Siemens CP342-5 PROFIBUS DP: Resolving 8F7FH and OFFLINE Errors

The CP342-5 PROFIBUS communication processor for SIMATIC S7-300 commonly returns two related error patterns during commissioning, and both almost always point to the same root cause: the ANY pointer passed to DP_SEND (FC 1) or DP_RECV (FC 2) is incomplete. The two observable symptoms are DP_SEND reporting RETVAL = 16#8F7FH (internal error / illegal ANY reference) and DP_RECV reporting DPSTATUS = 16#11 (OFFLINE) with no application data being updated. This reference documents the ANY pointer syntax that resolves both conditions, the surrounding HWConfig work that makes the data flow visible, the diagnostic procedures that confirm correct operation, and the firmware / catalog information needed to substitute an equivalent module if the installed CP is end-of-life.

1. Affected Hardware and Firmware

The CP342-5 occupies one slot in the S7-300 rack and acts as an independent PROFIBUS DP master (or slave) with its own processor. Because data exchange with the CPU is mediated by the CP, the application is restricted to the FC 1 / FC 2 interface; the data does not appear in the process image and cannot be read with the standard L PEW / T PAW instructions used for the integrated DP interface.

STEP 7 V5.5 SP2 with HSP-0131 and TIA Portal V13 and later support all four catalog numbers. The CP342-5 remains visible in TIA Portal V20 if the project is migrated with the HSP; for new installations the recommended replacement is the CP343-5 (6GK7 343-5FA02-0XE0), which uses the identical FC 1 / FC 2 interface.

2. Root Cause: Incomplete ANY Pointer

The DP_SEND and DP_RECV blocks shipped with SIMATIC NET NCM S7 require an ANY pointer that fully qualifies the data area. A common misformat is to supply only the DB number — for example passing DB1 or P#DB1 as the source / destination. The CP driver interprets the missing byte count as an internal length error and returns 16#8F7FH; in parallel, the CP diagnostic buffer records a configuration-mismatch entry, which DP_RECV mirrors as DPSTATUS 16#11 (OFFLINE).

The correct ANY pointer format on the CP342-5 is:

P#DB<number>.DBX <byte offset>.0 BYTE <length in bytes>

Worked examples:

// Send 32 bytes from DB1 starting at byte 0
P#DB1.DBX 0.0 BYTE 32

// Receive 16 words from DB100 starting at byte 20
P#DB100.DBX 20.0 WORD 16   // length unit may be BYTE / WORD / DWORD

// Send a flag area
P#M 0.0 BYTE 16            // 16 bytes from MB0..MB15

// Receive into a global DB with the typical 1-byte input + 1-byte output device
P#DB2.DBX 0.0 BYTE 2

Three syntactic rules to honor:

1. The DB number, byte offset, and byte count are all required. Omitting the byte count is the failure mode that returns 8F7FH.
2. The byte count must be even. The CP342-5 transfers data in 16-bit words, and an odd byte count is rejected with 16#8F7FH.
3. The byte count must be a compile-time constant. The CP342-5 does not support variable-length DP frames; redesign the slot or split into multiple DP_SEND calls if the payload length must change at runtime.

3. HWConfig Setup for the CP342-5

Before any DP_SEND / DP_RECV call returns valid data, the CP342-5 must be configured as a DP master in HWConfig and assigned a PROFIBUS address that does not collide with any other bus node. The procedure below applies to STEP 7 V5.5; the TIA Portal equivalent is documented in the Configuring PROFIBUS DP (S7-300, S7-400, S7-1500) reference.

1. Open the S7 project in SIMATIC Manager and switch to HWConfig.
2. Insert the S7-300 rack and add the power supply, CPU, and signal modules. Save and compile.
3. From the catalog, navigate to SIMATIC 300 > CP-300 > PROFIBUS > CP342-5 and drag the module to an open slot. Slot 4 is conventional, but any free slot is permitted.
4. Double-click the CP342-5 to open its properties. On the General tab, click Properties next to the PROFIBUS interface and assign an address. Address 2 is the most common default for the master; slaves are typically 3..32.
5. Set the PROFIBUS network to the highest baud rate supported by every node — 1.5 Mbit/s on a clean cable, 12 Mbit/s only when every slave is rated for it. Confirm the profile (DP) and the operating mode (DP master).
6. Click OK and save / compile the hardware configuration. The CP342-5 is visible online as an active node once the project is downloaded.

