Resolving S7-300 ET200M BF Flashing and SF LED Faults

Problem Description

A Simatic S7-300 CPU and its connected ET 200M distributed I/O station show the following LED status on the front panel:

• S7-300 CPU: SF LED solid ON, BF1 LED flashing
• ET 200M (IM 153-1): SF LED solid ON, BF LED flashing

Bus communication between the master (CPU 31x) and the ET 200M slave is not healthy even after the operator has replaced the IM 153-1 module, the DI module (MI1.0501+SK1-K031), and the Profibus connectors. All other Profibus slaves (DP couplers, VLT drives) report normal on their own BF indicators. The fault survives a fresh project download.

This pattern is one of the most common S7-300 field failures and almost always points to either a physical layer problem, a Profibus address/configuration mismatch, or a diagnostic buffer event the CPU has not yet been cleared from.

LED Reference - What SF and BF Really Mean

Two diagnostic LEDs on the S7-300 CPU and the IM 153-1 carry different but related meanings. Confusing the two is the single largest source of mis-diagnosis.

Root Cause Analysis

BF and SF simultaneously can be attributed to four classes of fault, ranked by frequency observed in the field:

1. Physical layer (most common, > 50% of cases): Shield not grounded, broken conductor in the Profibus cable, missing or double terminator, segment length > maximum allowed for the configured baud rate, T-piece or repeater failure.
2. Configuration mismatch: Profibus address set on the IM 153-1 DIP switches does not match the address assigned in HW Config; IM 153-1 article number (e.g., 6ES7153-1AA03-0XB0) does not match the HW Config version; GSD file revision mismatched.
3. Module-level fault on the ET 200M: Defective IM 153-1, defective I/O module (DI/DO/AI/AO), backplane bus connector failure, 24 V supply weak or missing on the load current supply (PS 305/PS 307).
4. Project / firmware fault: Outdated CPU firmware incompatible with the ET 200M GSD, OB82/OB86/OB122 not loaded so the CPU goes STOP on first access error, or hardware configuration has been corrupted.

In the reference incident, the engineer had already eliminated class 3 (new IM 153-1, new DI module) and class 4 (fresh download). This is a strong indicator that the fault is in class 1 (physical layer) or class 2 (address/GSD mismatch on Profibus node 30).

Diagnostic Buffer - The First Place to Look

Every S7-300/400 CPU maintains a ring-buffer of diagnostic events. It is the single most useful tool for this failure mode. Open the project in STEP 7 v5.x or TIA Portal and connect online.

1. In STEP 7 v5.x: PLC > Module Information, then click Diagnostic Buffer tab.
2. In TIA Portal: Online > Diagnostics > Diagnostic buffer.
3. Click the Save As... button to export the entire buffer to a .txt file (STEP 7 v5.x) or .csv/.xml (TIA Portal). Always attach this to a support ticket.
4. Sort the entries by Time of Event descending. The most recent event is the active fault.

Typical diagnostic events for an ET 200M BF/SF combination include:

For the IM 153-1 specifically, double-click the event to see the slot number and module type. The slot map for an ET 200M is shown below.

ET 200M Slot and Address Map

If the DI module tag is MI1.0501+SK1-K031 and the symptom is that "most DI signals are not ON," the slot-2 module is likely being read by user code whose pointer assumes a 32-channel mapping. Verify in HW Config whether the module is configured as DI16 x DC24V or DI32 x DC24V. Wrong slot-width in the project versus reality will cause SF because the cycle I/O handshake fails.

Step-by-Step Diagnostic Procedure

Use this sequence in order. Do not skip steps; each one rules out a class of fault before spending time on the next.

Step 1 - Verify Profibus Address

The IM 153-1 Profibus address is set with rotary switches on the module front. The reference plant has address 30. Confirm that:

• Switches read 3 on the tens (x10) and 0 on the units (x1).
• HW Config > DP Slave Properties > Profibus Address matches.
• No other node on the bus has address 30 (use a Profibus tester or cycle-power each slave until BF stops flashing to identify the offender).

Step 2 - Check Terminator Settings

Profibus RS-485 must be terminated at exactly two points, at the physical ends of the segment. The terminator is a 220 ohm resistor between A and B, plus a 390 ohm pull-up on VP and a 390 ohm pull-down on GND - the classic 9-pin D-sub Profibus connector with switchable terminator (e.g., 6ES7972-0BA52-0XA0).

The reference case shows terminator OFF on the ET 200M. This is correct if the IM 153-1 is in the middle of the segment. Verify that both end nodes of the segment have terminators ON; one missed terminator will reflect the signal and force BF.

Step 3 - Measure the Cable

At 1.5 Mbaud (the standard Profibus DP rate), the maximum segment length is 200 m. Use a Profibus cable tester or a multi-meter for the following checks:

Step 4 - Read the Online Diagnostics in STEP 7 / TIA Portal

1. Go online with the CPU.
2. Open Accessible Nodes (STEP 7 v5.x: PLC > Accessible Nodes). The ET 200M should appear with its Profibus address and module type. If it does not, the CPU has lost it.
3. Right-click the slave and choose Module Information. The DP Slave Diagnostics tab shows the raw diagnostic bytes returned by the IM 153-1.
4. Interpret the diagnostic bytes per the Profibus DP-V0 specification. Byte 0 bits 6/7 set indicate station_status; byte 0 bit 3 (external_diag) set means the IM has a module-level diagnostic pending; byte 1 contains the Profibus master address, byte 2 the slave's Profibus address.

