Overview of the Failure Mode
Replacing a SIMATIC S7-400 CPU 412 with an identical-order-number spare is supposed to be a five-minute swap. In the field, technicians routinely see the new module refuse every connection attempt while the digital output slots lose field power and two red LEDs light on the front of the CPU: BUSF (bus fault) and EXTF (external fault). The PLC is not bricked; the operator is normally looking at one of three well-understood commissioning failures on a fresh CPU:
- The PG/PC interface in STEP 7 is bound to the wrong physical adapter or to the wrong bus profile, so Online → Accessible Nodes times out.
- The replacement CPU is still running on Siemens factory defaults (MPI address 2, transmission rate 187.5 kbps), while the offline project expects a different MPI node address and a different PROFIBUS profile.
- The new CPU has no project loaded, so the central rack completes power-up but the distributed I/O backplane handshake and the output module diagnostics all return station failure (SF) on the I/O, which the CPU reports back as EXTF and BUSF.
All three collapse to the same cure path: bring the PG onto the MPI bus, push the offline hardware configuration into the new CPU, and let the central rack re-initialize. This article documents the diagnostic ladder, the exact STEP 7 clicks for the "Auto" mode that the field resolved the case with, and the LED/buffer interpretation a Siemens newcomer needs to read the result.
Identifying the CPU and Decoding the MLFB
Source MLFB as supplied: 6ES7 412-3X90-0AA0 (commonly written with separators as 6ES7 412-3X90 0AA0). The S7-400 family uses the SIMATIC MLFB convention:
| MLFB segment | Meaning | Typical values for CPU 412 |
|---|---|---|
6ES7 |
SIMATIC S7 family prefix | fixed |
412 |
CPU class = 412 (medium performance, work memory 256 KB - 768 KB code / 256 KB - 768 KB data depending on variant) | 410 / 412 / 414 / 416 / 417 |
-3X |
3rd character of the variant: 3 = integrated PROFIBUS DP master/slave interface; X = work-memory sub-variant |
Common: 1X (MPI only), 2X (MPI+DP), 3X (MPI+DP+IFM) |
90 / HJ14 / similar |
Firmware/hardware release key (Siemens uses two-character codes such as HJ14, EK06, etc.) |
Refer to the spare-parts list for exact cross-reference |
0AB0 / 0AA0
|
Front connector, coating, packaging — the last four characters must match for a true drop-in spare | Confirm on the type plate of the failed and the replacement CPU |
HJ14 vs HJ13). A same-order-number spare is always preferred; if a different release key is unavoidable, plan an upgrade in STEP 7 (Classic: Options → Install Firmware Updates) before commissioning. Reference: Siemens support entry 1117740 - S7-400 CPU spare-part compatibility.Symptom Set: What You Will See on the Rack
After pulling the original CPU 412 and slotting the spare, the rack typically shows:
| Indicator | Color / state | Meaning on a new, unconfigured CPU 412 |
|---|---|---|
| POWER | Green | 24 V supply to the rack is present; backplane OK |
| RUN | Off | CPU is in STOP because no user program is loaded |
| STOP | Yellow | Active stop state - normal on a fresh module |
| BUSF | Red, flashing | PROFIBUS DP interface cannot establish a logical token ring; in this scenario it is a configuration fault, not a cable fault, because the CPU holds no DP master configuration yet |
| EXTF | Red | An I/O module signaled an external fault (typically loss of 24 V load supply because the rack is in STOP and the SM backplane bus has not been started) |
| INTOF / SF on digital output modules | Red | No load voltage because the SM has not been parameterized; the field-side fuse/24 V is correct, but the module never gets a valid parameterization frame |
The diagnostic buffer of the new CPU will normally show a Startup event followed by Parameter assignment error on module in slot X or Station failure on the DP slaves if PROFIBUS is in use. Open the buffer with STEP 7 (Classic) via PLC → Diagnostic/Setting → Diagnostic Buffer (TIA Portal: Online & diagnostics → Diagnostics buffer).
