Troubleshooting S7-300 316-2DP Connection Limit and HMI Freeze

1. Problem Overview

The SIMATIC S7-300 CPU 316-2DP (6ES7316-2AG00-0AB0, later revisions 6ES7316-2AH14-0AB0) is a discontinued mid-range controller that ships with a fixed pool of 12 communication connection resources. In mixed HMI/SCADA installations, the controller exhibits two failure modes that look unrelated but share the same root cause:

• Intermittent OP comm errors on PROFIBUS panels, often increasing in frequency whenever additional Ethernet HMI clients (WinCC, WinCC Flexible) are brought online.
• Frozen analog values on PROFIBUS remote I/O after a power cycle, with the most recent good value latched and no diagnostic event in the diagnostic buffer.

Both symptoms persist when a single HMI station is removed, indicating the failure is not a noise or media problem but an exhausted connection-resource budget on the CPU. Connection-resource exhaustion on the 316-2DP causes the operating system to drop the lowest-priority resource owner and recycle the slot. Randomly dropped resources frequently include the IM365 backplane bus, the DP master interface, and active OP/PG connections, which is why analog process images appear to "freeze" — the DP master handshake is being recycled.

2. Affected Hardware and Firmware

The connection budget of the 316-2DP is enforced at the operating-system layer of the firmware (FW V2.x and V3.x). Simply raising the OP reservation count in HW Config does not create new resources — it only reallocates the 12 fixed slots between roles. To obtain more connections, the CPU must be replaced.

3. Connection Resource Accounting on the 316-2DP

The CPU exposes its connection budget as four configurable reservations on the Communication tab of the CPU properties in STEP 7 HW Config. The factory default allocation is:

The four reservations must sum to the maximum (12 on the 316-2DP). If a project requires more than the reserved count for any role, STEP 7 will issue a warning during compilation and refuse to download the configuration. The hard limit, however, is the CPU firmware — it is what causes connections to be silently dropped at runtime when the configured network exceeds the reservations.

3.1 What actually consumes a slot on the 316-2DP

• Every active PG online session (1 slot from PG reservation).
• Every active OP/HMI online session — one slot from OP reservation, regardless of the number of tags read.
• Every configured S7 connection in NetPro, even if never established at runtime.
• Every active ISO-on-TCP / TCP / UDP transport via CP 343-1, counted against S7 Basic or S7 Comm depending on the call type (AG_SEND/AG_RECV use a configured S7 connection → S7 Basic; PUT/GET use S7 Comm).
• The IM 365 backplane bus itself does not consume a connection resource in the standard accounting model, but an incorrectly configured PG interface that registers on the IM 365 link can consume one S7 Basic slot. Always inspect NetPro's online view to confirm.

3.2 Common miscounts in mixed HMI installations

Engineers frequently miscount because of three patterns:

1. WinCC Flexible copy-paste duplication. Copying a tag from one WinCC Flexible project to another and then re-pointing the connection does not overwrite the original connection — it adds a second one. Run Project > Compile and Check Consistency in WinCC Flexible to surface duplicate connection warnings.
2. Multiple S7 connections to the same PLC. A single WinCC station may create two S7 connections to one CPU (one for variables, one for alarms/archives). Each consumes a slot from the OP reservation.
3. Reserved S7 Basic connections left at the default of 7. This is appropriate only when the CPU is an MPI/DP master that hosts passive S7 partners. If the project has no configured S7 connections in NetPro, reduce the S7 Basic reservation to 1 or 0 and increase OP reservation accordingly.

4. Root Cause Analysis: Why Analogs Freeze on a Power Cycle

The "frozen analog" symptom after a PLC power cycle is the signature failure mode of an over-committed CPU. The mechanism is:

1. On power-up, the CPU brings up the DP master and negotiates with the configured DP slaves. The DP master handshake requires the CPU to allocate one DP master internal resource that lives in the same connection pool.
2. WinCC Flexible and the second WinCC station race to establish their OP connections while the DP master is still initializing. The connection budget is exhausted before the DP master slot is fully registered.
3. The CPU's OS drops the lowest-priority resource — frequently the IM 365 link or the DP master internal resource — and recycles it. The DP slaves lose their periodic I/O update, the analog values latch at the last good value (default behaviour for ET200S, ET200M, and most Festo/P&F nodes), and the diagnostic buffer shows no event because the slot was never fully registered.
4. When the HMI traffic settles, the dropped resource is re-registered, but the analog values remain latched until the DP slave reports a process interrupt or the CPU performs a re-init.

