S7-300F F-Monitoring Time and Slot Addressing Error Resolution
This technical reference covers two recurring field issues on a running SIMATIC S7-300F installation built around the CPU 317F-2 PN/DP: (1) selection of the F-monitoring time for the ET 200S fail-safe digital input module 6ES7 138-4FA04-0AB0 (4/8 F-DI DC 24V), and (2) intermittent "Slot cannot be addressed" diagnostic events that escalate to CPU STOP on the ET 200S fail-safe digital output module 6ES7 138-4FB03-0AB0 (4 F-DO DC 24V/2A). Both problems appear on systems that have been in service and were originally accepted, which makes them more interesting than a fresh-commissioning failure: the hardware passes the initial functional test, the safety signature is in place, and the fault only appears after weeks or months of operation.
6ES7317-2FK14-0AB0 (firmware V3.3) controlling ET 200S stations on PROFINET. The methodology, formulas, and remedies are equally valid for the equivalent PROFIBUS configuration and for STEP 7 V5.4 + S7 F-Systems V5.2 with the older 6ES7138-4FA03-0AB0 and 6ES7138-4FB02-0AB0 revisions.1. System Architecture Review
The CPU 317F-2 PN/DP is a fail-safe variant of the standard 317-2 PN/DP. It runs the F-runtime group in addition to the standard user program, executes the PROFIsafe protocol on PROFINET (and PROFIBUS via the DP master), and enforces the F-CPU signature at every safety-relevant download. Two interfaces are available on the front of the CPU:
- PROFINET interface (X2, port 1/2) – the primary path for the ET 200S F stations in the example installation. PROFIsafe profile V2.4 on PROFINET, slot-based addressing.
- PROFIBUS DP interface (X1) – used for legacy ET 200S F stations and for diagnostic repeaters.
The two modules involved in the reported problems are both members of the ET 200S F family and are designed to be installed on a standard ET 200S terminal module (e.g. 6ES7193-4CD30-0AA0 for screw-type or 6ES7193-4CL30-0AA0 for spring-type). The terminal module carries the PROFIsafe address setting switches, the backplane bus, and the load voltage distribution for the F-DO outputs. Reference the device manual at support.industry.siemens.com (search "CPU 317F-2 PN/DP") for the full interface and wiring specification.
| Item | Order number (MLFB) | Function | Channels | Revision relevant to signature |
|---|---|---|---|---|
| 4/8 F-DI DC 24V | 6ES7 138-4FA04-0AB0 | Fail-safe digital input, PROFIsafe | 4 dual-channel / 8 single-channel | HW Rev. 4, FW ≥ V1.0.0 |
| 4 F-DO DC 24V/2A | 6ES7 138-4FB03-0AB0 | Fail-safe digital output, PROFIsafe | 4 (each 2 A, electronic short-circuit protection) | HW Rev. 3, FW ≥ V1.0.0 |
| F-CPU | 6ES7 317-2FK14-0AB0 | Fail-safe CPU 317F-2 PN/DP | — | FW V3.3.x |
2. F-Monitoring Time Fundamentals
The F-monitoring time is the maximum interval that the F-system tolerates between two consecutive safety message frames from an F-I/O module to the F-CPU. Conceptually it is a watchdog: if the F-CPU does not receive a fresh, CRC-valid PROFIsafe telegram within the F-monitoring time, the F-CPU passivates the affected channel and substitutes the configured safe value (0 for outputs, 0 for inputs read by the standard program). The PROFIsafe watchdog model is documented in the PROFINET / PROFIsafe profile maintained by PROFIBUS & PROFINET International.
Two distinct watchdog parameters exist inside an S7-300F station and they must not be confused:
- F-monitoring time of the F-runtime group (F-CPU side) – set in HW Config → CPU properties → "F-Parameters" or, in newer revisions, in the safety program of OB 35 / F-OB. Default is 150 ms.
