Resolving CPU 315-2PN/DP Fault with IE/PB Link and IM151-7 CPU

Problem Overview

When an IE/PB Link PN IO gateway is inserted between a Siemens S7-300 CPU 315-2PN/DP (6ES7 315-2EH14-0AB0 family) and an ET 200S IM151-7 CPU (6ES7 151-7AA20-0AB0), the controllers drop into SF (System Fault) / STOP while the IE/PB Link itself remains in RUN, displays no diagnostic alarms, and is fully accessible from the engineering station. The visible symptom in STEP 7 / SIMATIC Manager is that the CPU 315-2PN/DP goes into fault mode and the IM151-7 CPU also goes into fault mode, yet the IE/PB Link module is in Run mode and shows OK and is accessible.

This is a configuration symptom, not a hardware failure. The IE/PB Link has no PROFINET slot mismatch and no bus fault, so it stays online; the CPUs detect a mismatch in slot 0 / slot 2 configuration data, in PROFINET device name assignment, or in PROFIBUS DP slave I/O mapping and raise an OB 85 / OB 86 / OB 122 error that escalates to STOP without an explicit OB handler.

Affected Hardware and Firmware

Network Topology and Data Flow

The intended topology in the source configuration is a two-level PROFINET/PROFIBUS bridge:

1. CPU 315-2PN/DP acts as PROFINET IO Controller on its PN port (X1 or X2, both are PROFINET interfaces on a 315-2 PN/DP; the second port is X2 with switch functionality).
2. The IE/PB Link PN IO is a PROFINET IO Device on the same PROFINET subnet and a PROFIBUS DP Master on its downstream DP port.
3. The IM151-7 CPU is connected as a PROFIBUS DP Slave on the downstream PROFIBUS network of the IE/PB Link, OR — in the configuration shown — as a PROFINET IO Device on the same PROFINET subnet with the IE/PB Link used only for additional DP slaves.

The user's HW Config screenshot shows an explicit I/O mapping of 1 byte: IB157 (1 Byte output, QB0 of the IM151-7 CPU) -> 1 Byte Input, IB0 of the main PLC. This is a typical slot 0 / slot 1 mapping for the IM151-7 in a DP-Slave role. The mapping itself is technically allowed; the fault originates from the way the slot is configured inside the IE/PB Link head module.

Diagnostic Buffer Analysis

Open the CPU online with STEP 7 and read the diagnostic buffer (PLC → Module Information → Diagnostic Buffer). The first incoming event with a stop cause must be identified before changing any hardware. The expected entries — in time order — for this fault class are:

Document the diagnostic buffer of both controllers before downloading. The IM151-7 buffer is read through its own PROFINET/DP interface using its configured IP or PROFIBUS address.

Root Cause Analysis

Three independent root causes are commonly observed in this configuration, all of which lead to the observed symptom ("IE/PB Link RUN, both CPUs in fault mode"):

1. PROFINET device name not written to the IE/PB Link PN IO. The IE/PB Link is delivered with a blank name. Without a name it cannot be addressed by the IO Controller, the slot 0 head module reports not found, and any DP slaves behind the link generate station-failure events that the controller's OB 86 cannot acknowledge. Reference: PROFINET commissioning (entry ID 19290277).
2. HW Config slot mismatch for the IM151-7 CPU. The IM151-7 has a default slot 0 with submodule "IM151-7 CPU interface". If the project uses a generic IM151 head instead of the IM151-7 CPU variant, the slot 0 record length differs and the CPU raises an OB 85 on every cycle. The correct entry is IM151-7 CPU > Interface module > Submodule: PROFINET IO in the catalog.
3. PROFIBUS DP address and master address of the IE/PB Link. The IE/PB Link must be configured as a DP Master with a unique PROFIBUS address (default 0 is reserved for masters with class 2). The IM151-7 must be assigned a slave address that does not collide with other DP nodes on that segment.

Hardware Configuration Procedure in STEP 7

1. Open the STEP 7 project, expand SIMATIC 300 Station, double-click Hardware to open HW Config.
2. Insert the CPU 315-2PN/DP in slot 2 of the rail from SIMATIC 300 > CPU 300 > CPU 315-2 PN/DP > 6ES7 315-2EH14-0AB0 > V3.3 (or matching firmware).
3. Right-click the CPU PROFINET interface and select Properties > Ethernet > IP address. Assign a free IPv4 address from the same subnet as the IE/PB Link (default factory IP of the IE/PB Link is 192.168.0.1; change it before assigning a name).
4. Drag the IE/PB Link PN IO from the catalog (PROFINET IO > Network Components > IE/PB Link PN IO > 6GK1 411-5AB00) onto the PROFINET subnet. STEP 7 will create a PROFINET IO System on the IE/PB Link's DP port automatically.
5. Drag the IM151-7 CPU from PROFINET IO > ET 200S > IM151-7 CPU > 6ES7 151-7AA20-0AB0 either onto the PROFINET IO System of the CPU 315-2PN/DP (PROFINET topology) or onto the PROFIBUS network hosted by the IE/PB Link (PROFIBUS topology). Verify the catalog revision matches the firmware.
6. Open the IE/PB Link Properties > PROFINET device name. Enter a unique device name, e.g. iepb-link-01. The name is case-sensitive.
7. Configure the IM151-7 slot 0 module. The module should be IM151-7 CPU with submodule PROFINET IO. The slot 0 length must be 0 bytes for the IM151-7 CPU; the I/O area is mapped via the integrated digital I/O or DP/PN submodule and not via slot 0.
8. Open the I/O mapping. The example shows QB0 of IM151-7 → IB157 of CPU 315-2PN/DP as 1 byte. This is created on the Module properties of the IM151-7, tab Addresses. Do not set the address of the IE/PB Link head module itself to a non-zero slot 0; it must remain at address 0 with 0 bytes.
9. Save and compile, then download HW Config to both stations.

