S7-300 Diagnostic Buffer: Resolving CPU Errors After Program Download
When an engineer transfers a STEP 7 project to a SIMATIC S7-300 CPU, two questions immediately surface: why does the online block list contain objects that do not exist in the offline program, and how is the red CPU fault indicator interpreted? Both questions are answered by understanding the S7-300 memory model and the integrated diagnostic buffer. This reference consolidates the field procedures, block taxonomy, and error codes that engineers encounter the first time they commission a download to an S7-300 CPU such as the CPU 315-2 PN/DP or CPU 317-2.
Overview of the S7-300 Download and Online Block Model
The S7-300 separates program storage into three physical regions: load memory (typically the MMC card or, on older CPUs, integrated RAM), work memory (volatile RAM executing the cyclic OB1), and system memory (timer, counter, bit, I/O, and local stack areas). The online view in STEP 7 V5.x or the TIA Portal reflects what is currently stored in load memory, not the offline source on the programming device. After a successful Download to Target System (Station), the online block tree therefore shows three categories of blocks:
- User blocks: OB, FB, FC, DB that exist in the offline project and were just downloaded.
- System blocks: SFB, SFC, SDB that the firmware generates or instantiates during hardware compilation.
- Residual blocks: older FB/FC/DB instances from a previous project that were not deleted from load memory before the new download.
Identifying the CPU Error: The SF LED and Diagnostic Buffer
The S7-300 has two diagnostic front-panel indicators that matter during commissioning: SF (group fault, red) and BF (bus fault, red). The SF LED is generic; it does not specify the cause. To identify the precise fault class, fault code, and timestamp, the engineer must open the diagnostic buffer.
The diagnostic buffer is a ring buffer of the last 100 fault and operating events held in non-volatile memory on the MMC. Each entry contains:
- Sequential event ID.
- Timestamp (CPU date/time, to millisecond resolution).
- Event class:
1= standard OB / startup,2= synchronous error,3= asynchronous error,4= stop event,5= mode change,6= communication,7= H/F/F-I/O fault,8= diagnostic for module,9= standard OB event,A= user-defined. - Fault code (hexadecimal).
- Block and address context where the fault was raised.
Opening the Diagnostic Buffer in STEP 7 V5.x
- Select the S7-300 station in SIMATIC Manager.
- Right-click the target CPU and choose Online > Accessible Nodes if the online partner is not already defined.
- Establish an online connection (MPI/PROFIBUS or Ethernet via TCP/IP).
- Highlight the CPU online object.
- Press Ctrl+D, or use the menu PLC > Diagnostic/Setting > Diagnostic Buffer.
- Click the most recent entry to expand the additional details (associated OB, fault location, register states).
- Click Open Block to jump directly into the offline block that raised the fault.
In TIA Portal, the equivalent path is Online > Diagnostics > Diagnostic Buffer after expanding the device tree under Online > Accessible Devices.
Common CPU Errors Reported After Program Download
The first diagnostic entries after a download typically fall into one of the following categories. Each fault code maps to a single root cause that must be corrected before the CPU can return to RUN.
| Hex Code | Meaning | Likely Cause After Download | Remediation |
|---|---|---|---|
SF 1010 |
STOP because of unknown OB | OB referenced by the program not loaded (e.g. OB82, OB86, OB121 missing for peripheral fault handling). | Add the required OB to the offline project and re-download. |
SF 2522 |
STOP because of priority class error | OB configuration error, or a block calls itself recursively. | Check block nesting, OB configuration table. |
SF 3500 |
STOP because of module diagnosis | A signal module reports diagnostic interrupt (e.g. wire break on AI). | Resolve field wiring, clear diagnostic with ACK. |
SF 3939 |
STOP because of memory reset request | MMC was inserted into a CPU that had been in RUN; automatic memory reset fails. | Perform MRES from STEP 7 or the front panel. |
SF 4900 |
STOP because of MMC failure | Memory card write fault, incompatible MMC size, or SIMATIC MMC write protection. | Replace MMC; ensure 2 MB minimum for most projects. |
SF 6581 |
STOP because of firmware update | Firmware update interrupted or incompatible with hardware version. | Re-flash using the correct firmware bundle. |
SF 8200 |
STOP because of PROFINET/PROFIBUS failure | Distributed I/O partner not reachable after download reset. | Verify device names, IP, bus topology. |
SF AA01 |
STOP because of user-program error | Indirect addressing fault, DB not loaded, type conversion overflow. | Use cross-reference; insert OB121 to keep CPU in RUN. |
SF indicate an event that drives the CPU to STOP. Codes prefixed with DV indicate a diagnostic event for a module that does not by itself stop the CPU.System Blocks (SFB, SFC, SDB): What They Are and Why They Appear
The S7-300 firmware provides a library of pre-implemented blocks that are integrated into the operating system. They are not loaded from the engineering station during download; instead, they are generated automatically when STEP 7 compiles the hardware configuration (HW Config) and writes the corresponding system data blocks.
