Troubleshooting S7-300 CPU 316-2DP Fault I/O Address Errors

1. Problem Profile: CPU 316-2DP Diagnostic Buffer I/O Access Faults

A Siemens SIMATIC S7-300 CPU 316-2DP (order number 6ES7316-2AG00-0AB0 or 6ES7316-2EH14-0AB0) reports a "System Fault" in STEP 7 / SIMATIC Manager, and the diagnostic buffer lists multiple I/O access errors. The faulting addresses in the event stack cluster around byte 256 (PIW/PQW 256, 258, 268) and the upper range 360-362, which usually correspond to peripherals on PROFIBUS-DP slaves configured in HW Config (for example, two Siemens Micromaster 4 inverters fitted with the 6SE6400-1PB00-0AA0 PROFIBUS module occupying the I/O slot 256-279, and a second DP slave occupying 360-367).

This symptom is one of the most common field issues reported on S7-300 systems: the CPU executes a peripheral I/O instruction (L PIW, T PQW, or a direct L PEB / T PAB access) and the PROFIBUS master cannot reach the addressed slot on the configured slave. The CPU does not stop by default — it logs an event, increments an internal error counter, and — depending on which OBs are loaded — either calls OB 85 (only when the error is detected in the cyclic OB or during system startup) and/or OB 122 (when the access error occurs inside a user program with the S7-300 I/O access error behaviour enabled). The user typically sees the SF (System Fault) LED lit on the CPU and an entry in the diagnostic buffer under "PLC > Diagnostic Buffer".

The address pattern is the diagnostic clue. Even byte addresses (256, 258, 268, 360, 362) correspond to the start of a 16-bit process-data word, exactly the alignment used by drive PZD slots. The first cluster (256, 258, 268) is consistent with two Micromaster 4 stations where PZD1 (control word / status word) and PZD2 (setpoint / actual value) are read or written, and an additional word for a digital frequency setpoint or a third PZD. The second cluster (360, 362) is consistent with a different DP slave (e.g. an ET 200S, ET 200M, or a third-party drive) whose I/O start address lies in the high peripheral range.

2. Reading the Diagnostic Buffer Event Stack

Open the offending CPU in SIMATIC Manager, right-click and select PLC > Diagnostic / Setting > Diagnostic Buffer (Online > Accessible Nodes, or via the programming port). Each event row contains:

• Event ID – a 4-digit hexadecimal code that classifies the fault.
• OB / Block – the OB that was active when the event was raised.
• Address / Mode – the byte address and the direction (read or write) that failed.
• Time stamp – relative or absolute time of the event, useful to correlate with the user's program cycle.

The event IDs relevant to this fault family are listed in the table below. They come from the standard Siemens diagnostic buffer specification in the S7-300 CPU 31x/31x-2 DP Manual.

When the entry has the form "I/O access error, reading byte 256 / writing byte 258 ...", the address embedded in the message is the byte offset that the CPU tried to access. The first cluster of 256, 258, 268 indicates that the program or the PROFIBUS image is being accessed at peripheral byte 256 and 258, and the bytes 268-275 likewise. This matches a Micromaster 4 PZD assignment in which each drive occupies 6 bytes (one control word, one setpoint, one optional word).

3. S7-300 I/O Address Map and the Peripheral Range

The S7-300 uses three address ranges that the CPU distinguishes:

• Process image (PII / PIQ): 0-127 (default). The I/O image is refreshed at the start of OB 1 (PII) and end of OB 1 (PIQ). Accesses with I/Q operate on the image, never on the bus.
• Peripheral range (PIB / PQB / PIW / PQW / PID / PQD): 0-65535. Each access goes directly to the module. PIW/PQW accesses are word-aligned, PID/PQD are dword-aligned, and PIB/PQB operate on a single byte.
• Consistent peripheral range: used for DP slaves and CP modules when the user wants to read/write a multi-word frame in a single atomic bus cycle. Accessed via SFC 14/15 (DPRD_DAT / DPWR_DAT) or via the L/T direct-consistent form.