On the first online connection, the CP342-5 LED stack reports its state:

The logical base address reported in HWConfig under Addresses is the value to pass as CPLADDR to FC 1 / FC 2. For an S7-300 in slot 4 the address is W#16#0100; moving the CP moves the base address according to the S7-300 fixed address map (slots 1..11 map to 0, 4, 8, 12, 16, 20, 24, 28, 32, 36, 40 bytes of input area per slot).

4. Installing the Vendor GSD File

Third-party DP slaves do not appear in the SIMATIC catalog. They are added to the HWConfig library by installing the vendor GSD file. For a generic 8-channel digital I/O block the GSD is typically named DP-Slave.gsd or a vendor-specific equivalent; the file is supplied with the device on a CD or downloaded from the manufacturer portal.

1. In HWConfig open Options > Install GSD File... (STEP 7 V5.5) or Options > Manage device description files (TIA Portal).
2. Browse to the directory that contains the GSD and the accompanying bitmap. Click Install. SIMATIC Manager copies the GSD into the project's STEP7\S7DATA\GSD directory.
3. Close and reopen HWConfig. The slave now appears in the catalog under PROFIBUS DP > Additional Field Devices > <Vendor>.
4. If the slave is also shipped with a type file (.typ) and a bitmap (.bmp), install them in the same step. Without the bitmap the slave appears in HWConfig as a generic icon and the slot is not visible at runtime.

5. Configuring the 8x Digital I/O Slot

Drag the slave from the catalog to the PROFIBUS line and assign a unique bus address. In the slave's slot table, add modules that match the physical device. For a typical 8-channel digital I/O block the configuration is two 1-byte modules (one input, one output) — the 8 DI / 8 DO interpretation in the GSD declares 1 byte per direction, not 8 bytes.

Compile and download the hardware configuration. The CP342-5 transitions from OFFLINE (DPSTATUS 16#11) to OPERATE (DPSTATUS 16#00) once the parameterization frame is acknowledged. The transition is observable in the PG online topology view and in the CPU diagnostic buffer (event ID W#16#0A21, DP master entered OPERATE).

6. DP_SEND / DP_RECV Block Calls

The CP342-5 uses FC 1 (DP_SEND) and FC 2 (DP_RECV) from the SIMATIC NET library. The block interface in STEP 7 V5.5 is:

CALL  "DP_SEND"        // FC 1
   CPLADDR   := W#16#0100   // logical base address from HWConfig
   SEND      := P#DB1.DBX 0.0 BYTE 32
   DONE      := M10.0
   ERROR     := M10.1
   STATUS    := MW12

CALL  "DP_RECV"        // FC 2
   CPLADDR   := W#16#0100
   RECV      := P#DB2.DBX 0.0 BYTE 32
   NDR       := M20.0
   ERROR     := M20.1
   STATUS    := MW22
   DPSTATUS  := MB24

The CPLADDR is the logical base address of the CP module from HWConfig (right-click the CP > Object Properties > Addresses). For a CP342-5 in slot 4 the default is W#16#0100; if the CP is moved, the address follows the slot per the S7-300 fixed address map. The blocks must be called from OB1 (or a higher-priority OB if deterministic latency is required). The DONE / ERROR / STATUS outputs are only valid for one scan; latch them into flags if a fault must be inspected from HMI.

For an 8 DI / 8 DO device the SEND length is 2 (one output byte) and the RECV length is 2 (one input byte). The P#DB2.DBX 0.0 BYTE 32 used in the snippet above is only valid if the master is configured to exchange 32 bytes per direction — confirm the value matches the sum of all slot lengths in HWConfig.

7. Error Code Reference

The two error patterns central to this reference are 8F7FH and DPSTATUS 16#11, but the full set returned by the CP342-5 covers DP parameterization, bus, and application errors. The table below is taken from the SIMATIC NET NCM S7 block help and applies to all CP342-5 firmware versions from V2.0 onward.

