Resolving S7-300 PROFIBUS DP-DP Slave Output Reset Fault

Problem Overview

Engineers commissioning multi-node PROFIBUS DP networks with multiple Siemens SIMATIC S7-300 stations occasionally encounter a fault pattern in which every digital output on a configured DP slave appears energized in the STEP 7 online watch table while the physical output modules on the rack remain de-energized (0 V at the load terminals). The CPU reports RUN with no SF (Group Error) LED, no BF (Bus Fault) LED, and the hardware diagnostic view in HW Config shows every module as "Available and OK." The process image of outputs is being cleared on every scan cycle, and no amount of SET or = logic retains the value at the module terminals.

The pattern is characteristic of a Process Image (PI) addressing conflict between the locally programmed I/O addresses and the I/O addresses STEP 7 reserved for the DP-DP coupling. When the master writes the slave's I/O into the local address space and the slave's scan-end update of the Process Image of Outputs (PIQ) writes 0 to the module because the logical and physical addresses do not align, the symptom is exactly what the field engineer observes: the online monitor shows 1, the hardware shows 0.

Affected System Configuration

The reference configuration described here consists of three identical stations, each based on a SIMATIC S7-300 CPU 315-2DP with PROFIBUS DP master/slave interface, organized in a DP-DP coupling (master/slave) topology.

The CPU 315-2DP integrates a PROFIBUS DP interface capable of acting as a class 1 master or as a slave simultaneously. When configured as a slave with the DP master-slave mode (MS), the CPU exchanges one or more consistent data blocks with its DP master. The slots in the configuration table for that interface define the data lengths and the local I/O address range where the master-side data is mirrored into the slave CPU's address space.

Observed Symptoms

The decisive row is the DP slave configuration in the slave CPU's HW Config (CPU 315-2DP > X2 > DP master-slave mode > Configuration). When the values shown above are entered, STEP 7 reserves the slave's input byte IB 534 for the master-to-slave data and the master's output byte OB 234 for the same data on the master side. The data exchange is consistent (one byte) and the master writes its QB 234 to refresh the slave's IB 534 at every DP cycle.

Root Cause Analysis

The fault described in the reference incident is not a PROFIBUS bus fault, nor a DP diagnostic fault, nor a CPU fault. It is a logical-to-physical output address mismatch introduced when the project was scaled from a single-station STEP 7 project to a multi-node DP network. The original single-station project had the SM 322 digital output module manually placed at logical address Q 0.0..Q 3.7 (the lowest possible address). When the engineer copied the hardware configuration into a new project and re-assembled the network, the SM 322 was left at its STEP 7 default address, which the software assigned as Q 16.0..Q 21.7 (a 6-byte digital output area). The user program, however, still referenced Q 0.0..Q 3.7 from the original project.

The CPU's process image of outputs, which is 128 bytes wide on the CPU 315-2DP, is updated to the output modules at the end of every OB1 cycle (or under explicit SFC27 "UPDAT_PO" control). The update writes the byte at PIQ offset 0 to QB 0 on the rack, offset 16 to QB 16, and so on. Because the SM 322 is physically mapped to Q 16.0..Q 21.7 after the re-assignment, only logical bits that are written to Q 16.x produce a voltage at the terminal. The user program's writes to Q 0.x update the process image at offset 0, but no module exists at that address. STEP 7 reports "Available and OK" because the slot is empty rather than faulty.

When the engineer changed the SM 322 logical address range to Q 126..127 and wrote SET Q 126.0, the program energized the output. This confirms that the user program and module mapping were simply out of register. The fix is to either (a) re-align the module address back to Q 0..3 in HW Config, or (b) update the program symbols and contacts to use Q 16..21.

Solution Procedure

The fix is to reconcile the logical I/O addresses between the HW Config module placement and the user program. The following procedure is reproducible on STEP 7 V5.5 with any S7-300 CPU 315-2DP at firmware V2.x.

1. Open the affected slave station in SIMATIC Manager and launch HW Config.
2. Select the SM 322 digital output module in slot 4 (or wherever the DQ module is placed).
3. Double-click the module to open its Properties dialog and select the Addresses tab.
4. Note the Start address currently assigned. If the start address is in the system default area (e.g., 16) and the program writes to a different address (e.g., 0), uncheck System default and enter the address that matches the program (e.g., 0), or alternatively update the program to reference the system default address.
5. Click OK and re-compile and download the HW Config to the CPU (Station > Compile and Download Objects, or PLC > Download to Target Station).
6. Place the CPU in STOP, perform the download, then return to RUN.
7. Verify in VAT/PLCSIM or with Monitor/Modify that the bit you SET in the program now produces a high level at the corresponding output terminal.
8. If the symbol table is bound to the old addresses, run a project-wide symbol update (Options > Symbol Table > Export/Import or use the "Replace" function) to retarget symbols to the new start address.
9. Document the final address map in the project's cover sheet so the next engineer (or the next project copy) can re-verify the mapping quickly.

