PROFIBUS-DP Telegram Structure: Frame Format and I/O Timing

This reference explains the byte-level structure of a PROFIBUS-DP telegram, how one analog input and one digital input are mapped into a cyclic I/O frame, and how the 12 Mbit/s line rate translates into packets per second. The discussion is anchored to a CPU-400 class master (Siemens S7-400 family) but the framing rules are defined by IEC 61158/61784 and apply to any DP-V0/V1/V2 station on the bus.

1. PROFIBUS-DP Protocol Stack and Versions

PROFIBUS-DP (Process Field Bus – Decentralized Periphery) is a token-passing, master-slave fieldbus standardized in IEC 61158 (Type 3) and IEC 61784-1 CPF 3. The protocol stack is intentionally thin: a single integrated Layer-2 service (FDL – Fieldbus Data Link) that is reused for both cyclic and acyclic traffic, sitting on top of an RS-485 physical layer.

DP-V0 is the only mode available on legacy DP slaves; DP-V1 acyclic services require the master class 2 service to be enabled in the project. The PROFINET counterpart, PROFIsafe, and PROFIdrive profiles are not defined on DP itself but can ride on top of DP-V2 where the slave supports them. Manufacturer documentation for specific slaves (e.g., Pro-face GP-Pro EX PROFIBUS DP Slave Driver manual, Acromag Introduction to PROFIBUS-DP) consistently references the same byte-level framing rules derived from IEC 61158.

2. Physical Layer: RS-485, Cable, and Baud Rates

PROFIBUS-DP uses a 9.6 kbit/s to 12 Mbit/s NRZ-encoded RS-485 link on a shielded twisted-pair cable (PROFIBUS cable type A, 150 Ω nominal, ≤ 30 Ω/km loop resistance, ≤ 110 pF/m capacitance at 1 kHz). Segment length scales inversely with baud rate:

The bit time column is the basic unit of all PROFIBUS-DP timing math. At 12 Mbit/s each bit occupies 83.33 ns, so each UART character (1 start + 8 data + 1 parity + 1 stop = 11 bits) takes 11 × 83.33 = 916.7 ns. A 32-byte I/O payload therefore occupies at least 32 × 11 × 83.33 ns ≈ 29.3 µs of raw line time, before any inter-frame idle time is added.

3. UART Character and Telegram Frame

Every byte on the wire is serialized as an 11-bit UART character. PROFIBUS-DP defines an asynchronous, byte-oriented transmission that is bit-rate-agnostic at the protocol level. The complete DP telegram is built from these UART characters, framed with a small set of delimiter bytes that allow the receiver to resynchronize and detect telegram boundaries.

Each field has a fixed semantic role:

Idle time (also called sync time) is mandatory between two consecutive telegrams. At 12 Mbit/s the minimum sync time T_SYNC is 33 T_bit ≈ 2.75 µs; at lower baud rates the rule still holds in bit times, so the absolute time grows.

4. Telegram Types (SD Values)

The Start Delimiter byte is the only thing the receiver has to look at to identify the telegram shape:

Cyclic I/O traffic is always carried inside SD2 or SD4 frames. A typical cyclic exchange between an S7-400 master and one slave is one SD2 or SD4 request followed by one SD2 or SD4 response. Acks, errors, and short status requests use SD1 or SD5. The token is SD3 and is the heartbeat that rotates the bus access right among active stations.

5. Cyclic I/O Exchange (MS0)

DP-V0 masters poll each assigned slave once per token rotation. The service is SRD (Send and Request Data with Reply, FC 0x09/0x19) or DDLM_Data_Exchange (FC 0x08/0x18). On the request the master appends its output bytes; on the reply the slave appends its input bytes. From the master application perspective the cyclic frame is mapped into process-image input and output tables; on the wire it is a single FDL PDU.

