Configuring Duplicate Profibus Slave Addresses in Siemens STEP 7

Profibus DP uses a polled, master/slave protocol in which the class 1 master (in this case the integrated DP interface of a Siemens S7-300 CPU 315-2) issues request frames to each slave by its station address in the range 0–126. The protocol requires that the address be unique on a single physical segment; two slaves responding to the same address cause ambiguous frame handling and the master reports a bus fault. This article explains the two supported patterns for keeping a single STEP 7 test program while accommodating several physical networks that share the same master type but have different slave address assignments and different ET200 module counts. The first pattern is to instantiate two or more Profibus subnets inside one STEP 7 project so that the duplicate address is only on a subnet that is not active during a given test. The second pattern is to use one project per physical installation. The article also covers how to keep a single S7 program portable when the largest network carries extra DI/DO modules on its ET200.

Profibus Addressing Rules and Why Duplicates Fail on One Segment

The Profibus DP standard (IEC 61158 Type 3, IEC 61784 CPF 3) reserves addresses as follows:

The physical segment supports up to 32 stations (including repeaters and masters), and a logical network with up to four repeaters can host up to 126 stations. Termination is required at both physical ends of the segment; ET200 IM modules from the IM153 family include a switchable terminator that must be ON only on the two end stations.

When two slaves share an address, the master polls the address, the bus arbitration lets exactly one device respond, and the second device's response collides on the wire. The CRC fails, the master logs a station failure for that address, and the second slave's I/O is never refreshed. The fault is logged in the CPU diagnostic buffer as event ID 0x0E42 (DP slave failure) and the SF LED on the affected slave's IM lights if the slave can self-diagnose the condition. The only correct fix is to give each slave a unique address on the segment.

Two practical exceptions make duplicate addresses feasible in a test setup:

1. The duplicate address is on a different physical subnet that is not connected at the same time as the first subnet.
2. The duplicate address is in a different STEP 7 project that is loaded into the CPU while the conflicting slave is physically disconnected.

Both are valid for the situation of testing one network at a time.

Solution A — Multiple Profibus Subnets Inside a Single STEP 7 Project

STEP 7 V5.5 (and TIA Portal for S7-300/400 via GSD/GSDML) supports multiple DP master systems on the same station, each representing a different physical subnet. You instantiate one DP master system per physical network you intend to test, assign the same CPU 315-2 as the master, and let each DP master system carry the slaves with their native addresses. When you download the project, only the DP master system that is connected to the live bus will cycle data; the others are present in the project as offline configurations. The CPU will not start token exchange on a master system whose bus is unpowered, and the offline slaves remain in standby until their bus is energized and terminated.

Prerequisites

• STEP 7 V5.5 SP2 or later with the HW Config catalog updated for the ET200 IM type in use (IM 153-1, IM 153-2, IM 151-1, IM 151-3 PN, etc.).
• CPU 315-2 with at least one Profibus DP master interface (typical order number 6ES7315-2AH14-0AB0). The X1 interface is MPI/DP switchable; the X2 interface is fixed DP master.
• ET200 GSD file if a non-Siemens slave is used. Install via Options > Install GSD File in HW Config.
• STEP 7 Ethernet, MPI, or USB PC adapter for downloading.
• Profibus cable with termination enabled only on the first and last physical station of each subnet.

