Siemens S7-300 CPU 315-2DP MMC Failure: Restoring Ethernet Access

Siemens S7-300 CPU 315-2DP: Defective MMC Locks Out Industrial Ethernet on CP 343-1

This reference documents a field-confirmed fault pattern on a Siemens CPU 315-2DP (order number 6ES7315-2AG10-0AB0) equipped with a CP 343-1 (6GK7343-1EX11-0XE0) and a 512 KB Flash MMC (6ES7953-8LJ11-0AA0). Symptom: the CPU sits in STOP with SF lit whenever the MMC is inserted, and the CP 343-1 stops answering the PG on Industrial Ethernet. Pulling the MMC restores the PG link but blows the on-chip work-memory ceiling. The root cause is a deteriorated MMC, and the resolution path (CP bypass > load via MPI/PROFIBUS > replace MMC > rebuild project on a verified card) is reproducible without changing program code. The procedure, supported by Siemens KB ID 21830698 and the broader MMC FAQ set, is laid out in full below.

1. Affected Hardware and Firmware Context

2. Observed Symptom Matrix

3. S7-300 Memory Model Recap (Why "MMC out" Restores the CPU)

An S7-300 CPU draws program blocks from load memory (Flash) and copies the active code into work memory (integrated RAM). Without a memory card, the only load memory is the integrated non-remain-load area (typically <= CPU work memory). The CPU 315-2DP ships with 128 KB work memory and 256 KB integrated load memory that is wiped at every power-on, so any project larger than ~128 KB blocks will not load without an MMC. The Flash MMC is therefore mandatory for non-trivial projects. If the MMC cannot be read, the CPU cannot populate work memory and stops in OB100 with SF lit; the CP 343-1 sits in OPERATE but the CPU is not in RUN, so the CP rejects online requests from the PG.

• Load memory: MMC (Flash FEPROM), persistent across power-cycle, removable. See S7-300 CPU Memory Cards Operating Instructions.
• Work memory: integrated RAM, volatile, ~128 KB on CPU 315-2DP. Holds data blocks (DBs), instance DBs, executable code from load memory.
• System memory: counters, timers, bit memory, process-image. Cleared on power-off unless configured to be retentive.

4. Root-Cause Path: Defective MMC vs. Other Suspects

The diagnostic decision tree documented below is intentionally narrow; it accepts the field-confirmed conclusion that the MMC is the failing component, while showing the systematic branch points that were walked before that conclusion was reached. Two equally bad MMCs (same batch, both >8 years in service) collapsed at exactly the same time, ruling out CPU flash-controller faults. The earlier "Industrial Ethernet dropouts" before the power-cycle are reproduced in many field reports and typically point to either an aging MMC or to a CP firmware lock-up. Per the Opto 22 Industrial Ethernet troubleshooting guidance and the Automation.com article on Industrial Ethernet troubleshooting, intermittent PG drops with no physical-layer alarm are nearly always either side (PC firewall, MMC, or CP) - not a bad switch or cable.

Decision-flow outline: if PG access resumes with the MMC removed, the MMC is the most likely culprit; if it does not resume, the CP or physical layer is suspect.

4.1 Other suspects ruled out before replacing the MMC

1. CP 343-1 factory-reset and re-IP: did not change behaviour.
2. On-CPU MMC format (MRES procedure per ID 21830698): format routine appeared not to start, no SD log error surfaced - a known indicator of unreadable NAND.
3. STEP 7 diagnostics-buffer readout (with MMC pulled): entries "Firmware update incomplete / MMC read error" or simply no entries from past online attempts mean the CPU itself cannot flag the MMC - the OS gives up before erroring.
4. Second MMC of identical order number: same symptom, two independent cards with same MLFB reading no project.
5. CP bypass load via MPI or PROFIBUS (see Section 7): CPU accepted download and reported work-memory error - confirming CPU and CP are healthy.

5. Pre-Replacement Diagnostics (Do This Before Touching the MMC)

1. Power-cycle with the MMC inserted. Watch for SF/STOP, and immediately count whether the diagnostic procedure (CPU stop » MRES-rotate "to MRES" then back) runs. If the FC LED group does not pulse the format routine at all, the CPU flash controller cannot communicate with the MMC.
2. Read the diagnostics buffer: STEP 7 → PLC → Module Information → Diagnostics Buffer. Search for entries tagged MMC, FWU, or error code W#16#A3xx. Examples:
   • SP error: MMC not readable (W#16#73C0 / W#16#73C2)
   • Loader stop, error in passive file system (W#16#4503 / 4520)
   • Firmware update error, no FW image on MMC
   No entry does NOT mean the MMC is good - many defective cards simply do not boot the diagnostic call.
3. Check PLC → Assign Ethernet Address against the configured CP IP/subnet. Document mismatch (default CP IP after factory reset is 0.0.0.0 until assigned).
4. Replace the PG/PC firewall rule for TCP ports 102 (S7), 50000...50100 (S7ONLINE). Disable Windows Firewall temporarily to rule out a transient drop that masquerades as a MMC issue, as per the broad first-step guidance in the Opto 22 network troubleshooting article.
5. Re-seat the MMC while the CPU is powered down (mating-oxide on the contacts can produce the same symptoms after years in the field).

