Profibus Master-Slave Communication Hardware and TIA Portal Setup

Overview of Profibus DP Master-Slave Communication

Profibus DP (Decentralized Periphery) is a high-speed fieldbus standardized in IEC 61158/61784 that uses an RS485 physical layer running at 9.6 kbit/s up to 12 Mbit/s. The bus is master-slave oriented in DP-V0 with token passing between masters, while slaves only respond when polled. A class 1 master (DPM1) cyclically exchanges process data with assigned slaves, and a class 2 master (DPM2) handles commissioning and diagnostics. Understanding this hierarchy is the foundation for any S7-300/S7-400 or S7-1500 integration via TIA Portal or STEP 7 Classic V5.x.

For a single-engineer integration on a Siemens platform, the practical path is to deploy an S7 CPU with an integrated or plug-in Profibus interface (for example CPU 315-2 DP, 6ES7 315-2AH14-0AB0, or the S7-1500 with CM 1542-1, 6GK7542-1AX00-0XE0) and rely on the Siemens DP master firmware rather than developing a master stack from scratch. The Profibus DP ASIC (SPC3, VPC3+C, LSPM2, or netX) and RS485 transceiver are inside the Siemens module, eliminating the need to design a custom PHY.

Hardware Requirements for Profibus DP Implementation

A custom Profibus DP device requires a specific hardware chain. A UART-based "bit-bang" approach on a generic STM32 or ATmega will not deliver the 12 Mbit/s timing required by PROFIdrive or isochronous applications. The minimum hardware bill of materials for a slave device is:

For the bus segment itself, the cable specification is 9-pin D-sub (Siemens 6ES7 972-0BA12-0XA0) with 150 Ω characteristic impedance and a maximum stub length of 0.3 m at 12 Mbit/s. Without the ASIC you cannot meet the Profibus DP-V1/V2 timing windows; the bus master would flag your device with diagnostic 0x0B (no response from slave) within the slot time.

Protocol Stack Options and Licensing

Off-the-shelf stacks are required because the firmware state machine is not trivial. The principal options for slave devices are:

• Softing PROFIBUS DP-V0/V1 Slave Stack – ANSI C source code, royalty-based, supports VPC3+C and netX. Conformance test certificate from PI included.
• Hilscher cifX stack – delivered with the netX 100/500/1000 loader, runs on the on-board ARM9. Free for use on Hilscher hardware.
• Siemens IO-Link/PROFINET device stack – only for PROFINET, not applicable here.

For a master, the only realistic options are an industrial PLC (S7-300/400/1500), a Hilscher PC card (cifX 50-RE, part number 1333.000), or a Softing PROFIusb/PROFIcard. Open-source stacks (for example, Apache PLC4X) provide Java/Python abstractions over already-conformant hardware but do not replace the underlying Profibus ASIC on a PC.

GSD Files and Device Integration

Every Profibus DP slave is described by a GSD (General Station Description) file, standardized in IEC 61784-1. The GSD is the XML/ASCII equivalent of an EDS file for DeviceNet. A minimal GSD contains the device identity (Vendor_ID, Model_ID), supported baud rates, slot count, and I/O module definitions.

; Example GSD excerpt - 16 DI slave
#Profibus_DP
GSD_Revision = 5
Vendor_Name = "ACME Automation"
Model_Name = "AC16DI"
Revision = "1.0"
Ident_Number = 0x0AC1
Protocol_Ident = 0
Station_Type = 0
FMS_supp = 0
Hardware_Release = "1.0"
Software_Release = "1.0"
; Supported baudrates
9.6_supp = 1
19.2_supp = 1
45.45_supp = 1
93.75_supp = 1
187.5_supp = 1
500_supp = 1
1.5M_supp = 1
3M_supp = 1
6M_supp = 1
12M_supp = 1
; Module definition: 16 bits input
Module = "16 DI" 0x10
EndModule

To integrate the device in TIA Portal, copy the GSD into C:\Program Files\Siemens\Automation\Portal V<version>\Data\Hsp\PROFIBUS\GSD, then in the hardware catalog, refresh and drag the device into the Profibus subnet. The GSD is mandatory for any PI conformance certificate.

Siemens TIA Portal Configuration for an S7 DP Master

To configure an S7-1500 (for example, CPU 1515-2 PN, 6ES7 515-2AM02-0AB0) with a CM 1242-1 DP master module (6GK7 242-1DX30-0XE0) acting as a Profibus master:

1. Add the CM 1242-1 to the device configuration; the Profibus interface appears as "DP-master (1)".
2. Open the DP master properties, set the address (default 2) and the highest station address (HSA, default 126).
3. Drag the slave GSD from the catalog into the Profibus subnet. The slave's Profibus address must be unique in the range 1-125.
4. Insert the I/O modules defined in the GSD into slot 1 of the slave. Each module appears as input/output bytes in the CPU's process image.
5. Compile and download the hardware configuration. Use "Go online" → "Online & diagnostics" to verify that the slave transitions to "DP-V0 OK" status.

Programmatic Control of DP Slaves in an S7 Master

Once the hardware is configured, the engineer typically needs to enable or disable slave communication by program. For example, if a redundant slave is offline, the master should not generate a bus fault (BF) on every cycle. The function block DPSLAV_ENABLE (FB 814 in S7-300/400 STEP 7 V5.x) and the equivalent SFB 81 / SFB 82 (RD_REC / WR_REC) on S7-1500 manage this behavior.

