Siemens S7-300 SF and BF Fault: STEP 7 Diagnostic Buffer Guide

The red SF (System Fault) and BF (Bus Fault) LEDs on a Siemens SIMATIC S7-300 CPU are the first and most important indicators of a controller-level problem. SF is lit whenever the operating system detects an internal error, a module diagnostic event, or an I/O access violation that the user program has not masked. BF is lit whenever the CPU's PROFIBUS DP master/sub-network cannot exchange telegrams with one or more distributed stations, when the bus cable is shorted or broken, when a connector drops out, or when a configured slave fails to respond. Both LEDs can be lit simultaneously, which usually points to a combined hardware + network event (for example, a failed ET 200M station carrying the very I/O the CPU was trying to read). This guide is written as a field reference for commissioning engineers and maintenance technicians: it consolidates LED truth tables, the STEP 7 diagnostic buffer workflow, the diagnostic OB family, the most common event IDs, and a deterministic isolation procedure that works on a stopped CPU with the programming cable still attached.

1. S7-300 Front-Panel LED Truth Table

The status LEDs are arranged in two groups on the CPU door. The CPU-specific group (SF, BF, BF1/BF2/BF3 where present, FRCE, RUN, STOP, Maint, DC5V) reports the controller state; the same physical SF/BF LEDs are also re-used on interface modules (IM) and PROFIBUS DP master modules (CP 342-5, IM 308-C) but with slave-side semantics. Use the table below to interpret what the CPU is telling you before opening STEP 7.

2. SF (System Fault): Underlying Conditions

The SF LED is a logical OR of every fault the CPU operating system considers a "group error". When you see SF you can be sure that at least one event has been written to the diagnostic buffer with an event class of "CPU / system error" or "diagnostic interrupt". The most common underlying conditions are:

• Missing diagnostic OB: A module raised a diagnostic interrupt but OB 82 is not loaded. The CPU cannot pass the interrupt to the user program, so it raises SF instead.
• I/O access error (OB 122): The user program read or wrote a process image word of a faulty or failed slave. Example: reading IW 512 of an ET 200S station that has just dropped off PROFIBUS.
• Priority class error (OB 85): An OB was called that the system could not find, or an OB update was lost because a higher-priority OB was already running.
• Rack / station failure (OB 86): A DP slave or a station on the central rack became unavailable. The OS writes "Station failure" / "Station return" events into the buffer.
• Module diagnostic interrupt (OB 82): A digital input card, analog input card, or function module has signalled an internal diagnostic event (wire break on AI, short circuit on DO, channel error, encoder error, etc.).
• Programming error (OB 121): An illegal operation in the user program (DB not loaded, indirect addressing error, range violation, BCD conversion error, division by zero, etc.).
• Communication error (OB 87): A global data communication error or an S7 communication failure.
• Insert/remove interrupt (OB 83 / OB 84): Hot-swap event for modules in ET 200S / ET 200pro or a CPU / IM hot-swap.

3. BF (Bus Fault): PROFIBUS and PN Conditions

BF is driven entirely by the DP master state machine inside the CPU or CP. It becomes active when the master has detected that:

1. One or more configured DP slaves are not responding to the master's poll within the configured watchdog time (T_WD). Default T_WD = 650 ms × slot-time index, but the typical engineering value is 1000 ms.
2. The bus cable is shorted or open (A and B wires bridged or one wire broken). Symptoms: the entire DP segment loses communication; repeater LEDs show segment error.
3. At least one DP connector has lost its terminating resistor (or two terminators are switched ON, producing a reflection). Use the off-ON switch on the Siemens PROFIBUS connector (e.g., 6ES7972-0BA12-0XA0) to leave termination ON only at the two physical ends of the segment.
4. The bus baud rate on a node does not match the master. Default for S7-300 DP master: 1.5 Mbit/s auto-detect; verify with a PROFIBUS tester (e.g., Softing PROFIusb or Siemens BT 200).
5. The slave's PROFIBUS address has been changed in hardware but not in HW Config (or vice versa). The master polls the configured address and receives no reply.
6. The slave has lost its 24 V supply or its DP interface is damaged.
7. Fibre-optic converters (OLM, OBT) have dirty connectors, broken fibres, or have lost their 24 V supply. The field report referenced at the start of this article describes exactly this scenario: the SF and BF cleared after the operator replaced damaged optical fibres between an OLM and an ET 200 station.

