PROFIBUS DP Slave Limits on S7-300/400 CPUs: Configuration Guide

PROFIBUS DP Network Limits Overview

A Siemens SIMATIC S7-300 or S7-400 station that talks to a string of ET 200M, ET 200S, ET 200pro, or third-party distributed I/O over PROFIBUS DP has to satisfy three independent limits before the first slave can even be parameterized. Field engineers routinely confuse these limits because they are reported by different sources — the PROFIBUS standard (IEC 61158 / IEC 61784), the RS-485 electrical segment rules, and the SIMATIC CPU manual. The result is usually a working project that compiles but refuses to download, or a bus that runs at 1.5 Mbit/s and still drops stations intermittently.

This reference consolidates the limits that govern an S7-300/S7-400 DP master system: the 32-node RS-485 segment cap, the 124 (or 125) DP slave address space per DP master port, the CPU-specific OBs/load memory constraints, and the way STEP 7 / TIA Portal accounts for repeaters and copper cable length when it computes the token rotation time. It is written for commissioning engineers who are about to wire more than thirty 8-channel I/O islands in a tank-farm, water-treatment skid, or crude-process unit and who have been told by colleagues that "you can only have 32 slaves on PROFIBUS" without being told why or what to do about it.

The 32-Node Segment Rule and Why It Exists

Every PROFIBUS DP segment is built on RS-485, a half-duplex, multi-drop, differential physical layer. The transceivers used in Siemens DP slaves (SPC 3, SPC 3-2, ASPC 2, LSPM 2) and in the CPU 31x PN/DP and CPU 41x DP ports all terminate into a 9.6 kbit/s up to 12 Mbit/s bus that is biased at one end and terminated at both ends with 220 Ω. The transceiver input impedance and the way the IEC 61158 line-driver reference design handles reflections limits the number of physically attached stations to 32 per electrical segment. The figure includes the DP master class 1, every DP slave, and every repeater that lives on the segment.

Once the 32-node electrical ceiling is reached the segment must be split with a PROFIBUS repeater. A repeater is signal-restoring; it re-biases the bus, regenerates the bit timing, and electrically isolates the two segments so that a short or a ground shift on one segment does not take down the rest of the plant. From a logical standpoint the repeater is transparent: the DP master does not see it in the slave list and does not exchange cyclic I/O with it. The exception is the PROFIBUS Diagnostics Repeater (6ES7 972-0AB01-0XA0), which does occupy a DP address and is configured in HW Config because it reports topology diagnostics to the master.

Address Space: 32 Electrical vs 124 Logical

Engineers frequently read 32 in one paragraph of the manual and 124 in another and assume the larger number is just marketing. In fact the two figures refer to two different limits:

Because the address space (124) is larger than the segment count (32), any installation that wants more than 30 slaves must use one or more repeaters. The repeater does not consume a DP address but it does consume a physical node, so the layout problem becomes: given N slaves and a maximum of 30 slaves per segment, how many repeaters do I need?

Re-arranging, the minimum number of repeaters is ceil((N − 30) / 30) — but because the master segment itself has to leave one slot free for a future repeater or terminator, the conservative rule of thumb used by most EPCs is to plan for 24 slaves per segment and let the segment count grow as the cable tray gets longer. The Siemens PROFIBUS Installation Guideline (SIMATIC NET PROFIBUS Network Manual, 6GK1970-1BA10-0AA1) and the PROFIBUS User Organisation (PNO) Installation Guide agree on this conservatism because it leaves headroom for termination, future ET 200 stations, and inline fieldmount repeaters.

Bus Speed vs Segment Length Matrix

The 32-node limit is not the only reason to insert a repeater. RS-485 propagation and the bit-time budget both impose a maximum cable length for a given baud rate, and beyond that length a repeater is mandatory even if the segment only has ten stations on it. The relationship is governed by the maximum signal round-trip time allowed for an acknowledgement within one bit, and it is tabulated in IEC 61158-2 and reproduced verbatim in the Siemens manual SIMATIC NET PROFIBUS Network Manual.