Step-by-Step Procedure

1. Open SIMATIC Manager and the project. In HW Config, double-click the CPU 315-2 to open the object properties.
2. On the Interface tab, create a Profibus subnet for the first DP master system. Set a subnet name (e.g. PROFIBUS_DP_NET_A) and pick a transmission rate appropriate for cable length: 1.5 Mbps for typical 200 m installations, 500 kbps for up to 400 m, 187.5 kbps for up to 1000 m. Confirm against the bus profile and cable length.
3. Add the slaves from the catalog to the DP master system. For the standard ET200 stations, drag the IM 153-2 (order 6ES7153-2BA02-0XB0) into slot 0 of the master system. Set the Profibus address via Properties > Profibus > Address (e.g. 3).
4. Stack the standard DI/DO modules in the slots to the right of the IM153-2. This is the "common" ET200 configuration used by all but the largest network.
5. For the second physical network with a different ET200 address, repeat step 1 but this time right-click the CPU 315-2 and choose Insert > Profibus Subnet to add a second DP master system. STEP 7 will name it PROFIBUS(2); rename it to PROFIBUS_DP_NET_B. Use a different subnet ID than the first network.
6. Add the ET200 to the new DP master system with the address that collides with the first network (e.g. 7 on this subnet, even though 7 already exists on the first subnet's offline configuration). HW Config will accept this without warning because the two are on different subnets.
7. For the "largest network" ET200 with the extra DI/DO modules, add a third DP master system, place the same IM 153-2 at the same address as the standard ET200, but stack the extra modules in the higher slots. The hardware catalog accepts the longer slot chain; the I/O addresses in the process image are pushed up accordingly.
8. Compile and save (Station > Save and Compile). The address offsets on the I/O symbols are merged into one consistent process image per DP master system.
9. Download the hardware configuration to the CPU. Only the live DP master system will start token exchange; the others sit idle until their bus is energized and terminated.

Bus Profile Settings

The bus profile set in HW Config controls slot time, max retry, and quiet time for the master. For test rigs with mixed baud rates on the subnets, use the DP profile (default) with the Use configuration checkbox ticked so that the configuration is downloaded with the project. The CPU 315-2 supports profiles DP, Standard, Universal, and User-defined; the User-defined profile lets you override T_SL, max T_SDR, and T_SET for non-standard slaves with long processing delays.

Verification

• In HW Config, select the CPU and use PLC > Module Information to inspect the diagnostic buffer. The active subnet should show DP master system OK.
• Right-click the active DP master system in NetPro and choose DP Master > Activate. STEP 7 reports the live slaves with their online state.
• Open the ET200 slave in Online & Diagnostics. The Cyclic I/O tab shows the current process image; verify that the slot count matches the physical configuration of the live network.

Solution B — Multiple STEP 7 Projects

If the differences between networks are significant (different I/O counts, different field devices), the simplest path is to keep one project per network. The benefit is that every network has its own diagnostic buffer, hardware configuration, and symbol table. The cost is that you must load the correct project before each test. The approach is to mirror the same S7 program source code into each project:

1. Build the S7 program (OB1, FB blocks, DBs, VAT) in a template project. Use symbolic addressing exclusively for the ET200 I/O; do not hard-code absolute addresses that depend on the ET200 slot count.
2. Save the S7 program as a source from the S7 program container using Options > Generate Source. The generated STL/SCL source can be re-imported into other projects via Insert > External Source in the S7 program container.
3. Create a new project per network. Add an S7-300 station with the CPU 315-2. Add the DP master system and the ET200 with the network-specific address and module count. Import the source from step 2 to recreate the S7 program. Recompile and download.

This pattern is the one recommended by Siemens service technicians for installation sites that share a firmware template but have field wiring differences. It is also the easiest to support from a documentation standpoint because the hardware configuration in each project exactly matches the as-built drawing of that network.

Handling a Variable ET200 I/O Count in One Program

The largest network carries extra DI/DO modules on its ET200 compared to the standard ET200 on the other networks. Three concrete strategies keep a single S7 program portable across both cases.

Strategy 1 — Symbolic Addressing with Optional Modules

Declare the extra DI/DO symbols in a single shared symbol table (S7 program > Symbols) regardless of which network is loaded. STEP 7 only resolves the absolute addresses that exist in the active hardware configuration. The unused symbols are flagged in the symbol table as "address not in use" when the configuration is downloaded; the program logic should test for module presence via the IM153-2 status bits before accessing the high-slot I/O. A safe pattern is to use the module-OK bit, which is reported at the first input byte of the slot (bit 7, I-address bit 7), to check whether the input is present before acting on it.

