Resolving S7-200 PPI Communication Failures in Micro/WIN

David Krause18 min read
S7-200SiemensTroubleshooting
Licensed PE Working through this on a live machine? A Maine-licensed engineer can take it from here — included with IMD hardware, by the hour for everything else. Book an engineer

1. Problem Overview

After a successful program download, a Siemens SIMATIC S7-200 CPU (CPU 212, 214, 215, 216, 221, 222, 224, 224XP, 226) suddenly stops responding to STEP 7-Micro/WIN on a PC connected through a PC/PPI or USB/PPI adapter. The communication path that worked reliably for months (or years) now produces timeout errors, "Cannot find station on network" messages, or "Connection failed" dialogs. The PLC runs the loaded program (the application is still working), but Micro/WIN can no longer go online, perform an upload, or download a corrected block.

The root cause is almost always one of four conditions introduced or exposed by the most recent download:

  1. The CPU port (Port 0 or Port 1) was reassigned to a special mode — Freeport, USS master, Modbus RTU master, or a user-written ASCII protocol — by a program block that Micro/WIN cannot override while the CPU is in RUN.
  2. The port baud rate, address, or protocol was permanently written to the system block by the downloaded program at a value Micro/WIN is not currently scanning.
  3. The PPI/USB cable has failed (USB driver issue, blown RS-232 transceiver, or a port that no longer enumerates).
  4. The CPU has entered a non-recoverable state that requires a memory reset.

This article walks through the diagnostic path, from quick port/baud checks through EEPROM-based factory reset, and lists every cable, driver, and address setting that must be verified before the PLC is declared dead.

2. S7-200 Communication Architecture and PPI Protocol

The S7-200 CPU exposes one or two RS-485 ports (Port 0 is always present, Port 1 is available on CPU 215, 216, 224XP, and 226). Each port is a multi-drop PPI (Point-to-Point Interface) network that supports baud rates of 9.6 kbaud, 19.2 kbaud, and 187.5 kbaud, with the latter being the default and the only rate that supports multi-master PPI traffic. Every S7-200 port has a station address (default 2 for Port 0, default 1 for Port 1) and a master/slave token-passing role.

Table 1 — Default PPI Parameters per Port
Parameter Port 0 Default Port 1 Default
Station address 2 1
Baud rate 9.6 kbaud (factory) 9.6 kbaud (factory)
Highest station address 31 31
Protocol PPI slave PPI slave
Mode PPI/Freeport switchable PPI/Freeport switchable

Micro/WIN acts as a PPI master. It transmits token frames at the configured baud rate, expects a slave acknowledgement, and only then negotiates the connection. If the CPU port is in Freeport mode, it ignores the token frame because the S7-200 firmware has handed the UART to the user program — at that point PPI is impossible regardless of physical cable health. A CPU in STOP retains the system-block port configuration but does not execute Freeport instructions, which is why placing the CPU in STOP almost always restores a usable link.

3. Common Root Causes of PPI Communication Failure

Table 2 — Fault Matrix: Symptom to Likely Root Cause
Symptom in Micro/WIN Likely Root Cause First Action
"Cannot find station on network" with PLC in RUN Port in Freeport (USS/Modbus/ASCII) Toggle PLC to STOP, retry
Connection works in STOP, fails in RUN USS_INIT or MBUS_CTRL/MBUS_MSG2 active on port Verify SMB30/SMB130 bit values
Timeout at 9.6 k, succeeds at 187.5 k (or vice versa) Baud rate stored in system block differs from PC setting Enable "Search all baud rates" in Communications dialog
"Communication error 0x00000001" with no LED activity on cable Cable failure, USB driver corruption, wrong COM port Check Device Manager, swap cable, swap USB port
Works on PC #1, fails on PC #2 with identical software PG/PC interface set to a different access point Reassign Micro/WIN access point to PC/PPI cable
All PCs fail, PLC in STOP, no PPI LED on CPU CPU port physically damaged or firmware locked EEPROM factory reset

4. Pre-Diagnostic Checklist

Confirm each item below before opening Micro/WIN. Skipping any one of these is the most common reason a "mystery" communication failure drags on for days.