System Functions (SFC)
SFCs are operating-system functions callable from the user program. They execute firmware-level tasks such as time-of-day handling, copy operations, and rack diagnostics. Examples include:
| Block | Function | Typical Use |
|---|---|---|
SFC 0 SET_CLK |
Set CPU clock | Time synchronization in distributed systems. |
SFC 1 READ_CLK |
Read CPU clock | Timestamping in user DBs. |
SFC 20 BLKMOV |
Copy memory area | Bulk data transfer between DBs. |
SFC 46 STP |
Stop CPU | Controlled shutdown. |
SFC 51 RDSYSST |
Read system status list (SSL) | Diagnostic polling. |
SFC 52 WR_USMSG |
Write user diagnostic message | Custom diagnostic entries. |
SFC 58 / 59 WR_REC / RD_REC |
Write / read data record | Parameterization of I/O modules. |
System Function Blocks (SFB)
SFBs are operating-system function blocks that retain their instance DB across cycles. They implement complex services that require state memory:
| Block | Function | Notes |
|---|---|---|
SFB 0 CTU |
Up counter | Instance DB mandatory. |
SFB 1 CTD |
Down counter | Edge evaluation internal. |
SFB 2 CTUD |
Up/down counter | Two output instances. |
SFB 3 TP |
Pulse timer | IEC 61131-3 conformant. |
SFB 4 TON |
On-delay timer | IEC 61131-3 conformant. |
SFB 5 TOF |
Off-delay timer | IEC 61131-3 conformant. |
SFB 9 CMOV |
Conditional move | Used for selective data routing. |
SFB 12 BSEND |
Buffered send | S7 communication (PUT/GET family). |
SFB 13 BRCV |
Buffered receive | S7 communication pair with BSEND. |
SFB 14 GET |
Read remote CPU | S7 connection: S7-300 ↔ S7-300/400/1500. |
SFB 15 PUT |
Write remote CPU | S7 connection partner. |
SFB 22 POS |
Positioning | Requires FM/ET200S. |
SFB 41 / 42 / 43 CONT_C / CONT_S / PULSEGEN |
PID control | Standard PID blocks. |
SFB 44 ANALOG |
Analog scaling | Used with FM 355 / FM 455. |
SFB 46 DIGITAL |
Digital I/O control | Used with FM 355 / FM 455. |
SFB 47 COUNT |
Counter control | Used with FM 350-1. |
SFB 48 FREQUENC |
Frequency measurement | FM 350-1. |
SFB 49 PULSE |
Pulse width modulation | FM 350-1. |
SFB 52 / 53 / 54 / 55 RD_/WR_DB / ALARM_ / NOTIFY_ |
DPV1 services | Decentralized diagnostics. |
SFB 73 / 74 / 75 PRVREC / RSVREC / PRSVREC |
PN IO read / record services | PROFINET record access. |
SFB 81 / 82 / 83 / 84 / 85 RD_DPAR / DPWR_DAT / DPRD_DAT / DPNRM_DG / DPLUA |
DP slave diagnostics | PROFIBUS DP-V1 master. |
The exact set of SFBs depends on the CPU firmware version. A CPU 315-2 (6ES7 315-2EH14) exposes a larger SFB set than a CPU 312 (6ES7 312-1AE14). Reference the CPU 31xC and CPU 31x operating instructions for the exact list per order number.
System Data Blocks (SDB)
SDBs are generated when the hardware configuration is compiled. Each SDB describes one logical component of the configuration: rack assignment, module parameters, PROFIBUS/PROFINET topology, S7 connections, and global data definitions. Common SDB numbers include:
-
SDB 0– CPU parameters (priority, watchdog, clock). -
SDB 1000+– Per-module parameter records. -
SDB 2000+– PROFIBUS DP master / slave configuration. -
SDB 3000+– PROFINET IO device assignment. -
SDB 4000+– S7 connection definitions (PUT/GET, ISO-on-TCP).
