Siemens ET200 Profibus DP Slave 'Not Ready': Diagnose & Repair

Problem Overview

The failure mode described below is a classic Siemens SIMATIC S7 / ET200 Profibus DP field fault: a remote I/O station (DP slave) that has been in continuous service for several years suddenly reports "slave not ready for peripheral communication" on the DP master diagnostic scan, while every piece of physical hardware (cable, connector, terminator, power supply) measures good. After reloading the hardware configuration (HW Config) into the CPU, the diagnostic text clears — but process I/O behaves erratically, as if functional blocks in the user program have been silently altered.

This symptom combination has a specific root cause in S7 memory architecture: an inconsistency between the Load Memory (Flash EPROM / MMC card) image and the Work Memory (RAM) image of the user program. The field-proven fix is to reload the complete project — hardware configuration and every logic block (OB, FB, FC, DB, SFB, SFC, SDB) — from an authoritative backup taken at commissioning.

Observable Symptoms

Root Cause Analysis

2.1 S7 Memory Architecture (Why Load Memory ≠ Work Memory)

Every S7-300 and S7-400 CPU runs the cyclic OB1 from Work Memory (RAM, backed by battery or capacitor). On a cold restart / warm restart the CPU copies the relevant blocks into Work Memory from Load Memory. Load Memory is either:

• An Flash EPROM card (FEPROM) on S7-300 (older 31x-2 DP without MMC, e.g. CPU 314, CPU 315-2 DP pre-2002), or
• A Micro Memory Card (MMC) on modern S7-300 (CPU 31x-2 PN/DP, 31x-3 PN/DP, 15xx), or
• A Flash Card or RAM Card on S7-400 (CPU 41x-2/3/4, 41xF).

The replication is not automatic after every online edit. STEP 7 "Online → Download to Target" writes the active blocks into Work Memory but does not by itself re-write the Load Memory image unless you select "Download to Target (complete project)" or run "PLC → Save to Memory Card".

If Load Memory develops an undetected bit error, or if a flash block was never updated after a later project revision, the following sequence can occur:

1. CPU powers up, reads Load Memory, detects the bad block silently (CRC mismatch is logged once to diagnostic buffer as Event ID 0x0315 "Flash error during block read") and silently substitutes the previous Work Memory copy.
2. For 6+ years the system runs on the cached RAM image and nobody observes the event.
3. A power loss, RAM backup capacitor failure, or battery low event clears Work Memory.
4. On next restart the CPU loads the corrupted block from Load Memory, executes a partially wrong logic sequence, and process I/O starts misbehaving — including DP slave diagnostics that depend on watchdog timeouts the wrong block no longer enforces.

2.2 DP Slave Detection Logic

A DP-V0 master polls each configured station within the configured watchdog time (default in STEP 7 HW Config: 1500 ms). If the slave does not respond with a valid response token within that window, the master raises the diagnostic bit "Station Failure" and zeros the input process image for that slot. The slave in turn raises SF if it cannot handshake its assigned slot.

Common — and far more common than Load Memory corruption — root causes that must be ruled out before assuming flash fault:

• Address switch drift on ET200ECO EcoFast: the rotary thumbwheel stick can vibrate loose and shift address (seen in field on accessible-as-mount in upper locations). Always re-verify DP address in HW Config matches the physical rotary setting.
• Missing bus terminator at the end of segment, especially after a cable repair.
• Faulty EcoFast or M12 connector pin: pin 6 (VP) supplies 5 V to the terminator bus; loss of VP turns off the network terminator.
• GSD file mismatch after a STEP 7 upgrade — wrong slot count or wrong diagnostic mapping.
• Interleaved EMC burst on field cable passing a VFD output within 200 mm — temporarily introduces slave timeout.

Diagnostic Procedure

1. Read the CPU diagnostic buffer in STEP 7: PLC → Diagnostics/Settings → Diagnostic Buffer. Filter for the failing station's I/O address. Expected event IDs for the four symptom families:

   Event ID (hex)	Meaning	Action
   0x001F	DP slave station failure (timeout)	Check addressing, wiring, watchdog
   0x00E0	Periphery not OK (PZF)	Compare expected vs. actual slot config
   0x0315	Flash error reading block	Reload Load Memory completely (Section 4)
   0x0322	Battery exhausted (S7-400 only)	Replace battery, then re-load project
   0x033C	Diagnostic interrupt from slave	Read slave-specific diagnostic
   0x0301 / 0x0302	Station OK / Station Reintegration	Informational; reset on power-up after transient

2. Read the slave's station diagnostic (DP-V1 mode): in HW Config right-click the slave → "Slave Diagnostics". Compare it to the diagnostic buffer.
3. Verify physical addressing: confirm every DP slave has a unique address 1..125, no duplicates, and the visible rotary / DIP switch matches DP Address in the station properties dialog.
4. Measure bus signals: with a Profibus tester (Softing PROFINET/Profibus Tester, Indu-Sol Probus, Amprolyser) confirm signal level ≥ 4.5 V at every segment end and < 5 % retry rate.
5. Check the backup battery / capacitor of the CPU. A BATTF LED on the CPU at the exact moment of failure is the single best confirmation of Load Memory vs. Work Memory drift.
6. Compare blocks online vs. offline in STEP 7: Options → Compare Blocks. Any FC / FB / OB / DB that shows differences is the smoking gun for RAM/Flash divergence. Differences in timestamp and checksum only mean you re-compiled offline but did not re-download — not a hardware fault. Differences in code region mean a Load Memory fault.