Strategy 2 — Process Image Partition Updates

Assign the high-slot DI/DO to a process image partition (PIP) such as PIP 2, and call UPDAT_PI (SFC 26) and UPDAT_PO (SFC 27) with PIP 2 only when the largest network is active. This avoids the OB1 cyclic update pulling undefined inputs from missing modules into the process image when the standard network is connected. Configure the PIP via HW Config on the slave IM's I/O Addresses tab: change the process image partition assignment from PIP 1 (default, OB1) to PIP 2.

Strategy 3 — Conditional Access via an FB Parameter

Wrap the high-slot logic inside an FB (function block) with an INPUT BOOL bHasLargeNetwork parameter. Pass the parameter from a configuration DB or a hardware input wired to a key switch on the test rig. The FB body guards the high-slot I/O accesses with this flag.

STL Example for Strategy 3

FUNCTION_BLOCK FB_LargeNetwork
VAR_INPUT
  bHasLargeNetwork : BOOL;
END_VAR
VAR
  bDI_HighSlot_Ok  : BOOL;
END_VAR
BEGIN
  IF bHasLargeNetwork THEN
    // Module OK bit at I-address bit 7 of the slot
    bDI_HighSlot_Ok := "I_HighSlot".%X7;
    IF bDI_HighSlot_Ok AND "DI_High_0" THEN
      "DO_High_0" := TRUE;
    ELSE
      "DO_High_0" := FALSE;
    END_IF;
  ELSE
    "DO_High_0" := FALSE;
  END_IF;
END_FUNCTION_BLOCK

Note: the exact location of the module-OK bit depends on the IM153-2 firmware and the slot position. Always check the I/O address assignment in HW Config and the IM153-2 manual for the active firmware version. The principle is that every DP slave that occupies a slot reports a module-OK flag in the process input image at the first byte of the slot.

Consistent Data Access with SFC14 / SFC15

For ET200 modules that transfer more than 4 bytes of process data per slot, Siemens recommends SFC 14 (DPRD_DAT) and SFC 15 (DPWR_DAT) for consistent read/write. The process image access I / Q can yield inconsistent data when the slave's update time falls inside a single OB1 cycle. Calling DPRD_DAT with the slave's configured base address copies the entire DP slot into a DB atomically:

CALL SFC 14  // DPRD_DAT
  LADDR  := W#16#0100    // I-base address of the slot
  RET_VAL:= MW100        // return code
  RECORD := P#DB50.DBX0 BYTE 8  // 8 bytes into DB50

For test programs that read high-slot data on the largest network and skip the read on the standard network, this pattern also avoids the need to read the process image at a slot that may be empty.

GSD File Installation for Non-Siemens Slaves

For Profibus slaves that are not in the STEP 7 catalog (third-party devices, older IM types not in the installed catalog), install the manufacturer-supplied GSD file:

1. Close all STEP 7 windows.
2. Copy the GSD file (extension .gsd) and any bitmap files to the STEP 7 S7DATA\GSD directory.
3. Open HW Config and choose Options > Install GSD File. Navigate to the .gsd file and click Install. STEP 7 will refresh the catalog.
4. The new slave appears in the catalog under PROFIBUS DP > Additional Field Devices. Drag it onto the DP master system and set the address.

For Profibus PA devices, the GSD file may be a .gsd plus a .imp (I&M parameter) file. Both must be installed. The PA device is then placed on a DP/PA coupler or link, and the link's address is what appears in the DP master system.

Single Test Program Pattern — A Reference Skeleton

For a test rig that powers up one network at a time, the recommended program structure is:

1. OB1 — cyclic main. Uses only the common I/O symbols. Calls FB_LargeNetwork for the optional high-slot logic.
2. OB82 — diagnostic interrupt. Logs every module OK / not OK transition to a data block. Lets the test engineer tell which network is live by looking at the diagnostic history.
3. OB86 — rack failure of a DP master system. Logs when a DP master system goes offline. This OB is critical when multiple DP master systems are in the project, because OB86 will fire for the subnet that is not connected.
4. FB_LargeNetwork — encapsulates the high-slot I/O logic as in Strategy 3.
5. DB_Diag — ring buffer of diagnostic events for post-test analysis.