Type A cable is the standard PROFIBUS DP cable (Siemens 6XV1 830-0EH10 or equivalent, 150 Ω characteristic impedance, solid conductor, 0.64 mm² / AWG 22). Type B is a lower-grade cable (twisted pair, no defined characteristic impedance) and is rarely accepted for new installations. For type A cable the row at 12 Mbit/s limits a single un-boosted run to 100 m; if the field cabinet is more than 100 m from the control room the only way to keep 12 Mbit/s is to insert a repeater at or before the 100 m mark.

The PROFIBUS DP cycle time T_cycle on a multi-master bus is approximated by the sum of all master/slave token-holding times:

Tcycle >= SUM ( Tmaster + Tslave_i ) + Trepeater * R

where R is the number of repeaters on the bus and T_repeater is the propagation delay of one repeater (typically 1.2 to 2.5 Tbit, or 100 ns to 250 ns at 12 Mbit/s). This is the reason STEP 7 asks the user to declare the number of repeaters and the total cable length when the project is compiled — see the Cable Configuration dialog covered later in this article.

S7-300 and S7-400 CPU Slave Count Specifications

The exact slave count is governed by the CPU manual, not by PROFIBUS in the abstract. The figures below are the values that the field report and the corresponding SIMATIC S7-300 / S7-400 CPU data sheets publish; check the data sheet of the actual order number (MLFB) on the Siemens Industry Online Support portal because Siemens does revise these numbers in later firmware releases.

S7-300 CPU 319-3 PN/DP (6ES7 318-3EL01-0AB0 and derivatives)

Two figures quoted in the field report are mutually exclusive on first reading: the contributor states "124 DP Slaves per DP Master port" as the absolute limit of the 319-3 PN/DP, and then in another post states "32 DP Slaves may very well be the maximum assuming you use its 1st onboard MPI/DP interface." The apparent conflict resolves as follows. The 32-node figure is the electrical segment cap and applies to a single RS-485 run when the first port is configured as MPI/DP. The 124-slave figure is the DP master system address space and is reachable only after the bus is split with repeaters or after a second DP master port is brought into service. The CPU itself does not enforce 32; the bus topology does.

S7-400 CPU 414-3 EM05 / 414-3 EM06 (6ES7414-3EM05-0AB0, 6ES7414-3EM06-0AB0)

The 414-3 in the source project (6ES7 414-3EM05-0AB0) shipped from Siemens with two DP interfaces and a slot for an IF 964-DP submodule. When the engineer reported that "I can not add more than 32 slave" the cause is almost always the bus topology, not the CPU: HW Config is configured to use the integrated DP port and the bus has not been split with repeaters, so STEP 7 refuses to add slave 33 to a 32-node segment. The fix is either to add a CP 443-5 EXT and migrate the surplus slaves to a second master system, or to insert a repeater and split the slaves across two or more segments — and to declare the repeater in Properties → Network Settings → Options → Cable Configuration so that STEP 7 can compute the token rotation time.

Repeater Architecture: Node Counting and Electrical Isolation

Siemens sells PROFIBUS repeaters under several order numbers, the most common being the RS 485 Repeater (6ES7 972-0AA01-0XA0) and the Diagnostics Repeater (6ES7 972-0AB01-0XA0). Both are physically the same shape (DIN-rail mount, 9-pin D-sub PROFIBUS connector on each side) but they behave differently in STEP 7 / TIA Portal:

For the working engineer the practical consequence is: when a project uses a Diagnostics Repeater, the DP address you assign to it must come out of the 1…124 address pool and one of the 32 physical node slots on that segment. When a project uses a plain RS 485 Repeater, no DP address is consumed, but the physical slot is consumed just the same.

A repeater also provides electrical isolation between the two segments it joins. In a tank-farm where a small I/O island sits near a VFD or a welding rectifier, the common-mode voltage on the local segment can drift several volts above the control-room ground; a repeater at the cabinet entry breaks the ground loop and protects the master port. This is one of the reasons the PNO installation guide requires a repeater at the boundary between buildings even when the bus has only 20 slaves.

