PROFIBUS DP Master-Slave Maximum Data Transfer on S7-400 CPUs

A frequent design question when connecting an AS 410 / CPU 410-5H controller to an S7-300 / CPU 318-2 over PROFIBUS DP is the maximum amount of process data that can be moved per slave and per bus segment. This technical reference consolidates the per-slave cap (244 bytes input + 244 bytes output), the per-master aggregate cap (1536 bytes on most S7-400 DP masters), slot-level sizing rules, the GSD/HW Config mechanics, and the diagnostic steps required to verify a 16-word input / 16-word output configuration in a PCS 7 / STEP 7 environment.

1. PROFIBUS DP Master-Slave Protocol Recap

PROFIBUS DP (Decentralized Periphery) is a token-passing, master-slave fieldbus standardized in IEC 61158 Type 3 and the historical EN 50170. On a single segment, one or more active masters (Class 1, DPM1) circulate the token, and each master polls its assigned passive slaves (DPS) in a deterministic cycle. The bus runs at 9.6 kbit/s to 12 Mbit/s; a single segment supports up to 32 nodes (masters + slaves) with repeaters, and 126 stations addressable in total when four repeaters are cascaded.

Two address spaces exist for every DP slave:

• Input area (master view): data the slave transmits to the master (read by the master).
• Output area (master view): data the master transmits to the slave (write by the master).

These are independent. The protocol does not require symmetry; an unequal split is fully legal (e.g. 32 bytes in, 240 bytes out) provided neither side exceeds the negotiated length.

2. Hardware Context: CPU 410-5H and CPU 318-2

The aggregate I/O budget of 1536 bytes in / 1536 bytes out per PROFIBUS DP master interface is the documented limit for the S7-400 family, confirmed in the Chipkin PROFIBUS DP Master protocol driver reference and consistent with PI specification guidance for Class 1 masters. See the Chipkin PROFIBUS DP Master PDF for the per-master total.

3. Per-Slave Data Limit: 244 Bytes Input, 244 Bytes Output

Per the PROFIBUS DP specification, each slave can exchange up to 244 bytes of input data and 244 bytes of output data with its master in a single polling cycle. This figure is the hard ceiling in the standard message frame; it derives from the one-byte length field in the DP-V0/V1 telegram (max 255 minus protocol overhead) and is independent of baud rate or cable length.

For the 16-word input + 16-word output configuration in question:

16 words input  = 16 x 2 = 32 bytes  (well below 244 byte cap)
16 words output = 16 x 2 = 32 bytes  (well below 244 byte cap)
Headroom:        244 - 32 = 212 bytes per direction still available

There is no requirement to use the full 244 bytes; the 16-word assignment is only consuming ~13% of the per-slave input budget and the same on the output side. Additional I/O slots can be added to the same slave in HW Config to expand the payload up to the cap, or to organize data by function block (e.g. one slot per drive, valve group, or PCS 7 CFC chart).

3.1 Why 244 bytes and not 256

The DP-V0 data-unit (DU) carries a length byte. Two length values are reserved: 0x00 for fixed-length query/response and 0xFF for variable-length short acknowledge. The user data range is therefore 0x01..0xFE = 254 bytes, but one byte is consumed by SAP addressing on the wire for some telegram types, leaving 244 bytes of effective user data per direction. Implementers should treat 244 as the absolute ceiling, not 256.

4. System-Wide Aggregate Limits

Two caps apply simultaneously when planning a DP segment:

The 1536 byte aggregate figure is sourced from the Chipkin PROFIBUS DP Master reference manual and is consistent with the S7-400 / CPU 410 family capabilities published in the SIMATIC S7-400 automation system manual. When more capacity is required, the options are:

1. Add a second PROFIBUS DP master interface (e.g. IF 964-DP in slot 3 of the CPU 410-5H) and split the slaves.
2. Switch a portion of the I/O to PROFINET IO via the integrated PN interface of the CPU 410-5H.
3. Use multiple lower-level masters and a DP/DP coupler (not used in the present scenario).