Addresses 256-279 and 360-367 are above the default 128-byte process image. They are peripheral addresses, and they are typically used for distributed I/O (PROFIBUS-DP). The CPU 316-2DP allows an extended process image configurable up to the full 1024 bytes, but the address range 256-279 must still be assigned to a real module in HW Config — otherwise any peripheral read returns an I/O access error.

4. PROFIBUS-DP Slave Configuration on the CPU 316-2DP

The CPU 316-2DP includes an integrated PROFIBUS-DP master port (X2) that supports DP-V0 and DP-V1 slaves. The slave list is stored in the system data block (SDB) and downloaded to the CPU with the hardware configuration (HW Config / STEP 7). The CPU maintains the I/O image for the slaves according to the configured slot order; the peripheral address displayed in the diagnostic buffer is the start address of the slot that failed.

Common configuration mistakes that produce the symptoms seen in the diagnostic buffer:

1. Slave is configured at the wrong address. HW Config shows the slave at, say, address 4, but the user code is reading PIW 256 expecting a PZD. The peripheral address 256 in the diagnostic buffer is the start address of the slave's PZD mapping; if the slave is not present at all in HW Config, the CPU will report I/O access errors for any read/write of that range.
2. GSD file mismatch. The Micromaster 4 is configured with the wrong GSD revision. The GSD file shipped with the option module 6SE6400-1PB00-0AA0 defines the PZD slot structure. Using the wrong GSD causes the I/O mapping to be off by one or more bytes, leading to a peripheral address collision with a neighbour slave.
3. Two slaves with overlapping address ranges. If two slaves are both configured to start at 256 (e.g. after a manual edit of the slot addresses), the second slave's actual I/O will overlap the first; the CPU will report errors for the conflicting slots.
4. Slave physically present but not configured, or configured but not present. A slave that is plugged but absent from the SDB returns 0x3942/0x3943 errors at every cycle because the CPU tries to read the PII image at the configured start address.
5. Termination / shielding. A PROFIBUS segment without proper termination (9-pin D-sub with 220 Ω on both ends) or with reversed A/B wiring will cause intermittent station failures, which generate the same 0x3942 events when the bus is down.

5. Micromaster 4 PROFIBUS Module (6SE6400-1PB00-0AA0) — Slot and PZD Layout

The Micromaster 4 family of drives is networked via the optional PROFIBUS communications module 6SE6400-1PB00-0AA0. The module is plugged into the front of the drive and presents itself on the DP network as a DP-V0 slave. The GSD file for the module is shipped as SIEM80F0.GSD (or MM4_0F0F.GSD on later firmware). Detailed slot information is in the Siemens Micromaster 4 PROFIBUS Module Operating Instructions.

Each Micromaster 4 PROFIBUS module exposes, by default, the following PZD slots in the GSD configuration:

Two Micromaster 4 slaves at peripheral addresses 256-279 therefore typically occupy 12 bytes each: 6 input bytes (PIW) and 6 output bytes (PQW). The remaining bytes 268-275 correspond to the second drive's PZD1-PZD3. The cluster of faulting addresses (256, 258, 268) is the start of each PZD1 word of each drive — exactly the bytes the user program is reading or writing in OB 1 to control the drive.

The second cluster (360, 362) is a different DP slave with its own start address. Common candidates are:

• An ET 200M with an SM 331 analog input module configured to start at PIW 360.
• An ET 200S 4 DO module starting at PQW 360.
• A second drive family (e.g. Sinamics G110/G120 with a CU240S DP, or a third-party inverter) on a different DP address.
• A CP 342-5 used as a lower-level DP master with its own sub-slaves, where the address mapping is indirect.

