SCALANCE W746-1 Not Recovering Link to S7-300 CPU315-2PN: Field Troubleshooting Guide

1. Problem Statement

A SCALANCE W746-1 IWLAN client module connected to a SIMATIC CPU 315-2 PN/DP (V2.6) via a hybrid connector cable periodically loses the Ethernet link to the CPU. The radio link itself (W788 access point ↔ W746-1 client) remains up, but the wired Ethernet segment between the W746-1 and the CPU's PROFINET port freezes. Symptoms include:

• BF2 LED of the CPU 315-2 PN lit red, indicating a bus fault on the PROFINET interface.
• Link LED of the W746-1 Ethernet port dark (off).
• Web UI of the W746-1 reachable over the radio; the "Ethernet" interface shows operational status Down.
• Log file shows alternating Link Down / Link Up entries prior to the freeze.
• Recovery only possible via power-cycle of the W746-1 or a soft restart from its Web UI.

After a restart, the link returns without any intervention on the cable, the connectors, or the CPU. The problem is reproducible on a period of 1–5 days, never on a fixed schedule.

2. System Architecture

The reference installation consists of three CPU 315-2 PN/DP controllers. Two of them communicate over a wired PROFINET ring, the third is mounted on a moving carriage and bridges to the network over an IWLAN segment:

• W788-1 M12 (6GK5788-1AA60-2AA0) — IWLAN access point, mounted on the fixed infrastructure.
• W746-1 M12 (6GK5746-1AA60-4AB0) — IWLAN client, mounted on the moving carriage.
• CPU 315-2 PN/DP (6ES7315-2EH14-0AB0, firmware V2.6) — on the carriage, connected to the W746-1 through the PROFINET port X1.
• Hybrid connector cable — single M12 Hybrid connector carrying 100 Mbit/s Ethernet plus 24 V supply from a power source, terminating in an M12 Hybrid plug at the W746-1 and a free wire end / RJ45 at the CPU side.
• Linear travel — approximately 20 m; client must hand over within the coverage cell.

Communication is implemented with S7 connections, PUT/GET, and ISO-on-TCP transport. No PROFINET IO device is bound to the radio segment; PROFINET IO has been explicitly disabled in the HW Config of the affected CPU.

3. Affected Hardware and Firmware Versions

Always verify the exact article number and firmware with the device's Web UI under Information > Versions before applying any of the recommendations below.

4. Symptom Pattern Analysis

The failure has a specific fingerprint that distinguishes it from a true radio outage:

1. The radio path remains usable: the W746-1 Web UI continues to respond over the wireless link from the W788-1.
2. Only the wired Ethernet segment between the W746-1 and the CPU's PROFINET port drops.
3. The W746-1 logs show several Link Down / Link Up sequences before the link eventually freezes in the Down state.
4. The BF2 LED of the CPU is solid red — the CPU sees no link partner on its PROFINET port.
5. A W746-1 restart restores the link without any physical intervention on the cable, connectors, or CPU.

This pattern rules out pure radio coverage problems. It points to one of: the Ethernet PHY in the W746-1, the Ethernet PHY in the CPU, the cable assembly, the connector pin assignment, or a W746-1 software state machine that fails to re-arm the link supervision after a certain number of bounces.

5. Root-Cause Hypotheses

Work the list top-down — fastest and cheapest checks first.

6. Diagnostic Procedure

Perform the following steps in order. Document the result of each step before moving to the next.

6.1 Capture the current configuration and logs

1. On the W746-1, open the Web UI (https://<IP of W746>).
2. Navigate to System > Load & Save and download the configuration file (CPL).
3. Download the log file from Information > Log Table > Save.
4. From the W788-1 access point, repeat step 2 and 3.
5. From the CPU, read the diagnostic buffer with STEP 7 / TIA Portal: CPU > Diagnostic Buffer.

