S7-400 CPU 412 Replacement Resolving Connection Failure After

David Krause14 min read
PLC HardwareSiemensTroubleshooting
Licensed PE Working through this on a live machine? A Maine-licensed engineer can take it from here — included with IMD hardware, by the hour for everything else. Book an engineer

Overview of the Failure Mode

Replacing a SIMATIC S7-400 CPU 412 with an identical-order-number spare is supposed to be a five-minute swap. In the field, technicians routinely see the new module refuse every connection attempt while the digital output slots lose field power and two red LEDs light on the front of the CPU: BUSF (bus fault) and EXTF (external fault). The PLC is not bricked; the operator is normally looking at one of three well-understood commissioning failures on a fresh CPU:

  1. The PG/PC interface in STEP 7 is bound to the wrong physical adapter or to the wrong bus profile, so Online → Accessible Nodes times out.
  2. The replacement CPU is still running on Siemens factory defaults (MPI address 2, transmission rate 187.5 kbps), while the offline project expects a different MPI node address and a different PROFIBUS profile.
  3. The new CPU has no project loaded, so the central rack completes power-up but the distributed I/O backplane handshake and the output module diagnostics all return station failure (SF) on the I/O, which the CPU reports back as EXTF and BUSF.

All three collapse to the same cure path: bring the PG onto the MPI bus, push the offline hardware configuration into the new CPU, and let the central rack re-initialize. This article documents the diagnostic ladder, the exact STEP 7 clicks for the "Auto" mode that the field resolved the case with, and the LED/buffer interpretation a Siemens newcomer needs to read the result.

Identifying the CPU and Decoding the MLFB

Source MLFB as supplied: 6ES7 412-3X90-0AA0 (commonly written with separators as 6ES7 412-3X90 0AA0). The S7-400 family uses the SIMATIC MLFB convention:

MLFB segment Meaning Typical values for CPU 412
6ES7 SIMATIC S7 family prefix fixed
412 CPU class = 412 (medium performance, work memory 256 KB - 768 KB code / 256 KB - 768 KB data depending on variant) 410 / 412 / 414 / 416 / 417
-3X 3rd character of the variant: 3 = integrated PROFIBUS DP master/slave interface; X = work-memory sub-variant Common: 1X (MPI only), 2X (MPI+DP), 3X (MPI+DP+IFM)
90 / HJ14 / similar Firmware/hardware release key (Siemens uses two-character codes such as HJ14, EK06, etc.) Refer to the spare-parts list for exact cross-reference
0AB0 / 0AA0 Front connector, coating, packaging — the last four characters must match for a true drop-in spare Confirm on the type plate of the failed and the replacement CPU
Spare-part rule: Siemens does not guarantee firmware-binary compatibility across different release keys (the field after the dash, e.g. HJ14 vs HJ13). A same-order-number spare is always preferred; if a different release key is unavoidable, plan an upgrade in STEP 7 (Classic: Options → Install Firmware Updates) before commissioning. Reference: Siemens support entry 1117740 - S7-400 CPU spare-part compatibility.

Symptom Set: What You Will See on the Rack

After pulling the original CPU 412 and slotting the spare, the rack typically shows:

Indicator Color / state Meaning on a new, unconfigured CPU 412
POWER Green 24 V supply to the rack is present; backplane OK
RUN Off CPU is in STOP because no user program is loaded
STOP Yellow Active stop state - normal on a fresh module
BUSF Red, flashing PROFIBUS DP interface cannot establish a logical token ring; in this scenario it is a configuration fault, not a cable fault, because the CPU holds no DP master configuration yet
EXTF Red An I/O module signaled an external fault (typically loss of 24 V load supply because the rack is in STOP and the SM backplane bus has not been started)
INTOF / SF on digital output modules Red No load voltage because the SM has not been parameterized; the field-side fuse/24 V is correct, but the module never gets a valid parameterization frame

The diagnostic buffer of the new CPU will normally show a Startup event followed by Parameter assignment error on module in slot X or Station failure on the DP slaves if PROFIBUS is in use. Open the buffer with STEP 7 (Classic) via PLC → Diagnostic/Setting → Diagnostic Buffer (TIA Portal: Online & diagnostics → Diagnostics buffer).