6. Hardware Configuration Review (HW Config)

The first step after a system-fault event is to read the HW Config online and compare it with the offline project. Open SIMATIC Manager, double-click Hardware in the station, and check the following on the DP master line:

1. Click on the DP master line (X2 on the CPU 316-2DP). The "DP Master Properties" dialog shows the bus parameters (baud rate, bus profile, highest station address / HSA). Confirm the baud rate matches the installed segment (typically 1.5 Mbit/s for short segments, 187.5 kbit/s for longer ones).
2. Click on each slave on the DP line. The slave's "DP Slave Properties" dialog shows the PROFIBUS address and the I/O configuration.
3. Double-click each configured slot (PZD module, AI/AO module, DI/DO module) in the lower part of the slave window. Confirm the start address shown matches what the user program is reading or writing.
4. If the slave is a Micromaster 4, expand the slave and verify the GSD revision. The slot at index 0 of the Micromaster 4 slave is "Universal module 16/16" (1 input word + 1 output word); slots 1 and 2 can be added to extend to 4 PZD in each direction. The default selection often yields 1 PZD each way, which uses PIW 256 / PQW 256 — exactly the address of the first fault.
5. Right-click the DP master and select DP master system > Diagnostics > Hardware Diagnostics to bring up the live diagnostic view. The "Module Information" dialog shows the diagnostic data of each slave in real time.

7. Programmatic I/O Access and OB Handling

The S7-300 raises an I/O access error in three situations:

• Reading/writing a peripheral address with no module responding — error raised at the moment of the access.
• Reading the process image with a module that has been removed or has failed — error raised at the PII refresh in OB 1 or in the startup OBs (OB 100/101/102).
• Reading/writing a consistent data record via SFC 14/15 on a slave that has failed — SFC returns RET_VAL = 0x80C0 / 0x80C1.

For each case, a specific OB is called by the CPU (if loaded):

The S7-300 OB 85 and OB 122 are also the "best place" to filter peripheral access errors so that a transient error does not propagate into a drive stop or a process shutdown. A minimal OB 122 is shown below.

// OB 122 - I/O access error handler (ST)
// Called when the user code accesses a peripheral
// address for which no module is responding.
// Avoid heavy processing in this OB; the CPU is
// in diagnostic handling mode here.

VAR_TEMP
    OB122_INFO   : STRUCT
        BLOCK_TYPE    : WORD;  // 0x1234 for OB 122
        BLOCK_NUMBER  : WORD;
        BLOCK_LENGTH  : WORD;
        PRIORITY      : BYTE;
        OB_NUMBER     : BYTE;  // 122
        RESERVED_1    : BYTE;
        RESERVED_2    : BYTE;
        OB_EV_CLASS   : BYTE;
        FLT_ID        : BYTE;  // 0x42 read, 0x43 write, 0x44 reserved
        BLOCK_NUMBER2 : WORD;  // block that caused the error
        OB_MEM_ADDR   : DWORD; // byte/bit address that failed
        RTU_CLASS     : BYTE;
        RTU_NUMBER    : BYTE;
        DIAG_EV       : WORD;
        FAULT_IN      : WORD;  // 0=I-input, 1=Q-output
        FLT_PRIORITY  : BYTE;
        OB_NUMBER2    : BYTE;
        RESERVED_3    : WORD;
        RESERVED_4    : WORD;
    END_STRUCT;
END_VAR

BEGIN
    // The error info is in OB122_INFO.OB_MEM_ADDR (byte offset).
    // Typical mitigation:
    // 1. Increment a counter for the failed address.
    // 2. If the counter crosses a threshold, raise a global flag.
    // 3. Do NOT block the OB with an SFC call to the same
    //    failed peripheral address or you will recurse.
END_ORGANIZATION_BLOCK

For a typical Micromaster 4 application, the user code in OB 1 contains peripheral accesses to PIW 256, PIW 258, PQW 256, PQW 258 (drive #1) and the same for drive #2. If a drive is in a powered-down state or the PROFIBUS cable is disconnected, OB 122 fires. The default behaviour (OB not loaded) is to log the error and continue. The SF LED remains on, and the diagnostic buffer fills up.

