Resolving S7-300 MPI Address Conflict After SDB Download

Problem Description

An MPI network of three SIMATIC S7-300 stations is built around a CP 5611 communication processor installed in an HMI/engineering station running SIMATIC Manager with WinCC. The PG/PC interface is configured for CP5611 (MPI). With the project closed, the operator opens Accessible Nodes from SIMATIC Manager and detects only two stations — MPI address 2 and MPI address 3 — even though the network physically contains three CPUs. The third CPU (expected at MPI address 4) is not enumerated, although its terminating resistor, PROFIBUS connector, and shield grounding have already been verified as correct.

Further investigation shows that a technician copied the offline system data (the collection of System Data Blocks, SDBs) from station 3 and downloaded it to station 4, because the two CPUs were assumed to be identical. Once the download completed, MPI address 4 disappeared from Accessible Nodes and could not be reached from WinCC, even though the CPU was still in RUN.

Root Cause: MPI Address Is Stored in System Data

On S7-300 CPUs (e.g. CPU 312, CPU 313, CPU 314, CPU 315-2 DP, CPU 317-2), the station's MPI address is part of the system data generated when the station is configured in HW Config. The system data contains, among others:

• SDB 0 and SDB 1 — CPU parameters (MPI/PROFIBUS addresses, scan cycle, retentive bit memory, clock memory, etc.).
• SDB 2/3 — DP slave parameter assignment (on DP CPUs).
• SDB 100/101 — diagnostic buffer references and module parameter assignment.

When a technician exports a station's System Data container (e.g. PLC > Download User Program to Memory Card is not the issue — the actual fault path is PLC > Compile and Download Objects > System Data, or the act of Copy + Download Station to PG followed by Download to Target Station), every SDB listed above — including the one that defines the MPI address of station 3 — is written to the target CPU. The target CPU therefore receives an MPI address of 3 even though the physical PROFIBUS/MPI connector is wired into a network where address 3 is already taken by another CPU.

Result: a hard MPI address conflict. Two CPUs respond to the same bus address. Most MPI masters (CP 5611, CP 5613 A2, CP 5621) will detect the collision and either:

• show the address with a question mark, or
• drop one of the responders from the live node list (which is what is observed — only nodes 2 and 3 are reported).

The phenomenon is documented in the Siemens Support entry "Accessible nodes" function does not display all MPI stations and is also referenced in the S7-300/400 system and standard functions manual.

Preconditions Before Recovery

1. You must have the original STEP 7 project (offline HW Config) for the network, or at minimum the HW Config of station 4 with the correct MPI address (4) entered.
2. The PG/PC interface must be set to CP5611 (MPI) in Set PG/PC Interface with the correct MPI parameters (187.5 kbit/s is the STEP 7 default, but the project may use 19.2 kbit/s, 1.5 Mbit/s, or 12 Mbit/s — match the existing project bus profile).
3. You need a known good MPI cable (PROFIBUS cable with D-sub connectors) and a free connector on the bus.
4. The CPU must be in STOP or be allowed to be placed in STOP for the hardware download if the project requires a cold restart. Modern firmware (V2.x and later on CPU 31x) tolerates a hardware download in RUN in most cases, but STOP is the safe choice.

Recovery Method 1 — Download HW Config Directly to the Conflicted CPU

This is the standard, recommended approach described in the STEP 7 V5.x "Downloading to a target system" online help:

1. Open the STEP 7 project in SIMATIC Manager that contains the correct HW Config for station 4.
2. From the project tree, select the SIMATIC 300 Station object that represents station 4 and double-click Hardware to launch HW Config.
3. In HW Config, open the Properties dialog of the CPU (double-click the CPU slot, e.g. slot 2) and verify the MPI address is 4. Click OK.
4. Save and compile (Station > Save and Compile). This regenerates the SDBs with the corrected MPI address.
5. Confirm the PG/PC interface is CP5611 (MPI) and the MPI bus profile matches the project (e.g. 1.5 Mbit/s).
6. Select PLC > Download to Target System (or press Ctrl+L). STEP 7 will first attempt to find an online node; because address 4 is not yet alive (the CPU answers to address 3), you must use the "Target node" selection in the download dialog and enter the MPI address 3 — the only address that the conflicted CPU will respond to.
7. STEP 7 prompts "Do you want to change the CPU to STOP?" — accept.
8. STEP 7 downloads the corrected SDBs. The new MPI address (4) becomes effective as soon as the CPU transitions back to RUN (or, depending on CPU firmware, immediately after the download).
9. Once the CPU is back in RUN, the bus master will now see two distinct responders: address 3 and address 4. Open Accessible Nodes and confirm that nodes 2, 3, and 4 are all listed.

