S7-400 Ethernet Communication: Siemens PLC Troubleshooting Guide

Overview of S7-400 Communication Interfaces

The SIMATIC S7-400 programmable logic controller is typically deployed in mid- to high-end factory automation cells that demand deterministic, redundant, and high-availability control. Communication with SCADA, HMI, drive systems, and third-party devices happens through three physical layers: Industrial Ethernet (IE), PROFIBUS DP, and point-to-point serial. Industrial Ethernet, whether terminated on the CPU PROFINET port (CPU 41x PN variants) or on a CP 443-1 communication processor, is the dominant path for SCADA, HMI, and most modern drive integration. Communication faults on this layer typically surface as combinations of the SF (System Fault), BF/BUSF (Bus Fault), and LINK LEDs, as well as entries in the CPU diagnostic buffer and the CP 443-1 diagnostic buffer.

Field engineers reporting S7-400 Ethernet communication failures typically describe three broad symptom classes:

• Total loss of link — PLC pings but cannot establish S7 or TCP connections. SCADA/HMI shows the controller as disconnected even though the link LED on the switch and CP lights up.
• Intermittent faults — communication works for minutes or hours then drops without any physical-layer change. Often traced to broadcast storms, duplex mismatch, managed-switch VLAN tagging, or warm-restart events.
• One-sided faults — specific connections (one HMI panel, one drive, one OPC server) fail while other connections to the same PLC succeed. Points to connection-resource exhaustion, partner-block configuration error, or fetch/write protection issues.

This guide consolidates the diagnostic methodology, parameter values, LED state tables, and step-by-step resolution paths used to clear each class of fault.

Hardware: CPU 41x PN and CP 443-1 Variants

Identifying the exact module is the first step in any Ethernet fault — the firmware revision, the type of PROFINET interface (CP 443-1 vs CPU onboard), and the configured communication services all vary by catalog number.

Communication Protocols and Ports

The S7-400 Industrial Ethernet stack supports several protocols, each with its own port and connection characteristics. Mismatched protocol selection on the PLC and partner is the most common configuration fault.

HMI/SCADA systems such as WinCC, TIA WinCC Unified, InTouch, and third-party OPC servers normally use S7 Communication (port 102). Non-Siemens OPC servers (including Inductive Automation Ignition) typically use the S7 protocol with the same ISO-on-TCP transport — if the CP 443-1 has S7 Communication disabled or the S7 connection count is exhausted, those clients cannot establish a session even though the PLC responds to ping and ARP.

IP Addressing and Subnet Configuration

Duplicate IP addresses, mismatched subnet masks, and gateway misconfiguration account for a large share of "link lights up, no communication" faults. Configure each Ethernet node with the following rules:

1. Each IP address on a single subnet must be unique. The CP 443-1 and the CPU onboard PROFINET port must each have a unique IP. Configuring both with the same IP causes the BF LED on the CP 443-1 to flash and a diagnostic buffer entry indicating address conflict.
2. Subnet mask must match across all members of the same broadcast domain. The default 255.255.255.0 is acceptable for class-C plant subnets; 255.255.255.252 (/30) is appropriate for point-to-point links.
3. Default gateway must be set on every node that must reach subnets outside its own. For a CP 443-1 that only communicates with a local HMI panel, no gateway is needed; for one that connects to a plant-wide SCADA server, the gateway IP must point to the L3 router interface in that subnet.
4. PROFINET device names must be unique across the entire PROFINET network. Two devices sharing the same PROFINET name causes intermittent IO faults and is not visible at the IP layer.

Step-by-Step Troubleshooting Procedure

Follow this sequence for any reported Ethernet fault on an S7-400. Do not skip steps — later steps assume earlier ones are clean.

Step 1: Verify Physical Layer

1. Check the LINK LED on the CP 443-1 (or CPU PN port) and on the connected switch port. A solid green LINK LED with no RX/TX activity indicates a one-way cable or an issue at the partner.
2. Swap the patch cable with a known-good Cat 5e / Cat 6 cable, maximum 100 m. Industrial cabinet-to-cabinet links should be under 80 m to allow for patch cords and bend radius.
3. Verify the switch port is administratively up, in the correct VLAN, and not disabled by a port-security violation.
4. Confirm duplex and speed negotiation. Force 100 Mbit/s full duplex on both the CP and the switch port if the plant design specifies static settings; auto-negotiation failures are common on managed switches with Energy Efficient Ethernet (EEE) enabled.

Step 2: Verify Layer 3 Reachability

1. From the engineering station, ping the CP 443-1 IP and the CPU PN IP. A response confirms ARP and ICMP work; absence of response indicates either Layer 2 isolation or a firewall rule.
2. If ping fails: re-check the IP, subnet mask, and gateway directly on the CP using a PG with the MPI/PROFIBUS interface (read via STEP 7 online diagnostics).
3. If ping succeeds but TCP/102 (S7) fails: continue to Step 3.

Step 3: Read the CP and CPU Diagnostic Buffer

1. In TIA Portal: Online > Online & Diagnostics > Diagnostic buffer. In STEP 7 V5.x: PLC > Module Information > Diagnostic Buffer.
2. Read the most recent entries first. Typical S7-400 Ethernet events include:

Step 4: Verify S7 Connection Configuration

1. Open Devices & Networks > Networks > S7 Connections in TIA Portal (or NetPro in STEP 7 V5.x).
2. Confirm each S7 connection is downloaded to the PLC and the partner ID matches. Mismatched local/partner TSAP is a common silent fault.
3. Right-click the connection > Connection diagnostics. TIA Portal will report the state (Established, Not Established, Disconnected).
4. For open TCP/UDP: verify the local port, partner IP, partner port, and connection ID. Active and passive endpoints must be configured consistently.

