Configuring S7-416-2DP and IM151-7CPU Profibus DP Communication

Overview

Coupling a SIMATIC S7-400 (CPU 416-2DP) to a distributed ET 200S station equipped with an IM 151-7 CPU over PROFIBUS DP requires careful attention to which side can act as the active (client) partner and which side is restricted to the passive (server) role. The IM 151-7 CPU integrates an S7-CPU into the ET 200S, but its integrated PROFIBUS DP interface is fundamentally a slave interface: the module can be addressed as a server by an external master, but it cannot initiate S7 communication as a client on this interface.

This reference covers the supported combinations of PUT/GET, basic S7 communication (I_PUT/I_GET), and direct I/O data exchange (DPRD_DAT/DPWR_DAT) for the order numbers 6ES7416-2XN05-0AB0 and 6ES7151-7AA21-0AB0, and shows the working code blocks (STL/SCL) for SFB14 (GET) and SFB15 (PUT) issued on the S7-400 master side.

Hardware Identification and Order Numbers

Verify the exact hardware versions before commissioning. Both modules have multiple firmware revisions that change the available communication services.

Cross-reference: the 6ES7416-2XN05-0AB0 is the V5 firmware (final V5.3 release for the AS 414/416 family), supporting S7 communication, SFB14/SFB15, and the basic S7 services. The 6ES7151-7AA21-0AB0 is the ET 200S CPU in its standard (non-F, non-FO) variant. See the SIMATIC S7-400 Automation System manual and the ET 200S IM 151-7 CPU manual for the full hardware description.

Communication Architecture Constraints

The IM 151-7 CPU is a hybrid: it is a full SIMATIC S7-CPU in its own right (it can run a STEP 7 user program) but its PROFIBUS DP slave interface can only terminate connections as a server. The DP master side (the S7-400) initiates every S7 communication job.

S7 Communication Primitives: PUT/GET vs I_PUT/GET

Two distinct S7 communication families are available over the same DP cable. Choose based on the version of STEP 7 installed and the required data volume.

For the typical engineering case — exchanging a few hundred bytes between an S7-400 and the ET 200S — SFB14/SFB15 is the correct choice. The basic S7 services (I_PUT/I_GET) are kept for legacy projects or for cross-MPI links where configuring a connection in NetPro is undesirable.

Configuration Procedure in STEP 7 / TIA Portal

1. Install GSD file for the IM 151-7 CPU (only required for non-Siemens master tools). The IM 151-7 CPU appears as IM151-7 CPU in HW Config under PROFIBUS DP > ET 200S. In TIA Portal, the device is in the catalog under Other field devices > PROFINET IO > ET 200S (PROFIBUS variant).
2. Assign a PROFIBUS address to the IM 151-7 CPU (e.g. 4). Make sure the address switch on the module matches the configured value if a hardware switch is present.
3. Configure the S7-400 as the DP master with the higher PROFIBUS address (e.g. 2). The integrated DP port of the CPU 416-2DP is the default master interface; do not enable the DP slave tab on the CPU 416-2DP unless the S7-400 is itself also to be a slave of a higher-level controller.
4. Open NetPro (STEP 7) or Devices & Networks (TIA) and insert an S7 connection from the S7-400 to the ET 200S CPU. The connection type S7 connection is used; the local endpoint is the CPU 416-2DP, the partner endpoint is the IM 151-7 CPU.
5. Set the connection to "PUT/GET active" on the S7-400 side. The IM 151-7 CPU's connection properties are typically left at the default (server). If the ET 200S CPU also runs PUT/GET, mark the partner endpoint accordingly; otherwise, leave the partner as "server only".
6. Compile and download the HW Config and NetPro data to both stations. NetPro writes a connection ID (e.g. 1) and a remote TSAP that SFB14/SFB15 will reference.
7. Load the S7 program containing SFB14 (GET) and SFB15 (PUT) into the S7-400. The IM 151-7 CPU does not need any S7-communication block; the integrated firmware handles incoming PUT/GET requests automatically.