Root Cause: Why a Same-MLFB Replacement Refuses to Connect

A factory-fresh S7-400 CPU boots with deterministic defaults, regardless of what the offline STEP 7 project expects:

Parameter CPU 412 default after factory reset What your offline project typically holds
MPI node address (X1 / IFM) 2 2, 3, 4, or any address assigned to the original CPU
MPI / DP baud rate (X1) 187.5 kbps 187.5 kbps, 1.5 Mbps, or 12 Mbps (PROFIBUS DP)
MPI / DP bus profile (X1) MPI MPI, PROFIBUS-DP master, PROFIBUS-DP slave, or user-defined
Highest MPI address (bus) 31 15 / 31 / 63
IP address (PN variants, e.g. 412-2 PN) 0.0.0.0 (DHCP) Project IP
User program Empty Blocks loaded from project
Hardware config (HW Config) Empty / rack mismatch Full rack and DP slave layout

The root cause of the connect failure is therefore not hardware damage. It is a configuration mismatch between the PG/PC and the MPI/DP parameters that the new CPU is broadcasting. Once those parameters are harmonized, the connection comes up; once the project is downloaded, BUSF clears and EXTF clears within one power cycle.

Prerequisites Before You Touch the Cable

  • STEP 7 (Classic, e.g. V5.6) or TIA Portal (V15.1 or later for S7-400 project support via the S7-400 option) installed on the PG.
  • The original project archive (.zip or .s7p) on the PG. If it is not on the PG, get it from the project server or from the SIMATIC Automation Tool backup before doing anything else.
  • PC adapter: a Siemens PC Adapter USB A2 (6GK1571-1BA00) with the latest driver, or a CP 5611 / CP 5621 PROFIBUS card. Plain USB-to-MPI clones from third parties do not work reliably above 187.5 kbps and are not recommended.
  • RS-485 PROFIBUS cable with terminated connectors on both ends of segment 1 (terminating resistor ON at the first and last node only).
  • Online access to the rack - 24 V DC supply on the CPU and on the load-voltage supply for the digital output modules must be present and within tolerance (24 V ± 5 %).
Adapter speed ceiling: The PC Adapter USB A2 supports up to 1.5 Mbps on MPI/PROFIBUS. If the project specifies 3, 6, or 12 Mbps PROFIBUS, you must use a CP 5611/CP 5621 or temporarily lower the bus baud to 1.5 Mbps to perform the first download, then raise it back. Reference: PC Adapter USB A2 manual entry 12604134.

Step-by-Step Resolution

Step 1 — Set the PG/PC Interface to "Auto" (this is the fix that resolved the field case)

  1. Open Control Panel on the PG → Set PG/PC Interface (32-bit, the legacy applet, not the Windows modern settings).
  2. Under Interface Parameter Assignment Used, select the entry that ends in (Auto), for example PC Adapter (Auto) - MPI/DP or S7ONLINE (STEP 7) → PC Adapter (MPI/DP) (Auto).
  3. Click Properties. On the MPI tab, leave the address as 0 (PG will get a free address from the bus master); on the bus profile leave the default MPI; transmission rate leave as 187.5 kbps for the first scan.
  4. Click OK. The “Auto” suffix is what tells the adapter to scan the bus and renegotiate; this single toggle is what made the field case go from Unable to establish a connection to a clean Accessible Nodes window.

Step 2 — Probe the bus with Accessible Nodes

  1. Open the SIMATIC Manager (or the TIA Portal project).
  2. Menu PLC → Accessible Nodes. STEP 7 will broadcast a 187.5 kbps MPI request and display every node it sees with its address and module order number.
  3. You should see the new CPU listed as CPU 412-... — Online: STOP. If you see nothing, the bus profile is wrong (jump to Step 3). If you see a different MPI address than the project expects, note it and proceed to Step 4.

Step 3 — Switch the bus profile if the new CPU is talking PROFIBUS, not MPI

A common failure pattern is that the original CPU had its X1 port set to PROFIBUS-DP master, so the field cabling terminates into a PROFIBUS segment, not an MPI segment. The new CPU is still at MPI address 2 by default, but the segment is PROFIBUS.