If the user program is to be preserved with its existing symbols (e.g., Motor1_Run bound to Q 0.0), it is usually faster to change the HW Config address. If the symbol table is to be re-built, changing the program may be preferable. Either way, the rule is that the symbol's address must equal the module's start address in HW Config.

Verification

After the download, perform the following checks in order.

1. Confirm CPU is in RUN with SF and BF LEDs off.
2. In VAT, force the suspect output bit (e.g., Q 0.0 := 1 in Modify). Measure the SM 322 output terminal with a multimeter: it should read 24 V DC (or your load voltage).
3. Open the CPU diagnostic buffer (PLC > Diagnostic/Setting > Diagnostic Buffer) and confirm no new diagnostic events have been logged since the download. Look specifically for event IDs in the I/O fault class (e.g., 0x3311, 0x3321, 0x39B1).
4. Open the module information of the SM 322 (HW Config > right-click > Module Information) and confirm parameter assignment, channel diagnostics, and I/O status are clean.
5. Power-cycle the slave station. The outputs should power up in their last state if the SM 322 is configured to retain, or in their default state per the module parameters. This rules out a cold-start re-mapping that could re-introduce the mismatch.
6. Repeat the test on the master side: set the master bit that maps to QB 234 and verify the value appears at the slave's IB 534 in the slave VAT. This confirms the DP-DP coupling is still healthy after the address change.
7. Run a cross-reference (Options > Cross-References) on the affected address range to confirm that all accesses (read/write) point to the same physical address and that no orphan accesses remain.

Process Image of Outputs vs Direct Peripheral Access

The CPU 315-2DP supports two distinct mechanisms for writing to digital and analog outputs.

The CPU 315-2DP provides a 128-byte Process Image of Inputs (PII) and a 128-byte Process Image of Outputs (PIQ). The mapping of a physical module's start address to either PII/PIQ or direct peripheral area is determined by the Process Image column in the module's HW Config > Addresses tab. By default, S7-300 digital I/O is mapped into the process image, and most analog I/O is mapped into the process image as well. Special modules (FM, CP, F-module) may opt out.

A common contributor to "output is 1 in VAT, 0 on the terminal" symptoms is mixing these two access methods. If the user program writes directly to the module with T PQB 0, the bit appears at the terminal immediately. However, when OB1 subsequently writes T QB 0 (or any PIQ-mapped instruction) with a value of 0, the end-of-cycle PIQ update clears the module. The fix is to keep direct peripheral writes consistent with PIQ writes for the same address — or, preferably, use the PIQ only and reserve direct peripheral access for time-critical paths.

OB1 Cycle and PIQ Update Timing

The PIQ update at the end of OB1 is implemented internally as a system call; the user does not see it in the program code. The order of operations in every OB1 cycle is: (1) read PII from input modules into the process image, (2) execute the user program in OB1 priority class 1, (3) write PIQ to output modules, (4) service any higher-priority OBs that have interrupted. If a higher-priority OB (e.g., OB35 cyclic interrupt, OB40 hardware interrupt) writes to the same output address with a different value, the last writer wins for the PIQ update at the end of the cycle.

For most field engineers, this is transparent. The trap is when the project contains both an OB1 that writes Q 0.0 := 0 as a default and an OB35 that writes Q 0.0 := 1 as a fast update. The VAT will show 1 in the moment after OB35 but 0 at the start of the next OB1. The terminal will read 0 most of the time. The fix is to consolidate the write logic into a single priority class, or to use SFC26 "UPDAT_PI" / SFC27 "UPDAT_PO" to force an explicit update between the two writes.

DP-DP Coupling Configuration (MS Mode)

DP-DP coupling allows two PROFIBUS DP masters to exchange I/O data without an intervening coupler. The S7-300 CPU 315-2DP supports this through its integrated DP interface when configured as a slave with operating mode DP-Master/Slave. The exchange is one or more consistent data slots, each with a partner address on the master side and a local address on the slave side.

Configuration rows are added in HW Config on the slave CPU by selecting the DP interface (X2) and opening Properties > Operating Mode > DP Master-Slave > Configuration. Each row defines one consistent data slot. Inputs and outputs are independent: a row is either input-to-slave (from the master) or output-from-slave (to the master), depending on direction. For cross-vendor DP master configuration of the same parameters, refer to the Schneider Electric Machine Expert documentation: PROFIBUS DP Master - 'General' (Schneider Electric). For a third-party slave device that exposes its PROFIBUS input/output address map to the master, see the Pro-face PROFIBUS DP Slave Driver manual for a worked example of how the master-side start address corresponds to a slave input.

The PROFIBUS master view of the same exchange is set up in the master's HW Config by adding the slave CPU as a DP slave and configuring matching slots. Mismatched slot lengths or directions cause DP diagnostic frames and the slave's diagnostic buffer will show a "Configuration fault" event (typically ID 0xE005) or a "Station failure" (ID 0xE002). Neither was present in this incident, confirming the DP-DP coupling was correctly configured at the bus level.

