FM 458-1 DP P-Bus Communication: Why Direct Module Linking Fails

Overview: The P-Bus Communication Problem Between Two FM 458-1 DP Modules

The FM 458-1 DP application module is a high-speed closed-loop controller in the SIMADYN D / T400 family, typically slotted beside a SIMATIC S7-400 CPU in the same rack. A frequent engineering question is whether two FM 458-1 DP modules mounted in the same S7-400 station can exchange data directly over the P-Bus (backplane bus) without an S7 CPU acting as intermediary. The short answer, confirmed by the official Getting Started with FM 458-1 DP manual, is no: the FM 458-1 DP is a passive device on the P-Bus and cannot initiate a read or write to another module on the same backplane. Data must be staged through the SIMATIC CPU using SFCs, or carried over an alternative high-speed link such as SIMOLINK.

FM 458-1 DP Hardware Position in the S7-400 Rack

The FM 458-1 DP is a dedicated function module that occupies a slot in the central rack (CR) or a universal rack (UR) of an S7-400 station. From the backplane perspective the module is treated as an I/O-slave-like peripheral, not as a peer master. Three roles coexist on the P-Bus in such a configuration:

• S7-400 CPU – the only active bus master that can read and write into the FM 458-1 DP's P-Bus memory image.
• FM 458-1 DP – passive target. It exposes a 128-Kbyte shared RAM window to the CPU but does not arbitrate the backplane itself.
• Other FM 458-1 DP modules – each has its own 128-Kbyte window. None can reach across to a sibling module because the CPU owns the bus grant.

Three Official Methods to Transfer Data Between an S7-400 CPU and FM 458-1 DP

Per the FM 458-1 DP documentation, only three data paths are available between a SIMATIC CPU and the module. They differ in payload size, latency, and triggering semantics.

All three methods require the S7-400 CPU to be the initiator. The FM 458-1 DP cannot call SFC58/59 itself, and it cannot raise a P-Bus cycle of its own accord to push a value into a sibling FM. This is the root cause of the failed CTV/CRV chart experiment in the field report.

Why the CTV ↔ CRV Chart Pair Fails Across Two FM 458-1 DP Modules

CFC chart blocks CTV (Transmit) and CRV (Receive) are designed to serialize user-defined structures into a shared data record. Inside a single FM 458-1 DP, the CTV/CRV pair uses the module's internal 128-Kbyte P-Bus memory and works without CPU involvement. As soon as the receiver sits on a different FM 458-1 DP, the record is no longer accessible because:

1. The receiving FM has no bus master rights to fetch the record from the sending FM's P-Bus window.
2. The S7-400 CPU is unaware of the record number because no SFC58/59 was issued.
3. No diagnostic interrupt is raised, which is why the engineer in the source thread observed "no communication fault" – the silence is architectural, not a wiring error.

Solution A: Stage Data Through the S7-400 CPU

The canonical workaround, recommended by Siemens support, is to use the S7-400 CPU as a deterministic data buffer between the two FM 458-1 DP modules. Two implementation patterns are common in the field.

Pattern 1 – Cyclic I/O Mirror (small payloads, ≤128 bytes)

1. On FM-A, publish the value through a CTV block to a fixed P-Bus address (e.g. DB offset 0 of the module's process image).
2. From the S7-400 CPU, read the value with a standard L PEW / T MW load in OB1 (or a faster OB like OB30 for synchronous exchange).
3. Write it back to the second module with T PAW into FM-B's process image at the offset the receiving CRV block is monitoring.

Sample STL excerpt (S7-400 side, OB1):

NETWORK 1  // Mirror FM-A setpoint to FM-B
  L     PEW 512        // FM-A P-Bus window offset 0
  T     MW 100         // CPU-side buffer
  L     MW 100
  T     PAW 768        // FM-B P-Bus window offset 0
NETWORK 2  // Diagnostics flag
  U     M 100.0
  S     M 110.0        // "FM-A alive" flag visible to FM-B CRV

Pattern 2 – Acyclic Data Records (large payloads, parameter sets)

For data > 128 bytes, use the standard record interface. The CPU calls SFC58 (WR_REC) to write into FM-A, and the second FM 458 reads the same record via SFC59 (RD_REC) when the CPU updates it into FM-B.

CALL  SFC 58  // WR_REC into FM-A
  REQ    := M 50.0
  IOID   := B#16#54          // Output / P-Bus area
  LADDR  := W#16#0200        // Logical base address of FM-A
  RECNUM := B#16#0001        // Record number 1
  RET_VAL:= MW 52
  BUSY   := M 53.0
  RECORD := P#DB 100.DBX 0.0 BYTE 256

CALL  SFC 59  // RD_REC from FM-B (or WR_REC into FM-B after CPU edit)
  REQ    := M 60.0
  IOID   := B#16#54
  LADDR  := W#16#0300        // Logical base address of FM-B
  RECNUM := B#16#0001
  RET_VAL:= MW 62
  BUSY   := M 63.0
  RECORD := P#DB 110.DBX 0.0 BYTE 256

This pattern is identical in spirit to the SFC58/59 use described in the FM 458-1 DP User Manual, but applied bidirectionally through the CPU's DB memory.