- PROFIsafe monitoring time (F-I/O side) – set per F-module in HW Config → F-module properties → "PROFIsafe" tab. The minimum allowed value is calculated from the cycle time of the F-OB and the current PROFIsafe bus cycle; Siemens publishes tabulated minimums in the S7 F/FH Systems manual that must be respected.
3. Calculating the F-Monitoring Time for 6ES7 138-4FA04-0AB0
The 4/8 F-DI module is an ET 200S F-DI that supports both 1oo1 and 1oo2 evaluation. Its PROFIsafe monitoring time is a property of the module instance in HW Config. The calculation path recommended in the S7 F/FH Systems manual is the following. The manual is available on the Siemens Industry Online Support portal at support.industry.siemens.com (search "SIMATIC S7 F/FH Systems – Configuring and Programming").
3.1 Determine the F-runtime group cycle
The cycle time of the F-OB (typically OB 35) is the first input. Read it directly from HW Config → CPU → "Cycle / Clock Memory" tab. In the example installation OB 35 is configured for 100 ms, which is a common default.
3.2 Add the F-I/O processing time
Per F-DI module the additional processing time inside the F-OB is the sum of the call of F_IO_DRIVER and the safety message frame processing. The figure published in the manual for the 6ES7 138-4FA04-0AB0 module is approximately 1.2 ms per channel pair at default diagnostics depth. For an 8-channel single-channel configuration this becomes 8 × 0.6 ms = 4.8 ms; for a 4-channel dual-channel (1oo2) configuration the figure is 4 × 1.2 ms = 4.8 ms.
3.3 Add the PROFIsafe frame transport time
For PROFINET the worst-case transport time is two PROFINET update cycles. The PROFINET update time is set in HW Config on the ET 200S station's PROFINET interface; with a 1 ms update time the additional contribution is 2 ms. For PROFIBUS DP the transport time is one DP cycle plus the bus idle time, typically 4–10 ms depending on bus load.
3.4 Apply the safety factor
Multiply the sum by 1.5 to obtain the minimum allowed F-monitoring time. The result is then entered in the "PROFIsafe" tab of the F-DI in HW Config, and the F-CPU-side F-monitoring time (in CPU properties) is set to the next-larger value that is at least equal to the largest F-module monitoring time in the F-runtime group.
| Parameter | Value | Source |
|---|---|---|
| F-OB cycle (OB 35) | 100 ms | HW Config → CPU → Cycle/Clock Memory |
| F-I/O processing (4/8 F-DI × 4 channel pairs) | 4 × 1.2 ms = 4.8 ms | Manual "F_I/O Driver" table for 4FA04 |
| PROFIsafe transport (2 × PROFINET update) | 2 × 1 ms = 2 ms | HW Config → ET 200S PN interface |
| Sub-total | 106.8 ms | — |
| Safety factor | × 1.5 | Siemens recommendation |
| Minimum PROFIsafe monitoring time | 160.2 ms → round up to 200 ms | PROFIsafe tab, F-DI |
| F-CPU F-monitoring time | ≥ 200 ms, recommend 250 ms | CPU properties → F-Parameters |
The Siemens manual also publishes a quick-lookup table ("Min. F-Monitoring times") for the most common combinations of OB 35 cycle and number of F-modules in the F-runtime group. If the value in the quick-lookup table is higher than the calculated 1.5× figure, the quick-lookup value takes precedence — the manual is more conservative than the arithmetic and that conservatism is mandatory, not advisory.
3.5 What happens if the F-monitoring time is too small
An undersized F-monitoring time produces a very specific signature in the diagnostic buffer. The F-CPU first reports "PROFIsafe communication error" with detail "Monitoring time exceeded" (event ID W#16#0194 / SF combined with W#16#75D2 on the F-DI), and only on the second or third consecutive violation does the F-CPU enter STOP with cause "F-monitoring time exceeded in F-runtime group 1". When the F-monitoring time is too small the F-DI is passivated, but the F-CPU continues running until the F-runtime group watchdog expires.