Expanding the DP Master Interface with CP and IF Modules

When the bus has run out of DP addresses (i.e. the engineer has reached slave 124) or when the bus has run out of physical slots on the existing segment (i.e. the engineer has reached 32 nodes and still has more stations to add), the remedy is to add a second or third DP master interface. The SIMATIC portfolio offers three paths:

When the user adds any of these modules, the engineer must drag the new master interface into the project, set its PROFIBUS address, and create a new DP master system. The original slaves stay on the integrated port; the surplus slaves are migrated to the new master system. After a Save + Compile the DP master list will read "Master system 1 (MPI/DP, IF1): 24 slaves; Master system 2 (DP, IF2): 47 slaves; Master system 3 (PROFIBUS, CP 443-5 EXT): 31 slaves", for example, and the bus is no longer constrained by the 32-node segment limit on the master side.

Caveat: the CPU firmware must support the module. The 319-3 PN/DP needs firmware V3.2 or later for the CP 342-5 to come up cleanly with the full 125-slave address space; check the S7-300 CPU 319-3 manual for the exact compatibility matrix.

STEP 7 Cable Configuration and Token Rotation Time

When a bus contains repeaters, STEP 7 / TIA Portal must know about it, or the token rotation time T_TR will be underestimated. The result is sporadic bus errors at high bus utilization, manifesting as SF (red) on the CPU, BF (red) on the slave, and OB 86 / OB 125 entering the diagnostic buffer with the message "DP slave failure". The user enters the bus topology in the Cable Configuration dialog.

Path in STEP 7 V5.x: HW Config > DP master system > Properties > Network Settings > Options > Cables.

Path in TIA Portal V20: Devices & Networks > DP master system > Properties > PROFIBUS > Cable configuration. The TIA Portal help page Adding DP slaves to the master system and configuring them (S7-300/S7-400/S7-1500) documents the procedure step by step, including the cable configuration screen.

The dialog asks for two values:

• Number of repeaters — the count of RS 485 repeaters in the segment tree (Diagnostics Repeater counts as one if configured as a DP slave, otherwise the engineer is reminded in the help text that the Diagnostics Repeater's diagnostic traffic must also be budgeted).
• Total cable length (km) — the sum of the type A cable runs across all segments. The dialog will not allow values that exceed the bus-speed table above; if the engineer enters a 600 m run at 12 Mbit/s the tool flags it as out of spec and refuses to compile.

STEP 7 then re-computes the bus parameters T_slot, T_set, max T_SDR, and T_TR. The classic target on a DP mono-master bus is T_TR < 50 % of the application OB 1 cycle, so that the slave I/O is consistent within one scan. On a tank-farm with 60 slaves, two repeaters and 800 m of cable at 1.5 Mbit/s, a typical calculation looks like:

Tbit            = 0.667 µs (at 1.5 Mbit/s)
Tslot (1 slave) = 264 Tbit = 176 µs
60 slaves       = 60 * 176 µs = 10.56 ms
2 repeaters     = 2 * 1.5 Tbit * 2 directions = 2 µs (negligible)
Cable delay     = 800 m * 5 ns/m * 2 directions = 8 µs (negligible)
T_TR            > 10.57 ms  (this is the bare DP cycle)
T_TR target     < OB 1 cycle / 2
              =>  OB 1 must be > 21 ms; configure OB 1 to 30 ms minimum

This is the calc the cable-configuration tool runs internally; an engineer who skips the dialog and later observes bus jitter should re-open it and declare the repeaters that were installed.

Configuration Procedure in STEP 7 V5.x (Classic)

The numbered procedure below is the working sequence for adding more than 30 DP slaves to an S7-300/S7-400 project. It is valid for STEP 7 V5.5 + SPx with the optional HSP for the specific CPU. For TIA Portal V20 the equivalent is documented at the Siemens TIA Portal help page referenced earlier.

