Troubleshooting Siemens Profibus DP Over UHF Radio Modem

1. Problem Overview

Field installations that bridge Profibus-DP across UHF radio modems (point-to-point or point-to-multipoint) regularly exhibit a distinctive fault signature: deterministic exchange during the first 10-20 minutes, followed by progressive slave dropouts in the SCADA/HMI picture. WinCC 7.0 SP1 HF5 with the OPC tunnel PC-Access and four S7-300 stations scattered over kilometres of terrain is a textbook realisation of that signature. The radio path itself is usually healthy (RSSI is high, eye-diagram good), so the engineering team focuses on Profibus timing and on the class-1 master hardware driving the network.

This reference documents the failure mode, ranks the plausible root causes from most likely to least, and presents the field-proven mitigation: replacing the CP 5613 A2 PCI master card with a CP 5611 PCI card, re-tuning the bus parameters for radio latency, and adding watchdog housekeeping so that any future glitch is recovered within seconds rather than minutes.

2. System Topology and Components

The reference installation has the following bill of materials:

2.1 Logical View

3. Failure Pattern and Symptoms

The observed sequence is consistent across multiple installations of this architecture:

1. Phase A — Stable. For 10-20 minutes after PC or master restart, all four S7-300 stations appear in WinCC, OPC tags update at the configured acquisition cycle, no diagnostic buffer entries.
2. Phase B — First dropout. Slave #1 disappears from WinCC. SIMATIC Manager online diagnostics show "Slave failure" or "Slave not reachable" in the CP 5613 / CP 5611 diagnostic buffer.
3. Phase C — Cascade. Within two minutes, slave #2 and then slave #3 fall off.
4. Phase D — Last slave. Slave #4 is the last to go. After this, only manual reboot of the master PC, or reset of the OPC tunnel, recovers the network.

3.1 State Machine of the Dropout

3.2 Diagnostic Buffer Sample (CP 5613 A2)

Typical entries in the master diagnostic buffer when the cascade starts:

Event 1: 10:42:13.412   Slave diagnostic - station 1 (addr 3) - external diag - bit 7 set (parameter fault)
Event 2: 10:44:08.101   Slave diagnostic - station 2 (addr 5) - watchdog timeout
Event 3: 10:45:55.870   Bus fault - station 3 (addr 7) - GAP factor exceeded
Event 4: 10:47:39.222   Slave failure - station 4 (addr 9) - slave not reachable

The "parameter fault", "watchdog timeout", and "GAP factor exceeded" keywords are direct evidence that the master is interpreting a radio-induced jitter as a slave malfunction and incrementing the retry counter beyond Retry Limit, after which the slave is declared offline.

4. Root Cause Analysis

Four candidate root causes were investigated and weighted by probability:

4.1 Why a CP 5613 A2 Fails on Radio Links

The CP 5613 A2 is a class-1 and class-2 master that offloads token handling and frame validation to firmware on the card itself. It implements Profibus-DP with tight timing assumptions suited for copper or fibre at 1.5 Mbps or 12 Mbps. Across UHF radio at 9600 bit/s, however, a single token rotation can take hundreds of milliseconds due to the radio turnaround and any forward error correction. The CP 5613 A2 applies its internal diagnostic gating: the slave response window (Max.Tsdr) is enforced, retries are counted, and after Retry Limit the slave is flagged "not reachable". On identical cabling but slower, jittery media, the CP 5611's slightly more forgiving token handling (the legacy PCI variant used in many legacy radio installs) does not trip the same gate.

4.2 Why Bus Parameters Matter on Any RF Hop

Even with the master card fixed, Profibus-DP is a strict master-slave poll: the master emits a request, the slave replies within Max.Tsdr, the next slave's request only starts after Min.Tsdr. Over RS-485 at 1.5 Mbps, t_bit = 0.667 µs; over a UHF modem at 9600 bit/s, t_bit = 104.17 µs. Combined with radio turnaround (encoding, FEC, RF power ramp), a one-way radio latency of 30-100 ms is realistic. The default bus parameters computed by Step 7 / TIA for 9600 bit/s assume the classic 35 t_bit Min.Tsdr and 50 t_bit Max.Tsdr, which translates to roughly 3.6 ms and 5.2 ms - an order of magnitude shorter than reality. The slave's reply always lands outside that window, so every cycle is at least one retry, and intermittent extended drops push past Retry Limit.

5. CP 5613 A2 vs CP 5611 Comparison

For a WinCC 7.0 + PC-Access + UHF radio scenario with under 32 slaves, the CP 5611 is the recommended master card. The CP 5613 A2 remains the right choice when the PC must serve as a class-2 diagnostic master for SIMATIC PDM or for parallel PROFINET integration, neither of which applies to a simple radio-bridged DP hub.