For a CPU 31x-2 PN/DP, BF refers to the integrated DP interface. PN (PROFINET) communication problems are reported as "Link down" / "Port error" inside HW Config under the PN interface, not as BF. The PN cable, switch port, or PROFINET device must be inspected independently.

4. Diagnostic Buffer Workflow in STEP 7

The diagnostic buffer is a ring buffer in the MMC/Flash card (or in RAM for older CPU 31x without MMC). It holds the last 100–500 events with a timestamp of resolution 1 ms. Every STOP transition, every OB call, every diagnostic interrupt, and every station failure is recorded. This is the single most useful tool you have when SF or BF is lit.

4.1 Open the buffer

1. Connect the PC to the CPU's MPI/DP port using a PC adapter (USB / serial) or directly to the PN port of a CPU 31x-2 PN/DP.
2. In SIMATIC Manager select PLC > Diagnostics/Setting > Module Information (or press Ctrl+D on the selected CPU in the project).
3. Click the Diagnostic Buffer tab. The newest event is on top.

4.2 Interpret the buffer entries

Each row contains the time, the event ID, and a short description. Double-click any row to see the detailed event, which often includes the slot number, the PROFIBUS address, the affected OB number, and the module order number (MLFB / order number). Common event IDs you will see during SF/BF conditions are listed in Section 8.

4.3 Save the buffer

1. Click Save As in the diagnostic buffer window.
2. Export as a plain text file (UTF-8) so the entries can be searched with grep, Notepad++, or any text editor. Each entry exports as one block separated by a row of dashes.
3. Keep this text file in the machine's documentation folder. It is the authoritative snapshot of the fault and is accepted as evidence during warranty and service ticket handling.

5. Diagnostic Organization Blocks (OBs) You Should Always Load

An OB is a routine the CPU calls when a specific condition occurs. If the OB is not in the user program, the CPU defaults to STOP on a serious error or to "ignore" on a recoverable event, but in both cases the SF LED is lit. Loading the following OBs as empty stubs is the standard field practice to convert a hard fault into a logged fault:

5.1 Minimal "logging only" stubs

The fastest way to keep the CPU in RUN while you diagnose is to load the OBs as empty blocks. In STL the stub is simply BE (block end). In FBD it is an empty segment. In SCL the stub is BEGIN END_FUNCTION_BLOCK; with no statements. Once loaded, the diagnostic event is still written to the diagnostic buffer (you can see it), but the CPU stays in RUN.

6. PROFIBUS DP Network Diagnostics

6.1 Topology and termination

A PROFIBUS segment is a single linear RS-485 bus. Termination is required at exactly two points — the physical ends. The Siemens PROFIBUS connector has a switch labelled "ON / OFF" next to the outgoing cable port. Termination is active when the switch is ON and the outgoing port is not used. A common field error is leaving the switch ON at a middle node; the result is a reflection that breaks all DP communication and lights BF on the master.

6.2 Cable specification

• Cable type: PROFIBUS cable (Siemens 6XV1830-0EH10, purple sheath) — characteristic impedance 150 Ω, 24 AWG, 11.5 mm outer diameter.
• Max segment length at 1.5 Mbit/s: 200 m. At 500 kbit/s: 400 m. At 187.5 kbit/s: 1000 m. Refer to the PROFIBUS DP planning guide for full tables.
• Shield must be bonded to the grounding bar at every cabinet entry, not just at the connector.

6.3 Repeater and diagnostic repeater

A standard repeater (e.g., 6ES7972-0AA01-0XA0) regenerates the signal and electrically isolates segments. The diagnostic repeater (6ES7972-0AB01-0XA0) adds per-segment diagnostics: it detects the distance to a cable break, the distance to a short, and the number of reflections on each segment. This is the most cost-effective way to find a broken cable in a long PROFIBUS run without pulling cable.