Step 5: Clear, Re-Download, and Test

1. Perform PLC > Clear/Reset on the CP 443-1 if the diagnostic buffer contains residual errors that do not clear after power-cycle.
2. Re-download the hardware configuration and the connection table (NetPro) to the PLC.
3. Cold restart the CPU if connection-resource counts remain inconsistent.
4. From the partner, attempt an S7 read of one DB. A successful DB100.DBW0 read confirms end-to-end function.

Diagnostic Indicators: LED States

Each S7-400 Ethernet-capable module exposes a defined set of front-panel LEDs. The combination of LED states pinpoints the layer at which the fault resides.

A BF LED that is on solid with LINK also on solid indicates the physical layer is good but no Ethernet frames are being exchanged — a Layer 2/3 fault. A BF LED on with LINK off indicates a physical-layer fault.

Common Fault Scenarios and Resolutions

Scenario A: PLC Pings but SCADA Cannot Connect

This is the most common reported pattern. Ping responds because ICMP does not require any Siemens-specific service, but SCADA typically attempts an S7 connection to TCP/102. Resolutions:

1. Verify the S7 Communication service is enabled on the CP 443-1 properties under Communication Services.
2. Confirm the partner (SCADA/OPC) is allowed through any plant firewall on TCP/102.
3. Check the S7 connection count. The CP 443-1 base model supports 64 S7 connections; CP 443-1 Advanced supports 128. Exceeded counts return an OB85 or buffer entry indicating resource exhaustion.

Scenario B: Intermittent PROFIBUS Device Dropouts Co-existing with Ethernet

When S7-400 Ethernet and PROFIBUS faults co-exist, the root cause is usually contention at the backplane bus or shared interrupt resources, not the Ethernet interface itself. Resolutions:

1. Check the CPU diagnostic buffer for OB122 (I/O access error) and OB85 (priority class error) entries. These confirm the PROFIBUS DP master (CP 443-5 or onboard DP) is losing I/O.
2. Verify PROFIBUS segment termination (terminators ON at both ends only) and shield grounding at every cabinet entry.
3. Reduce the DP cycle time if the CPU scan time is approaching the configured PROFIBUS timeout.
4. If the Ethernet side shows faults simultaneously, isolate the Ethernet switch and check for broadcast storms; a single faulty drive flooding the network will cause both PROFIBUS diagnostics (via PROFINET-to-DP gateway) and Ethernet SCADA failures.

Scenario C: Web Server Inaccessible on CP 443-1 Advanced

1. Verify Activate Web Server is checked in the CP properties under Web Diagnostics.
2. Confirm TCP/80 and TCP/443 are not blocked by an industrial firewall.
3. Reset the CP via PLC > Module Information > Reset. A warm restart of the CPU does not always reinitialize the web server; a power-cycle of the rack may be required.

Scenario D: OPC UA / Third-Party Client Cannot Open Session

The CP 443-1 base model does not support OPC UA natively; OPC UA requires either a CP 443-1 Advanced with the OPC UA server option enabled, or an additional IE/PB Link with UA. If the partner expects OPC UA but the CP only offers S7 communication, the connection will not establish and the partner will report BadCommunicationError. Resolutions: confirm whether OPC UA is in scope, or add a CP 443-1 Advanced with OPC UA activated.

External Diagnostic Tools

Wireshark with the S7 dissector is invaluable for distinguishing "TCP/102 open but no S7 handshake" (firewall, partner not configured) from "S7 handshake completes but no data" (TSAP mismatch). Filter on tcp.port == 102 and observe whether the S7 Communication Setup (TPDU CR) packet is exchanged and acknowledged.

Verification Checklist

After applying any correction, run this checklist to confirm resolution:

• LINK LED solid green on CP 443-1 and switch port.
• RX/TX LED shows continuous low-rate activity when a partner is connected.
• BF / BUSF LED off.
• SF LED off (no group fault).
• Diagnostic buffer contains no new error entries.
• Ping from engineering station succeeds.
• S7 read of test data block (e.g., DB100.DBW0) returns expected value from partner.
• SCADA/HMI tag subscription reads without timeout for at least 10 minutes.

Preventive Best Practices

1. Document every Ethernet node on the plant network in a single IP plan. Reject manual IP changes by individual technicians.
2. Reserve a static IP range for PROFINET devices separate from office/IT subnets. Run the PROFINET network on a managed switch with PROFINET-aware QoS (typically Real-Time class to highest priority queue).
3. Disable unused services on the CP 443-1: HTTP, FTP, SNMP if not required.
4. Use the CP 443-1 Advanced only when the advanced services (web diagnostics, FTP, OPC UA, e-mail) are actually required. The base CP 443-1 is sufficient for most S7 Communication and PROFINET IO scenarios and reduces the attack surface.
5. Apply firmware updates from Siemens Industry Online Support on a planned schedule; many CP 443-1 firmware updates include connection-resource, security, and PROFINET conformance fixes.
6. Maintain a backup of the STEP 7 / TIA Portal project, including the NetPro / S7 connection table. Without the connection table, a CP replacement requires manual reconstruction of every S7 connection.

Frequently Asked Questions