6. Profibus Bus Parameter Tuning for UHF Radio

The parameters live in the Configure Network dialog of Step 7 Classic (HW Config -> right-click on the DP master -> "PROFIBUS properties") or in the Bus Parameters tab of the CP Configuration tool in TIA Portal. Switching to manual mode unlocks all values.

6.1 Working Reference Set (Satelline 3AS, 9600 bit/s)

6.2 Calculation of the Radio Roundtrip Budget

For a UHF pair at 9.6 kbit/s with 30-ms one-way RF turnaround (typical Satel box, 9600, transparent mode), the master's token-to-token roundtrip budget is:

RT_budget = N_slaves * (Tslot_init + Max.Tsdr + 2 * T_radio)
            = 4 * (313 ms + 10.4 ms + 60 ms)
            = 4 * 383.4 ms
            = 1.534 s

This is comfortably within the Profibus default target rotation time (Ttr) of 10 s for class-1, but if the auto-computed values from Step 7 are accepted, the budget comes out at:

RT_default = 4 * (50 t_bit + 50 t_bit + 60 ms)
             = 4 * (5.2 ms + 5.2 ms + 60 ms)
             = 4 * 70.4 ms
             = 281.6 ms

That 281.6 ms includes radio overhead that the auto-computed bus parameters ignore, forcing every cycle into one retry and any shorter radio glitch into two or three retries - which exactly matches the observed "10-20 minute drift into dropout" pattern.

6.3 Export of Step 7 Bus Parameters

To export the parameters as text and lock them against re-computation:

1. Open HW Config in Step 7 V5.5 or earlier.
2. Right-click the CP 5611 / CP 5613 A2 master -> PROFIBUS properties.
3. Click Bus Parameters tab -> switch to Manual.
4. Enter the values in the table above exactly.
5. Tick Use the same parameters for all masters.
6. Save and recompile.

7. Reference Configuration: Satelline 3AS Radio Modems

For point-to-point or point-to-multipoint radio bridges, use the modem's transparent (data pipe) mode. Avoid Modbus RTU to Profibus converters in the same modem unless specifically required by the radio vendor for addressing. The Satelline 3AS datasheet confirms compatibility with Profibus-DP when set to:

8. Diagnostic and Repair Procedure

1. Capture a baseline. Open SIMATIC Manager -> PC Station -> CP 5611 -> Diagnostics -> Slave diagnostics. Note the count of "Lost" frames per slave over 1 h.
2. Check the diagnostic buffer. Count occurrences of "Slave failure", "parameter fault", "watchdog timeout", "GAP factor" events.
3. Inspect HW Config parameters. Confirm bus parameters are not on Auto. If they are, switch to Manual with the values from Section 6.1.
4. Replace the master card. Power down, open the PC, swap the CP 5613 A2 for a CP 5611. Reinstall the SIMATIC NET CD (matching the WinCC 7.0 SP1 HF5 setpoint), restart.
5. Re-import the PC Station configuration. Station Manager -> Import Station -> pick the original .xdb; verify the CP 5611 icon now appears.
6. Test in three phases. Test for 10 min, then 1 h, then 24 h. All four slaves must report "OK" for the full 24 h with no fallback to retry.
7. Tune OPC. In SIMATIC NET PC-Access, raise the "max retries" for slow channels to 5 and the timeout to 2500 ms (this matches the inflated Max.Tsdr).
8. Add WinCC housekeeping. Insert a VB or C script that polls a quality flag per tag and re-establishes the OPC connection on Quality Bad > 3 s. This auto-recovers from radio glitches without operator intervention.

8.1 Verification Checklist

9. Preventive Maintenance

• Monthly: Inspect antenna coax for water ingress and SWR drift > 1.5.
• Quarterly: Pull the diagnostic buffer of each CP 5611; alert on "Slave failure" rate > 0.1/h.
• Annually: Replace the radio modem backup battery (where applicable) and confirm RS-485 termination is at radio end only.
• On firmware update: SIMATIC NET PC-Access and CP firmware must match the WinCC 7.0 setpoint matrix. CP 5611 FWs older than V6.x tend to drift; pin to a tested combination.

10. When to Escalate to the Radio Vendor

After the master card swap and bus-parameter tuning, the system should be stable. If drops persist:

• Capture a Profibus trace on the master-side modem (Satel SATELtrace or equivalent) during the dropout window.
• Provide the radio vendor with: antenna heights, coax lengths, site coordinates, RSSI log, and the trace.
• Ask for a site-specific bus profile; many Satel partners publish per-installation Tslot_init sets for their radio hardware.

11. Linked Manufacturer and Standards Resources

• Siemens Industry Online Support - SIMATIC NET PC Software (PC-Access, CP 5611, CP 5613 A2)
• Siemens WinCC 7.0 SP1 HF5 Readme and Compatibility Matrix
• Siemens S7-300 / CPU 31x-2 DP Manuals
• Satel Oy - Satelline 3AS Radio Modem Datasheet
• PI International (PROFIBUS & PROFINET) - PROFIBUS Specification