Recovery Method 2 — Isolate the CPU on a Separate MPI Segment

If Method 1 cannot reach the conflicted CPU because the bus master refuses to bind to a duplicated address, or if the technician cannot determine whether the live responder at address 3 is the original or the copy, isolate station 4 on a dedicated MPI segment:

1. Power down station 4. Disconnect its PROFIBUS connector from the main MPI/DP trunk.
2. Use a short MPI stub cable to connect the engineering PG (or the HMI station with CP 5611) directly to the CPU's MPI port. Keep the bus short — direct PG-to-CPU is the most reliable configuration.
3. Power the station back up. The CPU is now the only responder on this mini-segment. It will still answer on MPI address 3 (the duplicated value).
4. Open HW Config of station 4, set the MPI address to 4, save and compile, then PLC > Download to Target System. STEP 7 will now find the CPU cleanly because there is no second responder at address 3.
5. After the download and CPU restart, set the MPI address back to the value required by the rest of the project (still 4), then power down the station and reconnect it to the main MPI trunk.
6. Restore power, verify Accessible Nodes on the engineering station shows addresses 2, 3, and 4.

Recovery Method 3 — Use the CPU's MPI/DP Port Assignment via the Front-Panel Switch (Last Resort)

On certain DP and PN CPUs (e.g. CPU 315-2 DP, CPU 317-2 DP), the second interface can be set as MPI via HW Config, but the front-panel port assignment on the CPU display menu allows temporary override. The procedure:

1. Use the CPU's display/mode selector (or STEP 7 PLC > Assign MPI Address if available on firmware ≥ V2.0) to set a temporary, unique MPI address — e.g. 5.
2. The CPU now answers on a free address; the duplicate at 3 disappears.
3. Connect with STEP 7 on address 5 and download the corrected HW Config with address 4.
4. Reset the display assignment to the configured value and verify Accessible Nodes.

Verification Procedure

1. Open SIMATIC Manager > Options > Set PG/PC Interface and confirm CP5611 (MPI) is active with the correct transmission rate (e.g. 1.5 Mbit/s).
2. Click PLC > Accessible Nodes. The list must show all three MPI addresses, each with a unique name and CPU type.
3. For each node, right-click and select Online > Monitor/Modify or Diagnose Hardware to confirm end-to-end communication.
4. From WinCC, trigger a tag read on a value that originates in the recovered CPU (e.g. a DBW in DB10) and confirm the value updates.
5. Open Accessible Nodes > Online > Module Information on the recovered CPU and check the diagnostic buffer for entries related to MPI address assignment. There should be no address-collision messages after the fix.

Diagnostic Buffer and Common Related Faults

Prevention: Best Practices for Cloning S7-300 Stations

• Never reuse the offline system data of one station on another. Use HW Config to author a fresh configuration for every CPU; only the user program blocks (OB, FB, FC, DB) can be safely copied between identical stations.
• When building a "golden image" for a fleet of identical CPUs, store the user program separately from the HW Config. Re-generate the HW Config with the correct MPI/PROFIBUS address for each target station before downloading.
• Use the SIMATIC Manager > Options > Assign MPI Address function (if available) when commissioning a CPU out of the box. The default MPI address on a brand-new S7-300 CPU is 2, not the address shown in the offline project.
• Document the MPI address of every CPU in the project and on the cabinet door; visual inspection is the fastest way to spot a duplicated address during a service visit.
• Verify the terminating switch on every PROFIBUS connector: the two stations at the physical ends of the segment must be terminated (switches ON), the others OFF. This is unrelated to the address conflict but is the most common secondary cause of "missing" nodes.

Commissioning Checklist After Recovery

1. PLC fault LED off; RUN LED solid green; SF/BF off on the MPI/DP interface.
2. Diagnostic buffer free of new entries related to address or parameter assignment.
3. All three CPUs appear in Accessible Nodes with distinct MPI addresses (2, 3, 4).
4. PG functions (Monitor/Modify, Download to PG) work on all three stations.
5. WinCC connection list reflects the correct MPI addresses for all three PLCs.
6. Cross-PLC communication (PUT/GET via S7 connection or BSEND/BRCV on S7-400) functions end-to-end between station 3 and the recovered station 4.
7. Backup of the corrected HW Config and SDBs is stored both in the PG project and on the CPU's memory card (if used).

Troubleshooting Matrix

Frequently Asked Questions