Troubleshooting Siemens S7-315 DP Profibus OB82/OB86 Faults

Problem Overview

Class 1 Profibus DP networks built around the SIMATIC S7-300 family are robust, but they accumulate physical and configuration defects very slowly. A typical symptom — and the one this article is built around — appears in the form of recurring OB82 (diagnostic interrupt) and OB86 (rack/DP-station failure) events at the CPU, with the network eventually refusing to operate at its design baud rate. The master is an CPU 315-2DP, the HMI is a PC running WinCC on a CP5611, the field slave is a Stahl IS remote I/O station with CPM gateway, and the communication hangs invariably point to address 1022 on the DP standard slave side. The bus was originally commissioned at 1.5 Mbps and has been force-degraded to 187.5 kbps to keep the process running.

This article reconstructs the failure mode from first principles, isolates the dominant root causes (physical layer, link layer, configuration layer), and prescribes a deterministic step-by-step recovery path. It is intentionally long because experience with Profibus DP shows that "shooting in the dark" with OB masking is the worst possible strategy: OB82 and OB86 are symptoms, not causes.

Hardware Architecture and Configuration Baseline

Document the station before you change anything. You will need this baseline when you compare online diagnostics with the archived hardware configuration.

Standard PROFIBUS DP baud rates the system can negotiate: 9.6 / 19.2 / 45.45 / 93.75 / 187.5 / 500 / 1500 / 3000 / 6000 / 12000 kbps. Both 187.5 kbps and 1.5 Mbps are valid DP rates per IEC 61158 / IEC 61784. The fact that the system worked at 1.5 Mbps for years and now must run at 187.5 kbps is itself a diagnostic clue: the available signal-to-noise margin on the bus has fallen below the level that 1.5 Mbps requires.

Decoding OB82 and OB86 Event Reports

OB82 is the CPU's "module is reporting a diagnostic change" handler. OB86 is the "rack or DP station failure/return" handler. When you see them firing together at address 1022, the OS of the CPU is telling you this: a DP standard slave at input address 1022 lost its ready state (OB86) and a diagnostic buffer byte came in just before or after the failure (OB82). The line you cited from the diagnostic buffer — "Module type: DP standard slave | Input address 1022 | User information available | Diagnostic interrupt from substitute | External module error" — is the canonical signature of an intermittent physical-layer disconnect on the slave link.

If OB82 is firing with no OB86, the slave is still present but is reporting a non-fatal diagnostic event. If OB86 is firing without OB82, the slave is going silent. Both firing in alternation is the signature of a flaky physical link — the master sees the slave drop, the slave reappears after the next token rotation, and the CPU buffer fills with the back-and-forth event log.

Physical Layer Root Causes

These are the cause in more than 80% of "the bus used to work" Profibus DP symptom sets in aged plants. Walk them in order.

2.1 Termination and DIP Switches

Only the two end nodes of a Profibus DP segment may have the bus terminator engaged. The terminator between pins 3 (Data B / RxD/TxD-P) and 8 (Data A / RxD/TxD-N) is nominally 220 Ω, plus 390 Ω pull-ups to the 5 V isolated reference on each line. With the system powered down, set the DIP switch ON at the CPU end connector, OFF at every intermediate connector, and ON at the Stahl slave end. Measure with an ohmmeter between pins 3 and 8 at the far (terminator-OFF) end: you should read 220 Ω.

2.2 Shield Bonding at Both Ends

This is the single most common mistake in retrofits. Unlike instrumentation cable (single-ended ground, noise rejection by grounded shield only at one end to break ground loops), Profibus cable shield must be bonded to functional earth at both ends of every segment, with the bonding surface area being as large and as flat as possible (the connector backshell or a 360° shield clamp). Single-ended grounding looks fine for months; then EMC drift, drive activity, or a VFD retrofit pushes common-mode noise across the link until the master starts losing the last bit of the byte — first random telegrams, then full address-1022 loss.

2.3 Cable Damage and Pin Condition

Check the cable run for pinch points, kinks behind trunking, and crushed jacket. With the connector removed, visually inspect pin 6 (VP / +5 V) and pin 5 (DGND) for bent or retracted pins — these are the termination power rails and a bent pin here is enough to drop the link entirely when the terminator is engaged. Verify the connector's screw locks are fully torqued; a connector that backs out by 1 mm changes the characteristic impedance of the stub.

2.4 Minimum Trunk Length Between Nodes

Maintain at least 2 m of trunk between any two PROFIBUS DP nodes, including taps. Stubs longer than the allowed "stub" limit are a separate consideration per baud rate, but at 1.5 Mbps and 187.5 kbps what kills networks more often is the <2 m spacing producing reflective edges inside the segment.