MS0 cycle math (per slave):

T_cycle = T_token_rotation + Σ_slaves ( T_request + T_response + 2 × T_sync )

For a configuration with N slaves and 12 Mbit/s:

• T_bit = 83.33 ns
• UART char = 11 T_bit = 0.917 µs
• Min sync = 33 T_bit ≈ 2.75 µs
• Per-slave framing overhead (request SD2/SD4 + response SD2/SD4) ≈ 26 UART chars ≈ 23.8 µs
• User data per slave = L_in + L_out bytes → 2 × L × 11 × 83.33 ns

6. Worked Example: 1 AI + 1 DI on a CPU-400 Master

The source scenario assumes one analog input (AI) and one digital input (DI) sent from a PROFIBUS-DP slave to an S7-400 master. The exact byte count on the wire depends on the I/O definition in the slave's GSD file, but PROFIBUS conventions strongly constrain the layout:

For a 16-bit AI plus 1 DI bit, the minimum cyclic I/O is 3 input bytes. With no outputs the master still sends a write component (typically 0 bytes) within the SRD request. The slave reply contains the 3 input bytes. The resulting on-wire exchange at 12 Mbit/s is approximately:

Request: SD4(1) + LE(1) + LEr(1) + DA(1) + SA(1) + FC(1) + DSAP(1) + SSAP(1) + out_len(0) + FCS(1) + ED(1) = 9 bytes
Response: SD4(1) + LE(1) + LEr(1) + DA(1) + SA(1) + FC(1) + DSAP(1) + SSAP(1) + in_data(3) + FCS(1) + ED(1) = 12 bytes
Line bytes: 21 bytes × 11 T_bit = 21 × 0.917 µs ≈ 19.3 µs
Sync times: 2 × 33 T_bit ≈ 5.5 µs
Telegram-level overhead: 19.3 + 5.5 ≈ 24.8 µs per slave poll

At 12 Mbit/s that single slave poll consumes ~25 µs of bus time. With only that one slave, the theoretical maximum poll rate is roughly 1 / 25 µs ≈ 40,000 polls/s. In practice the token rotation, master scan time, and slave application processing limit this to 1-2 kHz on a CPU-400. STEP 7 / TIA Portal reports the resulting bus cycle in HW Config (menu: DP master properties → "Bus parameters" → "T_tr" target rotation time, and "T_cyc" cycle time of the master).

7. Baud Rate and Packets-per-Second Math

"Baud rate" on PROFIBUS-DP is the bit rate of the RS-485 NRZ signaling, not the telegram rate. The two are related by the framing rules:

Telegram_time (µs) = (number_of_bytes + sync_chars) × 11 / baud_rate_Mbit_s
Packets_per_second = 1 000 000 / Telegram_time (µs)

For our 1 AI + 1 DI scenario the two extremes are:

The CPU-400 application layer is normally the bottleneck, not the bus. With OB1 scan on a 416-3 in the 5-10 ms range, you should expect the field input to be refreshed at the OB1 rate, not at the line rate. The bus has spare capacity long before the PLC's process image becomes the limiting factor.

8. Token Rotation, Active Stations, and GAP

Bus access is governed by a logical token ring among "Class 1 masters" (DP-V0 active stations). Each master holds the token for at most its configured token holding time, then passes SD3 to the next higher-addressed active station. After the highest address the token wraps to the lowest. A master that hears no token within a watchdog (default 10 s) reinitializes the ring; this is a frequent cause of bus "flicker" on miswired segments.

Newly added masters that the existing ring does not yet know about are queried via a GAP request. The slave-only devices (passive stations) do not receive the token; they answer only when polled. This explains why adding a 17th slave to a 16-master network does not change T_tr linearly — it only changes the number of SRD transactions inside one token rotation.

9. Acyclic Services (DP-V1 MS1, MS2)

DP-V1 introduces two acyclic read/write services that share the same physical telegram shape (SD2/SD4) but use a different FC (0x24 = MS1 broadcast read, 0x25 = MS1 broadcast write; 0x56/0x57 for MS2 connection-oriented). MS1 uses the cyclic poll "in the gap" of the master's MS0 cycle; MS2 requires the master to hold an explicit connection opened with the slave. The acyclic payload rides in the PDU after DSAP/SSAP, indexed by slot/subslot/index, and is limited to 240 bytes per call. Tools such as ProSoft PLX51 PROFIBUS-DP gateways expose up to 1536 bytes of cyclic I/O when chaining 1-10 slaves behind a single gateway instance, and use MS1/MS2 internally for parameterization and diagnostics.