SFB14 (GET) Programming Example

SFB14 reads a contiguous data area from the IM 151-7 CPU into a data block on the S7-400. The call must appear in OB1 (cyclical) or in a watchdog/cyclic OB; SFB14 must be called at intervals shorter than the configured keep-alive time, otherwise the connection times out.

// S7-400 STL example (OB1)
// Read 32 bytes of process data from IM 151-7 CPU DB 100 starting at byte 0
// into S7-400 DB 200 starting at byte 0

CALL  "GET" , DB14        // instance DB for SFB14, generated automatically
     REQ   :=M10.0        // rising edge triggers one GET job
     ID    :=W#16#1       // connection ID from NetPro
     ADDR_1:=P#DB100.DBX 0.0 BYTE 32   // remote area 1
     ADDR_2:=P#DB100.DBX 32.0 BYTE 32  // remote area 2 (optional)
     ADDR_3:=P#DB100.DBX 64.0 BYTE 32  // remote area 3 (optional)
     ADDR_4:=P#DB100.DBX 96.0 BYTE 32  // remote area 4 (optional)
     RD_1  :=P#DB200.DBX 0.0 BYTE 32   // local receive area 1
     RD_2  :=P#DB200.DBX 32.0 BYTE 32  // local receive area 2
     RD_3  :=P#DB200.DBX 64.0 BYTE 32  // local receive area 3
     RD_4  :=P#DB200.DBX 96.0 BYTE 32  // local receive area 4
     NDR   :=M20.0        // new data received (pulse)
     ERROR :=M20.1        // error flag (static while ERROR = 1)
     STATUS:=MW22;        // extended status word

The maximum total length per call is 462 bytes, spread across up to four address areas. The ADDR_1..ADDR_4 pointers must use the ANY pointer format with a single byte-aligned data area each.

For SCL, the equivalent call is:

// S7-400 SCL example
// Trigger GET once per second
IF "Trigger_GET" THEN
    "GET_DB"(REQ := TRUE,
             ID  := 1,
             ADDR_1 := P#"IM151_7".DB100.DBX 0.0 BYTE 32,
             RD_1   := P#"Local".DB200.DBX 0.0 BYTE 32,
             NDR    => "GET_NDR",
             ERROR  => "GET_ERR",
             STATUS => "GET_STATUS");
END_IF;

Reference: SFB14/SFB15 description in the S7-400 system and standard functions manual.

SFB15 (PUT) Programming Example

SFB15 writes a contiguous data area from the S7-400 to the IM 151-7 CPU. The IM 151-7 CPU side does not need any user program change; it serves the data in the addressed DB, MW, M area, or process I/O image.

// S7-400 STL example (OB1)
// Write 32 bytes of process data from S7-400 DB 300 to IM 151-7 CPU DB 110

CALL  "PUT" , DB15        // instance DB for SFB15
     REQ   :=M11.0        // rising edge triggers one PUT job
     ID    :=W#16#1       // same connection ID as for GET
     ADDR_1:=P#DB110.DBX 0.0 BYTE 32    // remote target area 1
     ADDR_2:=P#DB110.DBX 32.0 BYTE 32   // remote target area 2
     ADDR_3:=P#DB110.DBX 64.0 BYTE 32   // remote target area 3
     ADDR_4:=P#DB110.DBX 96.0 BYTE 32   // remote target area 4
     SD_1  :=P#DB300.DBX 0.0 BYTE 32    // local source area 1
     SD_2  :=P#DB300.DBX 32.0 BYTE 32   // local source area 2
     SD_3  :=P#DB300.DBX 64.0 BYTE 32   // local source area 3
     SD_4  :=P#DB300.DBX 96.0 BYTE 32   // local source area 4
     DONE  :=M21.0        // write completed (pulse)
     ERROR :=M21.1        // error flag
     STATUS:=MW24;        // extended status word

Basic S7 Communication with I_PUT/I_GET

When NetPro configuration must be avoided (e.g. for dynamic partners) or when using legacy MPI/DP shared connections, SFC7 (I_PUT) and SFC8 (I_GET) provide a stripped-down unidirectional service. Only the master can call these SFCs.