5. Configuring 16-Word Slots in HW Config

The 16-word assignment corresponds to one slot of 16 words in the input area and one slot of 16 words in the output area of the slave's module list. In SIMATIC Manager, open the slave's properties in HW Config, navigate to DP slave properties > Configuration, and add Universal Modules of the type 16 Words Input Consistent and 16 Words Output Consistent.

The word consistent matters: STEP 7 will only allow a 16-word (32-byte) consistent block if the master supports it. Consistency is defined as:

For a 16-word slot, configure the module as Total Length Consistent and use SFC14 "DPRD_DAT" and SFC15 "DPWR_DAT" to read/write the block from user program. Direct peripheral-access I/O is not safe for multi-word consistent data because the process image is refreshed in pieces.

5.1 Sample SFC14 / SFC15 call (ST)

// Read 16 words from slave input slot
CALL "DPRD_DAT"
  LADDR  := W#16#100    // logical base address of the slot
  RET_VAL:= MW 100      // 0 = OK; Fxxx = error
  RECORD := P#DB10.DBX 0.0 BYTE 32;  // 32 bytes = 16 words destination

// Write 16 words to slave output slot
CALL "DPWR_DAT"
  LADDR  := W#16#120
  RECORD := P#DB11.DBX 0.0 BYTE 32
  RET_VAL:= MW 102;

6. Master-Master Coupling vs. Direct Master-Slave

If the requirement is bidirectional data exchange between two PLCs that are both masters of their own segments, the standard topology is a DP/DP coupler (e.g. 6ES7158-0AD01-0XA0). The coupler is a slave to both masters and transfers up to 244 bytes per direction per side, with a maximum of 32-byte data sections in older revisions and up to 244 bytes per slot in newer firmware.

The original question specifies direct master-slave where one CPU is the DPM1 and the other CPU behaves as a DP slave (I-slave). The CPU 318-2 supports I-slave mode when configured with the DP slave operating mode on its DP interface. The coupling sequence:

1. On the CPU 318-2, enable DP slave mode in HW Config, set the I/O lengths to 16 words in / 16 words out, and download the configuration.
2. On the CPU 410-5H, install the GSD of the CPU 318-2 (or use "CPU 31x" from the Siemens catalog) and add the slave with the matching slot definitions.
3. Download the master project; both CPUs go through the DP startup sequence.

7. Step-by-Step Configuration Walkthrough (SIMATIC Manager)

7.1 Prerequisites

• STEP 7 V5.5 SP4 or later (TIA Portal V18+ is also supported for the CPU 410-5H).
• Both CPUs online-reachable via MPI/TCP for download.
• PROFIBUS cable with connectors set to terminating resistance ON at the two end nodes only.
• Bus address plan: assign a unique DP address to the master interface and to the slave interface (default 2 / 3 work; avoid 0, 1, 126).

7.2 Configure the CPU 318-2 as DP slave

1. Open the S7-300 station in HW Config.
2. Select the DP interface of the CPU 318-2 and open Properties > Operating Mode.
3. Tick DP slave. The interface becomes an I-slave.
4. In the configuration table, add two universal modules:
   • Slot 0: Input, 16 words, consistent over the entire length.
   • Slot 1: Output, 16 words, consistent over the entire length.
5. Set the diagnostic address (default 2047) and the I/O start addresses (e.g. 256 / 288).
6. Save and download to the CPU 318-2.

7.3 Configure the CPU 410-5H as master

1. Open the AS 410 station in HW Config.
2. Select the DP master system line attached to the CPU 410-5H interface.
3. Drag the CPU 318-2 DP slave from the catalog (or use the GSD import if the CPU is a different vendor).
4. Place it on the master system. STEP 7 will pre-fill slots based on the slave configuration.
5. Assign I/O addresses consistent with the user program (e.g. PIW 256..287 / PQW 256..287).
6. Compile and download to the AS 410.

7.4 Verify the link

1. Open Online > Accessible Nodes from the master project.
2. Confirm the slave appears with state RUN and no diagnostic interrupt pending.
3. Read the slave's diagnostic buffer: Slave > Operating Mode > Display Module Status. Look for 0x1F (slave present, ready for data transfer) in the first diagnostic byte.

