Resolving S7-300 CPU 319-3 PN/DP STOP on Gateway Power-Up

Problem Overview

An SIMATIC S7-300 CPU 319-3 PN/DP (order number 6ES7318-3EL01-0AB0, firmware versions V3.x) is configured with a mixed network topology consisting of a PROFINET connection to a TP1500 Comfort HMI panel, a PROFINET connection to a programming device (PG), and a PROFIBUS DP segment terminating at a third-party CANopen-DP gateway. After the hardware configuration (including the gateway GSD file) is downloaded to the CPU, the controller transitions cleanly to RUN. The instant the 24 V DC supply to the CANopen-DP gateway is switched on, the CPU drops back to STOP automatically, and the SF (System Fault) LED illuminates.

This class of fault is a classic PROFIBUS DP station-failure and/or diagnostic-interrupt issue. The CPU is reacting correctly to a hardware event on the DP segment; the deficiency lies in the user program, which is not equipped with the organization blocks (OBs) required to handle the event without escalating to STOP. The remainder of this article walks through root cause analysis, the diagnostic buffer entries to look for, the OB framework that must be loaded, and the steps to verify the fix on a live rack.

Affected Hardware and Firmware

The 319-3 PN/DP behaves identically to a 315-2 PN/DP or 317-2 PN/DP with respect to DP station failure handling. Only the diagnostic-buffer event IDs and the maximum number of DP slaves (124) differ.

Root Cause Analysis

When the gateway's 24 V DC supply is energized, the following sequence occurs on the DP segment:

1. The gateway's PROFIBUS transceiver powers up and enters the bus.
2. The DP master (CPU 319-3) polls the slave at its configured PROFIBUS address.
3. Because the slave's application firmware is still initializing, the master observes either a station failure (slave does not respond within T_SL) or a diagnostic interrupt (slave signals Diag.Flag set).
4. The CPU's operating system writes the event into the diagnostic buffer and calls the corresponding OB.
5. If the required OB is not present in the user program, the CPU transitions to STOP per the S7-300 error-reaction policy.

The two OBs most commonly missing in this scenario are:

• OB 82 — Diagnostic Interrupt: Triggered when a DP slave signals a diagnostic event. Refer to the S7-300 automation system manual for full behavior.
• OB 86 — Rack/Station Failure: Triggered when a DP station fails, returns, or cannot be reached. This is the primary suspect for a "STOP on power-up" symptom because the gateway is technically failing to respond during initialization.

A secondary root cause is a configuration defect: the GSD file assigns I/O length, diagnostic mode, or watchdog timing that is incompatible with the gateway's actual startup behavior. A third (less common) cause is a PROFIBUS wiring defect — missing termination, swapped A/B lines, or a shield break — that corrupts telegrams during the gateway's high-inrush power-on phase.

Diagnostic Buffer Event IDs to Look For

Open the online Target system > Diagnostic/Setting > Diagnostic Buffer in STEP 7 V5.5, or Online & diagnostics > Diagnostic buffer in TIA Portal. The first three or four events will tell the story. The relevant S7-300 event IDs for this scenario are:

If the last entry reads "STOP caused by missing OB 86 (DP station failure)" or "STOP caused by missing OB 82 (diagnostic interrupt)", the fix is to load the missing OB. If the last entry is "STOP due to I/O access error" (event ID W#16#2522), the issue is process-image access to a slot that the gateway has not yet mapped — also fixed by installing OB 122 (I/O access error) or by adding the I/O only after the gateway has been online.

OB Framework Required to Prevent STOP

An S7-300 CPU transitions to STOP when an event occurs for which the corresponding OB does not exist in the load memory. The minimum OB set for a robust DP installation is:

An OB with an empty body is functionally sufficient to prevent the STOP transition. For diagnostics in a running system, populate OB 82 and OB 86 with code that records the event in a data block. The temporary (TEMP) variables of OB 82 contain the local data structure OB82_EV_CLASS, OB82_FLT_ID, and OB82_MDL_ADDR; the temporary variables of OB 86 contain OB86_EV_CLASS, OB86_FLT_ID, and OB86_MDL_ADDR. Refer to the STEP 7 Online Help for the full local-data layout of each OB.

