Resolving CPU 319-3 PN/DP STOP on CANopen-DP Gateway Power-Up

1. Problem Statement

A Siemens SIMATIC S7-300 CPU 319-3 PN/DP (typical catalog number 6ES7318-3EL01-0AB0) is configured with a TP1500 Comfort HMI on PROFINET, a programming device (PG) on PROFINET, and a third-party CANopen-DP/2 gateway on the integrated PROFIBUS-DP interface. The user downloads the STEP 7 / TIA Portal project (including the gateway GSD file) and the CPU enters RUN. As soon as the 24 V DC supply of the CANopen-DP/2 gateway is switched on, the CPU drops back to STOP automatically, even though all four status LEDs on the gateway are green/active.

Two follow-on issues are observed once OB86 (Rack Fault) is inserted to keep the CPU in RUN:

• Issue #1 – The diagnostic buffer of the CPU shows a continuously repeating pair of events: Station Failure followed by Station Return on the distributed I/O (DP slave). This indicates that the CPU detects the gateway on PROFIBUS but loses it cyclically.
• Issue #2 – The user is new to CANopen and needs a methodical procedure to (a) address the gateway correctly, (b) wire/terminate the CAN segment, and (c) move SDO/PDO traffic between the S7-300 and the FAULHABER MCBL 3006 S AES CO drive.

2. System Topology and Components

The complete reference topology is summarized below. The CANopen-DP/2 gateway acts as a PROFIBUS-DP slave (per IEC 61158 / PROFIBUS-DP slave CANopen-DP/2) and as a CANopen master on the secondary side, exposing 240 bytes of process input and 240 bytes of process output to the DP master.

The gateway is shipped with a default PROFIBUS address of 0x11 (17 decimal), which the user must set both on the rotary DIP switches of the device and in the STEP 7 / TIA Portal hardware configuration. The T-connector, cables, and terminations referenced (C.1311.03 T-connector, C.1323.03 0.3 m cable, C.1322.03 0.3 m cable, C.1301.01 / C.1303.01 terminators) are standard CANopen accessories, typically supplied by IXXAT or HMS/IXXAT, and follow CiA DS 301 / DS 303-1 pin-out conventions.

3. PROFIBUS DP Slave Diagnostics in the S7-300

An S7-300 CPU monitors the PROFIBUS-DP segment in two ways:

1. Cyclic I/O exchange (DP-V0): The CPU polls each configured slave every bus cycle. If a slave does not respond within the configured watchdog time, the CPU raises a station failure and – if no OB86 is loaded – transitions to STOP. This is the most likely cause of the reported CPU goes to STOP when 24 V is applied to the gateway symptom.
2. Diagnostic interrupts (DP-V1): The slave signals a status change (for example, module status changed or channel diagnosis available). The CPU invokes OB82 (diagnostic interrupt). If the gateway reports an extended diagnostic that the master does not handle, the CPU may also go to STOP depending on the configured behavior.

The full PROFIBUS DP slave state machine implemented in the CPU is documented in the Siemens SIMATIC S7-300 automation system / CPU 31xC and CPU 31x: Installation and Operating Manual. The relevant organization blocks are:

Inserting OB86 alone is not enough; the project must also contain OB82, OB85, and OB122 as empty OBs, and the user program must not use direct I/O access (e.g. L IW 0) on a slot that has not been confirmed by the gateway.

4. Root Cause Analysis of the CPU STOP Transition

Five failure modes explain 95 % of "CPU drops to STOP at the moment a DP slave is energized" incidents. Work through them in this order:

1. DIP switch / project address mismatch. The gateway is set to 0x11 (17) on the rotary coding switch, but the project uses a different value, or the project address is correct but the leftmost (1's) switch group is in the wrong position. The CPU therefore tries to address a station that does not exist, raising station failure.
2. GSD file mismatch. The GSD file installed in TIA Portal does not correspond to the firmware on the gateway. The slave replies, but the master rejects the parameter telegram, and the slave enters wait-for-parameterization indefinitely.
3. Module / slot configuration mismatch. The user has added modules in the device view of TIA Portal that the gateway cannot provide (e.g. 32 words output where only 8 are mapped), or has left the default empty slot configuration. The gateway signals a configuration error, the master raises OB86 with diagnosis module configuration error, and the CPU goes to STOP.
4. PROFIBUS termination error. Termination ON at the CPU and at the gateway is correct, but a third termination on a T-connector or stub is left enabled. The reflections corrupt the parameterization telegram.
5. 24 V supply wiring or shield. A missing PE / shield bond, or a DC common that is not tied between the CPU rack and the gateway PSU, can raise common-mode noise that causes sporadic station failure / return, exactly the symptom reported in Issue #1.