4. "Slot Cannot Be Addressed" — Problem Description
The diagnostic event "Slot cannot be addressed" (German: "Steckplatz ist nicht addressierbar") is a system-level diagnostic, not a safety diagnostic. It indicates that the F-CPU is unable to exchange I/O data with the module at the slot address decoded from the configuration. When the event is raised on an F-DO that drives a safety load, the F-CPU passivates the channel, sets the safe value (0) on the output, and the standard program in OB 1 then sees a quality code of "substitute value" rather than the process value.
Three different slots in the system can raise this event:
- Slot 0 of the F-CPU's local rack — the F-CPU itself. Generally fatal and not the case here.
- A configured slot in a PROFIBUS or PROFINET station — the slot inside an ET 200S station is identified by the slot number, e.g. slot 4.
- The diagnostic slot of a module — some ET 200S F modules report a separate diagnostic slot that the F-CPU also tries to read. A failure on the diagnostic slot presents the same external symptom.
5. Root Cause Analysis
An installation that "was running very fine" before the error appeared is the classic profile of a hardware degradation fault, not a configuration fault. Configuration faults reproduce from the first cycle of operation; hardware degradation faults appear only after thermal cycling, vibration, or after a load event on the output. The most common root causes, ranked by frequency in field service reports, are listed in Table 3.
| # | Root cause | How to verify | Typical signature |
|---|---|---|---|
| 1 | Loose module on terminal base (vibration, thermal cycling) | Re-seat module; check torque on terminal screws | Event repeats, recovers after re-seat |
| 2 | Faulty terminal module (backplane connector worn) | Replace terminal module with spare; check spring contacts | Event appears on power-up; not on warm restart |
| 3 | Defective F-DO module (output driver shorted) | Substitute known-good module | Event follows the module, not the slot |
| 4 | PROFIsafe address mismatch after replacement | Read DIP switches on F-DO and on terminal module | Only the F-DO at the conflicting address fails |
| 5 | Load-voltage supply drop on F-DO terminal | Measure 24 V at terminal; check PSU sizing and fusing | Event correlates with heavy load switching |
| 6 | PROFINET/PROFIBUS interruption on the station | Check station diagnostic buffer for "Station failure" | All modules of the station report, not just F-DO |
| 7 | EMC-induced bit error on the backplane | Inspect cable routing; check shield termination | Event correlates with VFD or welding start |
| 8 | Configuration drift after online edit | Compare HW Config in PG with station actual | Event appears immediately after a download |
For the reported installation the configuration and DIP switches are confirmed correct, and the error is intermittent. That profile fits root causes #1, #2, #3 and #5 most strongly. Root cause #6 (PROFINET interruption) would also affect other modules on the same ET 200S station; if only the F-DO is reporting, the problem is local to that slot.
6. Diagnostic Procedure
The diagnostic buffer is the single most useful source of information. Use STEP 7 V5.5: "PLC → Module Information" (or the equivalent "Online → Diagnostics" in TIA Portal). Read the buffer chronologically from the bottom up — the oldest event is at the bottom. The relevant diagnostic IDs for the symptoms are:
| Event ID (hex) | Meaning | Where reported |
|---|---|---|
| W#16#39xx | Module-related diagnostic (general) | CPU diagnostic buffer |
| W#16#39A1 | Module removed/inserted | CPU diagnostic buffer |
| W#16#39A2 | Parameter assignment error on module | CPU diagnostic buffer |
| W#16#39C3 | Module faulty | CPU diagnostic buffer |
| W#16#75D1 | PROFIsafe address error | F-module diagnostic buffer |
| W#16#75D2 | PROFIsafe monitoring time exceeded | F-DI / F-DO diagnostic buffer |
| W#16#7960 | Module slot cannot be addressed (removed/failed) | CPU diagnostic buffer |
If the diagnostic buffer shows the "Slot cannot be addressed" event coincident with the F-DO going into passivation, the fault is on the F-DO slot. If the buffer shows a station-level diagnostic, the fault is upstream. Use the timestamp of the event in the buffer to correlate with the SCADA event log — the two should be within one second of each other.