Step-by-Step Resolution

Step 1 — Capture the Live Diagnostic Buffer

1. Connect the PG to the CPU via PROFINET (port 2 of the 319-3).
2. Open STEP 7 (or TIA Portal) and go online to the target CPU.
3. Open PLC > Diagnostic/Setting > Diagnostic Buffer.
4. Note the first STOP entry and the event(s) immediately preceding it. Write down the event IDs in hex.

Step 2 — Identify the Missing OB

Map the event IDs from Step 1 to the OB table above. The CPU text usually says "STOP due to missing OB xx". For a "STOP on gateway power-up" symptom, expect OB 82 or OB 86.

Step 3 — Insert the Missing OB

In the S7 program navigator (STEP 7 V5.5):

1. Right-click Blocks > Insert New Object > Organization Block.
2. Select the OB number (e.g., 86 for rack/station failure).
3. Choose the symbolic name (e.g., OB86_RACK_FAILURE).
4. Confirm the OB family (OB1 (1) for S7-300).
5. Open the new OB and write the diagnostic stub. A minimal STL implementation for OB 86 is:

// OB 86 — Rack/Station Failure (S7-300)
// Temporary local data provided by the operating system.
// Insert error-handling or logging as required.
//
// OB86_EV_CLASS    BYTE   // 16#38 coming, 16#39 going
// OB86_FLT_ID      BYTE   // 16#C3 station failure, 16#C4 station return
// OB86_MDL_ADDR    WORD   // Logical base address of the failed DP slave
// OB86_RACKS_FLTD  ARRAY  // Bit map of failed racks (DP)
//
// User code begins here
      L     #OB86_MDL_ADDR        // Load logical base address
      T     MW    100             // Store in a flag for HMI display
      SET
      SAVE                          // Set RLO = 1
      BEU                           // End block unconditionally

Save and download the block to the CPU.

Step 4 — Add the Defensive OB Set

Even if the diagnostic buffer names only one missing OB, add the full defensive set (OB 82, OB 86, OB 121, OB 122) in a single download. Each OB is < 200 bytes; the load-memory cost is negligible, and the result is a CPU that survives a wider class of field events.

Step 5 — Verify on a Live Power Cycle

1. Switch the CPU to RUN.
2. Switch the gateway 24 V DC off for 10 s.
3. Switch the gateway 24 V DC on.
4. Confirm the CPU remains in RUN and the SF LED clears within 5 s.
5. Open the diagnostic buffer online and confirm new OB 86 entries (event ID W#16#3187 "DP station returned") are written, but the CPU does not stop.

PROFIBUS Wiring and Topology Verification

If the CPU still drops to STOP after loading the missing OBs, the fault is in the physical layer. The 319-3's DP master port must see a clean bus during the gateway's power-up. Verify the following:

• Termination: The PROFIBUS segment must have termination resistors on at the two physical ends only. The CPU 319-3 has a built-in terminator on the DP port; enable it only if the CPU is one of the two end nodes.
• Shielding: The PROFIBUS cable shield must be bonded to ground at both ends with low-impedance clamps. A floating shield allows common-mode noise during the gateway's inrush to corrupt telegrams.
• Baud rate vs. segment length: At 1.5 Mbps, the maximum segment length is 200 m; at 12 Mbps, it is 100 m. Exceeding the spec raises the bit error rate and prolongs the station-failure window.
• 24 V DC inrush: The gateway's inrush current can pull the 24 V rail down far enough to buss the DP transceiver's logic reference. Power the gateway from a separate, properly sized 24 V supply, or add a 2200 µF buffer capacitor at the gateway's power terminals.
• DP address uniqueness: Open the gateway's hardware address switch (or DIP) and confirm the address matches the configured address in HW Config / TIA Portal. A duplicate address causes a permanent station failure.