Pattern 3 – Process Interrupt for 4-Byte Bursts

If only 4 bytes (e.g. a single REAL setpoint plus a control byte) must cross modules with the lowest possible latency, use OB40 hardware interrupts. FM-A raises an OB40 on the CPU, the CPU immediately writes the 4 bytes into FM-B's interrupt slot, and FM-B's CRV block is configured to consume the interrupt-triggered value.

Solution B: SIMOLINK for High-Speed, Multi-Drive Inter-Module Data

When the two FM 458-1 DP modules are controlling drives (e.g. SIMOVERT MASTERDRIVES, SINAMICS) and need sub-millisecond data exchange, the recommended alternative is the SIMOLINK fiber-optic ring. SIMOLINK bypasses the P-Bus entirely and offers:

• Up to 16 nodes on a closed fiber ring (plastic or glass, HCS).
• Cycle time of 0.4 / 0.8 / 1.6 ms configurable per master.
• Each node can transmit a 32-bit word per channel, multiple channels per node.
• Deterministic, broadcast-style data distribution – exactly the peer-to-peer behavior the engineer tried to achieve with CTV/CRV.

Both FM 458-1 DP modules require the SIMOLINK interface option (e.g. SLB firmware option on the FM 458-1 DP, or a separate SIMOLINK board such as SS52 on SIMADYN D). Once the ring is closed, each FM publishes its CTV payload on a SIMOLINK channel and the second FM consumes it through a SIMOLINK-aware receive block (e.g. SL_RECV equivalent in the D7-SYS function block library).

Point-to-Point Alternative Using the FM 458-1 DP's Serial Interface

Where the data volume is low and the modules are physically separated, a serial point-to-point link can be used. Reference: Siemens TIA Portal – Point-to-Point (PtP) Communication. The FM 458-1 DP exposes a serial interface that can be configured as a PtP master; the second FM is configured as a PtP slave. This is functionally identical to the S7-1200 PtP guidance: configure the Local/Partner connection path, define a logical network connection, and match baud rate, parity, and frame on both sides. The advantage is that the CPU is no longer in the hot path; the disadvantage is reduced bandwidth and the need for a dedicated cable (RS-422 / RS-485, full duplex recommended).

Diagnostic & Verification Procedure

1. Confirm module addresses – Open HW Config in STEP 7, note the logical base address of each FM 458-1 DP (e.g. 512 for FM-A, 768 for FM-B). Mismatched base addresses are the most common cause of "silent" P-Bus failures.
2. Force a test value – In CFC, connect a constant or a SWITCH block to the CTV input on FM-A. Place a DISPLAY block on FM-B's CRV output.
3. Check CPU-side visibility – In the S7-400, use a VAT table or watch table to read PEW 512 and PAW 768. If the source word updates but the destination does not, the wiring is wrong. If neither updates, the record is not being published by CTV.
4. Online CFC diagnostics – In STEP 7 / CFC Online, right-click the CTV block and choose Test > Record. Verify the record number matches the CRV on the remote side exactly (record numbers are 16-bit, range 0–65535).
5. Buffer / consistency check – For payloads larger than 4 bytes, ensure the SFC58/59 calls run from an OB with sufficient priority (OB1 is fine for parameter sets; OB30–OB38 for time-critical loops) and that the BUSY bit is monitored for handshake.
6. Hardware fault LEDs – A steady green SF on either FM with a non-zero diagnostic buffer entry points to a record-number or address mismatch, not the passive-bus limitation.

Method Selection Matrix

Common Engineering Pitfalls

• Assuming symmetry. FM 458-1 DP is not PROFIBUS-DP master; it cannot be configured as an active node on the P-Bus. Even with identical record numbers on both modules, no handshake occurs.
• Ignoring the 4-byte OB40 limit. A REAL value (4 bytes) plus a status byte (1 byte) does not fit in a single OB40. Either compress into one REAL with the status encoded, or move the status byte to cyclic I/O.
• Slot indexing. When a second FM 458 is added, all P-Bus base addresses above the new slot shift. Re-run HW Config and re-download to the CPU so the PAW / PEW addresses reflect the new layout.
• Record number collisions. SFC58/59 record numbers are global per logical address. Two CTV blocks on different FMs using record 1 will collide if the CPU also writes record 1 elsewhere.
• Firmware mismatch. Older FM 458 firmware (pre-V5.x) had smaller P-Bus windows. Verify both FMs run a firmware that exposes the full 128-Kbyte RAM; mismatched firmware is a frequent cause of asymmetric transfer behavior.

Safety & Commissioning Notes

During commissioning, the SIMOLINK ring and any P-Bus mirror must be validated with the drive in a safe state (e.g. OFF1 enabled, speed setpoint = 0). For safety-related drive interlocks (SIL 2 / SIL 3), do not route safety-relevant commands through the P-Bus mirror or SIMOLINK. Use the dedicated safety channels on the SIMATIC F-CPU or the PROFIsafe profile on the FM 458-1 DP's DP interface. Always confirm the final wiring against the safety plan and the relevant product manuals before energizing the rack.