SYNC and FREEZE Group Commands

PROFIBUS DP supports broadcast group commands that synchronize output updates (SYNC) and input capture (FREEZE) across multiple slaves simultaneously. Siemens documents the assignment of S7-300/S7-400 DP slaves to SYNC/FREEZE groups in TIA Portal and STEP 7. Refer to the Siemens TIA Portal documentation for assigning a DP slave to a SYNC/FREEZE group: Assigning a DP slave to a SYNC/FREEZE group (S7-300, S7-400, S7-1500).

The SYNC command instructs a slave (or a group of slaves) to freeze its outputs at the currently received values and to ignore subsequent output frames from the master until a new SYNC command with new data is issued. The FREEZE command instructs a slave to capture its inputs in a momentary state and to transmit that data in the next data exchange; subsequent input changes are ignored until the next FREEZE.

For the CPU 315-2DP operating in MS mode, SYNC and FREEZE behavior is enabled on the master side and affects the slave's outputs and inputs. If the engineer mis-assigns the slave to a SYNC group but the master does not issue SYNC, the slave's outputs will not update. This is not the cause in the reference incident (no SYNC group was assigned), but it is a related failure mode worth ruling out. To verify, open the master's HW Config > PROFIBUS DP > group properties and confirm no SYNC/FREEZE group is enabled for the affected slave.

Diagnostic Procedures

When facing an "output energized in monitor, de-energized on the terminal" symptom on a CPU 315-2DP, perform the following checks in this order.

1. Open the diagnostic buffer of the slave CPU (PLC > Diagnostic/Setting > Diagnostic Buffer). Look for entries with ID 0x130E (sub-module mismatch), 0x3311 (I/O read access error), 0x3321 (I/O write access error), 0x39B1 (module parameter assignment error), 0xE002 (DP station failure), 0xE003 (DP slave diagnostics), or 0xE005 (DP invalid configuration). None of these should be present for the symptom in question.
2. Open the module information of every SM (signal module) in the rack (right-click > Module Information in HW Config). Confirm that the Slot is populated and that the I/O status shows OK for each channel.
3. Compare the user program symbols (Symbols editor) against the module start addresses in HW Config (Addresses tab). Every symbol must resolve to a physical module address; an unresolved or mismatched symbol is the most common cause of this symptom.
4. Use a cross-reference (Options > Cross-References) to enumerate every access to the suspect address range (e.g., Q 0.0..3.7). Confirm that the program is not using a mix of process-image and direct-peripheral writes for the same byte.
5. Force the suspect bit in Monitor/Modify (PLC > Monitor/Modify). The force should persist across OB1 cycles; if it does not, the value is being overwritten elsewhere — search for additional = or R instructions on the same bit.
6. Open the DP slave configuration of the slave CPU and verify that the configured local address range (e.g., IB 534) does not overlap with any signal module address. The overlap would not normally cause outputs to clear, but it would corrupt the input data and could mask a coincident local-I/O fault.
7. Check the master-side DP slave configuration: open the master's HW Config, navigate to the slave CPU's properties, and confirm the slot definitions match the slave's configuration one-to-one.
8. Open the Address Overview (Options > Address Overview) in HW Config and print a side-by-side list of input, output, and DP-coupled addresses for the entire station. The map is the fastest way to spot a logical/physical mismatch.
9. If a third-party DP device is in the network, confirm that the GSD file version matches the firmware on the device. GSD / firmware mismatches can produce a module-status OK but data-not-refreshed condition.

Preventive Best Practices

1. Always reconcile module start addresses with the symbol table before downloading a copied HW Config. Use the STEP 7 "Address Overview" tool to print a side-by-side of logical and physical addresses.
2. Avoid the system default address range for new projects. Manually assign addresses starting at 0 (digital) and at the next free area above the process image (analog) so the symbol table can remain stable across project copies.
3. Use OB100 / OB101 / OB102 (warm/cold/restart) to initialize process images explicitly. A startup OB that sets all outputs to a known state prevents flicker during the first scan after download.
4. Lock the SM 322 module's address assignment in HW Config by unchecking "System default" for every digital output slot once the project is stable. This forces the engineer to acknowledge any address change before download.
5. When commissioning a multi-node DP network, document the expected I/O address map for each node in a separate spreadsheet. A one-page map is faster to verify than cross-referencing three HW Configs.
6. Place a single SET instruction on a known good output (e.g., a heartbeat LED) in OB1 and verify it toggles both in the VAT and at the module terminal after every download. This is a one-minute test that catches address mismatches before the system is signed off.
7. When copying a project, always re-open the slave HW Config and confirm that the slot-to-address map is identical to the original. A 30-second verification prevents a multi-day troubleshooting session.
8. Use OB35 (or another cyclic interrupt) for time-critical output logic instead of direct peripheral writes. The PIQ-based path is easier to monitor and avoids the direct-vs-PIQ consistency trap described above.
9. Keep the DP-DP coupling address range (e.g., IB 534) in a separate, well-documented area of the symbol table with a prefix like "DP_from_master_" to make it visually obvious that the address is not a local I/O point.

FAQ