7. Distributed I/O (ET 200) Fault Isolation

For a PROFIBUS DP master CPU 31x-2 DP, every station in HW Config is a potential BF source. The diagnostic buffer entry for a station failure includes the DP address of the slave. Walk through the following procedure per failed address:

1. Go to the cabinet of the affected station. Check the 24 V supply at the power module (PM) and the DP connector LEDs.
2. Look at the SF LED on the IM (interface module) of the ET 200. If SF is lit, the IM has a diagnostic event. Read it with STEP 7 via PROFIBUS-DP: PLC > Module Information on the IM, not the CPU.
3. Look at the BF LED on the IM. If BF is lit but the master sees the station, the IM has lost the downstream module or its DP cable is broken at the input side.
4. For ET 200M: the active backplane bus means a single failed module is enough to stop the whole station. Disconnect modules one at a time to find the offender. Power-cycle the IM after each change so the new configuration is re-evaluated.
5. For ET 200S: each module has its own channel-level diagnostics. The I/O module LEDs (channel error red) point at the failed channel. Replacing only that module is usually enough.
6. For ET 200pro: confirm the terminating module (e.g., 6ES7194-4JA00-0AA0) is fitted. Without it, the backplane bus terminator is missing and the IM signals an internal error.

8. Common Event IDs You Will See in the Buffer

For the full list, see the "S7-300 CPU 31x/31xC, Operating Instructions" and the online event ID reference in the Siemens Industry Online Support portal at support.industry.siemens.com.

9. Step-by-Step Troubleshooting Procedure

9.1 Before opening STEP 7

1. Note the CPU's STOP / RUN / Maint LED state. If the CPU is in STOP, read which state forced it there: turn the mode selector to STOP, then back to RUN-P, and re-read the diagnostic buffer. The "STOP cause" is always the top entry.
2. Walk to the cabinet. Count how many slaves are present and how many have their BF LED lit. One or two are normal failure sources; an entire segment losing communication at once points to the cable, terminators, or repeater power.
3. Touch the connectors. Loose connectors are the single largest source of BF events in service. Each connector should click audibly and have a pull-out resistance of >30 N.

9.2 In STEP 7

1. Go online with the CPU. Use Accessible Nodes in SIMATIC Manager if the project is missing or misaligned.
2. Open the diagnostic buffer. Read the top five events.
3. Identify the OB that is referenced. If the OB is not in the program, add the stub and download the hardware configuration.
4. Identify the slot or DP address. Drill into the affected module's Module Information to read its own diagnostic buffer.
5. Take corrective physical action: replace the cable, replace the module, replace the fuse, refit the terminator, replace the fibre, etc.
6. Cycle power on the slave (not on the CPU) so the master sees a fresh station-return event.
7. Verify that BF is off, SF is off, the CPU is in RUN, and a new "Station return" entry has been written to the diagnostic buffer.

9.3 If SF and BF stay on after power-cycle

1. Pull the DP connector of the master CPU and check whether SF stays lit. If SF goes off, the problem is on the network. If SF stays on, the problem is in the local rack (CPU, IM, central I/O).
2. For the local rack, disconnect central I/O one row at a time. A failed central I/O module that the user program tries to read will raise OB 85/OB 122 and keep SF on.
3. For the network, isolate the segment by switching off repeater power. If BF clears, the problem is downstream. If BF stays on, the problem is on the master side of the repeater.

10. Verification and Return to Service

After corrective action, the system is ready to be returned to the line only when all of the following checks pass:

• CPU is in RUN (green RUN LED solid, yellow STOP LED off).
• SF and BF LEDs on the CPU are off.
• All ET 200 / DP slave modules show green "ready" LEDs with no red channel or station errors.
• Diagnostic buffer contains a "Station return" event for the previously failed slave and no new error events for ≥5 minutes of normal operation.
• Force table is empty and FRCE LED is off.
• If the cause was a missing OB, the OB stub has been replaced by a production-grade error handler that writes the error code to a status DB before the system is returned to automatic.

11. Preventive Measures

• Load all standard OBs as stubs at commissioning. This converts hard stops into logged events and reduces mean time to repair dramatically.
• Apply connector strain relief. DP cables that hang on the connector place torsion on the PCB and eventually break the bus.
• Inspect terminator switches at every scheduled maintenance round. Use a torque-limited screwdriver to fix the rotary switches so they cannot move during shipment.
• Use a diagnostic repeater on long segments to record cable-health events without additional tooling.
• Log diagnostic buffer exports to a network share once per shift on critical lines. A rising rate of "Station failure" events is an early warning of cable degradation or connector wear.
• Keep a known-good MMC with the project image on the cabinet. If the MMC ever fails, a swap-and-go is faster than an online download.