When the online view lists SDBs that the offline project does not show explicitly, this is normal: SDBs are an artifact of compilation and reside only in load memory.
Why Extra User Blocks Appear Online
Beyond the firmware-generated system blocks, a download may also reveal previously downloaded user FB, FC, and DB blocks that the current offline project no longer contains. Three mechanisms produce this state:
- Incomplete overwrite: STEP 7 deletes blocks from load memory only when the Delete checkbox is set in the download dialog. A plain download re-loads blocks present in the offline tree but leaves orphan blocks intact.
- Block number reuse: An FB or FC was removed from the offline tree, but a download left the previous version resident. Loading only the active blocks will not overwrite deleted blocks.
- Forgotten instances: Instance DBs from previous FB versions persist because they were never explicitly deleted; renaming an FB does not garbage-collect the old instance.
Housekeeping Procedure Before a Download
- Right-click the S7-300 station and choose PLC > Download User Program to Memory Card with the Replace MMC contents option. This wipes the entire load memory and writes only the current project.
- Alternatively, in the download dialog, enable Overwrite all blocks and confirm deletion of unmatched blocks.
- After the download, perform PLC > Compare Blocks to verify online/offline equivalence.
Load Memory, Work Memory, and the MMC
For S7-300 CPUs, the load memory is implemented on the SIMATIC Micro Memory Card (MMC). Work memory is integrated RAM sized per CPU order number; it is not expandable. When a project is downloaded, the SFCs SFC 83 / 84 / 85 (READ_DBL, WRIT_DBL) may be used by the firmware to copy from load memory to work memory. The user program always executes from work memory; load memory holds the project source.
| CPU | Order Number | Work Memory (Code / Data) | MMC Required |
|---|---|---|---|
| CPU 312 | 6ES7 312-1BE03-0AB0 | 16 KB / 8 KB | Yes, 64 KB minimum |
| CPU 313 | 6ES7 313-5BF03-0AB0 | 32 KB / 16 KB | Yes, 64 KB minimum |
| CPU 314 | 6ES7 314-1AG13-0AB0 | 48 KB / 24 KB | Yes, 64 KB minimum |
| CPU 315-2 DP | 6ES7 315-2AG10-0AB0 | 128 KB / 64 KB | Yes, 128 KB minimum |
| CPU 317-2 PN/DP | 6ES7 317-2EK13-0AB0 | 512 KB / 256 KB | Yes, 1 MB minimum |
| CPU 319-3 PN/DP | 6ES7 318-3EL00-0AB0 | 1.4 MB / 1 MB | Yes, 2 MB minimum |
SF 4900. Always power down, remove the card, and re-insert before re-powering.Step-by-Step: Diagnosing and Clearing CPU Errors After Download
- Establish online connection. Open SIMATIC Manager (STEP 7 V5.x) or TIA Portal. Use Online > Accessible Nodes and identify the CPU by IP/MPI address.
-
Read the diagnostic buffer. Press
Ctrl+Dwith the CPU selected. Sort entries by ID descending. -
Identify the most recent STOP event. Click the entry; the right pane will list the event class (typically
1to4), fault code, and block context. - Open the offending block. Click Open Block from the diagnostic buffer toolbar; STEP 7 opens the offline block and jumps to the network/line.
- Cross-reference. Right-click the symbol or block number and choose Go To > Cross-Reference to identify callers.
- Resolve the fault. Typical corrections include adding missing OBs (OB82, OB86, OB121), correcting DB number conflicts, fixing indirect addressing, or repairing PROFIBUS/PROFINET wiring.
- Recompile. Station > Consistency Check then Save and Compile. Correct any SDB generation errors flagged by the compiler.
- Re-download. Use the full Download to Target System. Confirm the dialog lists all expected blocks.
- Switch to RUN. From the CPU online view, click RUN or use the mode selector on the front panel.
-
Verify. Observe the SF LED is off; check the diagnostic buffer again for new entries; confirm
RUNstate in the operating mode field.
