DP_RECV/DP_SEND ANY Pointer in SCL for S7-300 PROFIBUS

Overview

DP_SEND (FB13) and DP_RECV (FB14) are the PROFIBUS DP process-data exchange blocks supplied in the SIMATIC NET library for the CP 342-5 (order numbers 6GK7 342-5DA02-0XE0 and 6GK7 342-5DA03-0XE0). When the CP 342-5 is operated as a DP master on an S7-300 station with a CPU 315-2 DP (e.g. 6ES7 315-2EH14-0AB0) or CPU 315-2 PN/DP, the CPU does not access DP slaves directly. Instead the CPU transfers a contiguous data image to the CP and the CP performs the DP master role on the PROFIBUS segment. Each transfer call is parameterised with a 10-byte ANY pointer that identifies the source (DP_SEND) or destination (DP_RECV) data area in the CPU.

Writing this code in STL is straightforward because STL treats the ANY as a 10-byte literal (for example P#DB1.DBX5.0 BYTE 276). In SCL and CFC the same task is more nuanced: the compiler does not always allow the direct symbolic form when the buffer has non-standard layout, and programmers often have to manually populate the 10 bytes of an ANY-tagged UDT. This reference documents both the manual construction path and the recommended alternative: a dedicated byte-array DB used as a buffer between the user DB and the DP_SEND/DP_RECV calls.

The information below is consistent with the SIMATIC NET CP S7-300/S7-400 programming manual and the Siemens FAQ 109744374, which cover DP_SEND/DP_RECV for CP 342-5 in STEP 7 V5.5 and in TIA Portal V16 or later. Refer to the official links at the end of each section for the canonical Siemens wording.

Prerequisites

DP_SEND / DP_RECV Call Order and Handshake Rules

For the CP 342-5 the DP master executes a strict handshake between the CPU and the CP. According to the SIMATIC NET programming manual, exactly one DP_SEND or DP_RECV call must precede every subsequent call sequence. The rule, documented in the official Siemens manual page for DP_RECV (S7-300, S7-400), is summarised below:

1. Call FC1 DP_INIT once at start-up to configure the CP operating mode (master / slave / diagnostic).
2. Call FB14 DP_RECV to fetch the most recent DP input image into the destination buffer.
3. Call FB13 DP_SEND to push the next DP output image to the CP.
4. Repeat RECV / SEND in every OB1 cycle; do not skip a call.
5. Call FC2 DP_CLEAR before re-initialising the CP or in the event of an unrecoverable error.

The first call after power-up or DP_INIT must be either DP_RECV or DP_SEND; the CP will return STATUS =16#0000 and zero-length data on the first exchange while it builds the DP connection. Subsequent calls return STATUS =16#0000 on success, otherwise an event-class error word is returned in the STATUS output.

Understanding the 10-Byte ANY Pointer

An S7-300 ANY pointer is always 80 bits (10 bytes). For DP_SEND/DP_RECV the relevant subset is shown in the table below. Bytes 0 to 3 are the header; bytes 4 to 9 identify the data area.

The byte/bit packing rule is the most common source of bugs: DBX<B>.<b> is encoded as (B * 8) + b. For DB1.DBX5.0 the encoded value is (5 * 8) + 0 = 40 = 16#28, which goes into bytes 7-9 as 16#000028. The remainder of the area specifier (byte 4 = 16#84) is sometimes packed into the same DWORD; in the Siemens FAQ snippet cited in the field report, byte 4 occupies the high byte of the Source_Byte_Pointer DWORD while bytes 7-9 occupy bytes 1-3.

Approach 1: Manually Building the ANY in SCL

Declare an ANY-typed UDT or a STRUCT matching the 10-byte layout, fill it in SCL, and pass it to FB13 / FB14. This is the approach the source thread is exploring.

