Configuring the Siemens CP342-5 FC2 DP_RECV Block: ANY Pointer Format and PROFIBUS DP Master Data Exchange

The Siemens CP 342-5 communications processor (order number 6GK7 342-5DA02-0XE0 for the original DP master variant, or 6GK7 342-5DF00-0XE0 for the FO variant) is a PROFIBUS-DP module that plugs into the backplane of an S7-300 station. Unlike a CPU's integrated DP interface, the CP 342-5 does not expose its I/O directly to the process image. Instead, the data of every connected DP slave is buffered inside the CP and must be copied to the S7-300 CPU's memory using two system function blocks: FC1 (DP_SEND) and FC2 (DP_RECV). This article explains the FC2 call, the meaning of the RECV ANY pointer (for example P#DB18.DBX240.0 BYTE 103), the status outputs, and the configuration rules that must be respected in STEP 7 HWConfig to make the transfer reliable.

1. System Architecture and Data Flow

The CP 342-5 occupies a slot in the S7-300 rack and is configured as a DP master on its second PROFIBUS interface. The flow is:

1. STEP 7 HWConfig assigns a contiguous input area and a contiguous output area to the CP 342-5 for the entire DP master system (for example PE 126 ... PE 229 and PA 126 ... PA 229).
2. The CP polls the slaves cyclically and stores the consolidated telegram data internally.
3. FC1 (DP_SEND) copies the CPU's output process image fragment to the CP's transmit buffer.
4. FC2 (DP_RECV) copies the CP's receive buffer to any CPU memory area specified by the RECV ANY pointer.

The two FBs sit in the STEP 7 standard library under SIMATIC 300 CP 300 > CP 342-5 > FC1 / FC2. The blocks are version-stamped (for example V1.0, V2.0, V2.1); the version that ships with STEP 7 V5.5 SP2 and later supports the same interface described here.

2. Prerequisites

• S7-300 CPU (tested on CPU 313C, 314, 315-2 DP, 317-2) with a free slot for the CP 342-5.
• CP 342-5 (6GK7 342-5DA02-0XE0 or 6GK7 342-5DF00-0XE0) plugged into the rack and PROFIBUS-DP cable connected to the slaves.
• STEP 7 V5.5 (or compatible TIA Portal V16+ with S7-300 plug-in) installed on the programming device.
• GSD file of the DP slave installed via HWConfig > Options > Install GSD File if the slave is not in the STEP 7 hardware catalog.
• OB1, OB82 (diagnostic interrupt), OB86 (rack failure) and OB122 (I/O access error) present in the project — the CP raises diagnostic and station-failure interrupts that OB82/OB86 must handle.

3. CP 342-5 Hardware Configuration in STEP 7

1. Open HWConfig, drag the CP 342-5 onto an empty slot, and select the DP master interface as the active PROFIBUS subnet.
2. Double-click the CP, switch to the Operating Mode tab, and tick DP master. Disable the "Test mode" and "Bus topology" checkboxes unless the CP is used for commissioning.
3. Add a DP master system to the CP's DP interface. The system is assigned a master address (default 2) and a diagnostic address (default 8191 / 0x1FFF).
4. Drag the slaves onto the master system from the hardware catalog. If a slave is a modular ET 200, drop the I/O modules in the correct order — the slot order defines the byte offset inside the CP's receive buffer.
5. Return to the CP's object properties and note the input start address and output start address shown in the address overview (for example I 126 / Q 126). These are the addresses that CPLADDR in the FC2 call must point to.

4. Anatomy of the ANY Pointer on the RECV Input

The RECV input of FC2 expects a pointer in STEP 7 ANY format. The complete pointer occupies 10 bytes, but STEP 7 only displays the human-readable form:

P#DB18.DBX240.0 BYTE 103

The repetition factor 103 is the most often misread element. It is not an address, an index, or a slave identifier — it is the length of the contiguous receive buffer in bytes. The CP 342-5 receives the input data of all slaves on the DP master system and packs them into one block in slot order. The total length of that block is what the BYTE 103 field specifies.

The rule, restated: the length declared in the FC2 RECV pointer must equal the total length of the input area assigned to the CP 342-5 in HWConfig. If the hardware reserves 103 bytes of inputs, the FC2 call must read 103 bytes. If you change the I/O configuration of a slave and the consolidated input length changes, the FC2 call must be re-edited accordingly. The same applies to FC1 for the output direction.

For a single-slave configuration, the calculation is straightforward:

RECV length = sum of input bytes of every module in the ET 200
             (e.g. 2x 8 DI  = 2 bytes, 2x 8 DO = 2 bytes, etc.)

For a multi-slave configuration the rule extends to:

RECV length = sum of input bytes of slave 1
            + sum of input bytes of slave 2
            + ...
            + sum of input bytes of slave n

The CP 342-5 cannot return the data of a single slave. The receive call always returns the consolidated buffer. If you need per-slave data inside the CPU, the application must slice the buffer using the known byte offsets (computed from the slot order of the modular slaves).