2.5 Segment Length vs Baud Rate

If the segment is anywhere near the 200 m limit at 1.5 Mbps, the degradation to 187.5 kbps is a brute-force workaround, not a fix — and it still works no better than the underlying physical problems allow.

Link Layer Root Causes

3.1 Baud Rate Collapse Pattern

The "drop down to a slower baud rate to keep it working" behaviour is the textbook sequence of:

1. Early frames at 12 Mbps only failing during VFD start/stop → faster baud accepted.
2. Intermittent failures that worsen at 1.5 Mbps → operator downgrades to 500 kbps.
3. Recurring OB82/OB86 at 500 kbps → operator downgrades to 187.5 kbps.
4. OB82/OB86 events persist at 187.5 kbps → eventually the network becomes unusable.

If you have walked the bus down this staircase, fix the physical layer first; do not paper over it further.

3.2 Repeater Count and Topology

A maximum of 32 stations per segment is allowed without repeaters, and up to 126 stations per Profibus network if you cascade repeaters (each repeater counts as a station to the segment behind it). Newer field devices — including some Stahl-series and third-party isolated couplers — require their segment to terminate behind a repeater even when no repeater would be needed purely for electrical reasons. When in doubt, insert an active repeater at the slave end; do not push the existing master/slave segment past 32 logical stations.

Configuration Layer Root Causes

4.1 GSD File Mismatch

If a GSD file revision on the programming laptop is older or newer than the one actually loaded into the slave during commissioning, the master uses a different module catalog than the device. Slot counts, diagnostic bit positions, and DPV1 service lengths all change between GSD revisions. The symptom is a slave that powers up, enumerates, then either drops address resolution or fires periodic OB82s while the slave's own diagnostic LEDs show no fault. Verify the GSD file revision on the laptop matches the one in the archived STEP 7 project used at commissioning.

4.2 System Data Loss / Re-load

STEP 7 hardware configuration compiles to a System Data container (SDB files) under Blocks → System Data. If the master CPU was recently STOPPED due to a station failure or a memory reset, or if the project was downloaded with different HW parameters than the previous archive, the System Data block now on the CPU may be inconsistent with the field. Open the most recent archived project, locate its System Data entries, and compare them with the online HW Config view. If mismatch → download the archived System Data to the CPU.

4.3 Slot-0 Default Diagnostic Address 1022

Address 1022 (decimal) is the slot 0 default diagnostic address STEP 7 assigns to a DP slave. If the slave you are seeing fails is the third or fourth station you have replaced and the diagnostic address keeps showing as 1022, check the GSD definition: many slave manufacturers treat slot 0 as the DP slave's "station diagnostic" address, not the I/O start address. 1022 is the slave diagnostic address; the actual I/O start address is a separate field. Reading only the diagnostic address can mislead you into thinking the wrong module is at fault.

Diagnostic Procedure with SIMATIC Manager

1. Connect online to the CPU (PLC → Accessible Nodes) and confirm the CPU goes online without an SF LED at this moment.
2. In the project tree on the offline view, right-click Blocks, choose PLC → Module Information. The diagnostics buffer shows the last OB82 and OB86 with timestamps.
3. In Module Information → Diagnostic Buffer, open the OB86 entry and read Address: confirm it equals 1022 and that Event is Station failure, not a rack failure.
4. Open the OB82 that immediately follows the OB86: read its Channel, Error, and Interrupt bytes. The two events are jointly diagnostic only when read together.
5. Switch to HW Config, right-click the CPU module, and use PLC → Module Information → Diagnostic to read the DP station's diagnostic data block. Look at byte 0..5 for status flags and at byte 6..15 for vendor-specific ext_diag.
6. With the program stopped, hot-swap the bus connector at the slave and observe whether the BF (bus fault) LED on the slave clears within 5 s. If it does not clear, the slave's DP interface has additional concerns (address, termination power, or device failure).
7. Capture Statistics under PG/PC Interface → Diagnostics on the WinCC PC's CP5611. Look at Repeated Telegrams, Lost Telegrams, and Error Counters. Sustained growth on these counters during a quiet process moment confirms physical layer problems.