Verification Checklist
| Check | Expected Result | Failure Indication |
|---|---|---|
| CPU front panel | RUN LED green, SF LED off | SF on → read diagnostic buffer |
| Diagnostic buffer newest entry | Mode change "STOP -> RUN" | STOP event → resolve and retry |
| Block comparison | Online ↔ offline identical | Mismatch → re-download with overwrite |
| Cycle time | Within configured OB1 max (typ. 150 ms) | OB1 cycle time exceeded → optimize code |
| MMC write attempts | 100 000 write cycles remaining | Replace MMC if below 10 000 |
| S7 connections | All Established in Connected Partners | Broken → check IP/MPI, partner CPU |
| Distributed I/O | BF LED off on CPU and IM | BF on → check bus cable, terminator |
Troubleshooting Matrix
| Symptom | Diagnostic Buffer Code | Root Cause | Corrective Action |
|---|---|---|---|
| CPU stays in STOP after download | SF 1010 |
Missing OB | Add OB82/OB86/OB121 |
| SF on but CPU runs | SF 3319 |
Distributed I/O partial failure | Inspect failed station |
| BF on, no PROFIBUS comms | SF 3788 |
DP slave failure | Verify GSD file, slave address |
| Download fails with "target CPU not in STOP" | n/a | Mode selector not at RUN-P or STOP | Set selector to STOP or RUN-P |
| Download hangs at 50% | n/a | MMC full or write-protected | Replace MMC, unlock |
| Online view shows extra FB/FC/DB | n/a | Residual blocks from prior project | Re-download with overwrite |
| Online view shows SFB/SFC/SDB not in offline | n/a | Firmware / HW Config artifacts | Expected, no action |
| SF after firmware update | SF 6581 |
Boot loader damaged | Recover via SIMATIC Automation Tool |
Cross-Platform Notes
The block taxonomy discussed here is specific to the SIMATIC S7-300 family. For S7-1200 and S7-1500, the equivalent system blocks are accessible through the TIA Portal libraries and use FB/FC prefixes within the "System" directory; the conceptual model is the same but the firmware integration is tighter and the diagnostic buffer is accessed through Online > Diagnostics > Diagnostic Buffer on the device view.
For PLCs from other manufacturers, the same logical separation applies. Automation Direct CLICK series PLCs, for example, do not expose a diagnostic buffer of the S7 style; program downloads are managed through the CLICK programming software and the editing environment provides a compile log instead. Reference the Automation Direct CLICK software documentation for the equivalent transfer workflow on that platform.
Safety and Operational Considerations
During commissioning, a CPU in STOP removes process control. If the controlled equipment has no hard-wired safety path, an unexpected STOP after download can drive the process to a hazardous state. Best practice on first-time download:
- Bring the process to a safe state before initiating download.
- Verify mode selector is at STOP or RUN-P.
- Ensure OB82, OB86, OB121 are present so that single I/O faults do not drive STOP.
- Use a CPU with RUN-P capability to allow online edit while in RUN.
- After download, observe the SF LED and the diagnostic buffer for at least one full cycle before resuming normal operation.
Frequently Asked Questions
Why does the online block list show SFB, SFC, and SDB blocks that are not in my offline project?
These are firmware-integrated system blocks that the S7-300 CPU generates when the hardware configuration (HW Config) is compiled and downloaded. SFCs and SFBs are operating-system functions callable from your user code; SDBs hold compiled hardware parameters, module records, and S7 connection definitions. They reside in load memory and are part of the firmware, not the user program.
How do I open the S7-300 diagnostic buffer to identify a CPU error?
Select the online CPU in SIMATIC Manager and press Ctrl+D, or use the menu path PLC > Diagnostic/Setting > Diagnostic Buffer. The newest entry appears at the top; double-click it to expand the additional context and use the Open Block button to jump to the offline block that raised the fault. In TIA Portal the equivalent is Online > Diagnostics > Diagnostic Buffer.
Why are extra FB, FC, and DB blocks visible online after a download?
STEP 7 only overwrites blocks whose numbers match the offline project. Any FB, FC, or DB from a previous project that is no longer in the offline tree remains in the MMC unless explicitly deleted. Use the Replace MMC contents option of the download dialog, or enable Overwrite all blocks, to remove residual blocks and start with a clean load memory.
What does the red SF LED on the S7-300 CPU indicate?
SF stands for Sammlungs-Fehler (group fault). It is a latched indicator that turns on for any of several event classes: system errors, I/O faults, programming errors, time errors, battery faults, and MMC faults. The specific cause must be read from the diagnostic buffer; the SF LED alone is not diagnostic.
Can I download to the S7-300 without stopping the CPU?
Yes, if the mode selector is at RUN-P and the CPU firmware supports run-time edits. A full program download still requires the CPU to enter STOP briefly; the CPU will return to RUN automatically once the download completes if the Run after download option is set. Online block edits of a single FC or FB can be performed in RUN without interruption.