1. Problem Overview
On a working S7-400 station communicating with a Wonderware HMI/SCADA layer through OPC Scout over SIMATIC NET, the desktop PC suddenly reports "Defect(ICE) CP5613_5614 defect". The diagnostic panel of the PG/PC interface also returns Error 0x0119: The receive buffer is too small, and a secondary state trace shows CP_STATE_EXCP_CLOSE_0 with DW_Para1:0x0 and DW_Para2:0x101. Once this combination is logged, the CP drops out of the bus and the OPC namespace on the PC goes offline.
The pattern reported in the field is especially concerning because the CP appears to self-destruct: the first CP5614 fails after roughly three years, the replacement CP5613 fails again within four days, and swapping the suspect card into a different PC reproduces the same diagnostic string. That reproduction rules out a host-side failure mode and points to either the CP hardware itself, the PROFIBUS segment, or a low-level driver/firmware interaction with SIMATIC NET V6.0 SP5 on Windows 2000 SP3.
2. Affected Hardware and Software Stack
The fault surfaces only on the Siemens PROFIBUS PC cards listed below. Both share the same ASIC family (ASPC2 / DPC31 controller) and the same Windows driver, so the error strings and behavior are interchangeable.
| Component | Order Number (MLFB) | Form Factor | Channels | Supported Protocols |
|---|---|---|---|---|
| CP 5613 | 6GK1561-3AA00 | PCI 32-bit | 1 | PROFIBUS DP, MPI, S7, FDL, OPC |
| CP 5613 A2 | 6GK1561-3AA01 | PCI 32-bit | 1 | PROFIBUS DP, MPI, S7, FDL, OPC |
| CP 5614 | 6GK1561-4AA00 | PCI 32-bit | 2 | PROFIBUS DP, MPI, S7, FDL, OPC (dual-channel) |
| CP 5614 A2 | 6GK1561-4AA01 | PCI 32-bit | 2 | PROFIBUS DP, MPI, S7, FDL, OPC (dual-channel) |
The relevant software environment at the time of the original report:
- Windows 2000 Professional, Service Pack 3 (NT 5.0 kernel)
- SIMATIC NET PC Software V6.0 + Hotfix SP5 (build 6.0.5.x)
- SIMATIC NET OPC Scout V6.0 (component of SIMATIC NET V6.0)
- STEP 7 V5.x (used for PG/PC interface and PROFIBUS diagnostics)
- Wonderware InTouch / System Platform (DAServer connecting to the SIMATIC NET OPC server)
3. Decoding the Error Messages
Three distinct error indicators are involved. Each one is a real diagnostic message generated by the CP firmware or the Windows driver, and each must be resolved before re-commissioning the card.
3.1 "Defect(ICE) CP5613_5614 defect"
The ICE suffix in this string is short for Internal Communication Error. The driver raises it when the firmware on the CP reports a fatal internal state in which the host-side mailbox, the ASPC2/DPC31 host interface, or the dual-port RAM handshake can no longer be synchronized. The two most common upstream conditions are:
- The CP firmware watchdog reset the card because it lost PCI bus mastering or because the dual-port RAM signature word was corrupted.
- The Windows driver has overwritten the CP's internal state machine with a malformed request, which causes the firmware to drop into the EXCP_CLOSE_0 state.
3.2 CP_STATE_EXCP_CLOSE_0 with DW parameters
This is the state-machine trace produced by the CP firmware's exception handler:
| Field | Value | Meaning |
|---|---|---|
| State name | CP_STATE_EXCP_CLOSE_0 | The CP entered the "exception close" branch of the internal state machine and tore down all active connections. |
| DW_Para1 | 0x00000000 | No secondary cause code was stored; this is the default value when the exception occurs during the close sequence itself. |
| DW_Para2 | 0x00000101 (= 257 dec) | Internal sub-state identifier. 0x101 typically denotes that the close was triggered by a host-buffer underrun on the receive path (see 3.3). |
3.3 Error 0x0119: The receive buffer is too small
The PG/PC interface diagnostic returns this as a hex constant. Decoded:
- 0x0119 = 281 decimal
- Source: SIMATIC NET driver, function DPC31_ReadIndication()
- Trigger: an incoming PROFIBUS DP telegram exceeded the currently configured receive buffer of the PC-side application (typically the OPC server buffer).