5. FC2 DP_RECV Parameter Reference

The standard ladder view of a call in STEP 7 looks like:

CALL  FC2                                 // DP_RECV
  CPLADDR   := W#16#0120                  // CP base address 288
  RECV      := P#DB18.DBX240.0 BYTE 103   // receive buffer
  NDR       := M 99.1                     // new-data received
  ERROR     := M 99.2                     // error flag
  STATUS    := MW 105                     // FC2 status code
  DPSTATUS  := MB 0                       // DP diagnostic byte

6. FC1 DP_SEND — The Output Counterpart

FC1 has the same shape as FC2 but writes the CPU's output data to the CP's transmit buffer:

CALL  FC1                                 // DP_SEND
  CPLADDR   := W#16#0120                  // CP base address 288
  SEND      := P#DB18.DBX100.0 BYTE 103   // source buffer for output data
  DONE      := M 99.3                     // data accepted by CP
  ERROR     := M 99.4                     // error flag
  STATUS    := MW 107                     // FC1 status code
  DPSTATUS  := MB 1                       // DP diagnostic byte

Both FBs must be called once per cycle in OB1 (or in a watchdog OB) and must be called with the same CPLADDR that was assigned to the CP in HWConfig. The SEND and RECV lengths must match the HWConfig output and input lengths respectively.

7. STATUS and DPSTATUS Interpretation

When ERROR = TRUE, examine STATUS and DPSTATUS. The codes below are taken from the CP 342-5 manual (A5E00119768-04) and from the official Siemens support entry 18208090.

DPSTATUS carries the slave diagnostic summary:

• B#16#00 – all configured slaves are in data exchange.
• B#16#01..7E – the address of the first slave reporting a diagnostic event (refer to the slave manual for the diagnostic frames).
• B#16#FF – station failure of one or more slaves.

8. Multi-Slave Configuration: Byte Layout in the Receive Buffer

For a configuration such as CP 342-5 + ET 200M (32 DI / 32 DO) + ET 200S (16 DI / 16 DO) + ET 200eco (8 DI), the consolidated receive buffer is built by the CP in the order the slaves are attached to the master system in HWConfig:

If you write the application to DB18 starting at byte 240, the FC2 call stores the consolidated buffer from DB18.DBX240.0 to DB18.DBX342.0 (240 + 103 − 1). Make sure the destination DB is sized with the declared area. DB18 in the example must therefore be at least 343 bytes long, or the FC2 call will write past the end and trigger an OB122 I/O access error.

9. Step-by-Step Commissioning Procedure

1. Insert the CP 342-5 in HWConfig and configure it as DP master.
2. Add the DP slaves and configure their I/O modules. Record the total input length (e.g. 103 bytes) and total output length (e.g. 103 bytes).
3. Read the CP's logical base address from the address overview (e.g. 288 decimal = W#16#0120).
4. Open OB1 and insert CALL FC1 with the output length and CALL FC2 with the input length declared in step 2.
5. Wire the NDR / DONE, ERROR, STATUS and DPSTATUS outputs to flags or DB bits for evaluation.
6. Create / extend the target data block (DB18 in the example) to hold at least the receive length.
7. Download HWConfig and the S7 program to the CPU.
8. Switch the CPU to RUN. The CP's SF / BUSF LEDs must be off.

10. Verification

After commissioning, verify the data transfer with the following checks:

• Online > Monitor/Modify: in OB1, the ERROR outputs of FC1 and FC2 must stay FALSE. The STATUS outputs must read W#16#0000.
• The DPSTATUS byte must be B#16#00 when all slaves are healthy.
• Open DB18 in online view and confirm that the bytes at offset 240 .. 342 reflect the input states of the slaves (toggle a slave input and watch the corresponding bit in DB18).
• Trigger a slave diagnostic event (unplug a slave) and confirm that DPSTATUS jumps to the slave's PROFIBUS address, then returns to B#16#00 when the slave is plugged back in.
• Open Online > Diagnostics > Module Information on the CP and check the "DP master system" tab for the operational state of every slave.

11. Troubleshooting Matrix

12. Field-Proven Tips

• Use a single shared DB for both directions. Place the FC1 SEND area and the FC2 RECV area in the same DB but in disjoint address ranges (e.g. FC1 sends into DB18.DBX100.0, FC2 receives into DB18.DBX240.0) — this makes the buffer layout self-documenting.
• Document the byte map in a UDT or comment block. When the project is handed over, the byte offset inside the consolidated buffer is the only way a maintenance engineer can locate a specific input.
• Trigger OB82 / OB86 on the CP's diagnostic and station-failure events. They carry the slot address of the affected slave and are essential for any HMIs that visualize the bus health.
• Keep the BYTE counts a multiple of 2 if the slaves use 16-bit modules — this aligns the buffer with word boundaries and avoids byte-swap issues in any consumer that reads WORDs.
• Reload HWConfig after a slave swap. When you replace a slave with a successor that has a different module order, the CP will keep the old configuration in its firmware until HWConfig is reloaded.

FAQ