Resolving S7-300 CPU 319-3 PN/DP SF Fault: P-Area I/O Access Error 0x2942 / 0x2943

1. Problem Overview

A persistent SF (System Fault) LED on a Siemens SIMATIC S7-300 CPU 319-3 PN/DP — while the user program continues to scan and the machine keeps running — is one of the most common diagnostic scenarios on PROFIBUS and PROFINET installations. The user program does not stop because the corresponding error Organization Block (typically OB 122, "I/O Access Error") is loaded in the CPU. The CPU calls OB 122 instead of going to STOP, but the SF LED stays latched until the cause is cleared and the diagnostic buffer is acknowledged. The reported diagnostic buffer from the field unit shows:

• CPU order number: 6ES7 318-3EL01-0AB0 (CPU 319-3 PN/DP)
• Hardware version: 8
• Firmware version: V 3.2.10
• Boot loader / firmware expansion: A 37.11.12
• Rack 0, Slot 2
• Serial: S C-E9W777502014

Ten consecutive diagnostic events were captured at 08:44:28.990–.991 on 01/21/2021. All are P-area (peripheral I/O) access errors raised on OB 122 at priority class 1, in the "Incoming event" state. No Stop events, no bus faults, and no rack failures appear — the CPU is healthy, but the application code is reading or writing P-area addresses that are not currently accessible.

2. Affected Hardware, Firmware, and Catalog Reference

The reported unit is one of the higher-end S7-300 CPUs that combines PROFIBUS DP master and PROFINET I/O controller functions.

Parameter	Value
MLFB / Order No.	6ES7 318-3EL01-0AB0
Designation	CPU 319-3 PN/DP
Work memory (code / data)	2 MB / 700 KB (typical for -3EL01 variant)
Hardware version	8
Firmware	V 3.2.10
Boot loader	A 37.11.12
Interfaces	1× MPI/DP (X1), 1× DP master/slave (X2), 1× PROFINET 2-port switch (X3)
Programming tool	STEP 7 V5.5 + SPx or TIA Portal (compatibility range)

Firmware V 3.2.x is the maintenance line for the 318-3EL01 MLFB. The diagnostic buffer format and the meaning of Event IDs 16#2942 / 16#2943 are stable across all V3.x firmware on the 319-3 family.

3. Decoding the Diagnostic Buffer

Each diagnostic entry contains an Event ID and a 12-byte Coding field. For S7-300/400 CPUs the coding layout is standardized. The structure used by Siemens for I/O access errors is:

Byte offset in Coding	Meaning (S7 standard)
+0 / +1	Event ID (e.g., 16#2942, 16#2943)
+2 / +3	OB that was called (017A = OB 122 hex)
+4	Reserved / block type
+5	Access mode: 02=byte/word, 03=double-word
+6 / +7	Byte offset inside the area (P area in this case)
+8 / +9	Area / direction flags
+10 / +11	Slot / channel qualifier

3.1 Event ID 16#2942 — I/O Access Error, Reading

This event is raised when the user program issues a load (L / L PIB / L PQW …) that targets an input address which the CPU cannot currently resolve. Typical triggers:

• PROFIBUS slave is in "Not reachable" / "Bus fault"
• PROFINET device has lost AR (Application Relationship) and is in "Station failure"
• Address is configured in HW Config but the slot/submodule is missing
• Address is not configured at all (typo in the symbolic or absolute operand)
• Access length exceeds the configured slot size (e.g., reading a double-word from a single-word slot)

3.2 Event ID 16#2943 — I/O Access Error, Writing

Same as above but for store (T / T PQB / T PQW …) instructions. Writes that fail do not corrupt the slave; the data is discarded and the CPU records the event. OB 122 is called instead of STOP.

4. Address-by-Address Analysis

The ten events in the buffer do not all point at the same slave. They form three logical groups:

#	Event ID	Direction	Length	P-area address (byte offset)	Probable mapping
1	16#2942	Read	Double-word (4 B)	256 (PEW 256 / PED 256)	Input area of PROFIBUS/PROFINET I/O — first cluster
2	16#2942	Read	Word (2 B)	1002 (PEW 1002)	Input area — second cluster (gap ≥ 744 B from cluster 1)
3	16#2942	Read	Word (2 B)	1000 (PEW 1000)	Same cluster as #2, 2 B before
4	16#2943	Write	Word (2 B)	536 (PAW 536)	Output area — third cluster
5	16#2943	Write	Word (2 B)	534 (PAW 534)	Same cluster as #4, 2 B before
6	16#2943	Write	Word (2 B)	532 (PAW 532)	Same cluster as #4, 4 B before
7	16#2942	Read	Word (2 B)	536 (PEW 536)	Input mirror of the third cluster
8	16#2942	Read	Word (2 B)	534 (PEW 534)	Same cluster as #7
9	16#2942	Read	Word (2 B)	532 (PEW 532)	Same cluster as #7
10	16#2943	Write	Word (2 B)	530 (PAW 530)	Same cluster as #4, 6 B before

