Siemens CPU 318 to 317-2DP Migration: Resolving PLC STOP Error

Problem Overview

When an S7-300 program developed on a CPU 318-2 DP (6ES7318-2AJ00-0AB0) is downloaded to a CPU 317-2 DP (6ES7317-2AK14-0AB0 or earlier -2AG10/-2AJ10), the target CPU may transition to STOP (internal) with the diagnostic buffer reporting a programming error from OB 35. A typical entry looks like the following:

STOP caused by programming error (OB not loaded or not possible, or no FRB)
Breakpoint in user program: Cyclic interrupt OB (OB 35)
Priority class: 12
FB number: 88
Module address: 130
Previous operating mode: RUN
Requested operating mode: STOP (internal)
Internal error, Incoming event

The SF LED is lit, and the CPU refuses to return to RUN even after a manual restart or a memory reset followed by a cold restart. The root cause is rarely a single bad block: it is the architectural mismatch between the CPU 318-2 DP and the CPU 317-2 DP instruction set, accumulator model, and OB repertoire. The user program was originally authored against the S7-400 instruction set because the CPU 318-2 DP is, in Siemens's own framing, an S7-400 CPU packaged in an S7-300 form factor.

This article documents the exact root causes observed during a CPU 318-2 DP to CPU 317-2 DP migration: the ENT accumulator-rotate instruction, the S7-400-only OB81 (power supply fault), and the related download errors. It provides the diagnostic interpretation, the architectural reasoning, and a verified fix procedure that brings the S7-300 CPU back to RUN.

Affected Hardware: CPU 318-2 DP and CPU 317-2 DP

The two CPUs in this migration case are mechanically compatible (same S7-300 form factor, same 40-pin front connector, same PROFIBUS DP master port), but the firmware and instruction set are not. Engineers treating the swap as a drop-in replacement almost always end up with a STOP CPU on first power-up.

Two architectural differences drive every STOP event in this migration:

1. Four versus two accumulators. The CPU 318-2 DP exposes ACCU1 through ACCU4. The CPU 317-2 DP exposes only ACCU1 and ACCU2. Any S7-400 instruction that reads or writes ACCU3 or ACCU4 has no defined behavior on an S7-300 CPU.
2. OB81 absence. The S7-300 family does not generate the power supply fault interrupt as a discrete OB. If the program contains an OB81 block that the S7-300 does not load, the download warns and the runtime reports "OB not loaded" if any code path calls it.

Architectural Root Cause: An S7-400 Core Inside an S7-300 Shell

The CPU 318-2 DP is the only member of the S7-300 family built on an S7-400 instruction set. It was originally released to deliver S7-400-class work memory and bit-memory density inside an S7-300 rack, which is why STEP 7 and TIA Portal list the device under the S7-300 catalog. Programmers who learned the S7-300 instruction list (the subset delivered with the older CPU 312, CPU 314, and CPU 315) typically do not realize the S7-400 instruction set is also available, and they do not know which of the instructions they used are S7-400-exclusive.

After the program is loaded into the CPU 317-2 DP, the S7-300 runtime silently discards S7-400-only instructions during the download or treats them as download errors, leaving either a truncated or non-functional block, or an OB that the target CPU will refuse to load at all (which manifests as "OB not loaded" in the diagnostic buffer when something tries to call it).

The diagnostic event "STOP caused by programming error (OB not loaded or not possible, or no FRB)" specifically points to the missing OB, an unhandled programming error, or the absence of a Fault Reaction Block (FRB). When the cyclic interrupt OB 35 (priority class 12) is the OB that is unable to execute, the CPU drops to STOP with the calling block and module address recorded in the event.

ACCU Register Architecture Comparison

The accumulator model is the single most important difference for migration engineers. The diagram below shows the register topology each CPU exposes to the runtime.

The instruction ENT (Enable ENT, "Enter accumulator stack") in STL explicitly rotates ACCU2 to ACCU3 and ACCU3 to ACCU4. On an S7-300, the runtime simply does not have those registers, so the instruction is invalid for the target and the block is rejected during download. If the user ignores the warning and forces the download anyway, the block is corrupted and the first call to it returns a programming error.

Why ENT Was Used in the Original Program

STL code authored for the S7-400 routinely uses ENT to manage the result of an arithmetic operation before invoking the next operator without losing operands on the stack. The standard idiom looks like the one extracted from the failed program:

L  #TEMP6
L  #TEMP7
/R
L  #TEMP9
ENT
L  #TEMP8
/R
*R
SQRT
L  #IN0
*R
T  #OUT5

Line by line: load TEMP6, load TEMP7, divide (TEMP6 / TEMP7 in ACCU1), load TEMP9, ENT rotates so the existing ACCU1 (TEMP6/TEMP7 result) becomes ACCU2 and TEMP9 becomes ACCU1, load TEMP8, divide (TEMP9 / TEMP8 in ACCU1, leaving TEMP6/TEMP7 in ACCU2), multiply ACCU1 by ACCU2, take the square root, multiply by #IN0, store in #OUT5. The arithmetic is straightforward; the ENT is only there to preserve ACCU2 while preparing the next operand pair. Every one of those lines must be rewritten in S7-300 STL.

