Troubleshooting PLC and Bus Faults on S7-300/S7-200 PROFIBUS

Problem Description

On machines built around a SIMATIC S7-300 CPU and one or more S7-200 stations, operators and maintenance technicians frequently encounter recurring PLC fault and bus fault conditions. Typical symptoms include:

• The S7-300 CPU drops to STOP with the SF (red, group fault) LED on and the BUSF (red, bus fault) LED on or flashing.
• The S7-200 CPU displays SF (System Fault) or RUN with a flashing STOP LED following a fatal error.
• PROFIBUS DP slaves (ET200S, ET200M, EM277 on S7-200) report station failure on the master diagnostic buffer.
• Inter-PLC fiber optic link between the S7-300 and a peer CPU loses frames, causing timed retries and OB85 / OB86 entries.
• Intermittent faults that clear after power cycling but return within hours or days.

The root cause is rarely the CPU firmware itself. In field practice, more than 80% of PLC/bus fault events on S7-300/S7-200 installations traced to the physical layer (connector, cable, termination, shielding, address switch) or to a misconfigured DP parameter set.

Affected Hardware and Firmware

Root Cause Categories

Bus faults in mixed S7-300/S7-200 systems map to one of five layers. Isolate systematically from the bottom up.

Reading the S7-300 Diagnostic Buffer

The diagnostic buffer is the first place to look. It records every event the CPU registers during operation, with timestamp, event ID, OB context, and any associated I/O address.

Two ways to open the diagnostic buffer in STEP 7 V5.5 / STEP 7 Professional (TIA Portal):

1. Simatic Manager: with the station online, choose PLC > Module Status… and click the Diagnostic Buffer tab.
2. HW Config (Online view): open the online view, then double-click any module/slave showing a red cross (diagnostic icon). The buffer opens at the entry that pertains to that module.

Refer to SIMATIC Programming with STEP 7 V5.5 manual (entry ID 45531115), Chapter 23 "Diagnostics", for the full event ID catalogue.

Common Diagnostic Buffer Event IDs

Reading the S7-200 Event History

S7-200 does not use STEP 7. Use STEP 7 Micro/WIN (V4.0 SP9 is the final release) to view the CPU event history:

1. Establish a PPI / MPI / Ethernet (CP243-1) connection to the CPU.
2. From the menu, choose PLC > Information….
3. Click the Event History tab.

The S7-200 time-stamps every major event: power-on, transition to RUN, fatal errors, I/O errors, and password-protected operations. To get valid timestamps, the time-of-day clock must be configured and synchronised with the S7-300 master or with PC time.

See the SIMATIC S7-200 Programmable Controller System Manual (entry ID 1109582), section "CPU History Log".

LED Interpretation on S7-300

For an S7-315-2 DP or S7-317-2 DP, LED group BUSF1 corresponds to the DP master port (X2). LED BUSF2 (where present) corresponds to a second DP port or PN/DP port in DP mode.

LED Interpretation on S7-200 (CPU 224 / 226 with EM277)

• SF steady: fatal CPU error, forced I/O conflict, or EM277 diagnostic. Read the Event History.
• RUN flashing and STOP steady: the CPU has detected a fatal error and entered STOP.
• EM277: green DP LED flashes when receiving token from master; off = bus fault, address conflict, or no 24 V to the EM277.

Step-by-Step Isolation Procedure

1. Capture the diagnostic buffer of the S7-300 BEFORE power-cycling. Use PLC > Save Service Data… in STEP 7 V5.5 to create a .zip of all station diagnostic files.
2. Note LED state at the moment of fault: SF, BF, FRCE, MAINT, LINK on OLM/OBT, DC24V on OLM/OBT.
3. Inspect the PROFIBUS connector at every node. Confirm:

• Wiring uses PROFIBUS violet cable 6XV1830-0EH10 (or 6XV1830-3EH10 for drag chains).
• Shield clamped 360° with the metal strain-relief clamp on the connector body. Floating shield = bus fault waiting to happen.
• Termination resistor ON only at the two physical line ends. All intermediate nodes OFF. Mis-termination is the most common cause of intermittent BF flashing.
• Incoming and outgoing cores swapped correctly: A1 and B1 are the entry cores from the previous node; A2 and B2 exit to the next node.
• No oxidation on pin 6 (P5V) or pin 5 (DGND); a 100 Ω line-to-line measurement at the connector should yield ~110 Ω (terminated) or ~15 kΩ (unterminated).

