S7-400 Diagnostic Buffer: Reading CPU STOP Faults in STEP 7 V5.5

1. Problem Description

When a SIMATIC S7-400 CPU (such as the 6ES7 412-2XG04-0AB0 CPU 412-2 DP) transitions to STOP mode because of an internal or external fault, the engineering workstation running SIMATIC Manager STEP 7 V5.5 frequently loses the online connection through the industrial Ethernet path. Attempting to open the diagnostic buffer with the standard menu sequence PLC -> Module Information or the keyboard shortcut Ctrl+D produces an error dialog stating Connection to target module not established or Online: The connection to the target module could not be established.

The error occurs even though:

• The PG/PC was successfully online with the same CPU moments before the fault.
• The Ethernet cable, switch, and CP 443-1 Advanced (6GK7 443-1GX20-0XE0) are physically intact.
• The S7 connection in NetPro is configured correctly.
• The same access path worked during the previous commissioning session.

Because the diagnostic buffer is the only on-CPU record of the events that triggered the STOP, the inability to read it delays root-cause analysis and prolongs downtime. This article documents the failure mechanism and the three practical methods (industrial Ethernet, MPI via PC Adapter, integrated web server) to recover the buffer and bring the CPU back to RUN.

2. Affected Hardware and Software Versions

3. Root Cause Analysis

The Connection to target module not established error originates from one of the following conditions. Each is verified by the symptom and the corrective action. The Siemens TIA Portal manual collection page for the diagnostic buffer describes the same access model: the buffer is read through an explicit diagnostic session to the target, and if the routing path is broken the buffer becomes unreachable over the original path.

3.1 CP 443-1 Advanced Has Lost S7 Routing

When the CPU transitions to STOP because of a serious fault (programming error, missing OB, rack failure, or stop instruction executed in user code), the CP 443-1 may drop the S7 connection and the routing table. The PG/PC therefore sees no reachable target even though the CP is still physically on the network. The CP's own diagnostic buffer (separate from the CPU's) will contain entries that confirm the dropped route.

3.2 PG/PC Interface Mismatch

The PG/PC interface assignment under Set PG/PC Interface must point to the same network adapter that is bound to the S7 connection. If the laptop is connected through a docking station and the S7ONLINE access point references a different physical adapter, the connection attempt times out. This is a leading cause when the PG/PC has multiple Ethernet ports or when the docking station's NIC becomes default after a resume from sleep.

3.3 MAC Address or IP Conflict on the Industrial Ethernet

A duplicate IP address on the same subnet, or a switched topology that has not converged (spanning tree in transition), prevents TCP ARP resolution to the CP 443-1. The diagnostic buffer request from STEP 7 is sent but never delivered, and the S7 stack reports a connection failure after the configured retry timeout (default 10 s).

3.4 Process Mode Attribute Disabled in NetPro

If the S7 connection in NetPro is configured with the Process Mode attribute disabled, the connection is only used for programming and configuration. After the CPU goes to STOP, some S7 connections are released by the CPU to free resources, and a process-mode-disabled connection cannot re-establish automatically.

3.5 Defective Hardware

If the CP 443-1 is physically damaged (e.g., surge on the Ethernet port), all TCP traffic to the CPU is lost. This is the only case in which the diagnostic buffer is genuinely unrecoverable over the Ethernet path. A switch to MPI on the CPU's integrated MPI/DP port is required.

4. Prerequisites

To execute the procedures in this article, the following items must be available on site:

1. PG/PC with STEP 7 V5.5 SP4 or later installed. Confirm under Help -> About that the installed version supports the S7-400 firmware on the target CPU. SP4 HF7 or later is required for Windows 10 / 11 compatibility.
2. Either an active Ethernet connection to the same subnet as the CP 443-1 Advanced, or a PC Adapter USB A2 with the MPI cable connected to the CPU's MPI/DP port.
3. The STEP 7 project (*.s7p) that contains the hardware configuration (HW Config) for the affected S7-400 station. Without it, STEP 7 cannot authenticate the S7 connection.
4. Administrator rights on the PG/PC to change the PG/PC interface assignment and to disable the Windows firewall temporarily.
5. For the web-server fallback: the CPU must be a CPU 41x PN/DP with firmware V6.0 or later, or the CP 443-1 Advanced must be a variant that supports the web server (6GK7 443-1GX20-0XE0 with firmware V3.0 or later).
6. For exports: Microsoft Excel or a text editor capable of opening the *.csv or *.txt file generated by the export function.