UDT declaration

TYPE UDT_ANY_PTR
  STRUCT
    S7Code          : BYTE;   // Syntax-ID, normally 16#10
    DataType        : BYTE;   // 16#02 = BYTE
    Lenght          : INT;    // count of elements
    MemoryArea      : BYTE;   // 16#84 = DB
    DB_Number       : INT;    // DB number
    ByteAddressMSB  : BYTE;   // high byte of address
    ByteAddressLSB  : WORD;   // low word of address (bit 0-2 = bit)
  END_STRUCT
END_TYPE

SCL population for a 276-byte receive buffer in DB1 starting at DBX5.0

VAR_TEMP
  pAny1 : UDT_ANY_PTR;
END_VAR

pAny1.S7Code         := 16#10;
pAny1.DataType       := 16#02;        // BYTE
pAny1.Lenght         := 276;          // bytes
pAny1.MemoryArea     := 16#84;        // Shared DB
pAny1.DB_Number      := 1;            // DB1 = input area
pAny1.ByteAddressMSB := 0;
pAny1.ByteAddressLSB := 40;           // DBX5.0 = 5*8+0 = 40

// Pass to FB14 DP_RECV:
DP_RECV_DB14.RECV  := pAny1;
DP_RECV_DB14.NDR   := ...;
DP_RECV_DB14.ERROR := ...;
DP_RECV_DB14.STATUS:= ...;
CALL FB14, DP_RECV_DB14;

Encodings for common start addresses

Approach 2: Byte-Array DB as a Buffer (Recommended)

Rather than constructing the ANY from a user DB containing BOOL / WORD tags, define one or two byte-array DBs sized to the PROFIBUS I/O image and copy process data between the user DB and the byte buffer. This is the pattern recommended in the SIMATIC NET manual and is far easier to maintain in CFC because the buffer DB can be addressed symbolically and the DP_SEND / DP_RECV call accepts the symbolic array directly.

Buffer DB declaration

DATA_BLOCK DB_InputImage
  STRUCT
    bytes : ARRAY[0..275] OF BYTE;   // 276 bytes input image
  END_STRUCT
BEGIN
END_DATA_BLOCK

DATA_BLOCK DB_OutputImage
  STRUCT
    bytes : ARRAY[0..275] OF BYTE;   // 276 bytes output image
  END_STRUCT
BEGIN
END_DATA_BLOCK

SCL call with symbolic ANY (SCL auto-generates the 10 bytes)

CALL FB14, DB14_Inst
   RECV   := "DB_InputImage".bytes,
   NDR    := bNDR,
   ERROR  := bErr,
   STATUS := wStatus;

CALL FB13, DB13_Inst
   SEND   := "DB_OutputImage".bytes,
   DONE   := bDone,
   ERROR  := bErr,
   STATUS := wStatus;

Bit-level copy from byte buffer to user DB (BOOL tags)

// Example: copy first 8 DI bits from buffer byte 0 into user DB10
"User_DB".DI_00 := "DB_InputImage".bytes[0].%X0;
"User_DB".DI_01 := "DB_InputImage".bytes[0].%X1;
"User_DB".DI_02 := "DB_InputImage".bytes[0].%X2;
"User_DB".DI_03 := "DB_InputImage".bytes[0].%X3;
"User_DB".DI_04 := "DB_InputImage".bytes[0].%X4;
"User_DB".DI_05 := "DB_InputImage".bytes[0].%X5;
"User_DB".DI_06 := "DB_InputImage".bytes[0].%X6;
"User_DB".DI_07 := "DB_InputImage".bytes[0].%X7;

// Bit-level copy from user DB to buffer (DO bits)
"DB_OutputImage".bytes[0].%X0 := "User_DB".DO_00;
"DB_OutputImage".bytes[0].%X1 := "User_DB".DO_01;
...

Why this pattern wins

• No manual byte/bit packing, no endian mistakes, no off-by-one in the encoded address.
• SCL and CFC both accept the ARRAY OF BYTE directly as the ANY parameter; the compiler emits the correct 10-byte ANY.
• The buffer length is visible in HW Config (DP slave I/O size) and matches the ANY length automatically.
• BOOL / WORD tags in the user DB can be reordered without changing the DP_SEND / DP_RECV code.
• Trivial to use with CFC channel drivers: each CFC block simply reads/writes a BYTE.x slice of the buffer.

