S7-300 CPU 313C-2 DP Download Error 294-6: MB255 Memory Fix

1. Problem Overview

The Siemens S7-300 CPU 313C-2 DP rejects a block download with error code 294-6 when the FC, FB, or instance DB being loaded contains operands whose absolute addresses fall outside the memory map supported by the CPU. The most common trigger in the field is the use of bit-memory bytes above MB255 (e.g., MB256–MB4095), timers above T255, or counters above C255. The download halts and the block is not written to the target PLC even though STEP 7 (SIMATIC Manager or TIA Portal) reports a successful compile with zero errors and zero warnings.

The mismatch is silent at compile time because the offline program editor is bound only to the symbolic address table and not to the runtime memory map of the destination CPU. The error surfaces only when the load image is built and pushed across PG/PC → PLC via MPI/PROFIBUS or via the integrated DP port of the CPU 313C-2 DP.

2. CPU 313C-2 DP Technical Specifications

The CPU 313C-2 DP is a compact CPU with integrated digital and analog I/O, an integrated PROFIBUS DP master/slave interface, and three high-speed counters. The relevant memory limits for this article are summarized below.

Reference: S7-300 CPU 31xC and CPU 31x Manual (Siemens Support entry 8861711) and the S7-300 CPU 313C-2 DP/PtP Operating Instructions on the Siemens Industry Online Support portal.

3. S7-300 Address Space Architecture

The CPU 313C-2 DP organises its operand area as eight discrete address spaces. STEP 7's absolute address must be valid in the runtime image of the destination CPU; otherwise the online loader raises a download fault.

The total size of an operand's container (e.g., MW256 requires two bytes, MB256 and MB257) must also be fully within range. An MW254 or MW255 access is legal because it consumes only MB254–MB255. An MW256 access (consuming MB256–MB257) is illegal because both bytes fall outside the legal range.

4. Error Code 294-6: Detailed Breakdown

Siemens assigns diagnostic codes in a structured format: 294-6 falls under the family of download/load faults returned by the CPU's online interface. The 294 series signals block load rejected by target system; the suffix 6 indicates the specific reason: operand outside CPU-supported range.

Authoritative source: the STEP 7 Error Code Reference (PDF 770453, att_117322/v1) published by Siemens AG.

5. Root Cause Analysis: Why the MB255 Boundary Fails

The failure has three contributing factors that compound into a single error event:

1. Symbol table decoupling. The STEP 7 symbol table permits entries for any address the user types, including MB1024. The symbol editor does not validate against the destination CPU. As a result, a project originally developed for a larger S7-300 CPU (e.g., CPU 319-3 PN/DP with MB0 – MB4095) is silently portable to a smaller CPU with a different M-area size.
2. Block compilation blind to address map. Compiling a FC or FB checks only the network logic, instruction set coverage, and data type consistency. It does not confirm that the addresses are valid for the target CPU. STEP 7 reports 0 errors, 0 warnings.
3. Online load validates against CPU firmware. The download path (via PLC > Download in SIMATIC Manager, or Online > Download to device in TIA Portal) builds the block image and transmits it to the CPU. The CPU's loader walks the block, examines every operand, and rejects the block as soon as it encounters an address that exceeds the firmware-defined range.

The user-visible symptom is therefore: clean offline compile, failed online load, single 294-6 event in the diagnostic buffer. The diagnostic buffer (reachable via PLC > Diagnose/Hardware > Diagnostic Buffer) is the authoritative source for the rejected address.

6. Diagnostic Procedure

1. Read the diagnostic buffer. In SIMATIC Manager, right-click the CPU node, choose PLC > Diagnose/Hardware > Diagnostic Buffer. Look for an event of class CPU/fault with text containing the operand that triggered the rejection. Example entry: Block FC10 load error 294-6: operand MB256 out of range.
2. Cross-check the symbol table. In S7 Program > Symbols, sort the Address column descending. Any M, T, or C address exceeding the limit (255 for the CPU 313C-2 DP) is suspect.
3. Grep the FC/FB source. Open the failed block. In LAD/FBD view, use Options > Cross-references to enumerate every absolute operand. In STL view, search the source for the literal string MB 2 or higher, T 256 or higher, and C 256 or higher.
4. Confirm with Accessible Nodes > Online > Compare. This highlights exactly which block(s) the CPU refuses to absorb.