5. Primary Method - Online Access via Industrial Ethernet

The first attempt is to recover the Ethernet path without restarting the CPU. The diagnostic buffer remains in non-volatile memory across a CPU STOP, so the data is still present and only the transport is broken.

5.1 Verify the Physical Layer

1. Confirm the link LED on the CP 443-1 Advanced is lit for the port that connects to the PG/PC.
2. From a Windows command prompt on the PG/PC, execute ping <CP-IP-address>. A reply confirms Layer 3 connectivity.
3. If the ping times out, swap the patch cable, swap the switch port, and re-ping. This isolates a cabling fault from a configuration fault.

5.2 Reset the CP 443-1 Without Affecting the CPU

1. In SIMATIC Manager, right-click the CP 443-1 in the online view of HW Config.
2. Select PLC -> Operating Mode and observe the current mode.
3. Select Object Properties -> Diagnostics to view the CP's own diagnostic buffer.
4. From the menu, choose PLC -> Clear/Reset to soft-reset the CP. This does not clear the CPU's diagnostic buffer or the user program.

5.3 Re-establish the S7 Connection

1. Open NetPro in the STEP 7 project.
2. Right-click the S7 connection between the PG/PC and the S7-400 station, and select Object Properties.
3. On the General tab, verify the partner IP, partner rack, partner slot, and connection resource match the CPU configuration.
4. If the connection is shown as broken in the online view, select PLC -> Connect to Target System. STEP 7 negotiates a fresh TCP session.
5. Press Ctrl+D to open the module information. The diagnostic buffer is now readable.

5.4 Routing Through NetPro for Multi-Network Installations

In plants where the PG/PC is on a separate office subnet from the S7-400, the CP 443-1 must be configured as a router in NetPro. The Router submask on the S7 connection defines the gateway. After the CPU goes to STOP, this router must be reachable; otherwise, ARP fails and the same connection not established error appears.

6. Fallback Method 1 - Access via MPI Using a PC Adapter

When the Ethernet path is unrecoverable on site, the MPI/DP port on the CPU is the most reliable backup. The diagnostic buffer is held in the CPU's internal memory and is accessible through every communication interface the CPU exposes.

6.1 Configure the PC Adapter

1. Connect the PC Adapter USB A2 to the PG/PC's USB port and to the CPU's MPI/DP port using a PROFIBUS cable with a 9-pin D-sub connector.
2. In Windows, open Start -> SIMATIC -> STEP 7 -> Set PG/PC Interface.
3. Select the access point S7ONLINE (STEP 7) -> PC Adapter (MPI).
4. Click Properties and set the MPI address of the PC Adapter to 0, the transmission rate to 1.5 Mbps (or 187.5 kbps for legacy CPUs), and the highest station address on MPI to 31.
5. Click OK and OK again to apply.

6.2 Open the Diagnostic Buffer

1. In SIMATIC Manager, select the S7-400 station in the project tree.
2. Right-click and select PLC -> Connect to Target System. STEP 7 establishes an MPI connection directly to the CPU, bypassing the CP 443-1 entirely.
3. Press Ctrl+D or select PLC -> Module Information.
4. The Diagnostic Buffer tab displays the most recent 100 entries (S7-400 standard). The entries are time-stamped to the CPU's time-of-day, which is set from the PG/PC or from an NTP/SNTP source configured in HW Config.

6.3 Why MPI Works When Ethernet Fails

The MPI port is integrated into the CPU firmware and is not affected by the CP 443-1's TCP/IP stack. The diagnostic buffer is stored in a battery-backed SRAM region (or in the MMC for MMC-only CPUs) and is independent of any communication processor. As long as the CPU's MODE switch is in RUN, RUN-P, or STOP, the MPI port is active and will respond to diagnostic requests.

7. Fallback Method 2 - Web Server of the CPU or CP

The web server of the S7-400 provides read-only access to the diagnostic buffer through any modern browser. This method does not require STEP 7 to be open, which makes it the fastest way to capture a snapshot when the laptop is configured for remote support.

7.1 Enable the Web Server

1. Open HW Config in STEP 7 V5.5 and double-click the CPU 41x PN/DP (or the CP 443-1 Advanced).
2. On the Web Server tab (or Properties -> Web for the CP), select Enable web server on this module.
3. Define the user list with at least one administrator account. The default account is admin with the password you specify.
4. Save, compile, and download the hardware configuration to the CPU.

