PROFIBUS DP Slot Address Alignment: Why 128 Instead of 126

Overview

PROFIBUS DP master-slave configuration in Siemens automation systems uses a slot-based I/O model in which every slot of a modular DP slave is mapped to a contiguous range of byte addresses in the CPU process image. When an engineer adds additional slots to exchange data with a distributed I/O station, the I/O address planner in STEP 7 V5.x, the TIA Portal, or PCS 7 computes a starting byte for each new slot based on the declared byte length of the preceding slots and the alignment rules of the PROFIBUS DP protocol. A common field observation is that after declaring 13 input words starting at byte 100, the next available slot does not start at the seemingly obvious byte 126 but at byte 128. The 2 bytes 126 and 127 appear to be lost.

This article explains why the planner inserts that gap, how the GSD file definition of the slave module and the PROFIBUS DP consistency model drive it, how to interpret the address overlap rule that the planner enforces, and how to verify the result with STEP 7 or TIA Portal online diagnostics. The discussion applies to all Siemens modular DP slaves - ET 200S, ET 200M, ET 200pro, ET 200iSP, ET 200SP HA, third-party modular DP slaves, and CP 342-5 / CP 443-5 DP master interfaces.

PROFIBUS DP Slot-Based I/O Addressing Fundamentals

A modular PROFIBUS DP slave is described by a GSD file (General Station Description, standardized in IEC 61784 and maintained by PROFIBUS International / PI). The GSD file declares the slots of the station, the modules that may be inserted in each slot, and the I/O length of each module in bytes. The DP master imports this GSD file via the device database, presents the slots in the hardware catalog of the engineering tool, and assigns an input and output address range to each inserted module.

Per PROFIBUS DP (IEC 61158 Type 3), I/O addresses are byte-granular. The PLC CPU organizes the process image in input bytes (IB), input words (IW), input double words (ID), and the corresponding output qualifiers QB, QW, QD. The planner must place every slot on a byte boundary that respects two constraints:

1. The end of the previous slot, computed as Start + Length_in_Bytes.
2. An alignment requirement declared by the GSD entry for the next module (byte, word, or double word).

The PROFIBUS specification (see PROFIBUS International specification documents) defines slot lengths as multiples of 1 byte. Siemens GSD entries, however, are commonly written with their length expressed in PROFIBUS "units" where 1 unit equals 1 byte for digital modules and where some analog and motor-starter modules report length in 16-bit words.

Byte-Granular Addressing vs Word-Granular Configuration

In STEP 7 HW Config and in the TIA Portal device view, the slot dialog often displays the length of a module as "N word" because the catalog list is user-friendly. Internally, the planner stores the length in bytes and uses Length_bytes = N_word × 2. A declaration of "13 word" therefore occupies exactly 26 bytes of process image.

If slot 1 starts at input byte 100, the planner computes:

• First byte: 100
• Last byte: 100 + (13 × 2) - 1 = 125
• Next free byte (logical): 126

The address range IW100 to IW124 inclusive corresponds to 13 input words, each 2 bytes. Symbolically:

The expectation that the next slot starts at IW126 is logically correct for byte-granular addressing. The PROFIBUS DP planner, however, additionally checks the alignment requirement of the next module before confirming the start address. If the next module declares a length or a consistency unit that requires a 4-byte (double-word) boundary, the planner rounds the candidate address up from 126 to 128.

Why the Next Slot Starts at Byte 128 Instead of 126

Several GSD-side causes can force the planner to skip two bytes. The three most common reasons, in order of frequency, are:

1. Double-word alignment of the next module. Many Siemens DP modules (particularly the ET 200S digital and analog I/O modules and the SIMOTION / SINAMICS drives) declare in their GSD entry that the slot must start on a 4-byte boundary. The candidate address 126 is not a multiple of 4. The planner rounds up to the next multiple of 4, which is 128.
2. Reserved status bytes embedded in the GSD slot definition. The GSD entry often specifies a length greater than the user-visible data length. For instance, a 13-word module might be declared as 14 words (28 bytes) in the GSD to reserve 2 bytes for module status or diagnostic information. The 2 extra bytes are not visible in the slot list but are counted by the planner.
3. Total consistency greater than the data length. The PROFIBUS DP consistency setting ("Unit") on a slot dictates the smallest atomic block the master reads or writes. If the module declares a consistency of "Total length" or "4 bytes", the planner reserves a contiguous block of 4 or more bytes even when the user-selected length is smaller. The reservation lives in the process image but is not exposed in the user symbol list.

