Overview: Process Image and I/O Addressing in S7-300
The process image in a Siemens SIMATIC S7-300 CPU is a memory area in the system memory where the states of digital and analog inputs (Process Image of the Inputs, PII) and outputs (Process Image of the Outputs, PIO) are stored as a snapshot at the beginning of each OB1 cycle. The CPU copies the process image between the peripheral (P) I/O area and the internal bit memory area once per scan, then executes the user program against the consistent internal copy. This decoupling makes the program execution deterministic because the I/O does not change mid-cycle.
For the S7-300 and S7-400 families, the Siemens TIA Portal documentation describes the process image as a fixed partition of the input (I) and output (Q) address ranges. The default partition for the S7-314C-2 PN/DP is 256 bytes for inputs and 256 bytes for outputs, but the actual usable range depends on the CPU variant and any integrated I/O already mapped at low byte addresses.
CPU 314C-2 PN/DP Hardware Specifics
The CPU in question is the 6ES7 314-6EH04-0AB0, firmware V3.3. This compact CPU is part of the "C" (Compact) family and ships with hard-wired I/O on the front of the module before any signal module is plugged into the rack.
| Parameter | Value |
|---|---|
| Order number (MLFB) | 6ES7 314-6EH04-0AB0 |
| Firmware version | V3.3 |
| Integrated digital inputs (DI) | 24 channels (24 V DC), 4 of which are usable as HSC or interrupt inputs |
| Integrated digital outputs (DO) | 16 channels (24 V DC, 0.5 A) |
| Integrated analog inputs (AI) | 4 channels (0 to 10 V / 0 to 20 mA / RTD / thermocouple, depending on wiring) |
| Integrated analog outputs (AO) | 2 channels (0 to 10 V / 0 to 20 mA / ±10 V) |
| PROFINET interface | 2-port switch, supports PROFINET IO Controller and IO Device |
| PROFIBUS interface | DP master / DP slave (selectable) |
| Default PII size | 256 bytes |
| Default PIO size | 256 bytes |
| Maximum PII / PIO size | 1024 bytes each (CPU dependent; many S7-300 CPUs cap at the smaller of 1024 bytes or the OB1 process image maximum) |
Because the integrated I/O occupies fixed byte addresses inside the CPU itself, the very first external DI or DO module does not begin at IB0/QB0 on a C-type CPU. This is the source of the confusion reported in the field report, where the user observed DI/DO "starting at 124" — the integrated I/O is being assigned the lowest free byte addresses first, and the user's perception of "124" reflects the visible address gap after those integrated channels are mapped.
How the Address Map Is Built
When you load HW Config / TIA Portal device configuration, the Siemens configurator assigns byte addresses in the following deterministic order:
- Integrated I/O of the CPU (for the 314C-2 PN/DP, that is 24 DI + 16 DO + 4 AI + 2 AO) — these are mapped first, so they consume the lowest I and Q byte numbers.
- Central signal modules (SM) in slot 4, 5, 6 ... in the order they are physically plugged.
- Distributed I/O (PROFINET / PROFIBUS slaves) starting at the configured start address of each station header.
For a 314C-2 PN/DP with the default settings, the typical starting addresses look like this:
| I/O Type | Byte Length | Typical Starting Address (default) |
|---|---|---|
| Integrated DI | 3 bytes (24 bits, only 24 of 32 used) | I 124.0 ... I 126.7 (display in the source) |
| Integrated DO | 2 bytes (16 bits) | Q 124.0 ... Q 125.7 |
| Integrated AI | 8 bytes (4 channels × 16 bits) | PIW 128 ... PIW 134 |
| Integrated AO | 4 bytes (2 channels × 16 bits) | PQW 128 ... PQW 130 |
| First external SM (slot 4) | Module dependent | Follows immediately after integrated I/O |
When Do You Need to Increase the Process Image Size?
The process image is sized in bytes. There are two independent parameters:
- PII size (input process image, in bytes)
- PIO size (output process image, in bytes)
You only need to enlarge either partition when the highest byte address actually consumed by your hardware configuration exceeds the configured limit. The rule is straightforward:
Required_PII_bytes = ceil( (highest_input_bit_address + 1) / 8 )
Required_PIO_bytes = ceil( (highest_output_bit_address + 1) / 8 )
For example, if you place a digital input card that ends at I 117.7 in HW Config, the highest byte is 117, and the required PII size is 118 bytes minimum. The default 256-byte PII still has plenty of headroom, so no enlargement is required.
Conversely, if you map a remote PROFINET station that occupies inputs I 256.0 ... I 271.7, the highest byte is 271, and the PII must be configured to at least 272 bytes (round up to the next multiple of 16 in the GUI: 288 or 512). Anything lower and STEP 7 / TIA Portal issues an SDF (System Data Flow) consistency error at compile time, complaining that the configured address exceeds the process image boundary.