Cable, Termination, and Shielding Verification

1. Power off the master, the PC, and the slave. Disconnect the bus connectors.
2. Engage the terminator at the CPU connector (DIP ON) and the Stahl end connector (DIP ON). All intermediate connectors must be DIP OFF.
3. At the CPU connector, measure between pins 3 and 8 with an ohmmeter. Reading must be 220 Ω ± 5%.
4. At the intermediate connectors, between pins 3 and 8 you should see ≈3 × 220 Ω = 660 Ω (the parallel of the two end terminators through the segment). On long >200 m segments this will look different — note the reading, this is your baseline.
5. Verify pin 6 (VP) to pin 5 (DGND) at each end: you should see the passive terminator resistor network but no short. A shorted pin 6/5 pair is a common fault after a flash-over event.
6. Reconnect and verify the shield is bonded to functional earth at both ends with a 360° clamp or a backshell whose drain wire is firmly clamped to the connector shell.
7. Restart the master first, then the PC, then the slave. Wait one full token rotation (typically < 20 ms at 1.5 Mbps) before bringing the process online.

GSD and Hardware Configuration Recovery

1. Open the most recent archived STEP 7 project for this plant.
2. In HW Config, right-click the slave, choose Properties → Slave Diagnostics, and capture the slot count, I/O addresses, and the diagnostic address (should equal 1022).
3. Open the current project on the laptop, locate the same slave node, and compare. A mismatch in module order, slot count, or diagnostic structure means the System Data block on the CPU is no longer in sync.
4. Right-click the CPU module, choose PLC → Download → select System Data. Accept the prompt to overwrite the online CPU's System Data block with the archived values.
5. Confirm that the GSD file revision listed in HW Config matches the one specified in the project archive. If different, install the correct GSD into HW Config → Options → Install GSD File, recompile, and re-download.
6. Cycle the DP slave power after the download so it re-enters the data exchange phase with the new parameterisation.

Repeater Segment Strategy and Diagnostic Repeater

If the segment is approaching the maximum node count or the trunk runs near any VFD or welding circuit, isolate the slave behind a Profibus repeater. A standard Profibus repeater (e.g. Siemens 6ES7 972-0AA02-0XA0 or compatible third-party) regenerates the signal levels and physically decouples segments. If you want per-segment diagnostics without investing in the BT-200 cable tester, install a Diagnostic Repeater at the slave end (order code 6ES7 972-0AB01-0XA0). It produces statistics data that STEP 7 reads back as a DP-V1 extension and exposes Error Counters, Repetition, and Loss-of-Telegram counters into the STEP 7 diagnostics interface.

Two practical reasons to prefer a Diagnostic Repeater even when you don't need it for signal restoration:

• It gives you a per-segment, per-station trouble log without manual cable probing.
• It isolates noise from VFDs / soft starters from contaminating the master segment.

Step-by-Step Resolution Procedure

1. Capture baseline. Archive current project + System Data + diagnostic buffer + the GSD file revision.
2. Visual & physical audit. Walk the trunk, verify shield bonds at both ends, verify DIP switches (ON at ends only), verify > 2 m spacing between nodes.
3. Move the terminators. Power down, install 220 Ω terminators at both physical ends, verify with ohmmeter.
4. Verify the slave connector pin-out. Visually inspect pin 6/5, look for bent pins, re-tighten connector screws.
5. Compare GSD. If GSD mismatch suspected, copy the archived GSD file into the current project, recompile HW Config, and download.
6. Re-load System Data. Download System Data to the CPU, cycle slave power.
7. Re-test at 1.5 Mbps from a quiet process moment. If the bus holds > 30 minutes with no OB82/OB86, the issue is solved.
8. If OB82/OB86 returns at 1.5 Mbps: insert a Diagnostic Repeater at the slave end and check its counters over the next 24 h — you now have isolated the noise to either the master segment or the slave segment.
9. Persistent single slave failure with healthy neighbouring stations: replace the slave's Profibus DP interface (or the slave itself), reusing the original GSD file and diagnostic address 1022.
10. Enable trend logging in WinCC on the OB82 EVENT number and the OB86 EVENT number so the next intermittent event is time-stamped against the running process. Without trend logging you will be debugging blind.

Verification and Long-Term Monitoring

Once the OB82 and OB86 events are no longer accumulating at 1.5 Mbps, do not declare victory and walk away — configure permanent monitoring:

• Add a WinCC trend for the SF/BF LEDs of the CPU and the slave so you can plot them alongside any future process excursion.
• Enable the Diagnostic Repeater's counter write-back into WinCC tags.
• Schedule an annual physical-layer audit with a portable tester — the Siemens BT-200 (order code 6GK1 904-5BA00) walks the bus at multiple baud rates and highlights reflection, dead segments, and termination quality. It is faster than a manual probe pass and is the right tool for a plant of this complexity.
• Keep the GSD file under version control. Whenever you swap the slave firmware or the device itself, capture the new GSD and add a comment to the project.

Frequently Asked Questions