For PROFIBUS DP, the cycle time T_DP between two I/O updates is calculated as:

T_DP = sum over all slaves of (T_slave_input + T_slave_output) + T_idle + T_master_frame

If the master is starved by an OS-level resource recycle, the I/O update for that cycle is skipped entirely, not delayed, which is why the analog value latches rather than drifting.

5. Diagnostic Procedure

Perform the following checks in sequence. Each one rules in or out a specific contributor.

5.1 Confirm connection budget is exhausted

1. Open STEP 7 and the offline project for the affected CPU.
2. Right-click the CPU in HW Config → Object Properties → Communication tab.
3. Record the four reservations and the maximum. For the 316-2DP, the maximum must equal the sum.
4. Compare to the inventory of online sessions in NetPro. Switch NetPro to Online View: PLC > Activate Connection Status (or click the connector icon with the blue/white 'i').
5. If any reservation shows "in use" equal to the reservation count, the role is saturated and additional sessions on that role will be dropped at runtime.

5.2 Inspect NetPro for hidden connections

1. Open NetPro. From the menu bar, View > Online or press the Online/Offline toggle.
2. Expand the local CPU node. Each configured S7 connection object is listed, with a green indicator for established and a grey indicator for configured-but-not-established.
3. Pay particular attention to S7 connections with no project source — these are added by WinCC Flexible and by partners that import the station. Each counts against S7 Basic.
4. Open the project's Station > Save and Compile. STEP 7 will surface duplicate connection IDs and any connection that points to a non-existent partner.

5.3 Check the CPU online diagnostic buffer

1. Connect the PG via MPI/DP and open PLC > Accessible Nodes.
2. Open PLC > Diagnose Hardware and read the diagnostic buffer. Look for event ID 0x2543 "Connection aborted - resource bottleneck" and 0x2544 "Connection terminated locally". Both confirm resource exhaustion.
3. Record OB1, OB82, OB85, OB86, OB87, OB121, OB122 start events. Unacknowledged OB85/OB86 events on the 316-2DP correlate with DP slave comm loss and are often the second-level effect of the connection drop.

5.4 Confirm the port configuration matches the project

A common error on the 316-2DP is that one DP port is configured in the project as MPI while the hardware DIP switch and cable plant are both PROFIBUS DP. This causes the CPU to attempt passive MPI partner registration on a DP segment, which silently consumes an S7 Basic slot for the duration of the session.

1. In HW Config, right-click the DP interface → Properties → Interface sub-module.
2. Confirm the Interface is set to PROFIBUS (not MPI) for both ports if both are wired to DP segments.
3. If a port is unused, set it to DP with no master system, or physically disable it via the CPU properties → Interface → No DP master system.

5.5 Measure the OB1 cycle time

1. Online → right-click the CPU → Operating Mode → record the OB1 cycle time, the longest cycle, and the cycle time monitor setting.
2. On a 316-2DP, OB1 cycle time above 80 ms combined with the maximum of 12 connections in use is a strong indicator that communication is queueing at the OS layer. The fix is a CPU with more resources, not a software change.

