restart.
6. Add an operator-facing HMI tag showing bypass_esd and dp_recv_status in hex. This is essential for commissioning and fault finding.
7. Document the bypass in the cause-and-effect matrix and obtain sign-off from the site's safety authority before hot operation.

6.3 Verification

1. In online -> Monitor/Modify, observe dp_recv_status in hex while the panel is running. Expected steady-state value: 16#00000000.
2. Initiate a CPU STOP->RUN. Watch dp_recv_status change through bits 1, 4, 5, 2 then settle to 0 over 2-4 s. bypass_esd should be 1 during this window.
3. Power-cycle the panel. Confirm no shutdown command is issued and the well stays open / closed as the last operator command.
4. Force a slave failure: unplug Profibus connector from one ET 200M. dp_recv_status bit 2 (or the per-slave bit in 8-15) goes high. bypass_esd goes high. ESD logic remains in last state.
5. Reconnect. bypass_esd drops after the configured 5 s hysteresis.

7. CP 342-5 Error Code Reference

The CP 342-5 reports extended diagnostics through FC 1/FC 2 return values and through the diagnostic buffer. Common error codes relevant to this scenario:

Reference: Siemens CP 342-5 manual, section "Error codes of the FC 1/FC 2 user interface".

8. Diagnostic Buffer and SSL Reads

For deeper diagnosis, read the CP 342-5 diagnostic buffer using SFC 51 (RDSYSST) with SSL-ID W#16#00B1 (module diagnostic information) and W#16#0131 (DP slave diagnostic). The diagnostic records carry the time-stamped state transitions of the CP and of each ET 200M station.

// Read CP 342-5 diagnostic buffer via SFC 51
CALL SFC 51 (
    SZL_ID   := W#16#00B1,
    INDEX    := W#16#0001,        // CP slot
    RET_VAL  := sfc51_ret,
    BUSY     := busy,
    SZL_HEADER := ssl_header,
    DR       := diag_buffer       // 32 bytes of diagnostic
);

Compare the entries to the DP_RECV status bit transitions to correlate the bypass window with actual CP events.

9. Commissioning Checklist

10. Common Pitfalls

• Reading PII directly. Some legacy S7-300 code reads PEW / PED directly from the ET 200M. This bypasses the CP_RECV status information and re-introduces the original fault. Always route the data through a DB filled by FC 2 and gate it with the status word.
• Setting bypass_esd on a real station failure. Method A treats bit 2 (station failure) as part of the invalidity mask. This is correct for the ESD logic, but operators must be alerted to a real station failure. Use the raw DP_RECV status word to drive a separate HMI alarm.
• Bypassing on a real trip. The 5 s hysteresis must not extend a real ESD trip. Keep the trip latch outside the bypassed code path - bypass only the input evaluation, never the trip output itself.
• Confusing the integrated CPU DP port with the CP 342-5 port. On a CPU 317-2DP there are two Profibus interfaces. The CP 342-5 is a separate module with its own diagnostic buffer. Make sure the status word read is from the correct CP slot.
• TIM 3V-IE cold start vs. warm start. A TIM 3V-IE cold start can extend the CP startup window by another 30-60 s if the route configuration is non-volatile. The bypass logic is robust against this; verify with a long power-cycle test.

11. Optional Enhancement: Per-Slave Validity

For multi-well RTU installations where different wells are on different ET 200M stations, the high byte of the DP_RECV status (bits 8-15) gives a per-slave bit. Use these to bypass only the affected well, leaving healthy wells on full ESD protection:

// Per-slave bypass, one bit per configured ET 200M
FOR i := 1 TO max_slaves DO
    IF (dp_recv_status SHR (i+7)) AND 1 = 1 THEN
        bypass_well[i] := TRUE;
    ELSE
        bypass_well[i] := FALSE;
    END_IF;
END_FOR;

This reduces the bypass footprint and improves the overall safety case.

12. Summary

The CP 342-5 Profibus communication failure observed during CP STOP, panel restart, or warm restart is not a hardware fault - it is the normal DP master startup behavior. The application program must treat the input data as invalid for the duration of the DP master startup, which is precisely what the DP_RECV status word (bits 1, 2, 4, 5) is designed to signal. Gating the ESD logic on a properly-masked validity flag, supplemented by a short post-validity hysteresis timer, eliminates false shutdowns without compromising the integrity of real trip conditions.

For full details on FC 1 / FC 2 return codes and the DP state machine, refer to the official Siemens CP 342-5 manual: GH_CP342-5_76.pdf.

FAQ