6.2 Inspect the hybrid connector and cable

1. Power down the W746-1 and the CPU.
2. Disconnect the hybrid connector at the W746-1 end.
3. Inspect the pins under a magnifier: look for bent or recessed pins, contamination, and proper seating of the contact carrier.
4. Check the recommended torque (M12 hybrid typically 0.6 Nm) — over- and under-torque both cause intermittent contact.
5. Inspect the cable run for kinks, abrasion, oil ingress, and minimum-bend-radius violations.
6. Re-seat the connector, torque to spec, power up, and observe for 24 h.

6.3 Validate the radio segment

1. On the W788-1: Information > WLAN > Clients; confirm the W746-1 is associated and the signal level is stable.
2. On the W746-1: Information > WLAN > Radio; note the current channel, channel changes, and TX power.
3. Cross-check the channel against your local regulatory domain. With 802.11h (5 GHz outdoor) the device must support DFS (Dynamic Frequency Selection) and TPC (Transmit Power Control).

6.4 Reproduce the fault deterministically

Before changing any configuration, prove that the fault is reproducible and that you have a baseline:

1. Connect a managed switch or a tap between the W746-1 and the CPU to capture Ethernet frames (e.g., a SPAN port with Wireshark).
2. Run a continuous S7 PUT/GET traffic generator between the master CPU and the moving CPU.
3. Let the system run until a freeze occurs. Note the time of the freeze and the last 100 frames on the wired side.
4. Trigger a W746-1 restart and capture the re-arm sequence.

This data set becomes the baseline against which every fix is measured.

7. Configuration Optimization

7.1 Channel selection

802.11h is a 5 GHz regulatory domain for outdoor use and requires DFS. DFS radar hits force the radio to vacate the channel for 30 minutes, which can cause repeated client re-associations and link bounces. To reduce churn:

1. Use DFS-free channels where the regulatory domain permits. In Europe, channels 36, 40, 44, 48, 149, 153, 157, 161, 165 are typically DFS-free. Channel 140 is often the first 5 GHz choice for industrial outdoor use in Europe because it balances availability and bandwidth.
2. If 802.11h is not required by local regulation, prefer 802.11a/n on a DFS-free channel instead.
3. Disable automatic channel selection; pin both AP and client to the same channel.

7.2 MAC Mode = Layer2Tunnel

For radio segments that carry only S7 / PUT/GET traffic — and no PROFINET IO — set the MAC mode of the W746-1 to Layer2Tunnel. This mode transports Layer 2 frames transparently across the radio link without performing PROFINET DCP or LLDP forwarding. In the W746-1 Web UI:

1. Layer 2 > MAC Mode.
2. Set MAC Mode to Layer2Tunnel.
3. Save and activate.

Layer2Tunnel reduces broadcast / multicast load on the radio cell and avoids spurious DCP discovery frames, which directly addresses hypothesis H5.

7.3 Link supervision and port settings

1. On the W746-1: Layer 2 > Ethernet > Port. Disable Auto-Negotiation and force 100 Mbit/s Full-Duplex on the port that connects to the CPU.
2. On the CPU 315-2 PN/DP, in HW Config / device configuration, set the PROFINET port to 100 Mbit/s Full-Duplex, auto-negotiation off, autocrossing on.
3. Disable Energy Efficient Ethernet (EEE / 802.3az) on both sides if it is available; EEE can interact poorly with industrial real-time stacks.
4. Enable Link Aggregation only if the CPU supports it; do not aggregate on a single cable.

7.4 Disable PROFINET IO and DCP forwarding on the radio segment

Because the radio segment carries only S7 / PUT/GET:

1. In HW Config of the affected CPU, remove any PROFINET IO device assignment on the PROFINET interface that traverses the radio.
2. On the W788-1 and W746-1, disable the PROFINET device role and DCP forwarding so DCP discovery frames do not leak across the radio cell.
3. Verify with a filtered port mirror that no PROFINET DCP multicast frames are crossing the radio after the change.