  1. In Set PG/PC Interface, change the bus profile on the adapter from MPI to PROFIBUS (DP) at 1.5 Mbps (CP 5611) or 187.5 kbps (PC Adapter USB A2 ceiling for DP at 1.5 Mbps is fine).
  2. Re-run Accessible Nodes.
  3. If still nothing, temporarily move the PG to a node position with both bus terminators OFF on the local connector so the adapter is the only terminating device; a mid-segment PG is invisible until termination is correct.

Step 4 — Align the CPU's MPI address with the project

  1. From Accessible Nodes, select the discovered CPU and click PLC → Assign MPI Address.
  2. Enter the address that the offline project has on the CPU slot in HW Config (look in the project tree under SIMATIC 400 Station → CPU → Properties → Interface → MPI Address).
  3. Confirm. The CPU writes the new address to non-volatile memory and restarts the interface.

Step 5 — Download the hardware configuration

  1. In SIMATIC Manager, open the project, expand SIMATIC 400 Station, double-click Hardware.
  2. Confirm the rack layout matches the physical rack (slots 0-18: power supply, CPU, IMs, SMs in the correct order).
  3. Right-click the CPU → Download to Target System → CPU. In TIA Portal the equivalent is Project tree → CPU → Online → Download to device.
  4. When prompted, choose Download hardware configuration only on the first pass, or Complete download if the program blocks are also missing.

Step 6 — Re-run diagnostic buffer and LED check

  1. After the download, the CPU should transition from STOP → RUN within a few seconds.
  2. Open the diagnostic buffer. You should see Restart (cold start) executed, followed by I/O module OK events for every populated slot, and no further BUSF/EXTF events.
  3. Confirm that the digital output slots now report load voltage present and that the field outputs respond to a forced bit in the watch table.

PG/PC Interface Mode Reference Table

Mode What it does When to use it
(Auto) Adapter probes the bus and negotiates the bus profile and baud rate with the master First contact with an unknown replacement CPU; this is the field-proven fix
MPI Forces adapter to MPI profile at the configured baud Known MPI segment, fixed baud, and you want deterministic timing
PROFIBUS (DP) Forces adapter to DP profile at the configured baud Original CPU was a DP master; segment is DP
TCP/IP (S7ONLINE) Routes online access through ISO-on-TCP to a CP or PN interface CPU 412-2 PN/PN variants only

Bus Fault and External Fault: Field Decoding

The two red LEDs on the front of a CPU 412 are deceptively similar but they answer different questions:

LED Set by What it means on a replacement CPU without project How to clear
BUSF (red, flashing) The DP master diagnostics Master has no configured slaves, or DP cable is broken; in this case it is the empty config Download HW Config so the master has a slave list, then power-cycle the DP segment
BUSF (red, static) DP slave diagnostic At least one DP slave is in station failure; usually a wiring or address conflict Check slave address rotary switches, bus terminator, and the diagnostic buffer of the slave
EXTF (red) I/O module signals a class-1 diagnostic (wire break, missing load voltage, overtemperature) Output module lost 24 V load supply because the CPU never completed parameterization Confirm load supply, then download HW Config to send parameterization frames

Reference: SIMATIC S7-400 CPU 412 installation manual, section “Status and error LEDs”, Siemens support entry 1117740 and the CPU data sheets in the S7-400 Automation System Manual (entry 59192328).

Digital Output Module Power: Why It Is Missing

Loss of 24 V on the field side of a DO module after a CPU swap is almost never a power-supply issue. The chain is:

  1. CPU comes up in STOP, no user program, no project.
  2. STEP 7 has not yet downloaded HW Config, so the central backplane bus is not parameterized.
  3. Signal modules stay in their default “no parameter assignment” state; outputs are de-energized and the SF LED is lit.
  4. From the perspective of the load supply wiring, this looks like “no power on the module” even when the L+ terminal measures 24 V at the connector.

Once the project is loaded and the CPU transitions to RUN, the modules are parameterized, the SF LEDs clear, and the outputs become hot. If they do not, measure the load voltage at the module's L+ terminal with a multimeter and confirm the front connector is fully seated; the S7-400 hot-swap SMs require the front connector to be screwed down to land the load voltage.