  1. Power is applied to the S7-200 and the CPU is in a non-fault state. The SF/DIAG LED must be off; the RUN LED may be on or off depending on mode.
  2. The PPI cable is the Siemens 6ES7 901-3BF20-0XA0 (USB/PPI, isolating) or 6ES7 901-3DB30-0XA0 (USB/PPI, non-isolating) or the legacy RS-232 PC/PPI cable 6ES7 901-3CB30-0XA0. Generic USB-RS485 adapters do not implement the Siemens PPI framing and will never communicate.
  3. For USB cables, the S7-200 PC/PPI USB driver is installed. In Windows Device Manager the cable must appear under "Ports (COM & LPT)" as "Siemens PC/PPI cable #0301" (or similar). Reinstall from the Micro/WIN installation media if absent.
  4. Note the COM port number assigned to the cable. USB cables occasionally enumerate to a different COM number after driver re-enumeration or Windows updates.
  5. The PC is not running software that reserves the COM port (Hyperterminal, Putty, TIA Portal, or another Micro/WIN instance).
  6. The CPU mode selector is physically in STOP or TERM (TERM allows software mode switching if the system block permits).

5. Step-by-Step Diagnostic Procedure

Execute the steps in order. Do not skip ahead to EEPROM reset — that is a last resort, not a first action.

Step 1 — Place the CPU in STOP

Turn the physical mode switch to STOP. The RUN LED must turn off and the STOP LED must turn on. If the CPU is in TERM and the switch is inaccessible, use Micro/WIN > PLC > Stop, but this only works if the port is still responsive.

The reason this is always the first step: a Freeport-mode user program only executes in RUN. Stopping the CPU releases the UART, and the port reverts to the system-block PPI configuration. Many "bricked" S7-200s come back to life the moment STOP is forced.

Step 2 — Open Micro/WIN Communications Dialog

Launch STEP 7-Micro/WIN v4.0.0.81 (or any v4.0.x). On the left navigation bar click Communications, or use the menu View > Component > Communications. The Communications dialog appears with a double-pane layout: PC/PPI cable properties on the left, network nodes on the right.

Step 3 — Set the PG/PC Interface (Access Point)

Click Set PG/PC Interface. In the dialog that opens:

  1. Set "Interface Parameter Assignment Used" to Micro/WIN > PC/PPI cable (PPI) or, for the USB cable, Micro/WIN > USB > PC/PPI cable (PPI).
  2. Click Properties. On the PPI tab confirm the COM port matches Device Manager, transmission rate matches what you are testing, and the timeout is at least 3000 ms.
  3. If you are uncertain of the baud rate, click the Search all baud rates checkbox on the main Communications dialog. Micro/WIN will then probe 9.6, 19.2, and 187.5 kbaud before reporting failure.

The Siemens SiePortal community also documents this exact sequence: open PG/PC interface from inside Micro/WIN, verify the Access Point Micro/WIN is set to the PC/PPI cable, then click Properties to confirm baud rate, address, and timeout. See the discussion thread at S7-200 Communication Problem — SiePortal for the canonical Siemens-side procedure.

Step 4 — Double-Click "Search All PPI Masters" or Use "Double-Click to Refresh"

In the right-hand "Find PPI masters" pane, double-click the Double-click to refresh icon at the top. Micro/WIN broadcasts a PPI search frame. If the CPU is found, its address appears in the list and you can double-click it to establish online connection. If nothing appears, proceed to Step 5.

Step 5 — Swap Cables and COM Ports

Try each of the following, in order:

  1. A known-good Siemens USB/PPI cable from a working bench PLC.
  2. The same cable in a different physical USB port. Windows may assign a higher COM number that Micro/WIN is not scanning.
  3. An RS-232 PC/PPI cable connected directly to a built-in COM port (eliminates USB driver variables entirely).
  4. A different PC with a fresh install of Micro/WIN 4.0 SP9 (the final service pack, build 4.0.0.81 or 4.0.0.82). This isolates the issue to either the cable, the CPU, or the PC's COM stack.

USB/PPI cables, especially the non-isolating 6ES7 901-3DB30-0XA0, are notorious for intermittent failures. Field experience shows that any USB/PPI cable more than five years old is suspect.

Step 6 — Check the Mode-Selector DIP Switches (PPI Adapter)

The legacy PC/PPI cable (6ES7 901-3CB30-0XA0) has a bank of 5 or 8 DIP switches on its RS-232 DB9 end. The switches select baud rate, PPI/MPI/Freeport mode, and whether the cable is the network master. A bumped switch can change the cable from master to slave, or change the baud rate, without any software warning.