6. Step-by-Step Resolution

1. Reclaim the S7 Basic reservation. In HW Config, set S7 Basic to the minimum that the project actually needs (typically 1 or 2 — one for the CP 343-1 ISO-on-TCP partner, one for routing headroom). Increase OP reservation to the new total of panels. The four reservations must still sum to 12.
2. Eliminate duplicate WinCC Flexible connections. In each WinCC Flexible station, open Connections and verify exactly one connection per CPU. Delete any connection with no tags. Recompile and download the WinCC project.
3. Verify ISO-on-TCP connection is still required. The CP 343-1 ISO-on-TCP transport to the remote PLC consumes one S7 Basic slot as long as it is configured. If the remote PLC is on a separate project and the link is not strictly needed for the analog I/O it serves, consider replacing it with a periodic data exchange via shared I/O on the partner.
4. Replace the CPU. The 316-2DP is at the end of its service life. Siemens' official migration path is to a 315-2PN/DP (16 connections, 2 ports split as PROFINET + PROFIBUS) or 317-2PN/DP (32 connections, 2 ports split as PROFINET + PROFIBUS). For the workload in the field case (3–4 panels, 1 OP, 1 remote PLC, 1 IM 365, 2 VFD, 1 Festo, 1 P&F safety barrier), the 315-2PN/DP is sufficient; the 317-2PN/DP is recommended if future expansion is anticipated.
5. Re-architect the network. With a PN/DP controller, move all HMI/SCADA clients to the PROFINET port and keep PROFIBUS for I/O only. This isolates the deterministic DP cycle from HMI traffic and resolves the secondary cause of the intermittent OP errors (the MPI/DP backplane bottleneck).
6. Re-download the project, cold-start the CPU, and re-test per Section 9.

7. Migration Path Comparison

For the inventory listed in the field case (1 PG, 4 OPs, 2 WinCC, 1 remote PLC, 1 IM 365), the 315-2PN/DP provides 16 slots — enough for 8 OP slots and 8 S7 Basic slots, with comfortable headroom. The 317-2PN/DP is recommended only if you anticipate adding additional PROFINET devices (additional drives, I/O stations) or migrating the WinCC stations to WinCC Professional with redundant connections.

8. Network Architecture Best Practices

Beyond the CPU swap, the network topology is the second contributor to the symptoms. The rule is: isolate HMI traffic from I/O traffic.

• PROFINET port: All HMI/SCADA clients (WinCC, WinCC Flexible, TIA Portal panels). Use a managed switch if you have more than four PN clients. Configure PROFINET update time to 1 ms for HMI traffic, 0.5 ms for I/O.
• PROFIBUS port: I/O only — ET200 stations, drives (Sinamics G120 on PROFIBUS, G120C PN for new installs), Festo valve manifolds (MPA, VTIA), and P&F safety barriers with PROFIBUS gateway. No HMI panels on the PROFIBUS segment.
• CP 343-1 (if retained): Connect to the same PROFINET subnet as the HMI clients, configured as a separate logical subnet. ISO-on-TCP partner remains on the remote PLC.

9. Verification and Validation

1. After the CPU swap, download HW Config and the user program. Perform a cold restart (MRES) to clear all retained resources.
2. In NetPro online view, verify all configured connections reach the established (green) state within 30 seconds of CPU run-up.
3. Read the diagnostic buffer. There should be no event ID 0x2543 or 0x2544 over a 1-hour soak test with all HMI clients active.
4. Cycle power three times consecutively. After each cycle, verify all analog values from the ET200 / Festo / P&F stations are updating within one OB1 cycle (1–2 s). Latched values indicate the connection budget is still over-committed.
5. Soak test for 24 hours with the WinCC station enabled. OP comm error counters (visible on the OP under System > Diagnosis) should be zero or stable at the historical baseline.
6. Capture OB1 cycle time online. Target < 50 ms under full HMI polling load.

10. Preventive Measures and Tuning

• Document the connection inventory in the project. Add a comment on the CPU's Communication tab listing each PG, OP, S7 Basic, and S7 Comm role owner.
• Avoid string tags in WinCC Flexible that exceed the PLC string length. An over-long string read request causes the OP to re-request repeatedly, consuming its slot for longer. Set String length in the tag properties to the exact PLC value, including the 2-byte header.
• Reduce the OP polling rate. The default WinCC Flexible update rate is 1 s; for non-critical displays, raise to 2 s or 5 s. This reduces the per-second transactions and lowers the chance of OS-level resource starvation.
• Avoid S7 routing through the 316-2DP. Routing the PG through a heavily loaded CPU to reach a partner PLC consumes an additional S7 Basic slot.
• Use symbolic tag access in WinCC Flexible only if the project is small; for the 316-2DP, absolute addressing is faster and reduces the connection-establishment handshake overhead.

11. Troubleshooting Matrix

12. Frequently Asked Questions