Verification Checklist

  • LEDs: POWER green, RUN green, STOP off, BUSF off, EXTF off, INTF off.
  • Diagnostic buffer: no entries newer than the cold-restart event, no “Station failure” or “Parameter assignment error”.
  • Watch table: force a known output bit (e.g., Q 0.0), verify the field device actuates, then unforce.
  • PROFIBUS slaves: in HW Config Online → Accessible Nodes or Target system → Compare, confirm every slave is in “OK” state with no SF.
  • CPU operating mode: RUN, not RUN with HALT (operator panel yellow) — the new CPU will not have any operator error masks, so the panel should be clear.
  • Time-of-day: synchronize via PLC → Set Time of Day; replacement CPUs come up at 00:00:00 01.01.1994.
  • Retentive flags/timers/counters: replacement CPU has no remanent storage; reload from project. If the process requires remanence, configure it in HW Config and download.

Preventive Commissioning Procedure for Future Replacements

  1. Keep a project archive of every S7-400 station on a backed-up file share; never rely on the CPU as the only source of truth.
  2. Before pulling the old CPU, run PLC → Upload Station to PG as a last-resort backup.
  3. Document the MPI/DP/PN address of every CPU in a station binder; cross-check the new CPU's address against the document before power-up.
  4. Set the PG/PC interface to (Auto) by default; only switch to a fixed profile when a known-good session is in progress.
  5. Use a PC Adapter USB A2 only for baud rates up to 1.5 Mbps; keep a CP 5621 in the kit for 3/6/12 Mbps PROFIBUS.
  6. After the swap, always perform a full download (HW Config + blocks + comments) so the diagnostic buffer is clean and the next technician does not chase ghost faults.

When the Simple Fix Does Not Work: Escalation Matrix

Symptom Likely cause Action
No nodes appear in Accessible Nodes Adapter on wrong bus profile, cable reversed, terminator on the PG connector Set PG/PC to (Auto), check PROFIBUS D-sub pinout (3 = B, 8 = A), disable termination on the inline PG connector
CPU visible but “protection violation” on download Know-how protection on the old project Upload with the original project password, then download; or remove protection offline first
CPU visible but BUSF stays on after download DP slave address conflict or missing GSD file Open Accessible Nodes, find the conflicting slave, re-address it on its rotary switches, re-import the GSD if a third-party slave was used
EXTF stays on after download Load voltage missing at a specific SM Measure L+ at the front connector, check the module's load-supply fuse, confirm front-connector screw is tight
CPU won’t leave STOP after a complete download OB missing (OB100/OB102 for startup, OB1 for cyclic) or hardware config not downloaded to target Re-download HW Config; check whether OB1, OB100, OB121, OB122 exist in the offline project

Standards and Document References

FAQ

Why does my replacement CPU 412 show BUSF and EXTF immediately after a clean power-up?

A factory-fresh CPU 412 holds no hardware configuration and no PROFIBUS master parameter set, so the DP interface cannot complete the slave discovery and the SMs cannot be parameterized. Both LEDs reflect the missing config; they clear automatically once the offline HW Config is downloaded to the new CPU.

What does the “(Auto)” suffix on the PG/PC interface entry actually do?

It instructs the PC Adapter or CP to scan the bus and accept whatever profile (MPI or PROFIBUS) and baud rate the master is broadcasting. In the field case described, switching from a fixed MPI profile to PC Adapter (Auto) - MPI/DP was the change that allowed STEP 7 to see the new CPU and complete the project download.

My digital output modules stay unpowered after the CPU swap. Is the module bad?

Almost always no. S7-400 SMs de-energize their field outputs until the CPU downloads a parameterization frame. Confirm 24 V is present at the L+ terminal of the front connector, confirm the connector is fully seated, then re-download HW Config to clear the EXTF/SF LEDs.

Can I use a third-party USB-to-MPI cable to bring the CPU online?

Not reliably. Non-Siemens adapters commonly fail above 187.5 kbps and lack the bus-profile negotiation that the “Auto” mode requires. Use the Siemens PC Adapter USB A2 (6GK1571-1BA00) for MPI/DP up to 1.5 Mbps, or a CP 5621 PROFIBUS card for higher baud rates.

Do I need to upgrade firmware when swapping a different MLFB release key?

Only if the offline project contains blocks or system data that depend on a newer firmware feature. STEP 7 will warn you at download time; you can either upgrade the CPU firmware (Classic: Options → Install Firmware Updates) or roll the project back to a compatible release. Identical MLFB spares do not need an upgrade.

Back to blog