PROFINET Device Name Assignment

The IE/PB Link does not adopt a name by itself. The name must be written over PROFINET using one of these methods:

1. From STEP 7 (recommended): In HW Config, right-click the IE/PB Link → PROFINET device name → Assign. STEP 7 will resolve the device using LLDP and write the name to the persistent storage of the IE/PB Link.
2. From the IE/PB Link web server: Browse to the IP, log in with the admin / siemens default credentials, navigate to Module Information → PROFINET, enter the name, click Set Name. The web server is the only method that does not require a TIA / STEP 7 connection; it is used when the controller CPU is offline.
3. From the Primary Setup Tool (PST) or PRONETA: These utilities can scan the network and push a name without an online connection to the controller.

PROFIBUS DP Slave Configuration of the IM151-7

When the IM151-7 is used as a DP slave behind the IE/PB Link, additional steps are required:

1. On the IE/PB Link, open PROFIBUS DP Master System → Properties > PROFIBUS and set a master PROFIBUS address (e.g. 2). Address 1 is normally the IE/PB Link's own address; address 0 is reserved for class-2 masters.
2. Drag the IM151-7 from PROFIBUS DP > ET 200S > IM151-7 CPU > 6ES7 151-7AA20-0AB0 onto the DP Master System of the IE/PB Link.
3. Set the IM151-7 slave address to a unique value (e.g. 3). The address must match the DIP switch on the physical module — STEP 7 will warn if a mismatch exists, but the CPU will still go to fault on the first cycle.
4. Configure slot 1 with the digital I/O submodule. The mapping shown in the source (QB0 → IB0 main PLC) corresponds to a 1-byte output submodule of the IM151-7 in slot 1.
5. Save, compile, and download to the IE/PB Link. The IE/PB Link holds the DP configuration for its slaves in its own project, not in the main CPU project.

Firmware Compatibility Matrix

If the catalog and firmware do not match, the CPU diagnostic buffer will report 0xEA02 / W#16#EA02 ("Configuration of the PROFINET device does not match") on the first PROFINET AR attempt.

Step-by-Step Resolution Procedure

1. Power down all three stations. Inspect the IE/PB Link and IM151-7 labels and record firmware versions.
2. Open STEP 7 HW Config and verify each catalog entry matches the recorded firmware version. Replace any generic entries with the exact MLFB and firmware combination.
3. Assign a unique PROFINET device name to the IE/PB Link and write it using PLC → Ethernet → Assign PROFINET device name.
4. Verify PROFIBUS address DIP switches on every DP slave against the HW Config.
5. Add error-handling OBs: OB 82 (diagnostic interrupt), OB 83 (insert/remove), OB 85 (I/O access error), OB 86 (rack failure), OB 121 (programming error), OB 122 (I/O access). Without these OBs, the CPU will STOP on the first error. Reference: S7-300 CPU 31x-2 PN/DP Operating Instructions (entry ID 12996906).
6. Compile and download HW Config to all three stations. Perform a complete restart (MRES) on each CPU so the new PROFINET AR is negotiated from cold-start state.
7. Go online and read the diagnostic buffer of all three stations. The "incoming" event list must be empty after the restart.
8. Force-test the I/O mapping: set QB0 of the IM151-7 and observe the value at IB157 of the CPU 315-2PN/DP via a VAT or watch table.
9. Repeat the mapping in the opposite direction (output from the main CPU to input of the IM151-7) to verify the symmetric path is also alive.

Verification

The configuration is considered correct when all of the following are true:

• SF / BF LEDs on the CPU 315-2PN/DP, the IM151-7 CPU, and the IE/PB Link are all off.
• All three stations remain in RUN indefinitely (verified for ≥ 1 hour of process execution).
• The diagnostic buffer has no incoming events for PROFINET station failure, DP station failure, or I/O access error.
• The user I/O mapping exchanges process values in both directions with the configured length (in the source case, 1 byte output from IM151-7 → 1 byte input at the main PLC).
• The IE/PB Link web server displays the assigned PROFINET name and shows the connected DP slaves in green.

Troubleshooting Matrix

Safety and Diagnostic OB Recommendations

Distributed I/O is inherently fault-prone. The following OBs should be present in both CPU programs before commissioning is declared complete:

• OB 82 — handles PROFINET diagnostic interrupts (submodule state change). Without OB 82, a channel fault will STOP the CPU.
• OB 83 — handles submodule insert/remove events from the IE/PB Link DP port.
• OB 85 — handles I/O access errors when the process image is updated against a missing or faulty slot.
• OB 86 — handles rack / station failure, including IE/PB Link station failure.
• OB 122 — handles direct I/O access errors (load / transfer to a faulty periphery word).

A minimal OB 100 (warm restart) and OB 102 (cold restart) are also required. Reference: IE/PB Link PN IO Operating Instructions (entry ID 23644920).