S7-400 EXTF and BUS2F LED: PROFIBUS DP Fault Diagnostics

Problem Overview

After a power supply replacement on a SIMATIC S7-400 automation system, the field engineer observed a stable RUN state on the CPU 412-2DP but two non-fatal indicators remained active: the EXTF (external fault) LED was continuously lit and the BUS2F (bus fault on the second interface) LED was blinking. The diagnostics buffer of the CPU reported an I/O access error when writing to the process image of the output modules, specifically a P-area word access at access address 544, originating from FC3 and tied to module address 238. The I/O devices were all present on the PROFIBUS segment and powered, but the CPU could not see them as reachable DP slaves.

This article consolidates the diagnostic path, the root-cause analysis, and the field-proven recovery procedure that allowed the controller to come back into production without a CPU replacement.

Hardware Configuration and Affected Components

The PS407 10A is mechanically and electrically compatible with the PS407 4A slot in the S7-400 rack. Either PSU can deliver 5 V DC and 24 V DC backplane voltages; the 10 A version simply has headroom for a fully populated rack with high-consumption I/O modules such as the SM 321 digital input (6ES7321-1BL00-0AA0) or SM 332 analog output (6ES7332-5HF00-0AB0). No hardware configuration change is required when migrating from 4 A to 10 A other than updating the part number in HW Config so the diagnostics buffer does not flag a "module type mismatch".

LED Status Interpretation on the S7-400 CPU

The combination of RUN plus EXTF plus blinking BUS2F is a textbook signature for a CPU whose dedicated PROFIBUS DP interface (IF2) cannot establish token-passing communication with the configured slave population. Because the CPU does not transition to STOP, the OB1 / OB82 / OB86 / OB122 default behavior is being executed; the program continues to run while the diagnostic event is logged in the diagnostic buffer.

Interpreting the Diagnostics Buffer

Open STEP 7 (or TIA Portal with the legacy S7-400H support package) and navigate to PLC → Module Information → Diagnostic Buffer. The relevant entries for this case decode as follows:

Module address 238 is the diagnostic address STEP 7 assigns to a configured but unreachable slave. The CPU is trying to write a 16-bit process image word to the output area of that slave, the slave does not respond, and OB122 fires. OB122 can be left empty (no user logic) so the CPU just records the event and continues — which is why production is technically running, but no I/O updates are reaching the field.

Additional buffer entries that confirm the second DP interface failure typically include:

• DP slave failure (event ID 0x3901 / 0x3902 / 0x38B1) repeated for every configured slave on IF2.
• Station failure or Station return toggling every few seconds, indicating a flapping bus.
• PROFIBUS DP: bus fault, hardware fault of the interface (event ID 0x3E0B) — the smoking gun when the DP port itself is electrically damaged.

Root Cause Analysis

The combination of evidence — a PSU that failed catastrophically, a CPU that boots cleanly, an I/O-access error stack pointing at IF2, and a PC/PG that cannot see the slaves when attached to the DP port — points to electrical damage to the DP interface of the CPU. The most common field cause is a transient or sustained overvoltage on the PROFIBUS trunk:

1. 230 V AC on the bus from a miswired terminator or a failed insulation on a Simocode, Sirius, or other PROFIBUS-connected device.
2. Lightning-induced surge on a long outdoor cable run.
3. Hot-swap of a DP slave with the bus still energized and the connector shorted.
4. Cumulative damage from a previous short on a 24 V field conductor sharing the cable tray.

When the original PS407 4A failed, the fault event itself may have generated a back-EMF or short-circuit transient that propagated through the backplane to the CPU's IF2 transceiver. The 4 A PSU died first because the overcurrent was drawn through the 5 V rail that powers the DP transceiver, but the resulting inrush damaged the RS-485 driver ASIC on the CPU. After replacement of the PSU, the port remains electrically shorted or biased, so the CPU's DP master cannot drive the bus.

A secondary but related cause is mechanical: the DP connector's terminating resistor switch may have been left in the wrong position when the PSU swap was performed, or a piggy-back PG socket may be missing, leaving the bus unterminated. Always check this first; it is a free fix.