Root Cause: Why a Same-MLFB Replacement Refuses to Connect
A factory-fresh S7-400 CPU boots with deterministic defaults, regardless of what the offline STEP 7 project expects:
| Parameter | CPU 412 default after factory reset | What your offline project typically holds |
|---|---|---|
| MPI node address (X1 / IFM) | 2 | 2, 3, 4, or any address assigned to the original CPU |
| MPI / DP baud rate (X1) | 187.5 kbps | 187.5 kbps, 1.5 Mbps, or 12 Mbps (PROFIBUS DP) |
| MPI / DP bus profile (X1) | MPI | MPI, PROFIBUS-DP master, PROFIBUS-DP slave, or user-defined |
| Highest MPI address (bus) | 31 | 15 / 31 / 63 |
| IP address (PN variants, e.g. 412-2 PN) | 0.0.0.0 (DHCP) | Project IP |
| User program | Empty | Blocks loaded from project |
| Hardware config (HW Config) | Empty / rack mismatch | Full rack and DP slave layout |
The root cause of the connect failure is therefore not hardware damage. It is a configuration mismatch between the PG/PC and the MPI/DP parameters that the new CPU is broadcasting. Once those parameters are harmonized, the connection comes up; once the project is downloaded, BUSF clears and EXTF clears within one power cycle.
Prerequisites Before You Touch the Cable
- STEP 7 (Classic, e.g. V5.6) or TIA Portal (V15.1 or later for S7-400 project support via the S7-400 option) installed on the PG.
- The original project archive (.zip or .s7p) on the PG. If it is not on the PG, get it from the project server or from the SIMATIC Automation Tool backup before doing anything else.
- PC adapter: a Siemens PC Adapter USB A2 (6GK1571-1BA00) with the latest driver, or a CP 5611 / CP 5621 PROFIBUS card. Plain USB-to-MPI clones from third parties do not work reliably above 187.5 kbps and are not recommended.
- RS-485 PROFIBUS cable with terminated connectors on both ends of segment 1 (terminating resistor ON at the first and last node only).
- Online access to the rack - 24 V DC supply on the CPU and on the load-voltage supply for the digital output modules must be present and within tolerance (24 V ± 5 %).
Step-by-Step Resolution
Step 1 — Set the PG/PC Interface to "Auto" (this is the fix that resolved the field case)
- Open Control Panel on the PG → Set PG/PC Interface (32-bit, the legacy applet, not the Windows modern settings).
- Under Interface Parameter Assignment Used, select the entry that ends in
(Auto), for example PC Adapter (Auto) - MPI/DP or S7ONLINE (STEP 7) → PC Adapter (MPI/DP) (Auto). - Click Properties. On the MPI tab, leave the address as 0 (PG will get a free address from the bus master); on the bus profile leave the default MPI; transmission rate leave as 187.5 kbps for the first scan.
- Click OK. The “Auto” suffix is what tells the adapter to scan the bus and renegotiate; this single toggle is what made the field case go from Unable to establish a connection to a clean Accessible Nodes window.
Step 2 — Probe the bus with Accessible Nodes
- Open the SIMATIC Manager (or the TIA Portal project).
- Menu PLC → Accessible Nodes. STEP 7 will broadcast a 187.5 kbps MPI request and display every node it sees with its address and module order number.
- You should see the new CPU listed as CPU 412-... — Online: STOP. If you see nothing, the bus profile is wrong (jump to Step 3). If you see a different MPI address than the project expects, note it and proceed to Step 4.
Step 3 — Switch the bus profile if the new CPU is talking PROFIBUS, not MPI
A common failure pattern is that the original CPU had its X1 port set to PROFIBUS-DP master, so the field cabling terminates into a PROFIBUS segment, not an MPI segment. The new CPU is still at MPI address 2 by default, but the segment is PROFIBUS.
- In Set PG/PC Interface, change the bus profile on the adapter from MPI to PROFIBUS (DP) at 1.5 Mbps (CP 5611) or 187.5 kbps (PC Adapter USB A2 ceiling for DP at 1.5 Mbps is fine).
- Re-run Accessible Nodes.
- If still nothing, temporarily move the PG to a node position with both bus terminators OFF on the local connector so the adapter is the only terminating device; a mid-segment PG is invisible until termination is correct.
Step 4 — Align the CPU's MPI address with the project
- From Accessible Nodes, select the discovered CPU and click PLC → Assign MPI Address.
- Enter the address that the offline project has on the CPU slot in HW Config (look in the project tree under SIMATIC 400 Station → CPU → Properties → Interface → MPI Address).