4.1 Why three clusters matter

STEP 7 places PROFIBUS DP / PROFINET I/O addresses into the P area contiguously per configured slot. A gap of several hundred bytes between cluster 1 (offset 256) and clusters 2/3 (offsets 530–536 and 1000–1002) almost always means the addresses belong to two or more different distributed I/O devices — not a single faulty slave. Mapping rule of thumb:

1. Open the STEP 7 project online: PLC → Accessible Nodes or HW Config → Online → Station.
2. For each slave head module, note the configured I-address start and Q-address start.
3. Compare the byte offset reported in Event ID coding byte +6/+7 with the configured start of each slot.
4. Flag every slave whose configured range contains the failing address.

If, for example, PROFIBUS slave 6 has I-start = 1000 and Q-start = 530, then events 2, 3, 4, 5, 6, 7, 8, 9, 10 all map to slave 6 — a strong hint that slave 6 itself (or the segment it sits on) is the root cause, with one stray double-word read at offset 256 mapping to a different slave (perhaps a different DP master on X2 or a different PROFINET I-device on X3).

5. Root Cause Hierarchy

The probability ranking below is derived from the symptom pattern (multiple slaves failing, OB 122 loaded, SF LED latched, machine still scanning).

Rank	Likely root cause	Diagnostic evidence to collect
1	One or more PROFIBUS DP slaves are physically disconnected or have lost the token / segment	SF/BF LEDs on slave; online "DP slave diagnosis" buffer
2	Missing or incorrectly set bus terminator on the PROFIBUS segment	Reflected waveform on scope; resistance measurement A1-B1 ≈ 220 Ω
3	Damaged PROFIBUS connector (e.g., switch in OFF position, broken pigtail)	Visual inspection of every connector on the segment
4	EMV / cable routing fault (VFD output cable routed in parallel, missing shield)	Cable path audit
5	Address mismatch in HW Config vs. physical rotary switch on a slave	Compare HW Config DP address with the switches on the device
6	PROFINET I-device / device loss on the X3 port (different physical layer)	Online → Diagnostics → PROFINET devices
7	OB 1 code referencing a P-address that is not configured (programmer error)	Cross-reference in STEP 7 / TIA Portal
8	Access width larger than the configured slot (e.g., reading double-word on a 2-byte input)	HW Config slot view

Replacing the PROFIBUS cable as the operator reported is a valid first step, but the symptom of multiple distinct addresses failing simultaneously generally indicates a bus-level problem, not a single cable.

6. Step-by-Step Resolution Procedure

1. Connect online with STEP 7. Open SIMATIC Manager → online → Accessible Nodes. Confirm the CPU reports the same MLFB and firmware as the type plate.
2. Read the diagnostic buffer completely. PLC → Diagnostics/Set → Diagnostic Buffer. Note every Event ID, not just the latest. The first 10 entries here are tightly correlated in time and almost always belong to the same root cause.
3. Decode every Event ID with the table in §3. Build a list of {address, width, direction, slot reference}.
4. Open HW Config online. Right-click the DP master system or PROFINET IO system → Online → DP Slave Diagnosis (or PROFINET IO Diagnosis). A red "X" on a slave means station failure. A yellow triangle means diagnostic interrupt active. Both are equally bad — both prevent process data exchange.
5. Map every failing P-address to a specific slave using the configured I/Q start addresses from HW Config. Build a per-slave hit-list.
6. Physically inspect the affected segment. Walk from CPU X2 (DP) or X3 (PN) toward the first failing slave. Check:
   • Connector is fully seated and locked.
   • Termination switch is ON only on the two end devices of the segment.
   • Incoming and outgoing cable are both screwed down to the connector.
   • Shield is clamped to the connector shell (not the pin).
   • Cable is Siemens PROFIBUS cable (violet) or equivalent; twisted pair ≥ 1× per cm.
7. Measure the segment.
   • Resistance between pins A and B with all slaves powered: should read 110 Ω (two 220 Ω terminators in parallel). Open circuit = terminator missing. < 80 Ω = short circuit. Reading fluctuates = bad contact.
   • Voltage between A and B at the master: should be ≥ 4.5 V DC. < 3 V means a slave is dragging the bus down.
8. Isolate by substitution. Swap the suspected slave with a known-good one of the same order number. If the new slave fails identically, the bus is at fault. If the new slave works, the original device has a hardware defect.
9. Check the slave's own diagnostic buffer. ET 200S / ET 200M / ET 200MP slaves expose a station-diagnosis record. Open the slave in HW Config online → Module Information → Diagnostic Buffer. Look for "Channel fault", "Parameter error", "Configuration error".
10. Re-download HW Config if you made any hardware change. The CPU caches the configuration; a stale cache can still raise 0x2942 even after the physical fault is fixed.
11. Clear the SF LED. After the cause is fixed, the events transition to "Outgoing" automatically. The SF LED clears at the next STOP→RUN or power cycle. To force-clear without a restart: PLC → Diagnostics/Set → Clear Diagnostic Buffer followed by a STOP→RUN transition, or write '0' to diagnostic-status tag OB82_FLT_ID once the cause is gone.