8. Firmware Update Procedure

1. Download the firmware 4.1.11 image for the W700 family from the Siemens Industry Online Support (entry point: Siemens Industry Online Support; search for the article "SCALANCE W700 firmware 4.1.11").
2. Verify the SHA / MD5 of the download against the value published on the Siemens entry page.
3. On the W788-1, update first: System > Load & Save > Firmware. Activate, then reboot.
4. Update the W746-1 the same way.
5. Restore your configuration from the CPL backup you made in §6.1, or re-import via the configuration file.
6. Re-apply the changes from §7 (Layer2Tunnel, fixed 100 Mbit/FD, channel 140, DCP off).
7. Run a 72 h soak test with the link monitor described in §6.4.

9. Hardware & Cabling Verification

If the software changes do not eliminate the fault, escalate to the hardware layer.

9.1 Replace the hybrid cable end-to-end

1. Pull a known-good hybrid cable from stock.
2. Verify pinout against the W746-1 wiring diagram (M12 Hybrid: 8 pins, 100 Mbit Ethernet on pins 1, 2, 3, 6; 24 V on pins 4, 5; GND on pin 7; PE on pin 8).
3. Use a cable tester suitable for M12 hybrid: check each Ethernet pair, each power pin, and the shield.
4. Re-install, torque, and observe.

9.2 Bypass the hybrid connector temporarily

1. Power the W746-1 from an external 24 V supply (separate from the hybrid cable).
2. Connect the W746-1 to the CPU with a standard Cat 5e / Cat 6 RJ45 patch cord, using an M12-to-RJ45 media converter if required.
3. Run the system for 24–48 h.
4. If the fault does not reproduce, the hybrid cable / connector is the cause. If it reproduces, the fault is in the W746-1 or the CPU.

9.3 Swap the W746-1

1. Replace the W746-1 with a known-good spare.
2. Apply the same configuration (CPL).
3. Run a 72 h soak test.
4. If the fault disappears, RMA the original W746-1.

9.4 Swap the CPU

1. Replace the CPU 315-2 PN/DP with a spare of the same article number.
2. Restore the STEP 7 project.
3. Observe for one full fault cycle (typically 1–5 days in this installation).

10. Long-Term Stability Improvements

10.1 Watchdog S7 connection

Add an application-level watchdog on top of the S7 connection so the moving PLC can detect a frozen link even if BF2 is latched:

• A separate S7 connection per pair of CPUs carries a 1-Hz counter.
• The receiving CPU checks that the counter is incrementing; if it stalls for more than 3 s the application enters a safe state.
• This does not fix the root cause, but it contains the impact and gives the maintenance team time to roll a truck.

10.2 Scheduled W746-1 maintenance reboot

If after firmware update and cable replacement the fault is rare (one cycle per 30 days), a scheduled nightly reboot of the W746-1 is an acceptable mitigation. Schedule via the Web UI under System > Restart or via SNMP/NTP-based scripts.

10.3 Antenna placement review

1. Verify line-of-sight along the 20 m of linear travel.
2. Use directional antennas at both ends to reduce multi-path and DFS radar false-positives.
3. Document RSSI and SNR at the extremes of the travel; a target of ≥ 50 dB SNR at the worst point is a useful industrial guideline.

10.4 Log and trend

1. Configure the W746-1 to send its log to a syslog server (PRONETA, SINEC NMS, or any standard syslog collector).
2. Trend Link Down / Link Up counts. A sudden increase is an early warning.
3. Trend CPU diagnostic buffer for PROFINET port events. STEP 7's diagnostic buffer is the canonical source of truth for the CPU side.

11. Verification Matrix

12. Field-Commissioning Checklist

1. Confirm article numbers of W788-1, W746-1, CPU, and hybrid cable against the bill of materials.
2. Confirm firmware of W788-1, W746-1, and CPU matches the project specification.
3. Pin the radio channel on both ends (recommended: 140 in EU, or a DFS-free channel in your domain).
4. Force 100 Mbit/Full-Duplex on the W746-1 wired port and on the CPU's PROFINET port.
5. Set MAC mode to Layer2Tunnel on the W746-1.
6. Disable PROFINET DCP forwarding on the radio segment.
7. Configure syslog to a central collector.
8. Run a 72 h soak test with continuous PUT/GET traffic.
9. Document the as-built configuration, antenna positions, and signal levels.
10. Schedule a 6-monthly review of the trend logs.