Step-by-Step Diagnostic Procedure

1. Verify the Physical PROFIBUS Segment

1. Power down the rack (PSU selector switch to standby or remove the PS407).
2. Inspect every DP connector on the trunk. Confirm that the termination switch is ON only at the two physical ends of the segment (typically the CPU DP port and the last ET200 station) and OFF on every intermediate drop.
3. Measure the trunk voltage between pins 3 (RxD/TxD-P) and 8 (RxD/TxD-N) with the segment powered. A healthy PROFIBUS segment reads roughly 1 V DC of idle bias with 50 mV of differential activity when polled. A reading near 0 V or near 5 V indicates a shorted or pulled-up bus.
4. Measure between pin 6 (VP) and pin 5 (DGND) for 24 V field supply. This voltage should be sourced by only one device on the segment. Multiple 24 V sources will fight each other and bias the line.

2. Isolate Slaves One-by-One

1. With the CPU in STOP, open STEP 7 HW Config and disconnect one DP slave at a time by unplugging its bus connector.
2. Re-power the rack. Watch BUS2F. If BUS2F goes dark after unplugging a particular slave, that slave or its connector is the fault source.
3. Field experience: a terminated Simocode (3UF7) with a failed insulation path is a frequent culprit because the integrated PROFIBUS terminator ties the bus directly to the device's 24 V supply.

3. Test the CPU DP Port with a PC/PG

1. Attach a Siemens PC Adapter USB (6GK1571-1AA00) or CP 5512 / CP 5711 to a DP connector that has a piggy-back PG socket.
2. In STEP 7, set the PG/PC interface to PC Adapter (PROFIBUS) and the station address to 0.
3. Click Accessible Nodes. The CPU should appear at address 2 (the default PROFIBUS address of the CPU's DP master). If no CPU appears and BUS2F continues blinking, the DP master port is electrically non-functional.
4. As a cross-check, attach the PC/PG to the MPI/DP port. If the CPU is visible there but not on the second port, the IF2 transceiver is confirmed damaged.

4. Read the Diagnostic Buffer in Detail

1. Open PLC → Module Information → Diagnostic Buffer in online mode.
2. Click Help on Event for the top three entries — the S7-400 firmware provides a detailed explanation of each event ID, including the module address and the slot offset.
3. Note the timestamp of the most recent DP slave-failure event. If events occur at a regular 10-second cadence, the CPU's DP watchdog is firing; if they are random, the bus is flapping.

Recovery Path A — Reconfigure the MPI/DP Port as DP

If the dedicated DP port (IF2) is damaged and no spare CPU is on site, the field-proven workaround is to migrate the PROFIBUS master role to the MPI/DP port (IF1). The CPU 412-2DP supports this because IF1 can be software-selected to operate as either MPI or DP master. The drawback is that the HMI panel, which currently uses the MPI network, must be moved to PROFIBUS DP as well.

Prerequisites

• Source backup of the STEP 7 project (.s7p / .s7l).
• Configuration software for the HMI panel (ProTool / WinCC flexible / TIA Portal) to change the HMI's network assignment.
• Verified good DP cable with a terminator at each end of the new segment.

Procedure

1. Open HW Config in STEP 7. Double-click the CPU 412-2DP.
2. Select the MPI/DP interface. In the properties dialog, change Interface Type from MPI to PROFIBUS DP Master.
3. Set the PROFIBUS address of IF1 to the address formerly held by IF2 (typically 2). Set the baud rate to 1.5 Mbit/s (default and most robust for short segments).
4. Cut the DP subnet in HW Config and paste the slaves onto IF1. Save and compile. The system data (SDB) is regenerated.
5. Download the new hardware configuration to the CPU using the MPI/DP port (now still addressable as MPI for the download, or temporarily revert IF1 to MPI just for the download).
6. Verify that BUS2F is now dark and a new BF or BUS1F on IF1 is also dark once slaves are polled.

Recovery Path B — Reconfigure the HMI to PROFIBUS DP

Once IF1 is converted to DP, the HMI panel (MSystem / Micro Innovation GFO-57SQD-002) can be reconfigured as a DP slave on the same segment. The GFO-57SQD-002 is a 5.7-inch QVGA panel that natively supports both MPI and PROFIBUS DP; only the project file needs to be rebuilt and downloaded.