8. Step-by-Step Troubleshooting Procedure

1. Capture the diagnostic buffer. In SIMATIC Manager: PLC > Diagnostic / Setting > Diagnostic Buffer. Save the buffer to a text file. Identify the event IDs (0x3942, 0x3943, 0x3921, 0x3925).
2. Cross-check the offline project. In the same offline project, open Hardware. Record the I/O start address of every slot on every DP slave. Highlight the addresses that match the faulting bytes (256, 258, 268, 360, 362).
3. Run "Compare Online / Offline". From the HW Config menu: Station > Compare Online / Offline. The comparison reveals whether the CPU's SDB is in sync with the offline project.
4. Re-download the hardware configuration. In HW Config: Station > Save and Compile, then PLC > Download to Target Station. Choose Download the whole station to refresh the SDB.
5. Check the DP line state. Open PLC > Diagnose Hardware in the online view. Look at the "DP master system" view. Each slave icon turns green (OK), yellow (diagnostic pending), or red (failed). The faulting slave's icon will be red, with a hex diagnostic code in the lower pane.
6. Verify the PROFIBUS wiring. With the bus powered but the CPU in stop, measure the voltage on the A and B lines of each segment. A correctly terminated PROFIBUS segment shows ~1 V differential between A and B at idle, and the terminator is on at both ends only (220 Ω + 390 Ω bias). Use a PROFIBUS tester (e.g. Softing BC-700-PB, Indu-Sol PROFINET-INspektor, or the Siemens BT 200) to scan the bus and verify the segment integrity.
7. Isolate the faulting slave. Disconnect the DP slave that is reporting the 0x3942 errors. If the diagnostic buffer stops logging new errors, the slave is the cause. If the error continues, the CPU configuration is wrong.
8. Validate the user program. Use cross-references in the program editor (Ctrl+Alt+F7 in STEP 7) to find every L PIW / T PQW that targets 256, 258, 268, 360, 362. If an access exists for an address that has no module, comment out the access or insert an OB 122 trap.
9. Recompile the project. In SIMATIC Manager: Program > Compile All. Look at the SDB generation messages — STEP 7 reports any I/O address conflict at compile time.
10. Reset the diagnostic buffer. From the online view: PLC > Diagnostic / Setting > Clear Diagnostic Buffer. Run the user program and observe the buffer for new events. This validates the fix.

9. Common Root Causes and Their Fixes

10. Verification and Commissioning Checks

After the root cause has been fixed, perform the following checks to confirm the system is healthy:

1. Diagnostic buffer clear. Run the CPU for at least 30 minutes in production conditions. Open the diagnostic buffer and verify no new events of class "I/O access error" or "station failure" have been logged.
2. SF LED off. The SF LED on the CPU should be dark. The BF (bus fault) LED on the CPU's DP port should be dark too, except for a brief flash during a slave failure that is recovered.
3. Monitor the process image. Open PLC > Monitor / Modify and add a watch table for PIW 256, PIW 258, PIW 268, PIW 360. Each PIW should show a value that matches the drive's status word. The ZSW1 of a Micromaster 4 in "ready to run" state is 0xC037; in "operation enabled" it is 0xC437.
4. Drive control loop test. Write a setpoint to PQW 258 of each drive (e.g. 0x4000 = 16384 = 100 % of PZD scaling) and verify the motor runs at the rated speed. Read PZD2 status back from PIW 258 and confirm the actual value is in range.
5. DP bus statistics. In Diagnose Hardware, click the DP master line. The "Bus Statistics" tab shows repeater / cycle counters and per-slave error counters. Compare with the baseline (initial commissioning values) to ensure the network is clean.
6. Cold restart test. Power-cycle the CPU, bring it back to RUN, and verify the diagnostic buffer is empty and the drives accept the control words within one OB 1 cycle.

11. Firmware-Specific Caveats and CPU Part Numbers

The CPU 316-2DP exists in two main hardware revisions that are functionally similar but differ in firmware and order numbers:

On firmware V2.6 and earlier, the S7-300 OB 85 default behaviour is to log only and continue; on V3.x, the behaviour is the same but the diagnostic event format includes the slot number explicitly. The user can read the firmware version via PLC > Module Information > Firmware.

For the Micromaster 4 with the 6SE6400-1PB00-0AA0 module, the supported firmware is from MM4 firmware V1.05 upward. On a non-supported drive firmware, the slave appears online but the PZD2 response is corrupted, which leads to intermittent 0x3943 events during writes. The fix is to upgrade the drive firmware to a version listed in the option module's compatibility table (available on the Siemens Industry Online Support portal under the Micromaster 4 product page).