The DPSTATUS byte returned by DP_RECV is a snapshot of the CP's internal DP state machine:

8. DPSTATUS Byte Evaluation

When DPSTATUS = 16#11, the CP is in OFFLINE — typically because the master has not yet started parameterization or because a configuration error prevents it. Three things to verify, in order:

1. CP operating mode. In HWConfig, open the CP342-5 properties and confirm the operating mode is DP master, not No DP or S7 communication. A mis-set mode causes DPSTATUS = 16#11 immediately after download.
2. CPU-CP link. The CP342-5 is not a "transparent" DP device. It must be linked to the CPU as a partner in the S7 project. If the link is missing, the CP never receives a start command and remains offline. The link is visible in NetPro as a blue line between the CPU and the CP; if it is grey or absent, drag a connection from the CPU to the CP.
3. Slot length match. The byte count in the ANY pointer must equal the total length of the configured slots. For an 8 DI / 8 DO device (1 byte in + 1 byte out), the receive pointer must be P#DBx.DBX 0.0 BYTE 2 (not BYTE 32 unless more slots are configured). A mismatch causes the CP to report config mismatch and stay offline.

9. Alternative Integration Modes

The CP342-5 supports three PROFIBUS roles. Choosing the wrong role is a common reason DPSTATUS stays at 16#11 even when the bus hardware is intact.

If the application only needs S7-CPU-to-CPU exchange, the CP can be set to S7 communication and the DP_SEND / DP_RECV calls are no longer required. The integrated DP interface on the S7-300 CPU remains available for separate slaves. Mixing modes (DP master on the CP and S7 communication on the same CP) is permitted but requires both sets of blocks to be present in OB1.

10. PROFIBUS Cable and Termination

DPSTATUS 16#80 (bus fault) and repeated 8F7FH errors that reappear after every restart are almost always caused by cabling, not by software. The CP342-5 uses a Type A PROFIBUS cable (twisted, shielded, 150 Ω nominal impedance) and requires terminating resistors at both ends of every segment.

11. Timing and Watchdog

The DP cycle time on a CP342-5 master is set by the DP cycle parameter in HWConfig under CP342-5 Properties > Operating Mode > DP Master. The minimum cycle is 1 ms; the maximum is 65.5 s. The cycle is independent of the OB1 scan time — the CP has its own processor and runs the bus in parallel to the user program.

The DP watchdog is configured per slave in HWConfig under Slave Properties > Parameter Assignment. The default is 250 ms for cyclic slaves. If a slave misses a single Ack, the CP342-5 reports a diagnostic interrupt and continues with the next slave; if it misses a full watchdog interval, the CP removes the slave from the cyclic poll and DP_RECV reports 16#C2 (config mismatch) for the affected slot.

12. Diagnostic Buffer Event IDs

Every PROFIBUS transition on the CP342-5 is recorded in the CPU diagnostic buffer. The events below are the ones most useful for isolating a 8F7FH or 16#11 condition.

13. Verification Procedure

Once the HWConfig and the FC 1 / FC 2 calls are corrected, verify the data flow in this sequence:

1. Download HWConfig and the program blocks. Confirm the CP transitions to RUN (green LED steady, SF and BF off).
2. Open the variable table and force the eight outputs to a known pattern, e.g. 1010 1010 (binary). With a watch table on the corresponding bits, the slave LEDs should mirror the pattern within one DP cycle (typically 1..10 ms at 1.5 Mbit/s).
3. Toggle the eight inputs on the slave and verify that the bits appear in the receive DB within one DP cycle. The NDR (new data received) flag on DP_RECV should pulse every cycle.
4. Read STATUS and DPSTATUS. Both should be 16#0000 and 16#00 respectively when the bus is idle and the slave is responding.
5. Power-cycle the slave to force a fault. STATUS / DPSTATUS should report 16#80B0 (master not in OPERATE) briefly, then clear automatically when the slave re-joins the bus.
6. Disconnect the bus terminator. BF should light red within one watchdog interval. Reconnect; BF should clear after the next successful poll.

14. Troubleshooting Matrix

15. Migration to CP343-5 and TIA Portal

For new installations the recommended drop-in replacement is the CP343-5 (6GK7 343-5FA02-0XE0). It uses the same FC 1 / FC 2 block interface, so the application program does not change. For migration to TIA Portal V20 the CP342-5 device proxy is preserved by installing HSP-0131 and re-importing the HWConfig. The diagnostic buffer IDs, status codes, and DP state machine are identical between the two modules; existing troubleshooting procedures apply unchanged.

The CP343-5 differs in three areas:

• Default logical base address is W#16#0180 (slot 8) instead of W#16#0100 (slot 4).
• Integrated Web server for diagnostics over Ethernet — accessible at the IP address assigned in HWConfig.
• Additional S7 communication slots, allowing the same module to drive DP and exchange S7 messages in parallel without an additional CP.

Frequently Asked Questions