The ENT Instruction: Why It Fails on S7-300

The Siemens S7-400 instruction list documents ENT as: "The contents of ACCU2 and ACCU3 are transferred to ACCU3 and ACCU4." That is the only definition; the operation rotates two slots down. The S7-300 instruction list does not contain ENT at all because the runtime has no ACCU3 and no ACCU4 to rotate into.

When STEP 7 or TIA Portal downloads an STL block containing ENT to a CPU 317-2 DP, the loading sequence depends on the offline/online view:

• Block compiled offline: The compiler may either flag the instruction as an error or emit an UNKNOWN_OPCODE stub. The downloaded block is non-functional.
• Block transferred binary: The CPU rejects the block with a load error. The program then references an OB or FB that is not present, generating the diagnostic event seen on the operator panel.

The fix is to remove ENT and rely on the implicit S7-300 stack: every L instruction pushes the previous ACCU1 into ACCU2 automatically. The arithmetic above is rewritten without ENT by saving the intermediate result to a temporary variable and reloading it when needed.

Drop-in Replacement Patterns for ENT

Use the following S7-300-compatible patterns in place of ENT. They produce identical accumulator states when executed on an S7-300 CPU.

L  #A
L  #B
+R
ENT
L  #C
+R
T  #OUT

L  #A
L  #B
+R
T  #TMP
L  #TMP
L  #C
+R
T  #OUT

L  #IN0
L  #IN1
+R
ENT
L  #IN2
-R
T  #OUT

L  #IN0
L  #IN1
+R
T  #TMP
L  #TMP
L  #IN2
-R
T  #OUT

L  #IN0
L  #IN2
-R
L  #IN1
ENT
L  #IN2
-R
/R
L  1.000000e+002
*R
T  #OUT3

L  #IN0
L  #IN2
-R
T  #TMP
L  #IN1
L  #IN2
-R
L  #TMP
/R
L  1.000000e+002
*R
T  #OUT3

OB81 (Power Supply Fault): S7-400 vs S7-300 Behavior

OB81 is the S7-400 organization block for power supply faults. The S7-400 firmware raises OB81 when a redundant power supply module drops out, when the backplane buffer is below threshold, or when the CPU detects a power-quality event. The block passes OB81_EV_CLASS, OB81_FLT_ID, and a fault-specific data set the user program can read.

The S7-300 firmware does not raise OB81. The S7-300 family has no equivalent interrupt OB for power supply faults. Diagnostic events of this class are reported through the diagnostic buffer and the SF LED, but the user program cannot install a handler for them.

When an S7-318 program is downloaded to a CPU 317-2 DP:

1. If the program includes an OB81 block, STEP 7 / TIA Portal warns that the OB cannot be loaded on the target. The block is excluded from the download.
2. If user code elsewhere calls or jumps to OB81 symbolically, the call resolves to "OB not loaded" at runtime, and the CPU drops to STOP the first time the call executes.

The OB81 in the failed migration was a watchdog block; it read the local temp TEMP0, compared it to the constant W#16#38, and branched on the result. None of that logic has an S7-300 equivalent; the OB must be removed and any code that referenced it must be rewritten to use the S7-300 error-handling OB repertoire (OB80 for time error, OB82 for diagnostic interrupt, OB85 for OB-not-loaded, OB121 for programming error, OB122 for I/O access error).

OB Reference Migration Table

If your program relies on OB81 to flag a power supply drop, the only safe S7-300 migration path is to add an OB82 (diagnostic interrupt) for the power supply module and use that as the fault handler instead. The power supply modules that support OB82 diagnostics must be S7-300 PS 305 or PS 307 with diagnostic capability, or an ET 200S PM with diagnostic data.

Diagnostic Buffer Decoding: Reading the STOP Event

The diagnostic buffer entry seen during the failed migration is decoded as follows. The interpretation is valid for STEP 7 V5.x and TIA Portal V13+ when read from the CPU online diagnostics view.

Step-by-Step Migration Procedure

The procedure below brings a CPU 318-2 DP project onto a CPU 317-2 DP or CPU 317-2 PN/DP in the shortest number of cycles. It assumes the project was authored in STEP 7 V5.5 or TIA Portal V13 or later with the CPU 318-2 DP as the offline target.