12. Migrating to a Modern Replacement — Notes

When the CPU 316-2DP is replaced with a newer controller (e.g. an ET 200S CPU or an S7-1500 with PROFINET), the DP master becomes a PROFINET IO controller and the Micromaster 4 must be replaced with a Sinamics drive with a PN interface. The PZD slot structure is preserved (PZD1 = STW1/ZSW1, PZD2 = HSW/HIW), but the diagnostic message format changes to PN IO alarms and the address space is mapped as slot 0/1/2 of the device. The CPU 316-2DP migration path is documented in the Siemens Migration Guide S7-300 to S7-1500.

For a stay-with-S7-300 remediation that does not require a controller swap, the alternative is to:

1. Move the Micromaster 4 slaves into a sub-network with a CP 342-5 as a lower-level DP master. The CPU exchanges data with the CP 342-5 via SFC 14/15 on the CP's configured I/O range, and the CP handles the per-slave errors locally. The CPU's diagnostic buffer no longer fills up with the 0x3942 events for the Micromaster 4 slaves.
2. Add OB 122 and OB 85 handlers in the user project to swallow the transient errors during drive startup / power-down.
3. Replace the user-code peripheral accesses with SFC 14 (DPRD_DAT) and SFC 15 (DPWR_DAT). The SFCs return a RET_VAL that the program can use to detect the failure locally, without an OB 122 call, and to keep a per-channel health counter.

13. SFC 14 / SFC 15 — Consistent Read/Write for Drive PZD

Replacing PIW/PQW accesses with SFC 14/15 isolates the user code from the bus errors. The pattern below reads the Micromaster 4 status words with explicit error handling.

// Read PZD from Micromaster 4 #1 - Ladder / STL fragment
//  Call SFC 14 (DPRD_DAT) for consistent data read.
//  LADDR = hardware identifier of the slave (set in
//  HW Config, "Properties > Addresses > Hardware
//  identifier", e.g. 256 + 0 = 256 for word access
//  via the SFC).
//  RET_VAL = 0 on success, 0x80C0 on station failure.

CALL  "DPRD_DAT"
     LADDR  := W#16#100    // hardware ID of the slave
     RET_VAL:= MW 100      // 0 = OK, 0x80C0 = fail
     RECORD := P#M 200.0 BYTE 12  // PZD1+PZD2+PZD3 (12 bytes)

//  After the call, M 200.0 contains ZSW1,
//  M 202.0 contains HIW, M 204.0 contains ZSW2 / HIW2.

//  If RET_VAL is non-zero, mark the drive as "offline"
//  by writing a control word of 0x0000 to PZD1 next
//  cycle; do not let the program continue with the
//  previous buffer.

For DP-V0 slaves (the Micromaster 4 in the current case), consistent data is not guaranteed via a single PIW/PQW read; SFC 14/15 is the recommended way. The "Hardware identifier" mentioned above is set per slot in HW Config (Properties > Addresses > Hardware ID). On a CPU 316-2DP, this is typically a 16-bit value that starts at 0x100 for the first DP slave and increments per slot.

14. Summary of the Fix for This Case

For the specific symptom described — a CPU 316-2DP logging I/O access errors at byte offsets 256, 258, 268, 360, 362 — the most likely root causes and the corrective actions are:

1. Open HW Config and confirm that the Micromaster 4 slaves and the second DP slave are configured at start addresses 256 and 360 respectively, with the correct number of PZD slots (typically 1, 2, or 3 PZD in each direction).
2. Re-download the entire station (PLC > Download to Target Station > Full Download) to refresh the SDB.
3. Replace the user-code PIW/PQW accesses with SFC 14/15 calls so that the program has a clean RET_VAL-based health check on each drive.
4. If the user wants to keep the SF LED off while the drives are powered down, add OB 85 and OB 122 that contain a fault counter but do not change process state.
5. Validate the PROFIBUS segment with a bus tester; verify that the terminator is enabled only at the two physical ends of the segment.

15. Frequently Asked Questions