7. Behavior of OB 122 and What It Means for the Application

OB 122 is invoked only when an I/O instruction reads or writes a peripheral address that cannot be served at the moment. The S7-300 / S7-400 firmware guarantees that OB 122 is called in the same priority class as the interrupted instruction. The local temp area of OB 122 provides:

Local byte	Content	Use
OB122_EV_CLASS	Event class (always B#16#39)	Identification
OB122_SW_FLT	Fault code (B#16#42 = read, B#16#43 = write)	Distinguish R vs. W
OB122_PRIORITY	Priority class of the OB that triggered	Diagnostic logging
OB122_OB_NUMBER	B#16#7A (122)	Identification
OB122_BLK_TYPE	Type of block containing the fault	Locate faulty block
OB122_STEPI_ADDR	Step / address inside block	Locate faulty network
OB122_BLK_NUM	Block number of the faulty block	Locate faulty FB/FC/OB
OB122_IO_ADDR_WORD	Byte address of the I/O operation	Map to slave
OB122_IO_ADDR_BIT	Bit address	Map to channel

If OB 122 is empty (or missing from the project), the CPU goes to STOP on the very first P-area fault. The fact that the CPU is still in RUN means an OB 122 instance is in the project. This is a design decision: the developer chose to keep the process running despite the I/O fault. While pragmatic, it is also a risk — the substitution value (0) is propagated to the application, and on a closed-loop axis or process controller this can have dangerous consequences.

8. Verification Procedure

After the corrective action, the following checks confirm a clean state:

1. Diagnostic buffer clean. No new 16#2942 / 16#2943 events in the 30 minutes following the fix. Pre-existing entries remain (and are outgoing) but no new ones should appear.
2. SF LED off. After a STOP→RUN transition the SF LED must be dark. BF (Bus Fault) LED on the DP / PN interface must also be dark.
3. Online station diagnosis all green. In HW Config every slave head module shows the green check mark, no yellow triangle, no red X.
4. PROFIBUS / PROFINET statistics clean. Open Module Information → Diagnostic on the master interface. Bus error count, retry count, lost-station count should all be 0 (or stable at the pre-existing baseline).
5. Process values consistent. Force a value into a known I/O address and verify the application reads it back. Repeat for an output.
6. Cycle time unchanged. OB 122 with no fault runs in <1 µs. A repeated OB 122 call on every scan (1 ms or 10 ms) inflates cycle time and is visible in PLC → Module Information → Scan Cycle Time.

9. Preventive Measures

• Document every distributed I/O slave with its DP / PROFINET address, configured I-start, Q-start, and module count. This is the only way to decode the diagnostic buffer without a full HW Config open in front of you.
• Place the OB 122 body in a single FC that increments a counter, sets a global fault flag, and triggers a maintenance request to HMI. This makes the fault visible in the operator interface and not just a hidden LED.
• Add a process-image update (SFC 26 / 27) call only when strictly necessary. Excessive direct P-access (L PEW / T PAW) is the main reason even small bus glitches become SF-class faults.
• Apply a 24 V DC UPS or buffering on PROFIBUS connector electronics when long cable runs are exposed to ESD / lightning events.
• Use Siemens DP / PN cables and connectors, terminate strictly at the two physical ends, and never put a repeater in the middle of a properly terminated segment.

10. Reference: Event ID Quick Reference for S7-300 / S7-400

Event ID	Meaning	Triggered by
16#2942	I/O access error, reading	L PIB / L PIW / L PID on a non-accessible address
16#2943	I/O access error, writing	T PQB / T PQW / T PQD on a non-accessible address
16#2944	I/O access error, bit reading	U/E/O/X on a P bit address
16#2945	I/O access error, bit writing	S/R/= on a P bit address
16#3951	PROFINET IO: Station failure	PROFINET device lost
16#38C4	DP slave diagnostic interrupt	DP slave entered diagnostic state
16#39B1	DP bus fault	DP master lost the bus

11. Quick Field Decision Matrix

Symptom	Likely cause	First action
SF only, single address, OB 122 present	Single non-existent or unconfigured P address in code	Cross-reference the address in the project; add to HW Config or fix the typo
SF + BF on X2 (DP), multiple addresses	PROFIBUS segment down	Check terminators, cable, connector seating; measure A-B resistance
SF + BF on X3 (PN), multiple addresses	PROFINET IO system down	Check switch ports, link LEDs, device power, station names
SF, addresses from one slave only	That slave is offline or mis-configured	Open slave's own diagnostic buffer; verify rotary address / device name
SF, CPU in STOP	OB 122 not loaded or fault is not I/O-access type	Download OB 122 to the project, identify the real event ID