7.2 Browse the Diagnostic Buffer

1. Open Microsoft Edge, Chrome, or Firefox on the PG/PC.
2. Enter https://<CPU-or-CP-IP-address>/ in the address bar. The standard web page of the CPU is displayed.
3. Navigate to Diagnostics -> Diagnostic Buffer. The page lists the entries in a table with the same event IDs as the STEP 7 module information.
4. The browser's print-to-PDF function can be used to archive the buffer for the maintenance log.

7.3 Limitation

The web server presents the buffer in a read-only table; it cannot clear entries or trigger a memory reset. To clear the buffer (for example, to start a fresh event trace), use STEP 7 on the MPI port or the Ethernet port once it is recovered.

8. Reading, Exporting, and Managing the Diagnostic Buffer

8.1 Buffer Structure

The S7-400 diagnostic buffer is a ring buffer of 100 entries (firmware-dependent; CPU 412-2 DP at firmware V4.0.7 stores 100 entries). Each entry contains the following fields:

8.2 Export to CSV

1. In the module information dialog, open the Diagnostic Buffer tab.
2. Click Save As (or the disk icon).
3. Choose a path and a file name with the extension *.csv. The default delimiter depends on the STEP 7 language version; English STEP 7 uses a comma, German STEP 7 uses a semicolon.
4. Open the CSV file in Microsoft Excel. Each entry is a row. The Details column contains a hex dump; format the column as Number with 16 digits to view the raw block.

8.3 Export to TXT

1. Click Save As and choose *.txt. The text file is a fixed-width dump suitable for email attachments.
2. Open the TXT in a text editor to search for specific event IDs with Ctrl+F.

8.4 Clearing the Buffer

The buffer is cleared automatically by a memory reset (MRES) of the CPU. A MRES is initiated by:

1. Turning the MODE switch to STOP.
2. Holding the MRES position for approximately 3 seconds; the STOP LED flashes.
3. Releasing and re-engaging MRES within 3 seconds; the STOP LED flashes faster.
4. The CPU performs a full reset: work memory is cleared, retain memory is cleared, the diagnostic buffer is cleared, and the operating mode is set to STOP with no project loaded.

8.5 Archiving the Project with the Buffer

STEP 7 V5.5 allows the project to be archived as a *.zip or *.arj file. The archive does not include the on-line diagnostic buffer; the buffer must be exported separately. A recommended practice is to keep a folder named DiagBuffer under the project directory and store all exports there with a timestamp filename such as CPU412_DiagBuf_2024-05-14_1034.csv.

9. Interpreting Diagnostic Buffer Entries

The diagnostic buffer is a chronological record. The most recent entry (Number 1) is the one that caused the CPU to enter STOP, unless the CPU has restarted and the entry has been overwritten. The first step in root-cause analysis is to read the event ID of the most recent entry and look it up in the S7-400 system manual.

9.1 Common OB-Related Event IDs

9.2 I/O Fault Event IDs

9.3 Access Method Decision Tree

10. Verification and Recovery - Returning the CPU to RUN

Once the diagnostic buffer has been read and the cause of the STOP identified, the CPU can be returned to RUN.

10.1 Reset Fault State

1. If the fault was caused by a missing OB (event 16#2521, 16#2522), load the appropriate OB into the CPU. The minimum set is OB 80, OB 82, OB 85, OB 86, OB 100, OB 102, and OB 121/122.
2. If the fault was a cycle time overflow (16#2520, 16#2523), reduce the OB 1 scan time by optimizing the user program or by increasing the maximum cycle time in HW Config -> CPU -> Properties -> Cycle/Clock Memory.
3. If the fault was a PROFIBUS slave failure (16#2534), repair the slave or the bus cable, and acknowledge the fault with PLC -> Clear/Reset or by cycling the MODE switch from STOP to RUN-P.

10.2 Cold Restart vs Warm Restart

After the fault has been cleared, select PLC -> Cold Restart or PLC -> Warm Restart depending on the application's retention requirements. A cold restart initializes all data blocks to their initial values; a warm restart retains non-volatile markers, timers, and counters. The diagnostic buffer records the restart as event 16#4306 (cold) or 16#4305 (warm).

10.3 Verify RUN Status

1. Observe the RUN LED on the CPU. It must be solid green, not flashing.
2. In the module information dialog, the Operating Mode tab must display RUN.
3. The diagnostic buffer must contain a new entry of type 16#4305 or 16#4306 as the most recent event, confirming that the restart completed.

11. Troubleshooting Matrix

12. Frequently Asked Questions