// SCL example - S7-1500, disable Profibus slave at address 3 by program
#DP_DIAG_READ(REQ := TRUE,
              LADDR := 256,           // I/O start address of the DP master
              RET_VAL := #retVal,
              BUSY := #busy,
              ERROR := #err,
              DIAG := #diagBuf);       // 6-byte diagnostics record

IF #diagBuf.Slave_3_Station_Fault THEN
    // DDLM_Disable_Slave command (PI service 0x98)
    "DP_MASTER_CTRL".SLAVE_ADDR := 3;
    "DP_MASTER_CTRL".CMD := 16#98;   // Disable
    "DP_MASTER_CTRL".REQ := TRUE;
END_IF;

On S7-300 with STEP 7 V5.x, use FB 192 "DP_PRONETA" or directly call SFC 12 "D_ACT_DP" to deactivate a DP slave. This clears the BF (bus fault) LED and stops the master's polling, eliminating redundant diagnostic interrupts.

Reference: Enable and disable the Profibus slave communication by program for DP master documents the same DDLM service codes and the BF behavior when two healthy nodes are present.

Profinet vs Profibus DP: Selection Criteria

For new projects in 2024 onward, the engineering decision is whether to use Profibus DP or migrate to Profinet. Profinet offers:

Migration tools: Siemens provides the PN/PN Coupler (6ES7 158-3AD10-0XA0) to bridge a Profibus segment to Profinet. Softing and Hilscher offer similar protocol converters in the €400-€1500 range, which is far cheaper than redesigning a custom ASIC-based DP slave.

HART and HART-IP Integration Considerations

HART (Highway Addressable Remote Transducer) is not a direct replacement for Profibus. HART uses Bell 202 FSK modulation at 1200 bit/s superimposed on a 4-20 mA analog loop. The physical layer requires a HART modem, not an RS485 transceiver. HART-IP is the Ethernet/IP encapsulation of the HART command set (for example, command 03 reads PV, command 01 reads primary variable as % of range).

To read a HART device from an S7-1500, deploy a HART gateway such as the Phoenix Contact FL HART EPA (order no. 1043293) or the Siemens SITRANS AW200. The gateway exposes either HART-IP (UDP port 5094) or Modbus TCP to the PLC. Note that Apache PLC4X has a HART-IP driver that can poll a HART-IP gateway; however, the device-side HART bus still needs a physical FSK modem to reach the field instrument.

Diagnostic Tools and Protocol Analyzers

Capturing live Profibus traffic requires a tap or a master simulator with PCAP export:

• Softing BC-700-PB – USB Profibus master, captures and decodes DP-V0/V1 frames. Includes PROFINET IO Tester and FDT/DTM container.
• Procentec ProfiTrace 2 – bus monitor and oscilloscope, lists live station diagnostics including repeated telegrams and bus timing errors.
• Bihl+Wiedemann Profinet Master Simulator – PC-based Profinet controller for laboratory use, free with the BW1131 coupler.
• Wireshark – for Profinet, Wireshark has a production-grade dissector (the protocol is UDP-based). For Profibus, you need the WinPCAP-NT driver on a USB-RS232C adapter and a Bihl+Wiedemann master simulator; Wireshark will only see the raw bytes, not the DP service decoding.

For a free development environment, CODESYS 3.5 with the EtherNet/IP Scanner and Profinet Controller packages can run on a Raspberry Pi 4 with a 16 GB SD card. Two Pi units can act as a Profinet controller and device on the same network, allowing Wireshark capture via a managed switch SPAN port. The CODESYS Windows PLC runtime also works; the constraint is that only one instance of the runtime can be hosted per Windows host, so two PCs (or a VM) are required for two-node testing.

Development Cost and Conformance Certification

A realistic budget for a custom Profibus DP slave ASIC-based design, including conformance test:

For low-volume production (under 500 units), a serial-to-Profibus gateway from HMS Anybus (AB7801-F, ~ €450) or Prosoft (ILX34-PBS, ~ €600) is a cost-effective alternative. The gateway presents itself as a Modbus RTU/TCP device to your application microcontroller, while handling the Profibus DP master interface and conformance in firmware.

Field-Commissioning Verification Steps

1. Power up the master PLC and the slave. Check that the slave's BF LED is off within 5 seconds (one token rotation at 1.5 Mbit/s is ~3 ms).
2. In TIA Portal, "Go online" → expand the DP subnet → right-click the slave → "Online & diagnostics" → "DP diagnostics". Verify "Station status 1 = 0x00" and "Station status 2 = 0x00" (or the expected configured value).
3. Force a known I/O value in the slave and read it back from the PLC's process image. Use a watch table with the input byte address from the slot configuration.
4. Trigger a slave disconnect by powering off the slave. Confirm that the PLC's IO_device_error bit clears within the configured failure-detection time (default 100 ms in TIA V18+).
5. Run ProfiTrace for 30 minutes; the bus load should remain below 60% at 1.5 Mbit/s to leave headroom for acyclic services.

Troubleshooting Matrix

FAQ