- Confirm. The CPU writes the new address to non-volatile memory and restarts the interface.
Step 5 — Download the hardware configuration
- In SIMATIC Manager, open the project, expand SIMATIC 400 Station, double-click Hardware.
- Confirm the rack layout matches the physical rack (slots 0-18: power supply, CPU, IMs, SMs in the correct order).
- Right-click the CPU → Download to Target System → CPU. In TIA Portal the equivalent is Project tree → CPU → Online → Download to device.
- When prompted, choose Download hardware configuration only on the first pass, or Complete download if the program blocks are also missing.
Step 6 — Re-run diagnostic buffer and LED check
- After the download, the CPU should transition from STOP → RUN within a few seconds.
- Open the diagnostic buffer. You should see Restart (cold start) executed, followed by I/O module OK events for every populated slot, and no further BUSF/EXTF events.
- Confirm that the digital output slots now report load voltage present and that the field outputs respond to a forced bit in the watch table.
PG/PC Interface Mode Reference Table
| Mode | What it does | When to use it |
|---|---|---|
| (Auto) | Adapter probes the bus and negotiates the bus profile and baud rate with the master | First contact with an unknown replacement CPU; this is the field-proven fix |
| MPI | Forces adapter to MPI profile at the configured baud | Known MPI segment, fixed baud, and you want deterministic timing |
| PROFIBUS (DP) | Forces adapter to DP profile at the configured baud | Original CPU was a DP master; segment is DP |
| TCP/IP (S7ONLINE) | Routes online access through ISO-on-TCP to a CP or PN interface | CPU 412-2 PN/PN variants only |
Bus Fault and External Fault: Field Decoding
The two red LEDs on the front of a CPU 412 are deceptively similar but they answer different questions:
| LED | Set by | What it means on a replacement CPU without project | How to clear |
|---|---|---|---|
| BUSF (red, flashing) | The DP master diagnostics | Master has no configured slaves, or DP cable is broken; in this case it is the empty config | Download HW Config so the master has a slave list, then power-cycle the DP segment |
| BUSF (red, static) | DP slave diagnostic | At least one DP slave is in station failure; usually a wiring or address conflict | Check slave address rotary switches, bus terminator, and the diagnostic buffer of the slave |
| EXTF (red) | I/O module signals a class-1 diagnostic (wire break, missing load voltage, overtemperature) | Output module lost 24 V load supply because the CPU never completed parameterization | Confirm load supply, then download HW Config to send parameterization frames |
Reference: SIMATIC S7-400 CPU 412 installation manual, section “Status and error LEDs”, Siemens support entry 1117740 and the CPU data sheets in the S7-400 Automation System Manual (entry 59192328).
Digital Output Module Power: Why It Is Missing
Loss of 24 V on the field side of a DO module after a CPU swap is almost never a power-supply issue. The chain is:
- CPU comes up in STOP, no user program, no project.
- STEP 7 has not yet downloaded HW Config, so the central backplane bus is not parameterized.
- Signal modules stay in their default “no parameter assignment” state; outputs are de-energized and the SF LED is lit.
- From the perspective of the load supply wiring, this looks like “no power on the module” even when the L+ terminal measures 24 V at the connector.
Once the project is loaded and the CPU transitions to RUN, the modules are parameterized, the SF LEDs clear, and the outputs become hot. If they do not, measure the load voltage at the module's L+ terminal with a multimeter and confirm the front connector is fully seated; the S7-400 hot-swap SMs require the front connector to be screwed down to land the load voltage.
Verification Checklist
- LEDs: POWER green, RUN green, STOP off, BUSF off, EXTF off, INTF off.
- Diagnostic buffer: no entries newer than the cold-restart event, no “Station failure” or “Parameter assignment error”.
-
Watch table: force a known output bit (e.g.,
Q 0.0), verify the field device actuates, then unforce. - PROFIBUS slaves: in HW Config Online → Accessible Nodes or Target system → Compare, confirm every slave is in “OK” state with no SF.
- CPU operating mode: RUN, not RUN with HALT (operator panel yellow) — the new CPU will not have any operator error masks, so the panel should be clear.
- Time-of-day: synchronize via PLC → Set Time of Day; replacement CPUs come up at 00:00:00 01.01.1994.