For the configuration described (13-word input slot starting at IB100, followed by another 13-word input slot), the most likely explanation is reason 1: the second module requires double-word alignment, and the planner therefore rounds the candidate address 126 up to 128. Bytes IB126 and IB127 are reserved by the planner as a padding gap that closes the alignment to 4.

Consistency Types and Their Address Impact

PROFIBUS DP defines four consistency types that determine how the master transfers the I/O of a slot across the bus. The consistency type is declared in the GSD file and surfaced in the slot properties dialog of STEP 7 and TIA Portal as "Consistency". It directly affects both the size of the atomic transfer block and the planner's alignment decision.

A DP-V0 / DP-V1 slave is free to declare any of these. ET 200S digital I/O modules typically declare byte or word consistency, ET 200S analog modules and SIMATIC ET 200SP analog modules typically declare total consistency. When the planner inserts a slot whose declared consistency is "Total" and whose data length is not a multiple of the consistency unit, the planner expands the reserved area to the next multiple and the gap becomes visible.

In the case under analysis, a 13-word slot with total consistency of 4 bytes produces 26 bytes of data. The planner pads the slot to the next multiple of 4, which is 28 bytes, consuming bytes 100 to 127. The next slot then begins at byte 128.

GSD File Definitions and Reserved Status Bytes

The GSD file for a modular DP slave (file extension .GSE for STEP 7 V5.x, .GSD or .XML for TIA Portal) contains a Module definition for each insertable module. Each Module line lists the slot-specific parameters, the length of the input area, the length of the output area, and the consistency. The relevant PROFIBUS keywords (per the PROFIBUS GSD specification, also documented in the Siemens Industry Online Support GSD file reference) include:

• Lengths= - Total length in bytes
• Length_in_Bytes= - Length of input data
• Length_out_Bytes= - Length of output data
• Consistency= - 0 = byte, 1 = word, 2 = double word, 3 = total
• SlotDefinition= - Required slot number and family

Open the GSD in a text editor and search for the module name. The Lengths= field reveals the true address reservation. A module shown as "13 word" in the catalog may carry a Lengths=0x1C entry (hex 1C = 28 decimal), which corresponds to 28 bytes - exactly the 2-byte gap that produces the jump from 126 to 128.

Configuring Slot Start Addresses in TIA Portal and STEP 7 V5.x

To change or inspect the start address of a slot in the TIA Portal:

1. Open the project and navigate to the DP master system in the network view.
2. Double-click the DP slave to open the device view.
3. Select the slot whose start address you want to inspect.
4. In the properties inspector (lower pane), open the "I/O addresses" category.
5. Read the "Start address" field. Uncheck "Use default address assignment from the higher-level IO device" to enable manual editing.
6. Enter the desired start byte (for example, 126). The portal validates the address and accepts it only if it conforms to the module's alignment rule.
7. Compile the project. The "Go online" button reveals the live address table.

To perform the same operation in STEP 7 V5.x (HW Config):

1. Open the SIMATIC station and double-click the DP slave to open the station window.
2. Select the slot in the lower half of the window.
3. Open the menu Edit > Object Properties (or double-click the slot).
4. In the dialog, switch to the "Addresses" tab.
5. The "Input start" and "Output start" fields display the current values. Edit them and confirm with OK.
6. Save and compile. The system message "The slave address you entered is not valid" appears when the address violates alignment or overlaps another slot.

When the planner rejects the manual address "126" and forces the value back to "128", the rejection is not a bug. It is the planner enforcing one of the rules listed in the previous sections. To make the planner accept a different address, you must either change the GSD (not recommended and often not licensed) or change the module order so that the alignment-sensitive slot is preceded by a slot whose declared length is already a multiple of 4.

Manual Override Validation: Why "126" Was Rejected

The error message "The slave address you entered is not valid" is generated by the address-planner library of STEP 7 and the TIA Portal when the candidate start address fails one of the following checks:

• Process image boundary: The candidate start byte plus the module length must lie within the configured process image of the CPU. For an S7-300 with a default process image of 128 bytes, a slot starting at IB100 with a length of 28 bytes ends at IB127. The next slot must start at IB128 or later. A candidate start at IB126 would overlap slot 1 and is rejected.
• Alignment check: The candidate start byte must be aligned to the consistency unit. For a 4-byte consistency, the candidate must be a multiple of 4. 126 is not; 128 is.
• Slot order check: The DP master enforces that the start address of slot N is greater than or equal to the end address of slot N-1 plus 1. With slot 1 ending at IB127 (because the planner padded to 28 bytes), the next slot must start at IB128 or higher.
• Diagnostic address overlap: Siemens modular slaves reserve a diagnostic address range (often 1 byte) for slot 0 or for the station itself. The planner prevents I/O addresses from overlapping the diagnostic range.