When this error is raised repeatedly in a tight loop, the CP's firmware escalates the condition to the ICE path and forces the card into EXCP_CLOSE, which is then surfaced to the user as Defect(ICE). In other words, 0x0119 is the root cause, and Defect(ICE) is the symptom of a chronic condition that the card has decided it can no longer recover from.
4. Root Cause Analysis
Three candidate root causes have to be considered, in this order:
- Receive buffer configuration too small for the data volume. The most common reason a working CP suddenly starts returning 0x0119 after months of stable operation is that the OPC namespace grew (new tags added in STEP 7, new S7 connection re-imported into OPC Scout) without a corresponding increase in the application buffer. The default buffer that OPC Scout V6.0 allocates for an S7 connection is intentionally conservative; once the polling rate plus the variable count exceed that envelope, the driver returns 0x0119 for every over-budget frame.
- PROFIBUS segment quality. Reflection, missing or duplicated termination, or a marginal slave will force the master to retry. The retry storm is logged by the host driver as a sequence of small receive events, each one carrying a partial frame that the application buffer cannot reassemble. The resulting exception loop matches the EXCP_CLOSE_0 / 0x101 trace exactly. The fact that the ET stations remain "working fine" in the user's report is not a clean signal, because DP slaves with a healthy firmware watchdog can stay in cyclic data exchange even when individual frames are being discarded at the master.
- PC hardware / PCI slot / driver issue. This is the least likely cause once the swap-into-a-different-PC test reproduces the same error. It should, however, be re-tested with a known-good PCI slot, a fresh driver install, and the CP firmware load that matches the SIMATIC NET version.
5. Diagnostic Workflow
Follow this sequence before swapping hardware again. Each step either rules in or rules out one of the three root causes above.
- Capture the exact text of the error from the Windows event log. The Application log on Windows 2000 records the Defect(ICE) string with source SIMATIC NET CP. Note the timestamp and the event ID.
- Open STEP 7 → Set PG/PC Interface → Diagnostics → Test. Read the live bus statistics: token rotation time, repeat count, lost frames, and the per-slave diagnostic buffer.
- Open SIMATIC NET Commissioning → PROFIBUS → Bus Statistics. Enable the trace buffer. Let it run for at least 60 seconds of normal traffic, then export the trace. Look for repeating Frame_Abort or Slot_Error entries.
- Open OPC Scout V6.0 and inspect the connection properties. Note the configured receive buffer (in bytes) and the polling group size. The default is 4 KB per group in V6.0; OPC Scout will silently truncate any group that exceeds this value.
- Measure the PROFIBUS segment electrically. Use a PROFIBUS tester (e.g., Softing PROFIusb or a BC-700-PB) at the CP end and at the far end of the segment. Verify the A/B differential voltage at idle is ≥ 1.1 V and during transmission falls to ≤ 0.9 V.
- Inspect the terminations. PROFIBUS DP requires exactly two terminators, one at each physical end of the segment, both energized. The CP end of the bus is rarely a physical end (unless it is at the segment extremity); verify with the cable drawing.
6. Resolving the Receive Buffer Fault
The 0x0119 error is the lever for the entire incident. Fixing it almost always removes the cascade that produces the Defect(ICE) string.
- Close OPC Scout.
- Open SIMATIC NET → Commissioning → OPC Scout → S7 Connection.
- For the S7 connection used by the S7-400 CPU, raise the receive buffer from the default to at least 16 KB. The maximum supported by CP5613/5614 firmware at V6.0 is 32 KB; do not exceed that value.
- Save and restart the SIMATIC NET service (SNMP Service, S7 DOS, and the OPC server service in that order).
- Re-open OPC Scout and re-import the tag namespace from STEP 7. The re-import forces OPC Scout to rebuild its internal group buffers at the new size.
- Monitor the event log for 24 hours. The 0x0119 entry should disappear; if it does, the Defect(ICE) condition will not recur.