Step 5 - Use OB82 / OB86 / OB122 to Stay RUN

By default, an S7-300 CPU without OB86 will STOP the moment a DP slave is unreachable. With OB86 loaded, the CPU stays in RUN and the BF/SF LEDs indicate the issue. This is why the reference case sees the CPU in RUN despite the fault.

Verify in the project that the following OBs are present in the Blocks folder and were downloaded to the CPU:

• OB82 - Diagnostic interrupt
• OB86 - Rack failure (DP slave failure)
• OB121 - Programming error (permissive)
• OB122 - I/O access error (permissive)

Missing OBs do not cause BF/SF directly, but a missing OB86 on a CPU without permissive access can also be the reason SF appears the first time a peripheral access fails.

IM 153-1 Module-Specific Checks

The 6ES7153-1AA03-0XB0 (and later BA02, CA00) is the standard Profibus interface for ET 200M. Its front-panel LEDs add information beyond the standard BF/SF pair.

If BF is flashing at 0.5 Hz, the IM 153-1 has not received any Profibus frame from the master. If BF is solid ON, the IM 153-1 has lost link at the physical layer. Distinguishing these saves hours: a flashing BF means the master never sent a frame, a solid BF means the IM cannot hear what the master sent.

Addressing Math - Why the DI Module Looks Dead

The user code addresses MI1.0501+SK1-K031. In a STEP 7 symbol table this is a multi-instance, multi-slot pointer. The slot offset must equal the configured slot. If HW Config has the DI module at slot 2 but the symbol was generated against slot 4 (or vice versa), the CPU will report an I/O access error on every read because the address falls outside the input area the slave provides.

Worked example for Profibus address 30 with 4 DI16 modules at slots 2-5:

With MI1.0501+SK1-K031 as the symbolic name for byte 5 input (= bit offset 40 of slot 4), the calculation is:

IB 5 = I 5.0 ... I 5.7
"MI1.0501+SK1-K031" must map to I 5.0 to I 5.7

If the symbol was generated for slot 2 (PIW 0), it would read I 0.0 ... I 0.7 instead.

Re-crosscheck with Go To > Location in the symbol editor to confirm the absolute address of the symbol after a recompile.

Replacement Matrix - What the Engineer Already Did

What remains: Profibus cable integrity (shield, segment end terminator), 24 V load supply on the ET 200M, and address/GSD consistency in HW Config. The next most likely root cause is either a double-terminated or un-terminated segment or the ET 200M 24 V load supply is sagging when the IM 153-1 attempts a baud-rate handshake.

24 V Load Supply Test

The ET 200M has two supplies. The IM 153-1 takes its 24 V from the backplane. The load supply (L+ / M) is what powers the field-side of the I/O modules. A sagging load supply (below 20 V) is a common cause of partial DI module failure while still showing BF.

1. Measure L+ to M at the ET 200M power terminals with a DMM under full load.
2. Expected: 24.0 V +/- 5% (i.e., 22.8 V to 25.2 V).
3. If voltage sags when the field contacts close, the PS 307 (or the field wiring's current draw) is undersized.

Shielding and EMC Checks

Profibus is RS-485, which is differential but easily disturbed by VFD common-mode noise. With VLT drives on the same bus, the shield bonding is the highest-leverage fix.

• Verify the Profibus cable shield is bonded to ground at both ends of the segment through the Profibus connector's grounding bar (the metal clamp that grips the cable shield).
• Use cable with double shield when running in VFD cable trays.
• Keep at least 200 mm separation between Profibus cable and 400 V / VFD power cables; cross at 90 deg if they must intersect.

Verification - Confirming the Fix

After every change, perform this four-step verification before declaring victory:

1. LED check: CPU and IM 153-1 BF LEDs OFF, SF OFF, ACT solid green on the IM 153-1.
2. Diagnostic buffer clear: Open the buffer, no entries with 0x0E02 / 0x0A31 / 0x3942 in the last 5 minutes. The buffer should show only the "Station return" 0x0E03 event when the fix was applied.
3. Force and read: Force a single DI on the ET 200M from the field (turn on a 24 V source to the channel). Monitor the input in the VAT table at the correct PIW address. The status must toggle within one Profibus cycle (typically 1 - 10 ms).
4. Power-cycle test: Power off the ET 200M for 30 seconds, power on. Within 5 seconds the BF should self-clear and ACT should turn green. If BF does not clear, the master is not cycling the slave into RUN - check HW Config Save/Compile was performed after any change.

Preventive Recommendations

• Always use Siemens Profibus connectors with integrated inductor (e.g., 6ES7972-0BA52-0XA0) on the bus, and the diagnostic version with PG socket (6ES7972-0BB52-0XA0) for permanent analyzer connection.
• Document Profibus address, baud rate, and terminator state in the cabinet drawing and inside the cabinet door.
• Use the S7-300 CPU 31x/31xC, ET 200M system manual (entry ID 45531107) Chapter 23 as the canonical reference for diagnostic tools.
• Enable OB82, OB86, OB121, OB122 in the project so the CPU stays in RUN and the SF LED is the only visible indicator (rather than a STOP state).
• Schedule annual Profibus cable and connector inspection, including shield-resistance measurement and terminator resistance measurement.

Related Module Variants and Migration

If a Profibus-to-Profinet migration is being considered, the IM 153-4 PN is a drop-in replacement and reuses the same S7-300 I/O modules. The diagnostic event IDs are similar; SF and BF semantics are preserved as PROFINET channel diagnostics.

FAQ