- Retentive flags/timers/counters: replacement CPU has no remanent storage; reload from project. If the process requires remanence, configure it in HW Config and download.
Preventive Commissioning Procedure for Future Replacements
- Keep a project archive of every S7-400 station on a backed-up file share; never rely on the CPU as the only source of truth.
- Before pulling the old CPU, run PLC → Upload Station to PG as a last-resort backup.
- Document the MPI/DP/PN address of every CPU in a station binder; cross-check the new CPU's address against the document before power-up.
- Set the PG/PC interface to (Auto) by default; only switch to a fixed profile when a known-good session is in progress.
- Use a PC Adapter USB A2 only for baud rates up to 1.5 Mbps; keep a CP 5621 in the kit for 3/6/12 Mbps PROFIBUS.
- After the swap, always perform a full download (HW Config + blocks + comments) so the diagnostic buffer is clean and the next technician does not chase ghost faults.
When the Simple Fix Does Not Work: Escalation Matrix
| Symptom | Likely cause | Action |
|---|---|---|
| No nodes appear in Accessible Nodes | Adapter on wrong bus profile, cable reversed, terminator on the PG connector | Set PG/PC to (Auto), check PROFIBUS D-sub pinout (3 = B, 8 = A), disable termination on the inline PG connector |
| CPU visible but “protection violation” on download | Know-how protection on the old project | Upload with the original project password, then download; or remove protection offline first |
| CPU visible but BUSF stays on after download | DP slave address conflict or missing GSD file | Open Accessible Nodes, find the conflicting slave, re-address it on its rotary switches, re-import the GSD if a third-party slave was used |
| EXTF stays on after download | Load voltage missing at a specific SM | Measure L+ at the front connector, check the module's load-supply fuse, confirm front-connector screw is tight |
| CPU won’t leave STOP after a complete download | OB missing (OB100/OB102 for startup, OB1 for cyclic) or hardware config not downloaded to target | Re-download HW Config; check whether OB1, OB100, OB121, OB122 exist in the offline project |
Standards and Document References
- SIMATIC S7-400 Automation System Manual
- Siemens support entry 1117740 — S7-400 CPU spare parts and compatibility
- PC Adapter USB A2 manual (entry 12604134)
- PROFIBUS standard: IEC 61158 / IEC 61784 (CPF 3) for PROFIBUS DP physical and data-link layer, including baud rates up to 12 Mbps and the bus profile negotiation rules the “Auto” PG/PC mode relies on.
FAQ
Why does my replacement CPU 412 show BUSF and EXTF immediately after a clean power-up?
A factory-fresh CPU 412 holds no hardware configuration and no PROFIBUS master parameter set, so the DP interface cannot complete the slave discovery and the SMs cannot be parameterized. Both LEDs reflect the missing config; they clear automatically once the offline HW Config is downloaded to the new CPU.
What does the “(Auto)” suffix on the PG/PC interface entry actually do?
It instructs the PC Adapter or CP to scan the bus and accept whatever profile (MPI or PROFIBUS) and baud rate the master is broadcasting. In the field case described, switching from a fixed MPI profile to PC Adapter (Auto) - MPI/DP was the change that allowed STEP 7 to see the new CPU and complete the project download.
My digital output modules stay unpowered after the CPU swap. Is the module bad?
Almost always no. S7-400 SMs de-energize their field outputs until the CPU downloads a parameterization frame. Confirm 24 V is present at the L+ terminal of the front connector, confirm the connector is fully seated, then re-download HW Config to clear the EXTF/SF LEDs.
Can I use a third-party USB-to-MPI cable to bring the CPU online?
Not reliably. Non-Siemens adapters commonly fail above 187.5 kbps and lack the bus-profile negotiation that the “Auto” mode requires. Use the Siemens PC Adapter USB A2 (6GK1571-1BA00) for MPI/DP up to 1.5 Mbps, or a CP 5621 PROFIBUS card for higher baud rates.
Do I need to upgrade firmware when swapping a different MLFB release key?
Only if the offline project contains blocks or system data that depend on a newer firmware feature. STEP 7 will warn you at download time; you can either upgrade the CPU firmware (Classic: Options → Install Firmware Updates) or roll the project back to a compatible release. Identical MLFB spares do not need an upgrade.