7. Resolution: Step-by-Step

The following procedure resolves the 294-6 fault for the MB255 / T255 / C255 boundary. It assumes SIMATIC Manager with a STEP 7 V5.x project. TIA Portal follows the same logical flow with menu changes noted inline.

1. Place the PLC in STOP. From SIMATIC Manager: PLC > Operating Mode > STOP. This eliminates write-protection as a secondary cause.
2. Open the Blocks folder in the S7 program.
3. Compile the project explicitly. Right-click the Blocks folder and choose Compile. Confirm 0 errors, 0 warnings. If errors appear, fix syntax first.
4. Open the failing FC/FB in the editor (LAD/FBD/STL).
5. Use cross-references to list every absolute operand used in the block. Filter for operands with an M-, T-, or C- prefix and address number > 255.
6. Rewrite the offending addresses to legal values inside the 0 – 255 range. Two patterns are typical:
   • Shrink the working set. If the program genuinely requires more than 256 bytes of bit memory, you have already exceeded the CPU's design point. Either switch to a larger CPU (e.g., CPU 314, CPU 315-2 DP, CPU 317-2) with an extended M-area or refactor to use data-block (DB) storage instead of M-area. The CPU 317-2 PN/DP supports up to MB0 – MB4095; the CPU 319-3 PN/DP supports MB0 – MB16383.
   • Reuse existing M bytes whose existing symbols are no longer used by the live program. Cross-references and the Program Info (Reference Data) tool help confirm dead memory.
7. Update the symbol table to match the rewritten absolute addresses. Decide between Symbol has priority or Absolute address has priority in the block folder properties (see Section 8).
8. Recompile the entire Blocks folder. Resolve any new errors introduced by the address remap.
9. Download the corrected block(s) via PLC > Download. Repeat for every FC/FB/DB that previously failed.
10. Switch the CPU back to RUN and verify scan-cycle behavior.

8. Symbol Priority Configuration

After an address rewrite you must ensure that subsequent compiles do not silently re-apply the old absolute addresses. This is controlled in the Blocks folder properties:

Configure via: Blocks folder → right-click > Properties > Block folder > Address priority. In TIA Portal the equivalent setting lives under Project tree > PLC > Properties > General > Symbolic access and in the compile settings of the program blocks.

9. Verification and Validation

1. Diagnostic buffer clean. After download, re-open the diagnostic buffer. The 294-6 event should be the most recent download-related entry, with no follow-up fault.
2. Online > Compare. Online > Compare Offline/Online must report identical for the affected FC/FB/DB.
3. Monitor the affected M bytes with a VAT or watch table. Force a MW in the new range and verify expected behavior.
4. Run a scan-time check. With the CPU in RUN, the cycle time should be stable. A sudden 100 ms increase suggests a newly introduced loop or block overcall.
5. Cross-reference closure. Re-run Reference Data > Cross-references and confirm no unused or stranded operands remain in the symbol table.

10. Common Pitfalls and Cross-Platform Notes

11. Troubleshooting Matrix

12. Related Engineering Notes

• MMC sizing. A project rewritten to use more DBs and less M-area will grow load memory. The 313C-2 DP accepts up to an 8 MB Micro Memory Card (MMC, 6ES7953-8LPxx-0AA0). Plan for a 2–4 MB MMC if the project exceeds 256 KB of offline block data.
• IEC timers as a fallback. When the 256-timer limit binds, consider SFB 3 ("TP"), SFB 4 ("TON"), and SFB 5 ("TOF") IEC timers. They are stored in instance DBs and are not bound to the T-area count limit, trading simplicity for instance-DB overhead.
• Migration path to S7-1500. A direct port from S7-300 to S7-1500 via TIA Portal preserves symbol names, but the address-priority semantics differ. Use the migration tool with the Address priority: Symbol has priority option to avoid silent revert.
• Project documentation. Record the maximum M-, T-, and C-area consumed in the project header. This single line of metadata prevents the 294-6 class of fault the next time someone re-targets the project to a smaller CPU.