8. Sizing the Data Payload: Practical Formulas

Use the following relations to size a multi-slot slave or a multi-slave segment:

Per-slot byte count:

bytes = words * 2  +  (double words * 4)  +  bytes

Per-slave utilization:

U_slave_in  = (sum of input bytes)  / 244  * 100   [%]
U_slave_out = (sum of output bytes) / 244  * 100   [%]

Per-master utilization:

U_master_in  = (sum of input bytes across all slaves)  / 1536 * 100 [%]
U_master_out = (sum of output bytes across all slaves) / 1536 * 100 [%]

Cycle time estimate (rough):

T_cycle >= N_slaves * T_bit * 11  +  N_slaves * T_data_in + N_slaves * T_data_out

where T_bit = 1 / baud, T_data = bytes * 11 / baud (11 bits per byte: 1 start + 8 data + 1 parity + 1 stop). At 1.5 Mbit/s and a 100-byte input per slave:

T_data = 100 * 11 / 1_500_000 = 0.733 ms per slave direction
T_cycle ~ 100_slaves * 0.733 ms * 2 = 146.6 ms

Cycle time budget is independent of the per-slave cap. Even if every slave used only 32 bytes, the cycle could still be too slow if many slaves are on the same bus at low baud rate. Plan both axes: bytes and stations.

9. Diagnostic and Verification Procedures

9.1 Online diagnostic blocks

• FB 125 "FB_DP_DIAG" – Siemens example block that returns slave state, diagnostic events, and I/O access errors.
• SFC 13 "DPNRM_DG" – read the full diagnostic buffer of a DP slave (6-byte standard + manufacturer-specific).
• SFC 51 "RDSYSST" – read subsystem information; query SSL ID W#16#0131 / W#16#0192 for DP master and slave status.

9.2 Standard DP diagnostic bytes

A healthy slave in RUN returns 0x1C in byte 0 (bit2 + bit3 + bit4) when polled.

9.3 Verification checklist

1. BF (Bus Fault) LED off on both CPUs' DP interface.
2. SF (System Fault) LED off on the slave; if lit, read SFC 13 diagnostic buffer.
3. Diag buffer of the CPU 410-5H shows "DP slave entered data exchange" for the configured address.
4. Watchdog timer on the slave: a value of 10 s (default) is appropriate for PCS 7; do not lower below 200 ms without measuring worst-case cycle time.
5. Live signal test from the user program: write a 16-bit pattern to a known output word on the master, read it back on the slave, and verify the round-trip is stable for at least 60 s.

10. Troubleshooting Matrix

11. Comparison with PROFINET IO

If 244 bytes / 1536 bytes is too constraining, the CPU 410-5H (firmware V8.1 and later) supports PROFINET IO on the integrated X5 PN interface, with up to 256 devices and 16 KB of I/O per controller. Migration is non-trivial for an installed PROFIBUS base; usually only new installations or partial upgrades adopt PROFINET. The 16-word / 16-word configuration in question is well within the PROFIBUS envelope and does not justify migration.

12. Practical Recommendations for the CPU 410-5H <-> CPU 318-2 Coupling

1. Keep the 16-word assignment as a single consistent slot; do not split it into 8 x 2-word slots unless the user program has a reason.
2. Use the CPU 318-2's DP interface (X2 on the 2AJ variant) for the I-slave, not the combined MPI/DP interface (X1). X1 is best left for engineering / HMI.
3. Set the bus baud to 1.5 Mbit/s for typical PCS 7 segments; 12 Mbit/s only on very short, well-terminated trunks.
4. Configure a watchdog of 10 s on the slave side; do not rely on the default 650 ms when many slaves are on the bus.
5. Reserve ~30% of the 1536-byte master aggregate for future expansion. The 32-byte payload in each direction is small, but additional slaves can quickly eat the budget.
6. Document the I/O start addresses in the PCS 7 plant view so the next engineer can correlate process values to the bus without going online.