7. Step-by-Step Resolution
Use the following sequence. The sequence is non-destructive up to step 6; steps 7–9 require a controlled shutdown and re-commissioning of the affected F-runtime group.
- Read the diagnostic buffer on the F-CPU and on the failing F-DO. Note the event IDs in chronological order. Do not clear the buffer yet.
- Check PROFIsafe address of the F-DO. With the F-CPU in STOP, remove the F-DO and read the DIP switches on the side of the module and on the terminal module — they must match the value configured in HW Config.
- Inspect the load-voltage supply at the F-DO terminal block. Verify 24 V ±5 % under no load and under nominal load. The 4F-DO 2A module draws up to 8 A at full output activation; a marginal PSU or an open fuse will produce a brief brownout that the F-CPU reads as a slot failure.
- Re-seat the F-DO on its terminal base. Power-cycle the station, observe whether the slot is now reachable. If the slot is reachable, the original fault was root cause #1 (loose module).
- Substitute the terminal module with a known-good spare of the same order number. The terminal module is the more frequent failure point than the electronic module itself because it carries the spring contacts of the backplane bus.
- Substitute the F-DO with a known-good spare. If the slot is reachable with the new module, the original module is defective — send it to the repair shop and update the spares inventory.
- Re-validate the safety signature. Every F-module replacement that changes the hardware revision, the firmware version, or the PROFIsafe address invalidates the F-CPU's safety signature. The F-CPU will refuse to enter RUN until the safety program is re-signed. Accept the new signature only after a full functional test of the affected F-runtime group.
- Force a STOP → RUN transition on the F-CPU and verify that the F-DO slot is reachable from HW Config "Online → Accessible Nodes" or from the standard program by reading the input image (quality code = "Good" instead of "Bad / Substitute value").
- Run the S7 F-Systems acceptance test for the affected F-runtime group. The acceptance test is mandatory after any F-module replacement; the report is signed by the safety engineer and archived as proof of compliance with IEC 61508 / ISO 13849.
8. Verification and Commissioning Checks
After the resolution and before the system is returned to production:
- Diagnostic buffer clear — clear the F-CPU diagnostic buffer, run the system for at least one hour under load, and read the buffer again. The buffer should be empty of "Slot cannot be addressed" events.
-
PROFIsafe status word — read the PROFIsafe status word of the F-DO from the safety program (
DIAGdata block). Bits 0 and 1 must both be 0, indicating no channel passivation and no PROFIsafe communication error. -
Standard program quality code — read the quality code of the F-DO input image from the standard program. The code must be
16#80(good) and not16#00(substitute / bad). - Watchdog of the F-runtime group — read the F-runtime group status word in OB 35. The DB number of the F-runtime group status is the one returned by the S7 F-Systems wizard (typically DB 138 for the first F-runtime group in a small project).
- 24-hour load test — run the affected F-DO under the production load profile for 24 hours. This catches intermittent faults that did not reproduce during the 1-hour soak test.
9. Prevention and Best Practices
The two issues in the original report are independent but the prevention measures overlap:
- Mounting torque. Use a torque-limiting screwdriver to 0.6–0.8 N·m on the terminal module mounting screws. Higher torque deforms the spring contacts of the backplane; lower torque allows the module to vibrate loose.
- Load-voltage fusing. Use a 10 A fast-blow fuse per F-DO terminal, sized for the 2 A continuous + inrush of the driven load. The fuse limits the short-circuit current that the F-DO's internal electronic protection must interrupt, and reduces the probability of a brownout-induced slot event.
- Spare module inventory. Keep at least one spare F-DO and one spare terminal module of the exact order number on site. The F-DO revision (4FB03 vs. 4FB02) is binding for the safety signature; do not substitute a different revision in an emergency.
- PROFIsafe monitoring time margin. Always add 30–50 % margin above the calculated minimum. A margin that is too tight will not survive a future PROFINET reconfiguration or the addition of a new device on the same subnet.