Table 3 — DIP Switch Settings for PC/PPI Cable (DB9, 5-Switch Bank)
Switch Block Setting Meaning
SW1 / SW2 ON / OFF 9.6 kbaud (legacy slow mode)
SW1 / SW2 OFF / ON 19.2 kbaud
SW1 / SW2 ON / ON 187.5 kbaud (default, most common)
SW3 OFF 11-bit PPI frame (correct for S7-200)
SW3 ON 10-bit frame (legacy, do not use)
SW4 OFF Cable is PPI master (correct)
SW4 ON Cable is slave (incorrect — Micro/WIN needs master)
The 8-switch cable uses switches 1–4 for baud, 5 for 10/11-bit, 6 for master/slave, 7 and 8 reserved. Consult the legend printed on the back of the cable housing — Siemens has shipped at least three DIP switch layouts and the silk-screen is the only reliable reference.

6. Port Mode Conflicts: Freeport, USS, and Modbus

The single largest reason an S7-200 stops responding to Micro/WIN after a successful download is that the program just loaded reconfigures the port to Freeport. The configuration is set in the system block (Port 0 in SMB30, Port 1 in SMB130) or by a special-function block call at runtime.

Table 4 — Special-Function Blocks that Hijack the PPI Port
SFB Name Port Affected Effect on PPI
USS_INIT USS protocol initialize Port 0 (typically) Port goes Freeport; Micro/WIN cannot connect in RUN
USS_INIT_2 USS init for Port 1 Port 1 Port 1 goes Freeport
MBUS_CTRL Modbus RTU master init Port 0 Port 0 goes Freeport at configured baud
MBUS_CTRL2 Modbus init for Port 1 Port 1 Port 1 goes Freeport
MBUS_MSG2 Modbus message handler Both Uses already-initialized Freeport
XMT / RCV Transmit / Receive Both Switches port to Freeport; persists in SMB30/SMB130
User-written ASCII protocol Custom Both Configures UART directly; PPI is gone

To confirm Freeport is the issue, scroll the user program in Micro/WIN and search for any of the SFBs above. If found, the program intends to release the port. Communication with Micro/WIN in RUN is not possible while the program executes these blocks. Communication in STOP is always possible because STOP halts all OB1 cycles.

If you must communicate while the CPU is in RUN (for online editing, for example), the port mode must be set back to PPI by writing a value with bits 0–3 of SMB30 (Port 0) or SMB130 (Port 1) cleared. A safe PPI value is 16#00 for 9.6 kbaud PPI slave, or 16#C0 for 187.5 kbaud PPI slave. Read the current value first — overwriting it without reading is a common cause of permanent Freeport lock-in.

7. Baud Rate Mismatch Resolution

The download dialog in Micro/WIN shows the current system block baud rate in parentheses next to the port address, e.g. "2 (187.5 kbaud)". If this field is blank or the wrong number, the system block on the CPU was overwritten by a download. The simplest fix is:

  1. Open the Communications dialog in Micro/WIN.
  2. Click Search all baud rates.
  3. Click Double-click to refresh. Micro/WIN will now try 9.6, 19.2, and 187.5 kbaud sequentially.
  4. Whichever rate succeeds is the rate stored in the CPU. Note it.
  5. Set that rate as the fixed rate in Set PG/PC Interface > Properties > PPI and reconnect.

If the search returns nothing, the CPU is likely in a state where it cannot respond to PPI requests at any standard baud rate. Proceed to the factory-reset section.

Baud rate is part of the system block (SDB0 / SDB1). The S7-200 firmware always responds at the system-block rate, never at the rate the program requests dynamically. If a user program changes the rate to a non-standard value (e.g., 38.4 kbaud for a custom Modbus variant), the CPU will be invisible to Micro/WIN at all three standard rates, and only a STOP condition or factory reset will recover it.

8. PPI Cable Verification and DIP Switch Settings

If a known-good cable has been tried and the search still fails, the issue is not the cable. But if the same cable is used on a different CPU and works, the cable is fine. Three quick cable-level checks:

  1. USB cable: unplug, wait ten seconds, plug into a different USB port. In Device Manager verify the new COM number matches what Micro/WIN is set to scan. Reinstall the S7-200 PC/PPI USB driver if the device shows a yellow warning triangle.
  2. RS-232 PC/PPI cable: confirm the DB9 is seated fully on the PC's COM port. Try a null-modem adapter only if the cable's own wiring expects one — most PC/PPI cables are DCE and pin out for a direct PC connection, but some third-party clones are not.
  3. Check the cable's PPI LED. On a working Siemens USB/PPI cable, a steady or flickering LED indicates activity on the RS-485 side. A dark LED after a Micro/WIN search means the PC is not even transmitting.