Procedure

1. Open the HMI project in ProTool / WinCC flexible 2008 SP5 (or the equivalent TIA Portal project).
2. Change the HMI's Connection from MPI S7-400 to PROFIBUS DP S7-400. Set the HMI's PROFIBUS address to a free value (e.g., 4) to avoid collision with the CPU master (2) and any ET200 stations (3, 5, 6, …).
3. Add a PROFIBUS DP partner entry for the CPU at address 2. Recompile and download the HMI image via Ethernet or serial.
4. Cycle power on the HMI. Confirm that the HMI is visible in STEP 7 Accessible Nodes at the new DP address.

Recovery Path C — Replace the CPU

If both ports on the spare CPU are needed (one for HMI, one for I/O) and the damaged CPU cannot be repaired in place, the only clean recovery is a CPU swap. The CPU 412-2DP is hot-swappable on a powered rack when using a memory card and a backup project. Order a replacement using the MLFB 6ES7412-2EK06-0AB0 (firmware V6.0.7 or later). After replacement:

1. Insert the memory card with the project backup.
2. Power up. The CPU boots, copies the project from the card, and enters RUN automatically.
3. Confirm the EXTF and BUS2F LEDs are dark and that all DP slaves are reachable.

Verification Checklist

Extended Diagnostic Considerations for S7-400H Systems

If the rack is part of an S7-400H fault-tolerant pair, the EXTF LED has an additional meaning: it can be lit by an asymmetric event where one CPU has lost a redundant link or where the buffer battery of the partner CPU has failed. The Siemens support portal documents that an S7-400H with EXTF always on a single PLC was traced to buffer battery monitoring — replacing the battery cleared the LED without touching the I/O configuration. Always check the buffer battery first on an H system before assuming a bus fault.

For the H system, the diagnostic buffer entries differ slightly. The OS blocks SFC 13 / SFB 52 / SFB 54 read structured diagnostic data and the system status list (SZL) with index 0x0A92 and 0x0A94 provide a direct map of redundant link states. Reading these SZLs from the user program is a reliable way to localize the EXTF cause.

Commissioning Procedure After Recovery

1. Power down and re-power the rack to clear all latched diagnostic state.
2. Connect STEP 7 online and read the diagnostic buffer top-down. Confirm the latest entry is a station return for every configured slave.
3. Run the user program in single-scan (CPU in STOP, then one RUN cycle) to test that FC3 write operations to address 544 complete without OB122.
4. Force a single output bit on the affected module and verify with a multimeter at the field terminal.
5. Force an input bit and verify the value in the variable table (VAT).
6. From the HMI, jog a motor or open a valve to confirm end-to-end operation.
7. Log the recovery steps in the maintenance log; document the bus topology and the new port assignment.

Preventive Measures

• Install a Siemens PROFIBUS terminator (6ES7972-0DA00-0AA0) only at the two physical ends. Remove the active terminator from every device in between.
• Add surge protection (Siemens 6ES7972-0DA00-0AA0 active terminator with surge, or a Phoenix Contact PT-IQ series) at any cable that leaves the cabinet.
• Verify the shield bonding of the PROFIBUS cable. The shield should be bonded to ground at the cabinet entry using a 360-degree clamp, not a pigtail.
• Avoid sharing a 24 V field conductor with PROFIBUS devices that can fail short. The 24 V common-mode voltage on a Simocode that has lost insulation is the most frequent cause of a destroyed CPU DP port.
• Replace the buffer battery (3.6 V lithium, 1.5 Ah, e.g., 6ES7971-0BA00) on a fixed schedule (every 3-5 years) to prevent EXTF from the battery monitor.
• Maintain a spare PS407 4A or PS407 10A and a spare CPU 412-2DP on the shelf for production-critical cells.

When to Escalate to Siemens Support

Escalate when:

• The diagnostic buffer shows event ID 0x3E0B (DP hardware fault of the interface) that reappears after every power cycle.
• Replacing the PS407 and re-cabling the bus does not clear BUS2F.
• The HMI project source is lost and the original machine builder cannot be reached.
• The system is a S7-400H and the EXTF LED persists after battery replacement and bus verification.

Have the following ready when opening a support request: the full diagnostic buffer export, the HW Config printout, the station list, the firmware version of the CPU (read from the module information), the order numbers of all components, and a wiring diagram of the PROFIBUS segment.