Solution: Restore Load Memory and Work Memory Consistency

4.1 Prepare the authoritative backup

Source the project from the most trusted of, in order of preference:

1. The PG archive created the day of commissioning (still on the original diskette / CD).
2. The STEP 7 project on the CPU's Memory Card (open SIMATIC Manager → File → Memory Card File → Open from MMC).
3. The latest controlled backup from a backup server / AS-AS synchronization.

4.2 Wipe and re-load Load Memory

For S7-300 with MMC:

1. Power down CPU.
2. Open the MMC card slot door, remove the card.
3. Insert MMC in the PG's external prommer (e.g. SIEMENS PG USB prommer, or use SIMATIC Manager File → S7-Memory Card → Delete).
4. Open the offline project in STEP 7, mark all blocks of the S7 program (OB, FB, FC, DB, SFB, SFC, SDB, system data), right-click → Download to Memory Card.
   • Or use PLC → Download to Target Station → Complete Project with the card inserted in the CPU and a SIMATIC NET cable connected.
5. Confirm STEP 7 reports Transfer successful: N blocks, M bytes.
6. Reinsert MMC in CPU, power up. CPU performs automatic overall reset and reload.

For S7-400 with Flash Card:

1. Same procedure, but the card type is Flash, not MMC. Use PLC → Save to Memory Card from a PG that has the offline archive and is wired PROFIBUS/MPI/Ethernet to the CPU.
2. Select RAM to ROM from "Online" toolbar to copy the just-loaded Work Memory image back into Load Memory in one step. This is the only operation that bulk-flashes all blocks atomically on S7-400.

4.3 Re-load the hardware configuration

Even if the HW Config of the restored archive matches the physical plant, force a reload:

1. Open HW Config. Verify no yellow-bordered slot.
2. Right-click the DP master system → Download to Target Station. Tick Replace modules / compare as needed.
3. After HW Config download the DP slaves should re-enter cyclic data exchange within watchdog time (typically 1.5 s).

Verification

Prevention and Long-Term Hardening

6.1 Backup strategy

For every SIMATIC project in continuous service, schedule the following:

• Annual Load-Memory dump to offline archive: PLC → Save to Memory Card → RAM to ROM, then upload the card to a PG and store the .S7P / *.zip archive on a redundant storage with a 30-day retention.
• Read the diagnostic buffer quarterly. Export to *.csv; correlate 0x0315 events with later unexplained PLC restarts.
• Replace CPU backup batteries at 50 % of rated life. Lithium cells (e.g. 6ES7971-0BA00, part of S7-400 BATT box) usually rated 5–6 years at 25 °C; replacement at year 3 eliminates the dominant RAM-clear path.

6.2 Engineering discipline

• Enable STEP 7 Options → Customize → Online: Activate "Load to memory card when downloading to RAM" so RAM updates always flush to card.
• Standardize on MMC in S7-300 (instead of legacy FEPROM) so that you can read the card without removing the CPU and rewriting it in a prommer; this makes "SIMATIC Manager → File → Retrieve from Memory Card" a one-click restore.
• Plant changes must follow a single workflow: offline edit → Compare Blocks → Download to Target Station (Complete Project) → online test → archive. A change that is "just tested online" without offline archive becomes unrecoverable at the next Load Memory fault.

6.3 Profibus physical layer robustness

• Keep DP cable away (> 200 mm parallel separation) from VFD output cables; if crossing is unavoidable, cross at 90°.
• Use active bus terminator (e.g. 6GK1 500-0AB10) at every segment end instead of the resistor-only terminator plug. Active terminators are far more tolerant of one missing supply.
• Tighten ET200ECO EcoFast sticks after maintenance, and on elevated locations use thread-locking adhesive on the rotary switch plate (the field failure mode mentioned in the source thread).

Field-Proven Edge Cases

Standards Reference

• IEC 61158 / IEC 61784 — Fieldbus specifications including PROFIBUS DP profile.
• EN 50170 — General fieldbus conformance.
• PI (PROFIBUS International) testing and certification — defines GSD file format & conformance tests; refer to PI Profibus Technology Overview.
• SIMATIC S7-300 CPU 31x-2 / 31x-3 manual set — SIEMENS Support Entry ID 12996906.
• ET200M IM 153-2 manual — SIEMENS Support Entry ID 15371074.
• STEP 7 V5.7 System and Standard Functions reference — diagnostic buffer event ID catalogue.