9. PG/PC Interface Configuration in Micro/WIN

Micro/WIN reads its PC interface settings from the Set PG/PC Interface utility. A misconfigured access point is responsible for a large share of "suddenly no longer connects" reports, especially after a Windows update or after TIA Portal is installed alongside Micro/WIN.

  1. From Micro/WIN, click Communications > Set PG/PC Interface (or in older builds, find it in the Windows Control Panel under Siemens Automation).
  2. In the "Interface Parameter Assignment Used" dropdown, select Micro/WIN > PC/PPI cable (PPI) for RS-232 cables, or Micro/WIN > USB > PC/PPI cable (PPI) for USB cables.
  3. Click Properties. The PPI tab has:
    • Transmission rate — must match the CPU. Use "Search all baud rates" if unsure.
    • Highest station address — should be at least 31 for multi-drop networks, 2 for a single PLC.
    • Timeout — raise to 5000 ms if the CPU is slow to respond.
  4. Click OK > OK to commit. Restart Micro/WIN.

If Micro/WIN still cannot see the CPU, open Windows Control Panel > Set PG/PC Interface and remove all unused access points. Multiple active access points can cause Micro/WIN to default to a wrong COM port.

10. Factory Reset Using the EEPROM Cartridge

Use the factory-reset procedure when all cable, port-mode, and baud-rate diagnostics have been exhausted and the CPU remains invisible. The procedure overwrites the user's program, data block, and system block with the contents of an EEPROM cartridge that you pre-load on a known-good PLC.

Factory reset erases the user program. Confirm that a backup of the project is in your archive, or that the running process can tolerate a clean state, before continuing.

Required Hardware

  • Siemens 6ES7 291-8GE20-0XA0 EEPROM memory cartridge (or equivalent 8 KB cartridge for the CPU family in use).
  • A second, known-good S7-200 PLC of the same family, configured and running Micro/WIN.
  • The PC/PPI or USB/PPI cable (proven working on the donor PLC).

Procedure

  1. On the donor PLC, use Micro/WIN to create a project with an empty OB1, an empty data block, and a default system block. The system block must specify 9.6 kbaud PPI slave for Port 0 and Port 1, addresses 2 and 1 respectively, highest station address 31, no password.
  2. Insert the empty EEPROM cartridge into the donor PLC with power removed. Power on the donor PLC; the CPU copies its current RAM contents (the empty project) to the cartridge during startup.
  3. Wait until the donor PLC's STOP/RUN LEDs indicate normal operation (STOP LED on, RUN LED off after a few seconds).
  4. Power off the donor PLC. Remove the EEPROM cartridge. The cartridge now contains the reset image.
  5. Power off the affected (target) PLC. Insert the EEPROM cartridge into the target PLC's cartridge slot.
  6. Power on the target PLC. The CPU reads the cartridge on startup and overwrites its RAM with the cartridge contents. The system block is now 9.6 kbaud PPI.
  7. Wait approximately 10 seconds for the copy to complete. The CPU enters STOP with default parameters.
  8. Remove the EEPROM cartridge. Connect Micro/WIN at 9.6 kbaud, address 2. The CPU should now be reachable.
  9. Restore the user's program from the project archive. Re-download.
The EEPROM cartridge reset is non-destructive to the cartridge itself — the cartridge is overwritten each time the CPU boots with it inserted. To repeat the procedure, just power the donor PLC with the same cartridge inserted.

What the Reset Does Not Do

  • It does not clear a CPU password. A password-protected CPU requires the password to be entered before the system block can be downloaded, and the EEPROM reset will not bypass it. Use Micro/WIN > PLC > Clear Password (requires the original password) or escalate to Siemens technical support.
  • It does not reflash the CPU firmware. Firmware corruption (rare, but possible after a botched firmware update) requires a factory service tool.
  • It does not recover a physically damaged RS-485 transceiver. If the PPI port LED is dead and the CPU never responds at any baud, the port hardware has failed; the CPU must be replaced.

11. Verification Procedure

After each step above, run a structured verification to confirm communication is fully restored before closing Micro/WIN.