Prerequisites

• STEP 7 V5.5 SP4 or later, or TIA Portal V13 SP1 or later, with both CPU 318-2 DP and CPU 317-2 DP or CPU 317-2 PN/DP device descriptions installed.
• The original S7-300 project with the CPU 318-2 DP as the offline target.
• A backup of the S7-300 project, the S7-300 user program, and the S7-300 hardware configuration.
• The Siemens CPU 318 Migration Check tool, V1.0, available via FAQ 18365209.
• A copy of the SIMATIC S7-300 Instruction List manual for the target firmware.

Procedure

1. Back up the original project. Archive the STEP 7 or TIA Portal project file (.s7p or .ap13) to a network share or USB. Do not edit the live project before the backup is verified.
2. Change the offline target. In the device configuration, replace the CPU 318-2 DP with the CPU 317-2 DP (or CPU 317-2 PN/DP for new deployments). Recompile the hardware configuration. STEP 7 or TIA Portal will flag any hardware feature that the target CPU does not support.
3. Run the CPU 318 Migration Check tool. Open FAQ 18365209 and download the V1.0 executable. Run it against the offline S7-300 project. The tool reports every block that contains S7-400-only instructions, the block number, and a recommended action (remove, rewrite, or leave). Print or export the report.
4. Cross-check STL sources for the four-character token ENT. Open each FB, FC, and OB in the STL view. use Find and Replace with the regex \bENT\b and resolve every match. For graphics blocks (FBD or LAD) the compiler never emits ENT, so the find will return zero matches in those views.
5. Remove OB81 from the program. In the project tree, locate OB81 and delete it. STEP 7 and TIA Portal will not regenerate it for the S7-300 target. If the program includes other code that calls OB81 symbolically, replace each call site with the S7-300 equivalent (typically OB82 for diagnostic interrupt, or the diagnostic buffer read at OB1 startup).
6. Rewrite the S7-400-only instructions. For every ENT detected in step 4, apply the patterns from the table above. Use an explicit temporary variable when the S7-400 code relied on the stack to bridge a load operation. Recompile each block.
7. Re-verify the hardware configuration. Open the device view, then go online, and compare the configured slots against the actual module layout. Pay particular attention to any module that maps to a logical I/O address referenced in OB35 / FB 88 / address 130 in the original buffer. Reposition the module or fix the access in the user program.
8. Install OB121 and OB122 as Fault Reaction Blocks. If the program does not already include them, add a minimal OB121 and OB122 that simply return (BE). With these in place, the next programming error or I/O access error does not bring the CPU to STOP. This is the same FRB reference in the diagnostic buffer entry.
9. Download the project to the CPU 317-2 DP. Use the online wizard. STEP 7 / TIA Portal will issue a "block cannot be loaded: OB81" warning. Acknowledge the warning only if OB81 has been intentionally removed. If any other block is rejected, stop the download and resolve the block before proceeding.
10. Cold restart and verify RUN. Switch the mode selector from RUN to MRES, then back to RUN, to clear the diagnostic buffer. Confirm the SF LED is off and the RUN LED is solid green. If the CPU drops back to STOP, open the diagnostic buffer, read the new entry, and loop back to step 3.
11. Compare online vs offline blocks. In the online block list, compare every FB, FC, and OB against the offline source. Any block marked with a timestamp or "different" must be reconciled before the migration is closed out.

CPU 318 Migration Check Tool (FAQ 18365209)

Siemens publishes a dedicated FAQ and a migration check tool for the CPU 318-2 DP. The tool walks the offline S7-300 project and flags every construct that the S7-300 instruction set does not support. Engineers who skip the tool typically discover the missing constructs at first power-up, when the CPU refuses to enter RUN and the diagnostic buffer shows a programming error that points at the first offending block.

The tool does not rewrite the program. It is a static analyzer. The user is responsible for applying the recommended action (remove, rewrite, or keep) and recompiling the project.

Verification and Commissioning Checks

After the project is downloaded and the CPU is in RUN, run the following checks before returning the machine to production. Each check is a discrete diagnostic operation that can be executed from STEP 7 or TIA Portal online.

For the four-character ENT scan, use a project-wide search with case sensitivity disabled. The token "ENT" also appears in identifiers such as "ENTRY", "IDENT", and "INCREMENT"; restrict the search to whole-word matches or to the first column of an STL line.

Recommended Replacement Targets and Long-Term Planning

The CPU 318-2 DP is the most capable S7-300 CPU Siemens has ever produced, and the migration path off it is limited. The recommended targets, in order of preference for new projects, are listed below.

For migrations that include PROFINET, prefer the CPU 319-3 PN/DP or CPU 317-2 PN/DP. For pure PROFIBUS deployments, the CPU 317-2 DP is the lowest-cost replacement and is binary-compatible with the S7-300 instruction set once the ENT and OB81 issues are resolved. Always cross-check the target CPU's firmware release notes against the STEP 7 or TIA Portal version you use to compile, as some S7-300 instructions were added in later firmware revisions.

FAQ