6. Compatibilty and Sizing: Picking the Replacement MMC

Compatibility is governed by CPU firmware: the CPU 315-2DP at FW V2.x supports all -8LJ...-8LR revisions. Ordering tip: keep one brand-new sealed 2 MB card as a swap spare - DO NOT swap with an MMC that has spent years inside another running CPU. Old cards carry the same ageing risk.

7. Bypassing the CP 343-1 via MPI / PROFIBUS to Reach the CPU

When the CP 343-1 stops bridging to the PG, you can still reach the CPU using the integrated PROFIBUS-DP port (X2 on the CPU). This is the most reliable recovery move.

7.1 Hardware required

• PC adapter: PC Adapter USB A2 (6ES7972-0CB20-0XA0) for RS232-to-MPI/DP, OR a CP 5611 / CP 5621 / CP 5622 PC card.
• PROFIBUS DP cable (violet) plus PROFIBUS connector with selectable terminating resistor (e.g. 6ES7972-0BB12-0XA0).

7.2 STEP 7 settings

1. PG/PC interface → select S7ONLINE → PC Adapter USB A2 (MPI/DP) (or the appropriate CP 5611 driver).
2. On the MPI/DP cable, set the master address to the PG default (0 if not assigned).
3. Set the CPU MPI/DP "DP address" (in HW Config) - default is 2, baud rate is 187.5 kbit/s by default on MPI, 1.5 Mbit/s on DP.
4. Set the PG interface parameters to match. Click Accessible Nodes. The CPU should appear even with no MMC online.
5. Open the project → PLC → Download with target CPU set to CPU 315-2DP directly (not via the CP). This populates on-chip load memory to confirm CPU health.

7.3 Why this matters

If the download via MPI/DP succeeds on the bare work memory (~128 KB total or less), the CPU is verified. The remainder of the commissioning can proceed by reinserting a known-good MMC and downloading the full project onto the MMC, which the CPU then uses as a load-memory source.

8. MMC Replacement Procedure

1. Power down the CPU 315-2DP. (Hot swap of MMC is supported by STEP 7 firmware on many CPUs, but for the -2AG10 the safe path is a cold power-down to avoid corrupting the new card on initial write.)
2. Slide the old MMC (6ES7953-8LJ11-0AA0) out of the slot on the front of the CPU. Bezel notch is to the right; pull along the slot's axis, no rotation.
3. Insert the replacement MMC (e.g. 6ES7953-8LJ11-0AA0 new in the box, or upgrade to 6ES7953-8LL11-0AA0 2 MB).
4. Power up. CPU should come up to CPU: MRES-less boot if MMC is empty; it will report "MMC empty - new load memory" in the diagnostics buffer (W#16#4545 family).
   STEP 7 → PLC → Module Information → Diagnostics Buffer -> this entry confirms the MMC slot is good.
5. Re-establish Ethernet via the CP 343-1: Accessible Nodes on TCP/IP → ...; the CP should now respond because the CPU is no longer stuck in OB100 read failure.
6. Download the project onto the new MMC: PLC → Download (or Download to Target Device in STEP 7 V5.x). Confirm RAM to FEPROM progress completes.

9. Verification & Commissioning Checklist

10. Preventive Practices for MMC Lifespan

• Avoid hot-cycling the CPU while a firmware update is mid-write. Mid-write power loss is the leading source of "MMC bit-flipped" failures.
• Store spare MMCs sealed and ESD-bagged. A spare kept inside an active cabinet runs the same thermal ageing as the working card.
• Rotate MMCs every 5-7 years in continuously operating plants - Siemens Flash FEPROMs inside -8L... cards are typically rated for ~10 years of on-card retention but wear on read cycles accelerates.
• Document the MMC order number as part of the asset record so that a future CP-locked outage can be correlated to card age.
• After every commissioning, perform one full upload from the running CPU: PLC → Upload to PG -> archive. This gives you the ground truth in case the next MMC is suspect.
• For new installations, prefer the 2 MB card (6ES7953-8LL11-0AA0) to keep headroom for future CLC or HMI download stations.

11. Field-Reporting Summary (For Copy-Paste to Your Service Request)

• Hardware: CPU 315-2DP (6ES7315-2AG10-0AB0), CP 343-1 (6GK7343-1EX11-0XE0), MMC 512 KB (6ES7953-8LJ11-0AA0), STEP 7 V5.3 SP3.
• Symptoms: SF + STOP with MMC inserted; CP refuses PG on Ethernet; removing MMC restores PG link; CPU rejects download due to "project > work memory".
• Diagnostics attempted: CP factory-reset, MMC format via MRES, second card swap, MPI/DP direct download, on-board diagnostics buffer read.
• Root cause: defective MMC (Flash card unable to load project at OB100).
• Resolution: replace MMC; cold-boot; download project via CP 343-1 over Industrial Ethernet; three consecutive power-cycle verifications.

12. Frequently Asked Questions