Configuring PROFIBUS DP Slave I/O Addressing and Data Exchange in SIMATIC S7

In SIMATIC S7 controllers (S7-400, S7-300, and S7-1500), PROFIBUS DP slave I/O data from third-party modules (such as Turck, Beckhoff, or Festo) is accessed either through direct Process Image addressing or peripheral system functions. If slave I/O slots are assigned within the CPU's Process Image Input/Output range (e.g., I4.0, IB4, QB4), the operating system updates data cyclically without user code. For consistent data blocks exceeding 4 bytes or addresses located outside the process image, you must use system functions SFC14 (DPRD_DAT) to read and SFC15 (DPWR_DAT) to write.

PROFIBUS DP Master-Slave Data Exchange Architecture

In SIMATIC automation systems, PROFIBUS DP operates as a deterministic master-slave fieldbus protocol adhering to IEC 61158 / EN 50170. An S7 DP Master—such as an S7-400 CPU (6ES7410-5HX08-0AB0), CP 443-5 Extended (6GK7443-5DX05-0XE0), or S7-1500 with CM 1542-5 (6GK7542-5DX00-0XE0)—cyclically polls configured DP slaves (e.g., modular Turck BL20/BL67 stations, drives, and valve manifolds).

Each slave device integrates into the master's configuration via a manufacturer-provided Device Master File (GSD file). In the engineering software (STEP 7 HW Config or TIA Portal), the engineer inserts the slave onto the DP master system and configures individual I/O modules into virtual slots, establishing defined logical input and output addresses.

Process Image Addressing vs Peripheral System Functions (SFC14/SFC15)

The method used to read and write DP slave data in the controller program depends on the address range and consistency requirements:

Addressing ModeConfigured Address RangeProgram Access SyntaxData Consistency LevelTypical ApplicationProcess Image (PII / PIQ)Within CPU Process Image (e.g., 0 ... 511)I4.0, IB4, IW4, Q4.0, QB4Byte or Word consistent; cyclic CPU OS update at OB1 cycle boundary.Standard digital I/O, simple 2-byte analog values, status words.Direct Peripheral AccessOutside Process Image or immediate readPIB4, PIW4, PQB4, PQW4Byte or Word consistent; immediate bus access during instruction.Time-critical single signals; addresses beyond default process image.Consistent Read (SFC14)Configured with consistency: Total Length (> 4 bytes)CALL "DPRD_DAT" (SFC14)Complete payload consistent across all bytes (3 to 64 bytes).Drives (PROFIdrive telegrams), multi-channel analog modules, weighing scales.Consistent Write (SFC15)Configured with consistency: Total Length (> 4 bytes)CALL "DPWR_DAT" (SFC15)Complete payload consistent across all bytes (3 to 64 bytes).Drive command telegrams, position setpoints, multi-word control records.

Table 1: S7 controller data access methods for PROFIBUS DP slaves.

Configuring Third-Party GSD Slaves in HW Config

To configure and access third-party DP slaves in STEP 7 / PCS 7:

Install the Slave GSD File:
* In HW Config, select Options > Install GSD Files.
* Browse to the directory containing the vendor's .gsd file and install it.
Assign the Slave to DP Master System:
* Drag the slave from the catalog (PROFIBUS DP > Additional Field Devices) onto the PROFIBUS line.
* Set the unique PROFIBUS DP station address (matching physical rotary switches on the slave).
Configure Modular I/O Slots:
* Insert physical I/O submodules into the rack slots (e.g., Slot 1 = 4 DI, Slot 2 = 4 DO, Slot 3 = 2 AI).
* HW Config automatically assigns start addresses (e.g., Input byte 4, Output byte 4).
Determine Consistency Settings:
* Double-click the slot row. Under the Addresses tab, check the Consistency setting.
* If consistency is Unit (Byte/Word), direct addressing (IB4, QB4) is valid.
* If consistency is Total Length (e.g., 8 bytes consistent), note the hexadecimal hardware start address for use with SFC14/SFC15.

Integration into SIMATIC PCS 7 and Driver Generation

In SIMATIC PCS 7, manual peripheral addressing (PIW/PQW) in CFC is discouraged in favor of automated channel drivers:
* For standard modular I/O, map the hardware input address to PCS 7 channel driver blocks (Pcs7DiIn, Pcs7AnIn) in CFC.
* When executing Chart > Compile > Generate Module Drivers, the PCS 7 driver generator creates diagnostic blocks (MOD_D1, DPDIAGV0) to monitor slave station health, power failure, and bus line breaks.
* If a third-party slave lacks standard PCS 7 driver support, use the generic channel driver blocks or connect addresses directly to technological block inputs, and monitor slave diagnostic status using system function SFC51 (RDSYSST).

Verification

To confirm proper communication and data exchange:

Download the hardware configuration to the S7 CPU: confirm that the BUSF (Bus Fault) and BF LEDs on the CPU and slave extinguish.
In STEP 7 / TIA Portal, open a Variable Table (VAT).
Enter test addresses: IB4 (Input Byte 4) and QB4 (Output Byte 4).
Monitor inputs: toggle physical inputs on the slave module and confirm byte bits toggle in real time.
Modify outputs: force QB4 = 16#FF and confirm that digital output LEDs on the physical slave illuminate.
If using SFC14/SFC15, verify that the RET_VAL output returns 16#0000 (success).

Limitations and Operational Precautions

Never attempt to access a slave slot configured with Total Length consistency using direct instructions (e.g., L PIW4); the CPU will trigger an access error and call OB122 (I/O Access Error OB).
Verify that the total DP bus baud rate and cable lengths adhere to RS-485 guidelines (e.g., 1.5 Mbps maximum 200 m per copper segment without RS 485 repeaters 6ES7972-0AA02-0XA0).
Always ensure proper PROFIBUS terminating resistors are activated at both physical endpoints of the bus segment.

Engineer FAQ

What does error 16#8090 on SFC14 mean?

Return code 16#8090 indicates that the specified hardware address (LADDR) was not configured in HW Config, or that the configured slot does not possess consistent data properties.

Can I expand the CPU process image to include all slave addresses?

Yes. In CPU Properties > Cycle/Clock Memory, you can enlarge the process image partition (OB1 process image) up to the CPU model's maximum limit, allowing direct tag addressing for all fieldbus devices.

Do third-party DP slaves support hot-swapping in PCS 7?

Hot-swapping (Removal and Insertion under Power) requires active backplane bus modules (such as ET 200M active bus modules 6ES7195-7HD10-0XA0). Most third-party modular slice I/O do not support hot-swapping without causing a temporary bus interruption unless specifically certified.