The diagnostic buffer entries "Station Failure" then "Station Return" cyclically, while the gateway LEDs are all green, is the signature of case 2 or 5: the gateway briefly accepts the parameterization, then loses it, then re-accepts. This can also indicate that the gateway's watchdog is shorter than the master's slot time; the slave believes the master has gone away and resets, only to be re-parameterized on the next cycle.

5. Reading and Interpreting the Diagnostic Buffer

Open the project in TIA Portal, go online, and select Online & diagnostics → Diagnostics buffer on the CPU. The buffer is read-only and time-stamped. Look specifically for entries that contain:

• Station failure – event ID 0xE380 for DP, 0xE382 for PROFINET.
• Station return – event ID 0xE381 / 0xE383.
• Distributed I/O: station failure – OB86 was called but the user has not processed OB86_START_INFO to identify the failed slot.
• I/O access error when reading – OB85 / OB122 (user program reads a non-existing input word).

For every station failure entry, drill into the Details pane. The logical base address of the failed DP slave is shown; compare it to the configured I/O start address in the device view. If the address does not match, the user has not selected the same physical PROFIBUS address that is set on the gateway's DIP switches.

6. Installing the GSD File and Configuring the CANopen-DP/2 Gateway

The CANopen-DP/2 gateway is a PROFIBUS-DP slave conforming to IEC 61158 with 240 bytes input and 240 bytes output. To integrate it in TIA Portal V16 or later:

1. Download the GSD file (typically *.gsd or *.gsd.gz) from the gateway manufacturer's support page. Do not import a GSD from a different firmware revision.
2. In TIA Portal: Options → Manage general station description files (GSD) and point to the downloaded file. TIA installs it under Other field devices → PROFIBUS DP → Gateway in the hardware catalog.
3. Drag the gateway into the PROFIBUS subnet. Set the PROFIBUS address to 17 to match the DIP switch (0x11 = 17 decimal).
4. Open the device view of the gateway. Insert exactly the modules that correspond to the CANopen I/O image the user needs. Typical layout for a single FAULHABER drive is:
   • Slot 0 – gateway diagnostics (8 bits input)
   • Slot 1 – Universal module (configurable PDO length, e.g. 8 bytes input / 8 bytes output)
   • Slot 2 – second universal module if more PDOs are required
5. For each universal module, configure the start addresses so that the cycle OB (OB1) can address them. The default I/O start address in TIA is shown in the properties of the slot, e.g. IW 256 / QW 256.

Save, compile, and download the hardware configuration only (not the user program) to the CPU, then go online and observe whether the gateway reports DP-V1 diagnostic: OK in the diagnostic buffer. If yes, the parameterization is correct; the CPU will no longer go to STOP at power-up.

7. Handling the Universal Module in TIA Portal

The "universal module" is a configurable slot whose length is set by the gateway's configuration tool, not by TIA Portal. The mapping is:

To add or resize a universal module:

1. Open the gateway's configuration tool (e.g. Helmholz ToolBox, HMS IXXAT CANopen Configurator, or Intreis CW-CONFIG). The tool is supplied by the gateway vendor, not by Siemens.
2. Import the EDS / DCF file of the FAULHABER MCBL 3006 S AES CO drive. The standard FAULHABER EDS file follows CiA 301 / CiA 402.
3. Map the desired TPDOs of the drive to the gateway's internal image at the byte offset that matches the universal module configured in TIA Portal. For example, if the universal module starts at input byte 0 and is 8 bytes long, map TPDO1 (statusword, actual position, actual velocity) to bytes 0..7 of the gateway image.
4. For SDOs (acyclic, parameter channel), leave one of the slots configured as SDO rather than PDO. The SDO is accessed via RDREC / WRREC in the user program (see next section).
5. Export the gateway configuration to the device (typically via USB or the gateway's web UI). The gateway stores it in non-volatile memory; the configuration is retained across power cycles.

8. SDO and PDO Exchange Through the CANopen-DP/2 Gateway

There are two classes of CANopen traffic over the gateway:

• PDO (Process Data Object) – cyclic, real-time, mapped directly to the I/O image. The PLC reads IB x / writes QB x in OB1 and the gateway does the rest.
• SDO (Service Data Object) – acyclic, used for parameterization (e.g. setting the position loop gain, reading the device name, changing the node ID). On PROFIBUS-DP-V1, SDOs are transported using the RDREC / WRREC system function blocks.