Common scenarios that force you to enlarge the process image:
- Large distributed I/O stations assigned high start addresses (start address of station > current PII/PIO size).
- Central racks filled beyond 8 SM slots, where bit addressing pushes past 256 bytes (rare on S7-300).
- Re-mapping after firmware update that re-arranged the integrated I/O assignment (some firmware revisions change the base offset).
Address Gap Between Integrated I/O and the First External Module
A frequent misunderstanding is that an address gap inside the configured process image is "wasted" memory. The Siemens TIA Portal documentation on process images is explicit: address gaps inside the configured PII/PIO partition are still scanned each cycle. The CPU must address every byte from byte 0 up to the configured size once per OB1 cycle to keep the snapshot consistent.
For the 314C-2 PN/DP, the integrated DI/DO/AI/AO occupy low bytes (124 onward in the user's view), and the first external SM starts at the next free byte. If the user adds a remote I/O station with start address 1000, the gap from 128 (or wherever the integrated I/O ends) to 999 is filled with undefined bits. The CPU still scans the full configured range, even if those bits are reserved or unused.
PIB 1000 or PQB 1000 directly without touching the process image. This is the recommended technique when you need a single, high-address module and do not want to enlarge PII/PIO just for one station.Scan Time Impact of Enlarging the Process Image
Siemens' S7-300/S7-400 CPU specification manuals state qualitatively that "the total scan time will increase if the process image area is increased." The mechanism is the OB1 housekeeping that copies PII in and PIO out before and after user program execution.
A practical upper-bound estimate for the additional overhead is:
t_pi_overhead ≈ 2 × (PII_bytes + PIO_bytes) × t_byte_copy
Where t_byte_copy is the per-byte copy time of the CPU. For a 314C-2 PN/DP (firmware V3.3), a representative order of magnitude for t_byte_copy is in the sub-microsecond range — typically 50 to 200 ns per byte, depending on whether the bytes are cached, located in integrated I/O, or in distributed I/O memory. With a PII of 1024 bytes and a PIO of 1024 bytes:
t_pi_overhead ≈ 2 × (1024 + 1024) × 100 ns = 409.6 µs ≈ 0.41 ms
This is a measurable but small fraction of typical cycle times (5 to 50 ms). In other words, enlarging the process image from 256 to 1024 bytes adds roughly 0.3 to 0.4 ms of overhead on a 314C-2 PN/DP — well below the 1 ms threshold where most application engineers would notice the change.
| Configured PII = PIO | Approx. Overhead (314C, fw V3.3) | Notes |
|---|---|---|
| 128 bytes | ~0.05 ms | Minimum partition some S7-300 CPUs allow |
| 256 bytes | ~0.10 ms | Factory default for the 314C-2 PN/DP |
| 512 bytes | ~0.20 ms | Common for medium distributed I/O |
| 1024 bytes | ~0.41 ms | Maximum typical S7-300 PII/PIO |
The theoretical scan time does increase with process image size, but the slope is shallow. If your program OB1 time is 5 ms with PII = PIO = 256, expect approximately 5.31 ms with PII = PIO = 1024 under the same user program. The dominant term is the user program, not the process image overhead.
Configuring the Process Image in STEP 7 / TIA Portal
Configuration is identical in STEP 7 V5.5 and TIA Portal V16+:
- Open HW Config (STEP 7) or the Device Configuration (TIA Portal).
- Click the CPU rack icon (the slot 2 / slot 3 module).
- Open the Properties dialog and select "Cycle / Clock Memory" (German: Zyklus / Merkerbits) or "I/O addresses / Process image" depending on the tool.
- Enter the new sizes in bytes for Input process image and Output process image.
- Click OK, then Save and Compile.
- Download the new System Data to the CPU (STOP mode required for some firmware versions).
In TIA Portal V17+, the field labels are:
- Size of the process image input area [bytes]
- Size of the process image output area [bytes]
Values are accepted in multiples of 8 bytes up to the CPU-specific maximum. If you enter a value larger than the CPU maximum, the configurator truncates it with a warning, and the HW consistency check will refuse to compile until the value is corrected.
Direct Peripheral I/O Access (P Area) as an Alternative
When enlarging the process image is undesirable — for example, to avoid scan-time overhead or to access a single high-address module — the Siemens documentation recommends direct peripheral access. This bypasses PII/PIO entirely:
// Ladder example - read input byte from P area
L PIB 1000 // direct peripheral input byte read
T MB 100 // copy to flag byte
// STL equivalents
L PIB 1000
T MB 100
// SCL example
myByte := "PIB1000"; // direct read, no process image
myWord := "PIW1000";
The drawback is that direct access is non-atomic. If the I/O module updates its byte between two reads of adjacent bytes, you can get inconsistent data. Use this technique only for single-byte reads or for high-speed signals where the process image update latency is unacceptable. For interlock and safety-related signals, always use the process image.