// S7-400 STL example for I_GET
// Read 32 bytes from IM 151-7 CPU DB 50 byte 0 into S7-400 MB 100..131

CALL  "I_GET" , DB8       // instance DB for SFC8
     REQ   :=M12.0        // trigger
     CONT  :=TRUE         // keep connection open after the call
     IOID   :=B#16#54     // input area identifier (B#16#54 for inputs, B#16#55 for DB)
     LADDR  :=W#16#0      // logical address, 0 for direct station addressing
     RECV   :=P#M 100.0 BYTE 32
     DONE   :=M22.0
     ERROR  :=M22.1
     STATUS :=MW26;

The IOID parameter selects the memory class: B#16#54 = process inputs, B#16#55 = DB area, B#16#56 = process outputs, B#16#57 = bit memory. With IOID = B#16#55 the LADDR parameter is interpreted as the DB number offset by zero.

Direct I/O Exchange (DPRD_DAT/DPWR_DAT)

For very small, high-priority exchanges, the S7-400 can use DPRD_DAT and DPWR_DAT to read/write up to 32 consistent bytes from the I/O area of the IM 151-7 CPU. This path bypasses the S7 communication stack and is faster but limited in size.

// S7-400 STL example for DPWR_DAT
// Write 16 bytes to slot 4 of the IM 151-7 CPU (logical base address = 0)

CALL  "DPWR_DAT" , DB21
     LADDR  :=W#16#0        // logical base address of the slot
     RECORD :=P#DB 400.DBX 0.0 BYTE 16
     RET_VAL:=MW28;

This is the right approach when the IM 200S modules behind the IM 151-7 CPU expose process I/O (e.g. digital output modules) and only the I/O image needs to be updated, not a user DB.

Diagnostics and Troubleshooting Matrix

Detailed STATUS code semantics are documented in the SFB/SFC error code reference for the S7-400 series.

Performance and Sizing Notes

• A single SFB14 (GET) call to a 6ES7416-2XN05-0AB0 over PROFIBUS DP at 1.5 Mbps typically completes in 5–15 ms for a 100-byte transfer, including the S7 acknowledgement turnaround.
• Keep-alive: the S7-400 sends a keep-alive frame every 30 s by default. If SFB14/SFB15 is not called for > 60 s the connection is released. Plan the cyclic call accordingly.
• Connection resources: the CPU 416-2DP supports up to 64 S7 communication connections. Each PUT/GET pair uses one connection resource on both sides.
• CPU run-time: SFB14/SFB15 each consume roughly 1.0–1.5 ms of CPU time per call on the S7-400, plus 0.2–0.5 ms on the IM 151-7 CPU. Plan the OB1 cycle accordingly; an OB1 cycle of 20 ms is comfortable for 10 S7 communication partners.

Verification and Commissioning Checklist

1. In NetPro, right-click the S7 connection and select Connection diagnostics; the connection should be reported as Established.
2. Trigger SFB14 from a watch table by setting the REQ bit; verify NDR pulses and that the RD_x area updates with the expected values from the IM 151-7 CPU.
3. Cross-check the S7-400 STATUS word — after a successful call it reads 0000H and is reset to 0000H on the next call.
4. Open the online diagnostics of the IM 151-7 CPU (accessible via PLC > Online & Diagnostics); no S7-comm errors should be listed under Communication.
5. Remove the DP cable and verify that ERROR is set within 60 s; reconnect and verify the call resumes automatically.

Frequently Asked Questions