A typical SCL snippet to read an SDO from the FAULHABER drive (object 0x1008 — manufacturer device name) on slot 1 of the gateway at DP address 17 is:

// Read SDO: index = 0x1008, subindex = 0x00
#status := RDREC(
    REQ     := TRUE,
    ID      := 17,                         // PROFIBUS address of gateway
    INDEX   := 16#1008,                    // CANopen object dictionary index
    MLEN    := 4,                          // record length
    VALID   := #valid,
    BUSY    := #busy,
    ERROR   := #error,
    STATUS  := #rec_status,
    LEN     := #rec_len,
    RECORD  := #sdo_buffer);               // destination P#DBX0.0 BYTE 4

For a write, use WRREC with the SDO payload in little-endian byte order. The INDEX parameter of RDREC / WRREC on a CANopen-DP/2 gateway corresponds to the CANopen object dictionary index; the gateway performs the SDO segment transfer to the drive and returns the result on the next call.

For motion control (profile torque, profile velocity, profile position modes per CiA 402), send the appropriate controlword (0x6040), target position (0x607A), and modes of operation (0x6060) as SDOs at startup, then operate the drive cyclically via PDOs in OB1 for low latency.

9. PROFIBUS Wiring, Termination, and Shielding Best Practices

The user's wiring description is technically correct in topology but contains two common termination mistakes. Apply the following checklist, derived from the Eaton SmartWire-DT gateways / CANopen and PROFIBUS-DP commissioning guide and the general PROFIBUS installation guidelines:

1. Terminations count. A PROFIBUS segment must have exactly two terminations, one at each physical end of the trunk. The CPU (X2) and the gateway are both ends — both terminations ON, no others. If the T-connector on the CAN side has its own 120 Ω terminator (C.1301.01), verify it is enabled only at the two physical ends of the CAN segment.
2. Stub length. Keep CAN stubs as short as possible (< 0.3 m for 1 Mbit/s) and use the dedicated stub cables (C.1323.03 / C.1322.03 in the user's case).
3. Shield bonding. Bond the PROFIBUS cable shield to functional earth at both ends, using 360° low-impedance clamps. For CAN, bond the shield at both ends as well, with a low-pass RC network (1 MΩ in parallel with 1 nF) at one end only if a ground loop is present.
4. 24 V DC common. The M (0 V) of the gateway PSU must be tied to the M of the S7-300 PSU. Floating grounds will create a common-mode voltage that the gateway's CAN driver interprets as bus errors and the master sees as station failure.
5. Baud rate. For 1.5 Mbit/s PROFIBUS, the maximum stub length drops to 0.3 m. For 12 Mbit/s, stubs are not allowed at all. The user has not stated the baud rate; if the default 1.5 Mbit/s is in use, the wiring is fine; if 12 Mbit/s is forced, the T-connector C.1311.03 between the gateway and the drive may be too long.

For a deeper treatment of the same engineering rules applied to DP gateways, the ABB PROFIBUS DP devices overview provides a useful reference architecture, particularly for the segment topology and the maximum 32-station rule.

10. FAULHABER Drive Commissioning from TIA Portal

The user has already proved the drive electrically by running it in FAULHABER Motion Manager. To drive it from the S7-300:

1. In Motion Manager, export the drive's EDS file and the current configuration. Note the configured node ID (default 1) and the active TPDOs / RPDOs.
2. In the gateway configuration tool, scan the CAN bus, add the drive with the correct node ID, and assign TPDO1 → Statusword / actual position to byte 0 of the gateway image, TPDO2 → actual velocity / actual current to byte 8, and so on.
3. Map RPDO1 (Controlword / target position) to the corresponding output bytes in the gateway image.
4. In TIA Portal, add a universal module of the right size in the device view of the gateway. The PLC start address is, for example, IB 256 … IB 271 for inputs and QB 256 … QB 271 for outputs.
5. In OB1, copy the controlword into QB 256 (e.g. 0x0006 for Shutdown, 0x0007 for Switch On, 0x000F for Enable Operation, 0x003F for New Set-point) and the target position into QD 258.

For SDO access to objects such as 0x6060 (modes of operation) and 0x6081 (profile velocity), use WRREC as shown in section 8. Always switch the drive to the desired mode of operation (1 = profile position, 3 = profile velocity, 6 = homing) with an SDO write to 0x6060 before issuing cyclic PDO commands, or the drive will report a mode of operation not supported emergency message.

11. Verification and Commissioning Checklist

Before declaring the system commissioned, verify every line of the table below. Each row corresponds to a measurable condition.

12. Frequently Asked Questions