1. Open SIMATIC Manager > HW Config and double-click the CPU on the rack to open its Properties. Confirm the MLFB exactly (e.g. 6ES7 414-3EM05-0AB0). The MLFB determines how many DP master ports the CPU has, and what firmware features are unlocked.
2. Right-click the integrated DP interface of the CPU and choose Add Master System. Drop the ET 200M heads (IM 153-1, order number 6ES7 153-1AA03-0XB0 or later) on the bus and assign DP addresses 3, 4, 5, … within the 1…124 range (address 0 is reserved for the master, 1 is conventionally the engineering tool).
3. Continue adding IM 153-1 heads until you reach the 32nd node (the master itself is node 1 of the 32, so the 31st IM 153-1 is the 32nd physical node). HW Config will refuse to drag a 33rd slave onto this segment without a repeater; the error message is "DP master system is full. Maximum of 32 stations may be connected."
4. Insert a PROFIBUS RS 485 Repeater (6ES7 972-0AA01-0XA0) into the bus. In HW Config the repeater is dropped from the catalog at PROFIBUS DP > Network Components > Repeater. It is not configured as a slave, but the tool now allows you to add slaves on the second segment.
5. Drop the remaining IM 153-1 heads on the second segment, observing the 30-station rule (1 of 32 nodes on the second segment is the repeater itself, the master is on segment 1).
6. Open DP master system > Properties > Network Settings > Options > Cables. Enter the number of repeaters in use (in this case 1) and the total cable length in km. Accept the recomputed bus parameters.
7. If the number of DP slaves must exceed the logical limit of the first port (124) or if the CPU is constrained to 32 slaves on its first port (the case flagged by the source contributor for the 319-3 PN/DP), add a CP 342-5 (for S7-300) or a CP 443-5 EXT (for S7-400) and create a second master system. Migrate the surplus slaves to the new system.
8. Save, compile, download. Watch the CPU diagnostic buffer for "DP slave OK" messages and the BF LED of each IM 153-1 head for a steady green.

Configuration Procedure in TIA Portal V20 (Modern)

The TIA Portal workflow is the same logical sequence but lives in a different navigation tree. Per the Siemens TIA Portal help page Adding DP slaves to the master system and configuring them (S7-300/S7-400/S7-1500), the procedure is:

1. Open Project tree > Devices & Networks. Drag the S7-300 or S7-400 CPU from the catalog into the network view.
2. Click the PROFIBUS interface of the CPU and choose Add master system. TIA Portal will draw a bus backbone that the ET 200M heads can be dropped onto.
3. From the catalog at Distributed I/O > ET 200M > IM 153-1 drag the required heads onto the bus. The tool auto-assigns addresses 3, 4, 5… as each head is placed.
4. When the 32-node limit is reached, drop a Repeater from the catalog at Network components > PROFIBUS > Repeater. The bus diagram now shows two segments, and a 33rd head can be placed on the second segment.
5. Open Master system > Properties > Cable configuration and enter the number of repeaters and the cable length. TIA Portal displays the calculated T_TR and warns if it is out of spec for the chosen baud rate.
6. If a second master port is required, drag a CP 342-5 / CP 443-5 EXT into the device view, add a new master system to its PROFIBUS interface, and move the surplus slaves onto it.
7. Compile (right-click the device > Compile) and download to the CPU. TIA Portal performs a topology check and reports any DP address conflict or bus-parameter violation in the Inspector window.

Diagnostics Repeater Configuration

The Diagnostics Repeater (6ES7 972-0AB01-0XA0) deserves its own section because its behaviour is the one most often misconfigured. The Diagnostics Repeater monitors the segment it sits on and reports to the master:

• Slaves that have stopped responding (segment is broken past the repeater)
• Reflected-wave faults on the local segment (cable short, missing terminator, broken shield)
• Distance-to-fault estimate (m of cable, measured by the repeater's TDR engine)

Because the Diagnostics Repeater reports data, it must be configured in HW Config as a DP slave with a PROFIBUS address of its own (typically 2, the first address after the master). The address you assign to the Diagnostics Repeater counts against the 32-node segment limit and against the 124-slave address space. The slave's diagnostic record is mapped into the process image as 16 bytes of input; the slot is IB x…IB x+15 and is included in the HMI tag list by default.