Common Pitfalls and Field-Proven Caveats
- Forgetting the integrated I/O offset. Engineers familiar with non-C S7-300 CPUs (e.g., 315-2 DP) expect IB0 to be the first external DI. On the 314C family, IB0 is reserved for integrated I/O that may not be used. Address gaps cannot be reclaimed.
- Re-sizing only one partition. The PII and PIO are independent. If you add many digital inputs but few outputs, enlarge only the PII.
- Process image vs. PROFINET update. PROFINET devices also have their own update time, controlled by the device configuration. The process image size does not change the PROFINET cycle time.
- Firmware-specific maximums. Some S7-300 firmware revisions cap the PII/PIO at 256 bytes. Always check the CPU-specific technical data sheet for the firmware version in use.
- Download behavior. Process image size changes usually require STOP mode download on older S7-300 CPUs. RUN-mode download is supported on the 314C-2 PN/DP firmware V3.0+ but only if the new size does not change the address layout.
Verification Checklist
After changing the process image size, verify the configuration with these steps:
- In TIA Portal, run Compile > Hardware (rebuild all). There must be no SDF errors.
- In the CPU diagnostics buffer (Online & Diagnostics > Diagnostic Buffer), confirm there is no "Process image size mismatch" entry after download.
- In the user program, add a "watch table" reading the highest-byte input of every configured remote station. Confirm the values match the physical wiring.
- Use the SFC 13 "DP_TOPOL" (PROFIBUS) or "DPV_TOPOL" (PROFINET) functions to verify that all distributed I/O stations are online.
- Measure the OB1 scan time before and after the change with a hardware timer or with the
OB1_PREV_CYCLEtag in the system clock bits.
Cross-Platform Notes on Process Image
Process image mechanics are not unique to Siemens. Other vendors use the same architectural concept, with platform-specific naming:
- Beijer Electronics (Click and X2 series controllers): the input process image is ordered strictly by expansion slot position — see the Beijer IO Process Image Map. Data width, type, and slot order determine the byte position.
- WAGO 750/753 I/O-System: the head station (e.g., 750-8202 PFC200) builds a local process image from the data width, module type, and slot position, as documented in the WAGO TechDocs Process Image page. Each terminal module contributes a deterministic slice of the image.
The Siemens-specific behavior is that the CPU's integrated I/O slots are treated as the lowest physical slots before any external signal modules, which has no equivalent in modular systems that lack integrated channels.
FAQ
Why does my CPU 314C-2 PN/DP show DI/DO starting at byte 124 instead of byte 0?
The CPU 314C-2 PN/DP (6ES7 314-6EH04-0AB0) has 24 integrated DI, 16 integrated DO, 4 integrated AI, and 2 integrated AO on the front of the module. The Siemens configurator assigns the lowest free byte addresses to these integrated channels first, so any external SM you plug into the rack begins at a higher byte (typically in the 124 range). This is fixed hardware behavior, not a configurable option.
How do I know when to enlarge the process image size?
Open HW Config / Device Configuration and check the highest byte address assigned to any input or output. If that byte exceeds the configured PII/PIO size, you must enlarge that partition. STEP 7 / TIA Portal also emits a compile error ("Address exceeds process image boundary") if the configured module does not fit, so the tool will tell you when an increase is required.
Does enlarging the process image from 256 to 1024 bytes significantly affect scan time?
On a 314C-2 PN/DP firmware V3.3, the additional overhead is approximately 0.3 to 0.4 ms per OB1 cycle, dominated by the PII/PIO copy step. This is small compared to typical user-program execution times of 5 to 50 ms. The scan time does increase, but the slope is shallow and rarely the limiting factor in cycle time budgeting.
Can I access high-address modules without enlarging the process image?
Yes. Use direct peripheral access with the P area, for example L PIB 1000 in STL or PIB1000 in SCL. The CPU reads or writes the peripheral byte directly without involving the process image. Note that direct access is not atomic across multiple bytes, so use it carefully for interlock or safety-related signals.
Is the default 256-byte PII/PIO limit hard-coded on the 314C-2 PN/DP?
No. The default is 256 bytes per partition, but both can be enlarged up to the CPU-specific maximum (commonly 1024 bytes for S7-300). On the 314C-2 PN/DP with firmware V3.3, values up to 1024 are accepted by the configurator. Some older firmware revisions may cap lower; always consult the CPU-specific technical data sheet for your exact firmware build.