  1. In the Communications dialog, double-click the detected CPU address. Micro/WIN should report "Connected" or display the CPU type, firmware version, and error-free status in the status bar.
  2. Use PLC > Information to read the CPU type, firmware version (e.g., CPU 224XP, FW 2.01), and run/stop status. The error code field should be 0000.
  3. Use PLC > Compare to compare the online project to the offline project. If they differ, this is the source of the user's confusion — the offline copy was out of date.
  4. For a port-mode test, place the CPU in RUN with the user's program. The port should remain responsive to Micro/WIN in RUN only if no Freeport SFB is active. If communication drops when entering RUN, the user's program is the root cause — the program logic must be modified to release the port or to use a Freeport-compatible polling scheme.
  5. For a baud-rate test, run the application for at least one full cycle (typically a shift or 8 hours) and re-verify Micro/WIN can connect at the end of the cycle. Some Freeport configurations release the port only intermittently.

12. Preventive Measures and Best Practices

  1. Lock the system block. After commissioning, set the system block to a known baud (9.6 kbaud is the safest for slow networks) and prevent the program from overwriting SMB30/SMB130 except under controlled conditions.
  2. Avoid dynamic baud changes. Programs that switch port baud rate at runtime (typical in some Modbus multi-master schemes) are the most common cause of "I can't connect anymore" tickets. If a dynamic baud is required, document the recovery sequence on the cabinet door.
  3. Maintain a known-good EEPROM cartridge. Keep one pre-loaded with the empty/9.6 kbaud project. It will save hours when a PLC goes dark.
  4. Label the cable. PPI cables are cheap enough to be mis-shelved. Mark the part number (6ES7 901-3xxx) and the COM port number on the cable body with a label.
  5. Update Micro/WIN. Service Pack 9 (build 4.0.0.82) is the final release and addresses several USB/PPI communication bugs. Install it even if your current SP is working.
  6. Keep the CPU in TERM, not RUN. If the application allows, leave the mode switch in TERM. This lets Micro/WIN force STOP remotely and prevents an operator from switching to RUN while you are troubleshooting.
  7. Back up the project before every download. The Micro/WIN project file (.mwp) is the only authoritative record of the program. Use File > Export or the project archive feature after every successful download.

13. FAQ

Why does my S7-200 connect in STOP but not in RUN?

The user program is most likely calling USS_INIT, MBUS_CTRL, MBUS_CTRL2, or XMT/RCV, which switches the port to Freeport. PPI is not possible in Freeport mode. Either modify the program to release the port, or use the physical mode switch in TERM/STOP for online access.

What is the default baud rate of a factory-fresh S7-200?

9.6 kbaud on both Port 0 and Port 1, PPI slave mode, address 2 on Port 0, address 1 on Port 1. Micro/WIN's "Search all baud rates" option will find this in under three seconds.

Can I reset an S7-200 to factory defaults without the original program?

Yes. Create an empty project (no logic, default system block at 9.6 kbaud, no password) on a donor PLC, copy it to an EEPROM cartridge (Siemens 6ES7 291-8GE20-0XA0), and boot the target PLC with that cartridge inserted. The CPU will copy the cartridge contents to RAM and restart at 9.6 kbaud.

Why does Micro/WIN report "Cannot find station on network" even though the PPI cable LED is flashing?

The flashing LED confirms the PC is transmitting on the RS-485 side, but the CPU is not responding. The most common cause is a baud-rate mismatch. Open Set PG/PC Interface, enable "Search all baud rates," and refresh. If the CPU still does not appear, force STOP and try again — the port may be in Freeport under a RUN program.

Does a non-Siemens USB-to-RS485 adapter work as a PPI cable?

No. PPI is a Siemens-proprietary RS-485 framing protocol that requires master/slave token passing and 11-bit character frames. Off-the-shelf USB-RS485 adapters do not implement this framing. Only the Siemens 6ES7 901-3BF20-0XA0 (isolating USB/PPI) or 6ES7 901-3DB30-0XA0 (non-isolating USB/PPI) will communicate reliably with an S7-200.

My USB/PPI cable worked yesterday. What changed?

Windows may have reassigned the COM port number after a driver update or USB re-enumeration. Open Device Manager, find "Siemens PC/PPI cable #0301," and note the new COM number. Update Set PG/PC Interface in Micro/WIN to match. If the device is missing or shows a yellow warning triangle, reinstall the S7-200 PC/PPI USB driver from the Micro/WIN installation media.

Back to blog