HKEY_LOCAL_MACHINE\SOFTWARE\Siemens\SINEC\S7\Connections\[connection_name]\RecvBufferSize. Set the value to 0x00004000 (16 KB) as a DWORD, restart the SIMATIC NET service, and re-test.7. Validating the PROFIBUS Segment
The Defect(ICE) string is also a strong indicator of marginal PROFIBUS signal integrity. Validate the segment before any further hardware is installed.
| Check | Expected value | Failure mode if out of spec |
|---|---|---|
| Segment baud rate | 1.5 Mbps max for CP 5613/5614 with classic DP | Higher rates require repeaters and shorter cable runs |
| Max stub length to each ET | ≤ 0.3 m at 1.5 Mbps, ≤ 1.0 m at 500 kbps | Long stubs cause reflections and the master reports the slave as missing |
| Total segment length | ≤ 200 m at 1.5 Mbps, ≤ 400 m at 500 kbps, ≤ 1000 m at 187.5 kbps | Excessive length attenuates the signal below the CP's receiver threshold |
| Terminator count | Exactly 2, both energized | One terminator → reflections; three terminators → excessive loading |
| Shield continuity | 360° bonded at every cabinet entry | EMC ingress raises the error floor, which the CP reports as a chronic fault |
| Number of repeaters in cascade | ≤ 3 in series between any two masters | Each repeater adds 0.5 bit-time of jitter to the token rotation |
If any value is out of spec, correct it before re-inserting a CP. A CP installed on a bad segment will not fail immediately; it will fail within days or weeks, which matches the failure timeline reported in the original incident.
8. Verifying PC and Driver Integrity
Even though the swap test reproduced the error on a different PC, the PC side still has to be validated. A CP that survives on a clean PC but fails on a marginal one is itself diagnostic.
- Open Device Manager → Siemens PROFIBUS → CP 5613/5614 → Properties → Resources. Verify that the CP is in a PCI slot that is not shared with a high-throughput device (e.g., a SCSI controller, a gigabit NIC, or a RAID card) and that the IRQ is not shared with a USB controller.
- Open the CP firmware load dialog (Commissioning → CP Firmware Load) and verify that the firmware version matches the SIMATIC NET V6.0 SP5 release notes. Mismatched firmware on the CP is a known cause of the EXCP_CLOSE_0 state with 0x101.
- Reinstall the SIMATIC NET driver cleanly. On Windows 2000 SP3, the only supported method is the SIMATIC NET Setup with the
/cleanswitch, followed by a full reboot and a re-install of the same V6.0 SP5 build. - Disable screen savers, power management on the PCI bus, and any background backup agent that might wake the disk. Windows 2000 SP3 occasionally stalls the SIMATIC NET OPC server when the disk I/O subsystem is blocked, which the driver reports as a chronic 0x0119.
9. Simatic Net Configuration Hardening
Once the buffer and segment are clean, the configuration itself should be tightened. These settings are the ones that most directly correlate with the Defect(ICE) / 0x0119 cascade.
| Setting | Location | Recommended value | Reason |
|---|---|---|---|
| PG/PC Interface access point | Set PG/PC Interface | S7ONLINE (STEP 7) -> CP5613_5614.PROFIBUS.1 |
Routes all S7 traffic to the CP rather than to a soft MPI over TCP |
| Bus profile | STEP 7 → PC Station → Bus Profile |
Standard for the original 1.5 Mbps segment |
Matches the original reported value and avoids the DP-V1 timing assumptions of the "DP-V1" profile |
| Highest PROFIBUS address | PG/PC Interface | 126 | Limits the token search window; the default 32 is too small for a multi-ET segment |
| OPC poll cycle | OPC Scout → group properties | ≥ 500 ms for status, ≥ 1000 ms for slow process values | Reduces receive-buffer pressure on the CP |
| Number of S7 connections | Commissioning → S7 Connections | 1 per active OPC namespace | Multiple S7 connections to the same CPU multiply the receive load |
| Watchdog time | CP properties → Diagnostics | 3 s | Prevents the CP from entering EXCP_CLOSE on transient stalls |
10. OPC Scout Communication Path
The S7-400 CPU is the DP master for the segment, and the CP5613/5614 is the master's secondary path into the SCADA layer. The path is:
S7-400 CPU (PROFIBUS DP master)
│
▼
ET200S / ET200M slaves (PROFIBUS DP)
│
▼
CP 5613 / CP 5614 in the PC (PROFIBUS DP master class 2)
│
▼
SIMATIC NET OPC Server (S7 protocol)
│
▼
OPC Scout (browser + tag database)
│
▼
Wonderware DAServer (OPC client)
│
▼
InTouch / System Platform viewThe Defect(ICE) string terminates the second-to-last link (the SIMATIC NET OPC Server), which is why the SCADA layer goes offline even though the S7-400 and the ET stations keep running. A correctly sized receive buffer at the OPC Server is therefore the most leveraged single change in the entire chain.