4. Verify PROFIBUS address at every node. S7-200 EM277 uses a hex rotary DIP switch (0–99). The address in HW Config (slave properties, "PROFIBUS address") must match exactly. A duplicate address creates two competing slaves and corrupts the bus.
5. Check bus profile: in HW Config, right-click the DP master, choose "Properties", and confirm baud rate. Default is 1.5 Mbit/s. At 12 Mbit/s, segment length is limited to 100 m; at 1.5 Mbit/s, 200 m; at 187.5 kbit/s, 1000 m. If the layout exceeds this, install an RS485 repeater 6ES7972-0AA02-0XA0 or use an OLM with fiber.
6. Inspect the fiber segment between the S7-300 and the peer CPU. Minimum bending radius for POF (980/1000 µm) is 30 mm. Inspect connectors for dust; clean with a dry, lint-free swab. Verify 24 V supply at OLM/OBT. Watch the LINK LED on each port: on = physical link up, off = no light. A FLICKERING link LED = weak optical budget; check for over-bent cable.
7. Swap suspect module: if isolation points to one slave, replace the PROFIBUS connector first, then the slave I/O, then the EM277, then the master CP if needed.
8. Programmatic check: confirm that the program loads OB82 (diagnostic interrupt), OB85 (rack/slot fault), OB86 (slave failure), and OB121 (programming error). Missing OBs cause the CPU to STOP on the first occurrence instead of surviving the disturbance.

PROFIBUS Termination Resistor Reference

Termination is a 5 V bias network internal to the bus connector: 390 Ω pull-up to P5V on A line, 390 Ω pull-down to DGND on B line, and 220 Ω between A and B. Measured line-to-line resistance at the powered network should be ~220 Ω at the two terminated ends.

Fiber Optic Link Diagnostics

The S7-300 does not natively support fiber PROFIBUS. A fiber segment is inserted using one of:

• SIMATIC NET PROFIBUS OLM (Optical Link Module), e.g. 6GK1502-3AB11 for 2 RS485 + 2 BFOC ports.
• SIMATIC NET OBT (Optical Bus Terminal), 6GK1500-3AA10, for single-segment fiber termination.

Each optical port has a green LINK LED and a yellow CHANNEL LED. LINK off = no optical receiver signal (broken fiber, dirty connector, port disabled, or remote OLM unpowered). CHANNEL indicates bus activity. The OLM web interface (firmware ≥ V2.0) reports link budgets and port power; values below –24 dBm typically indicate a degraded path needing cleaning or re-splicing.

For POF (980/1000 µm) with 0.5 m minimum length, total attenuation budget between OLM ports is approximately 7.5 dB including connectors and aging. Plastic-clad silica (HCS, 200/230 µm) offers ~12 dB and up to 300 m per segment.

Replacement and Re-commissioning Sequence

1. Power down the affected rack.
2. Mark and photograph every connector before disconnecting.
3. Replace the connector (not just the cable) so that crimp/IDC integrity is restored.
4. Strip 50 mm of outer jacket, expose the braided shield, fold back 360° over the strain relief.
5. Insert cores into the colour-coded spring terminals: red = A / green = B on Siemens connectors.
6. Torque the strain-relief screw to 0.6 Nm (Siemens spec).
7. Set termination at the two ends only.
8. Power up. Verify green RUN on the S7-300, no BF, slaves report "OK" in PLC > Module Status > DP Slave Diagnostics.
9. From STEP 7, run CPU > Operating Mode > Cold Restart if buffer still contains legacy errors.

Verification Checklist

• Diagnostic buffer shows no entries after 24 hours of continuous RUN.
• All slave BF LEDs OFF (or green if applicable).
• No SFB / SFC error codes in OB1 status word.
• OLM/OBT LINK LEDs steady on every active port.
• Time-stamped Event History on the S7-200 shows no I/O or fatal errors.
• PROFIBUS diagnostic repeater (e.g. 6ES7972-0AB01-0XA0) reports line state "healthy" if installed.

Preventive Maintenance Schedule