10. Configuration with STEP 7 / TIA Portal

The master project on a CPU-416-3 (or any CPU-400 with integrated DP interface or CP 443-5 Extended) needs three artifacts:

1. The GSD file (text GSD up to GSD Revision 5, or GSDML for PROFIsafe/PROFINET-style profiles) describing the slave. Older Siemens ET200S and ET200M GSDs are GSD; newer ET200SP/ET200AL are typically GSDML. Import the file via HW Config → Options → Install GSD File.
2. The slave's DP address, set by rotary switches on the device or via the slave's own "Set PROFIBUS address" service from the master (Class 2 SET_SLAVE_ADDR). 0 is reserved for service tools; 1-125 are valid for masters and slaves; 126 is the default "Address cannot be set from network"; 127 is broadcast.
3. The slot/I/O configuration: in HW Config drag the AI module to slot 1 and the DI module to slot 2. The cyclic I/O is then assembled in the order the modules appear in the slot table; the master transmits them as one contiguous byte stream in the SRD response.

After project download, HW Config → DP master → Operating mode → "DP slave diagnostics" should show green. The slave's "I-slave / I-device" interface, if present, must agree with the configured direction (input vs. output). HMI access to the same I/O via WinCC or PanelView requires no extra PROFIBUS-DP setup; the HMI's own PROFIBUS-DP user manual (Rockwell 2711-UM005) shows the equivalent configuration on the Allen-Bradley side.

11. Diagnostics, GSD, and Parameterization Telegrams

Beyond MS0, the master periodically issues Set_Prm (FC 0x5E / 0x5D) to push the slave's parameterization record, Chk_Cfg (FC 0x5F) to verify the slot table, and reads the diagnostic buffer with Get_Cfg / Slave_Diag (FC 0x0C/0x0D). The first 6 bytes of a standard diagnostic telegram are:

Bit Ext_Diag = 1 tells the master to fetch the extended diagnostic buffer (header + module status bytes). This is the field where over-range, wire-break, and short-circuit flags on the AI module appear. Refer to the slave vendor's GSD for the exact extended-diagnostic layout — Acromag, Pro-face, and Wago 750 series all follow the PROFIBUS profile conventions but allocate status bits at different module offsets.

12. Gateway Interoperation and Modern Alternatives

Where a CPU-400 class master must hand off to a non-PROFIBUS controller, a gateway is the typical solution. The ProSoft PLX51 PROFIBUS-DP Master/Slave gateway for example can present itself as up to 10 DP slaves to a CPU-400 master (1536 cyclic I/O bytes total) and forward to EtherNet/IP, Modbus TCP/IP, or Modbus serial. The PROFINET-DP coexistence path is the alternative: most new installations use PROFINET with PROFIsafe profile 1.1 / 2.4 over 100 Mbit/s Ethernet and bypass PROFIBUS-DP entirely. See the academic survey at ScienceDirect (PROFIBUS DP protocol on Ethernet) for the historical context that drove the PROFINET specification.

13. Field Commissioning Checklist

1. Terminate both ends of the segment with 220 Ω + 390 Ω (forming 150 Ω) bus terminators; do not use intermediate terminators. Siemens 6ES7 972-0DA00-0AA0 is the standard 9-pin D-sub terminator.
2. Verify shield continuity. Connect shields to ground at both ends with low-impedance clamps; avoid "pigtail" shield terminations longer than ~20 mm.
3. Set slave address 1-125 (avoid 0 and 126-127 unless you know why).
4. Match baud rate across the segment; PROFIBUS-DP uses auto-baud, but baud must be identical for every active station.
5. Check segment length against the baud-rate table; do not exceed 100 m at 12 Mbit/s.
6. Inspect green "BUS" LED on the slave and on the master's DP port; solid green means data exchange is established.
7. Use HW Config → "PROFIBUS" → "Diagnose" to read live station status before trusting the process image.
8. Confirm that the GSD revision matches the firmware on the slave; mismatches produce a CFG_Fault during Chk_Cfg.
9. For DP-V1 acyclic traffic, enable the master's MS1/MS2 services in the DP interface properties (TIA: "DP master operating mode" → "DPV1").
10. Capture bus traffic with a PROFIBUS analyzer (Softing, Intrepid, or the Siemens BT200 hand-held) and validate the SD4 telegram layout against Section 6 above.

14. Practical Diagnostics Matrix

15. Notes on Documentation Sources

When the Acromag, Pro-face, and ProSoft manuals describe the PROFIBUS-DP frame, they reproduce the same byte-level rules because they all implement IEC 61158 Type 3. For binding authority always cross-check the byte layout against the IEC 61158-3/-4/-5/-6 (Type 3) clauses, and against the GSD keyword definitions in the latest PROFIBUS Guideline from PROFIBUS International (PI).