Configuration steps:

1. Drag the Diagnostic Repeater from the catalog onto the bus and assign a DP address (e.g. 2). The repeater must be the first station on the segment, electrically, because its TDR measurements assume it is at one end.
2. Open the repeater's Properties > Diagnostic tab and enable the records you want to receive. At minimum enable "Station failure", "Cable break / short", and "Distance to fault".
3. In the CPU's OB 86 (Rack failure OB) the engineering tool will automatically generate the slave-evaluation logic. A simple STEP 7 snippet for distance evaluation:

// STL example: read Diagnostics Repeater diagnostic record 1
CALL  SFC 13 // Read diagnostic record
       LADDR  := W#16#7FF0  // diagnostic address of repeater, base + 0
       RECNUM  := B#16#01   // diagnostic record 1 = topology
       RET_VAL := MW100
       RECORD  := P#M 200.0 BYTE 16
       BUSY    := M110.0
// Evaluate fault distance (m) from record bytes 4–5
L     MW 204       // fault distance in metres
T     MW 300       // expose to HMI

For S7-1200/1500 the equivalent is a RDREC instruction on the diagnostics repeater's I/O slot.

Verification and Commissioning Checklist

Before the bus is handed over to operations the engineer should walk through the following list. Each line is a check that has been proven in the field to catch one specific failure mode that the rest of the project can hide.

1. Topology verification. The total number of nodes per segment is ≤ 32. Total number of slaves per DP master system is ≤ 124 (or per the CPU manual, whichever is lower). Count masters, slaves, repeaters and OLM electrical ports.
2. Cable length verification. Each segment length is within the bus-speed table above. Use a TDR meter (e.g. Softing PROFINET Tester + PROFIBUS plug-in or Siemens BT 200) to confirm.
3. Termination verification. Each end of every electrical segment has a powered terminator. The terminator is a 220 Ω / 330 Ω network with +5 V bias. The most common field fault is a terminator left in the toolbox after a re-pull.
4. Shield bonding verification. Cable shields bonded to ground at both ends with low-impedance clamps. Drain wire terminated, not coiled.
5. Bus parameter verification. T_TR from the Cable Configuration dialog < 50 % of OB 1 cycle. The slave diagnostic buffer shows "Synchronized" on every slave.
6. Fail-safety verification. OB 86 (rack failure) is loaded and removes I/O from the process image when a slave goes down. OB 85 (program execution error) is also loaded. The default 318/319 CPU will stop if these OBs are missing.
7. Address uniqueness. Each DP slave has a unique PROFIBUS address. Use HW Config > Station > Check address consistency.
8. Diagnostic buffer on the CPU has zero "DP slave failure" events after a 24-hour soak with the bus at 50 % utilization.
9. Diagnostic repeater (if fitted) reports zero "Cable break", "Short" or "Reflected wave" events on a 24-hour soak.
10. EMC verification. Step the field with a 1 kV / 1 MHz ring-wave per IEC 61000-4-12 and confirm the bus does not drop slaves. The repeater is the main mitigation; the cable is the second.

Troubleshooting Matrix

Field-Notes Summary

Three rules cover roughly 90 % of the field cases that the source contributor and the rest of the engineering community run into:

• The 32-node limit is electrical and applies to one RS-485 segment. It is reached by counting the master, every slave, every repeater and every Diagnostics Repeater that has its own DP address.
• The 124-slave limit is logical and applies to one DP master system (one DP master port). It is reached by counting the slaves only, regardless of segment count.
• The bus-speed / cable-length table is electrical and applies to each segment individually. A repeater resets the budget for the segment that follows it.

When the project is at the boundary of any of these limits the engineer should re-open the Cable Configuration dialog, declare the repeaters and the cable length, and let STEP 7 / TIA Portal recompute T_TR. Skipping this step is the single most common reason for a bus that works on the bench and drops slaves on site.

For the S7-300 319-3 PN/DP, the S7-400 414-3 EM05, and any other CPU that the field team deploys, the relevant Siemens documentation is the SIMATIC S7-300 / S7-400 CPU manual (PDF on the Siemens Industry Online Support portal, search by MLFB), the SIMATIC NET PROFIBUS Network Manual, and the TIA Portal help page Adding DP slaves to the master system and configuring them (S7-300/S7-400/S7-1500). Cross-check every bus-parameter value against these documents before energising the field.

Frequently Asked Questions