GSD File and Configuration Pitfalls

The GSD file for the CANopen-DP gateway must match the gateway's firmware revision. Mismatches produce diagnostic-interrupt floods. Common pitfalls:

• Watchdog time: The DP master opens a watchdog timer when the slave starts communicating. If the gateway's application firmware takes longer to initialize than the configured watchdog (typical default 10 ms), the master will declare a station failure. Increase the watchdog in HW Config (DP slave properties > Parameter assignment > Watchdog) to 200 ms for slow-starting slaves.
• Diagnostic mode: Confirm the GSD allows Status 1 + Status 2 + Diagnostic in the DP slave properties. Disabling diagnostics can mask legitimate faults.
• I/O length: The number of input/output bytes in HW Config must equal the gateway's actual data width. A mismatch produces a configuration error at bus start-up and a station failure.
• Device-specific diagnostics: If the gateway uses extended diagnostics, the master must have Enable device-specific diagnostics checked; otherwise the master interprets the slave as faulty.

Extended Diagnostic Tools

When the OB framework is in place and the CPU still misbehaves, escalate with these tools:

• STEP 7 "DP Slave Diagnostics": Right-click the DP master in HW Config > DP Slave Diagnostics. This read-only view shows live state, station number, and per-slave status for every configured DP node.
• SIMATIC Automation Tool & PRONETA: Siemens PRONETA scans the PROFINET/PN-side bus; for PROFIBUS use the STEP 7 "Online & diagnostics" bus diagnostics. Repeats, illegal responses, and CRC errors are counted per node.
• PROFIBUS bus monitor: A class-2 master (e.g., a Siemens PG with the PROFIBUS Diagnostics toolbox) records token rotation time, repeat counts, and error frames. A repeat count above 100 per minute indicates a marginal segment.
• Diagnostic repeater (6ES7972-0AB01-0XA0): A diagnostic repeater on the DP segment isolates cable faults by reporting the segment in which the error occurred. It is the fastest way to find a break or a missing terminator.

Safe-State Behavior Summary

Step 7 / TIA Portal Quick Reference

For technicians working in TIA Portal (V16 or later) on the same CPU, the path to the diagnostic buffer is Online & diagnostics > Diagnostics > Diagnostic buffer. The path to the OB insertion is Project tree > CPU_1 > Program blocks > Add new block > Organization block. For STEP 7 V5.5, the same path is S7 Program > Blocks > Insert > Organization Block. The OB 82 and OB 86 in TIA Portal expose the same temporary local data as in STEP 7 V5.5; local-data names are case-sensitive in the TIA Portal editor.

Verification Checklist

• CPU is in RUN with the gateway unpowered (24 V DC off).
• Gateway 24 V DC is switched on. CPU remains in RUN within 5 s.
• Diagnostic buffer contains a new DP station returned event (W#16#3187) and an OB 86 executed event, with no STOP entries.
• SF LED on the CPU is off.
• BUSF LED on the CPU is off (or briefly flashing during the gateway's first poll).
• HMI shows live process data from the gateway.
• Reverse cycle (gateway 24 V DC off): CPU remains in RUN, new DP station failure (W#16#3185) and OB 86 executed events in the buffer.

Preventive Recommendations

1. Make the defensive OB set a project template. Every S7-300 / S7-400 project that talks to a DP or PN segment should ship with OB 82, OB 86, OB 121, and OB 122 as empty stubs.
2. Document the watchdog time for each DP slave in the project functional specification. A non-default watchdog (e.g., 200 ms for slow-starting gateways) should be visible from HW Config printout.
3. Power third-party gateways from a dedicated 24 V rail with a buffer capacitor; do not parallel them with sensors that produce heavy inrush (e.g., valves, contactors).
4. Add a startup inhibit in the gateway's configuration (where supported) so the slave does not enter the PROFIBUS ring until its application firmware has fully initialized.
5. Review the diagnostic buffer in the factory acceptance test (FAT) and the site acceptance test (SAT). Any STOP transition is a project defect.

FAQ