The "128" the planner suggests is therefore not arbitrary - it is the smallest valid byte that satisfies all four checks.

Accessing IW124 and ID124 - Word vs Double-Word Semantics

A second source of confusion in slot addressing is the difference between the size of an address symbol and the size of the address range it occupies. In S7 syntax the operand size is fixed by the qualifier:

For the 13-word slot ending at byte 125, IW124 occupies bytes 124 and 125 only - it is a single 16-bit word, not a 32-bit double word. To access 4 bytes as a single coherent value, use ID124, which spans bytes 124 through 127. Because the planner reserved bytes 126 and 127 as alignment padding (not as module data), the high word of ID124 contains status or undefined content.

The same logic applies to the output side. QW124 occupies bytes QB124 and QB125; QD124 occupies bytes QB124 through QB127.

Address-Mapping Example: 5-Slot DP Slave

To make the rules concrete, the following table summarises the planner's view of the 5-slot configuration described in the field scenario. The "Logical Bytes" column is the user-expected address range; the "Reserved Bytes" column is what the planner actually reserves based on the GSD and consistency rule.

The exact "Start" column depends on the consistency declaration in the GSD. If the GSD declares byte consistency for slot 1, the slot occupies exactly 26 bytes (IB100-IB125) and slot 2 starts at IB126, not IB128. The 2-byte gap is the diagnostic signature of 4-byte consistency or 4-byte alignment.

Verification and Online Diagnostics

To confirm the planner's address assignment in the live system:

1. Compile the project and download the hardware configuration to the CPU.
2. Connect online with STEP 7 or TIA Portal and open the device view of the DP slave.
3. Switch to "Online > Diagnostics > Module Information". The dialog displays the actual start and end byte for each slot as seen by the CPU.
4. Compare the online start address with the offline value. If they differ, the planner's offline value is what the offline configuration stores; the online value is what the master is actually using. Differences typically indicate a failed download or a different GSD revision on the slave.
5. Use a VAT or watch table to read the input words. Read IW100 to IW124 and confirm that the values update in the expected pattern.
6. Read IB126 and IB127 to determine whether they contain module status (typically a fixed pattern) or undefined values. The pattern is documented in the slave's manual (for example, in the Siemens ET 200S operating instructions).

If the project must use byte 126 as the start of the next slot, the practical solutions are:

• Reduce the length of slot 1 from 13 words to a value that yields a multiple of 4 in bytes. For instance, 14 words = 28 bytes ends exactly on byte 127, and the next slot still starts at byte 128. Twelve words = 24 bytes ends at byte 123, and the next slot starts at byte 124.
• Insert a 1-byte placeholder module (a digital input or output module that occupies 1 byte) at slot 1.5 to consume the alignment gap. This trick is common when working with third-party GSDs that cannot be edited.
• Replace the DP slave with a different family whose GSD does not require 4-byte alignment. Some ET 200SP HA and third-party slaves declare byte consistency, which removes the gap.

Standards and Manufacturer References

The behavior described in this article is documented in several official sources. The PROFIBUS DP protocol (Type 3 of IEC 61158 and the corresponding profile in IEC 61784 CPF 3) defines the GSD specification and the consistency types. The Siemens-specific implementation is documented in the manuals for the relevant modular I/O systems:

• SIMATIC ET 200S Distributed I/O System manual (hosted on Siemens Industry Online Support) - explains slot-based configuration and consistency settings.
• SIMATIC S7-300 CPU 31xC and CPU 31x Operating Instructions (on Siemens Industry Online Support) - documents the process image layout and address-planner rules.
• TIA Portal help system, topic "Configuring PROFIBUS DP slaves" - documents the address-planner checks performed when the user edits a slot start address.
• PROFIBUS GSD Specification, Version 5.x, published by PROFIBUS International / PI - defines the keywords Lengths=, Consistency=, and the Module definition grammar.

When verifying a specific behavior, always cross-reference the GSD file shipped with the actual slave (revision and date code printed on the device label) against the configuration in the engineering tool. GSD revisions can change the alignment rule between firmware versions of the slave.

Frequently Asked Questions