OB86 is particularly useful: the CPU 315-2 raises OB86 each time a DP master system transitions between OK and faulty. The OB86 local variables include the master system number and the logical base address. By writing the latest event to DB_Diag you can read, after a test, exactly which DP master system was last connected to the live bus. Example OB86 diagnostic writeback:

ORGANIZATION_BLOCK OB 86
VAR_TEMP
  info : STRUCT
    event_class : BYTE;
    fault_id    : BYTE;
    priority    : BYTE;
    ob_number   : BYTE;
    reserve1    : BYTE;
    reserve2    : BYTE;
    msf_id      : BYTE;
    md_id       : BYTE;
    ms_id       : BYTE;
    io_flag     : BYTE;
    log_base    : WORD;
  END_STRUCT;
END_VAR
BEGIN
  // Write master system ID and timestamp into ring buffer DB_Diag
  "DB_Diag".last_msf_id := info.msf_id;
  "DB_Diag".last_md_id  := info.md_id;
  "DB_Diag".last_ms_id  := info.ms_id;
  "DB_Diag".last_event  := info.fault_id;
END_ORGANIZATION_BLOCK

Diagnostics and Troubleshooting

When a Profibus slave does not come up, the diagnostic process is to identify whether the fault is addressing, wiring, or configuration. Useful diagnostic methods include:

• CPU diagnostic buffer via PLC > Module Information in STEP 7. Look for event IDs:
  • 0x0E40 — DP master system failure
  • 0x0E42 — DP slave failure (station failure)
  • 0x0E43 — DP slave diagnostics available
  • 0x0E84 — duplicate address detected on the bus
• ET200 SF LED. Solid red means configuration or wiring fault; blinking red means bus fault. The exact meaning depends on the IM family.
• Live list with a Profibus tester. The tester (e.g. Amprolyzer, BT200, or an HMS Anybus Profibus diagnostics tool) lists all addresses it can see on the wire. The duplicate address shows as a single address with garbled responses, or as two devices at the same address with one not responding.
• Bus statistics. Most diagnostic tools report bus errors per second, retry count, and worst-case response time. The HMS Anybus PROFIBUS diagnostics eBook covers the standard physical-layer tests (signal level, termination resistance, shield continuity).

Troubleshooting Matrix

Commissioning Checklist

1. Verify the IM Profibus address against HW Config before powering up. The IM 153-2 displays the active address on its 7-segment display for 5 seconds after power-on, then hides it; you can also read it via the master once the bus is up.
2. Enable bus terminators only on the first and last physical station of each subnet. Disable on all intermediate stations.
3. Confirm the bus transmission rate in HW Config matches the physical rate. STEP 7 auto-detects 9.6 kbps and 19.2 kbps; for higher rates every slave must match the configured rate (most IM153 modules do auto-detect across the full range).
4. For networks that share the same STEP 7 project, mark each DP master system with a clear subnet name. NetPro shows the subnet list in the project tree.
5. Cycle the bus after any change to a slave address. The master retains the old slave in its poll list until it logs a station failure; a power cycle forces a fresh discovery.
6. Document the bus topology (cable length, repeater count, terminator position) and attach the drawing to the project as a "Plant view" in NetPro.
7. For multi-subnet projects, run an OB86 test by disconnecting the live bus and confirming that OB86 writes an entry to DB_Diag with the expected master system number.
8. Validate the high-slot I/O with the largest network before reverting to the standard network, so any timing or scaling issues are caught on the more complex hardware.
9. Store the project archive on the test rig's laptop with a dated SHA-256 hash so that the exact configuration loaded for a test is reproducible.

Specifications