FC1 DP_INIT Parameterisation

FC1 is the only block required at start-up. Its inputs are a 16-byte ANY pointer describing the CP start-up data. Leave the start-up ANY as a zero literal if the CP only operates as a DP master with default diagnostics.

The 16-byte DP_INIT payload for a CP 342-5 acting purely as a DP master is typically all zeros. If the CP is to act as a DP slave or to publish diagnostics, byte 0 must contain the role bits: 16#01 = master, 16#02 = slave, 16#03 = master + slave. See the CP 342-5 manual for the exact byte map.

Return Codes and STATUS Word

Troubleshooting Matrix

Commissioning Procedure

1. In HW Config, insert the CP 342-5 in the S7-300 rack and assign PROFIBUS master mode. Add the DP slave(s) with the appropriate I/O slot count.
2. Create a buffer DB (DB_InputImage) with ARRAY[0..N-1] OF BYTE where N equals the sum of slave input lengths.
3. Create a second buffer DB (DB_OutputImage) with the same structure for outputs.
4. Add the SIMATIC NET blocks from the library to your program: FC1 DP_INIT, FC2 DP_CLEAR, FB13 DP_SEND, FB14 DP_RECV. Generate instance DBs.
5. Call FC1 once in OB100 (warm restart) with DP_INIT_DATA set to a 16-byte zero area or an ANY with P#P 16#0 Byte 16.
6. Insert FB14 (RECV) and FB13 (SEND) calls into OB1, RECV first.
7. Wire the bytes array of DB_InputImage to the RECV ANY input and DB_OutputImage to the SEND ANY input.
8. Download HW Config and the S7 program. Watch STATUS of FC1, then STATUS of FB14/FB13 in VAT online.
9. Use the CFC channel drivers or direct SCL assignment to map individual bytes[x].%Xn into the user BOOL DB.
10. Verify in online > Monitor/Modify that the bytes update at the configured PROFIBUS update rate.

Edge Cases and Field-Proven Caveats

• Length must be even. Many PROFIBUS slave profiles require an even number of input / output bytes. The CP 342-5 pads with one fill byte automatically if the configured slot total is odd. Match the ARRAY length to the configured total plus 1 in that case.
• Consistent lengths. If the RECV and SEND ANY lengths differ from the configured DP image, STATUS returns 8085 or 8091. Always regenerate the buffer DB after changing HW Config.
• CFC and symbolic ANY. In CFC the wire connecting bytes to the RECV ANY must come from the array symbol; do not pass a single bytes[i] element as the ANY because SCL generates a 1-byte ANY that will be rejected.
• Use of global DBs vs instance DBs. The user BOOL DB and the buffer DB must be global DBs (not instance DBs) because the DP_SEND/DP_RECV ANY requires an absolute address.
• Bit memory and process image. Never wire the standard process-image inputs (E area) directly to DP_SEND/DP_RECV. The CP 342-5 expects a DB-backed ANY, not a PI/PQ area pointer. The field report's manual packing into 16#82 or 16#81 will be rejected with STATUS 8085.
• Multiple cycles per OB1. If OB1 executes faster than the DP cycle, the CP repeats the last image; this is normal. Do not reduce the OB1 cycle time below 5 ms when polling a heavy DP segment.
• S7-400 migration. On S7-400 the same FBs are renamed (DPSEND / DPRECV for IF 964-DP) and use a different library. Do not copy the S7-300 FB13/FB14 instances to an S7-400 project.

Migration to TIA Portal

If the project is moved from STEP 7 V5.5 to TIA Portal V16 or later, the CP 342-5 is added as a "CP 342-5" PROFIBUS device rather than an S7-300 rack module. The official Siemens Support entry 109744374 describes the configuration steps. The ANY handling is identical once the buffer DBs have been migrated, but the call interface of FB13/FB14 is regenerated from the SIMATIC NET library inside TIA Portal. Manual ANY construction is therefore rarely needed in TIA Portal because the editor can complete the ANY from the symbolic buffer.