11. Prevention and Replacement Strategy
When a CP is replaced under these conditions, follow the checklist below before powering the PC back on.
- Install the new CP in the same PCI slot the old one occupied. Different slots can map to different IRQs on Windows 2000 SP3, and an uninitialized IRQ will re-trigger the 0x0119 fault within minutes.
- Run Set PG/PC Interface → Diagnostics → Test and confirm that the bus statistics show zero repeat frames for at least 60 seconds.
- Open OPC Scout and load the smallest possible test group (one tag) before reloading the production namespace. Verify that no 0x0119 event is logged for 10 minutes.
- Reload the full namespace. Monitor the event log for 24 hours. The Defect(ICE) string must not reappear.
- Document the bus profile, the OPC buffer size, the slot/IRQ, and the SIMATIC NET build. This is the information that the next maintenance event will need.
12. Verification and Re-Commissioning Checklist
The checklist below is the minimum set of checks that has to pass before a CP can be signed off as healthy on this error pattern.
- [ ] Event log free of Defect(ICE) CP5613_5614 for 24 hours of normal traffic.
- [ ] PG/PC Interface diagnostics show zero 0x0119 receive buffer entries.
- [ ] SIMATIC NET bus statistics show bus repeat count = 0 for 60 seconds at full load.
- [ ] OPC Scout namespace fully loaded and refreshing at the configured poll rate.
- [ ] Wonderware DAServer shows OPC quality = Good for every tag for at least 30 minutes.
- [ ] CP firmware version matches the SIMATIC NET V6.0 SP5 release manifest.
- [ ] PCI slot and IRQ documented in the PC station file.
- [ ] A PROFIBUS terminator audit has been completed at both physical ends of the segment.
What does the "Defect(ICE) CP5613_5614" error actually mean?
It is a Siemens driver-level error string. ICE stands for Internal Communication Error: the CP firmware has detected a fatal condition on the host interface (PCI bus, dual-port RAM, or mailbox) and has dropped into the EXCP_CLOSE_0 state, tearing down all active connections.
Is error 0x0119 the same as Defect(ICE)?
No. 0x0119 (the receive buffer is too small) is the underlying cause; Defect(ICE) is the firmware's escalation of that condition. If 0x0119 is resolved at the OPC server buffer, the Defect(ICE) string will not reappear.
Why did a new CP5613 fail within four days of being installed?
Because the underlying condition (receive buffer size, PROFIBUS segment, or driver/firmware mismatch) was not changed when the card was replaced. Every new card inserted into the same environment will reproduce the same fault on the same timescale.
Does a CP5613 work on Windows XP or later?
CP 5613 and CP 5614 are PCI 32-bit cards supported through SIMATIC NET V7.1. On Windows XP SP3 and Windows Server 2003, the driver is reliable if the buffer configuration is matched to the OPC namespace size. From Windows 7 onward, only SIMATIC NET V8.1+ on a PCIe card (CP 5622) is supported.
Can Wonderware InTouch read directly from a CP 5613/5614 without OPC Scout?
Not in the SIMATIC NET V6.0 era. InTouch uses the Wonderware DAServer for SIMATIC NET, which in turn subscribes to the SIMATIC NET OPC Server. OPC Scout is the configuration and diagnostic front-end for that OPC server; removing it from the path would break namespace configuration but not the runtime data path.