- Cable routing. Keep PROFINET cables at least 200 mm away from VFD output cables and welding transformer cables. Cross at 90° if a crossing is unavoidable.
- Online edits. Disable "Download to target device" on the F-CPU during normal operation. Online edits to the safety program invalidate the signature and force a re-sign cycle; they should be batched in planned maintenance windows.
- Firmware pinning. Pin the F-CPU firmware version in HW Config and prevent automatic online firmware updates during commissioning. A firmware update from V3.3 to V3.4 on the CPU 317F-2 PN/DP can change the F-monitoring time default and invalidate the signature.
10. Troubleshooting Matrix
| Symptom | Likely cause | First action | Second action |
|---|---|---|---|
| CPU STOP with "F-monitoring time exceeded" | F-monitoring time too small for current load | Increase F-monitoring time in HW Config | Reduce F-OB cycle or split F-runtime group |
| CPU STOP with "Slot cannot be addressed" on F-DO | F-DO module or terminal base failed | Re-seat F-DO | Substitute terminal base, then F-DO |
| CPU STOP with "PROFIsafe address error" | DIP switch on F-DO does not match HW Config | Read DIP switch and reconfigure to match | Replace terminal base (DIP switch may be on the base) |
| Intermittent F-DO passivation, CPU stays RUN | PROFIsafe telegram CRC error from EMI | Check shield termination on PROFINET cable | Reduce PROFINET update time to 1 ms |
| F-DO passivation, no CPU STOP | Output driver short-circuit | Read diagnostic buffer for short-circuit event | Inspect wiring and load; replace F-DO if internal |
| All modules of one ET 200S station passivate | PROFINET station failure or PSU | Check station diagnostic buffer | Check PROFINET cable and switch port |
| F-DI reports channel passivation, no CPU STOP | Discrepancy error on dual-channel input | Check input wiring and sensor health | Extend discrepancy time in HW Config |
What is the minimum F-monitoring time for the 6ES7 138-4FA04-0AB0 F-DI?
For an F-OB (OB 35) cycle of 100 ms, the calculated minimum is approximately 160 ms; round up to the next published value of 200 ms in the "Min. F-Monitoring times" table of the SIMATIC S7 F/FH Systems manual. Always apply the table value if it is larger than the 1.5× arithmetic figure, and add a further 30–50 % margin for production operation.
Why does the F-CPU go to STOP on a "Slot cannot be addressed" event on the F-DO?
The F-CPU passivates the F-DO channel as a safety reaction because it cannot verify the PROFIsafe telegram from the module. If the F-DO drives a safety-relevant load, the F-CPU forces the safe state (output = 0) and enters STOP to prevent the standard program from continuing to read stale process data.
Can I replace the F-DO 6ES7 138-4FB03-0AB0 with a 6ES7 138-4FB02-0AB0 in an emergency?
No. The F-CPU will reject the substitution because the module revision in the safety signature does not match. Use the exact order number (6ES7 138-4FB03-0AB0) and revision 3 or higher. After replacement, re-sign the safety program and run the S7 F-Systems acceptance test for the affected F-runtime group.
What is the difference between the F-monitoring time and the PROFIsafe monitoring time?
The F-monitoring time is the watchdog enforced by the F-CPU on the F-runtime group. The PROFIsafe monitoring time is the watchdog enforced by the F-I/O module on the incoming safety telegram. The two values are independent and both must be set correctly; the F-CPU value must be at least equal to the largest F-module value in the same F-runtime group, and each F-module value must be at least 1.5× the F-OB cycle time.
How do I clear the diagnostic buffer after a "Slot cannot be addressed" event?
In STEP 7 V5.5, open the F-CPU's online view, select "PLC → Module Information → Diagnostic Buffer", and click "Clear Buffer". The buffer is also cleared automatically on a STOP → RUN → MRES sequence. Clearing the buffer does not clear the safety-relevant event log, which is archived in a separate area and is not user-erasable.