Resolving PROFIBUS DPV1 Communication on S7-300 CPU315-2PN/DP

System Overview and Integration Context

Integrating a third-party PROFIBUS DPV1 slave with a Siemens SIMATIC S7-300 CPU 315-2 PN/DP is a routine task when a GSD file is available, but it is one of the most failure-prone integration paths in factory automation because three constraints have to be satisfied simultaneously: the GSD file must be installed and selected against the correct DP master interface, the slot table must be configured with the byte counts and consistency declared by the slave vendor, and the application program must use a function block that matches the chosen I/O model (cyclic consistent data via DPWR_DAT / DPRD_DAT or acyclic data records via WRREC / RDREC). The 480 V servo drive data concentrator described in the field case — a master/slave device that exchanges a 130-byte outbound cyclic telegram and a 228-byte inbound cyclic telegram every 500 ms — is a typical example of a DPV1 node that requires both large input and output slots and a defined update time.

The behavior described — "data is being sent, but I get no response" — is almost never a function-block bug. The PLC is producing output telegrams because the CPU is putting bytes on the wire, but the slave is rejecting the telegram, not recognizing its length, or never entering the data-exchange state. The first place to investigate is therefore HW Config (or the TIA Portal device configuration), not the application block.

Hardware Identification and CPU Variant

Before any software configuration, the CPU must be positively identified. The 315-2 PN/DP family ships in several firmware generations that differ in supported DPV1 features and in the maximum number of DP slaves and I/O bytes per rack.

Read the exact MLFB and firmware version from the module itself — both are printed on the front panel. Open the CPU door and look for the strip on the inside of the door or the laser-etched label on the housing. The firmware version is reported in STEP 7 under PLC → Module Information → Diagnostic Buffer and in the TIA Portal under Online & Diagnostics → Diagnostics. CPU firmware V3.3 supports the full DPV1 feature set including acyclic record transfer via WRREC/RDREC and is the recommended baseline for integrating modern third-party slaves.

The PROFIBUS master interface is the 9-pin D-sub female connector labelled X2 on the bottom of the CPU. It supports up to 12 Mbit/s and is electrically isolated. Pin 3 is Data B (red, RxD/TxD-P), pin 4 is RTS, pin 5 is DGND (data ground), pin 6 is VP (+5 V bus terminator power), pin 8 is Data A (green, RxD/TxD-N). A PROFIBUS terminator must be active at both physical ends of the segment, and only at the ends — intermediate nodes must leave termination switched off. The CPU itself does not contain a built-in terminator; termination is provided by the PROFIBUS connector (e.g. 6GK1500-0EA02) or by an Active RS-485 Terminating Element (e.g. 6ES7972-0DA00-0AA0).

PROFIBUS DPV1 vs DPV0 — What the Slave Needs

PROFIBUS DPV1 is a superset of DPV0. Every DPV1 master can communicate with DPV0 slaves transparently, but a DPV1 slave may require features that are only negotiated when the master is configured for DPV1 operation. The defining DPV1 features relevant to this case are:

• Cyclic I/O — identical to DPV0; fixed-size input and output slots mapped into the process image or into a peripheral area.
• Acyclic record transfer — read/write of up to 240-byte data records indexed by slot and index; used for parameterization, diagnostics, and slow setpoint channels.
• DPV1 class 1 alarms — slot- and diagnostic-alarm reporting pushed from the slave to the master.
• DPV1 class 2 — used by engineering tools for live parameter modification.

A data concentrator for 480 V servo drives that publishes a complete byte map almost certainly uses both the cyclic channel (real-time process data) and the acyclic channel (parameter download at boot, drive identification reads). The PLC application must handle both.

Step-by-Step: Hardware Configuration in STEP 7 V5.5

The following sequence assumes the standard SIMATIC Manager project with a CPU 315-2 PN/DP inserted at slot 2 of rack 0. The procedure for TIA Portal V16+ is functionally identical but the menu paths differ.

1. Install the GSD file. Open HW Config. Menu Options → Install GSD File. Browse to the GSD (or GSDML, if PROFINET) file supplied by the third-party vendor. Restart HW Config if the slave does not appear in the catalog immediately. The Siemens-supplied CPU 315-2 PN/DP GSD is part of STEP 7 and is loaded automatically. Place a SIMATIC 300 station in your project; double-click slot 2 to assign the CPU.
2. Add the DP master interface. Open the CPU properties. Tab Interface → sub-node PROFIBUS → click Properties → New. Assign a PROFIBUS subnet (default subnet name PROFIBUS(1)), set the master address (default 1 — the address of the CPU 315-2 PN/DP), set Highest PROFIBUS address to 126, and set Transmission speed to a value the slave supports (1.5 Mbit/s is the most robust default for a 3rd-party servo concentrator). Disable DP slave operation of the CPU master interface unless the CPU is also acting as a slave.
3. Set the operating mode to DPV1. In the same dialog, switch to Operating Mode. Select DP master and tick DPV1. Without this tick, the master will negotiate only DPV0 and acyclic WRREC/RDREC calls will return STATUS = 0x80D0 ("Function not supported by DP slave") even if the slave is DPV1-capable. Refer to the S7-300 CPU 31xC and CPU 31x manual for the menu layout; the standard manual ID is 12996906 on Siemens Industry Online Support.
4. Insert the third-party slave on the bus. Drag the slave from the catalog onto the PROFIBUS (1) subnet. Double-click the slave icon on the bus and assign PROFIBUS address 2 (matches the field case). Confirm the GSD revision.
5. Configure slots. Open the slave object. The vendor GSD declares a default slot table. Each row is one module/slot. For the data concentrator the typical default is one or two input modules and one or two output modules. Click each slot and verify:

• Length in bytes matches the telegram (130 bytes output for the concentrator's request, 228 bytes input for its reply). The lengths declared in the GSD are the lengths the master will allocate; if the GSD declares a single 32-byte module you must change it to the vendor-specified length, or split it across multiple GSD slots of compatible sizes.
• Consistency is set to Total length (the default for >4 byte slots). This is mandatory for DPWR_DAT and DPRD_DAT to operate correctly; "byte consistency" or "word consistency" will cause sporadic short telegrams with mismatched timestamps.
• I/O address starts at a known peripheral area, e.g. PEW 256 / PAW 256. Record these addresses — they are passed as the RECORD parameter (in I/O words) to DPWR_DAT and DPRD_DAT.

6. Save and compile the HW Config, then download to the CPU. The CPU must be in STOP for the first download. After download, switch to RUN and observe the diagnostic LEDs.

Functional Block Selection: DPWR_DAT / DPRD_DAT vs WRREC / RDREC

The choice between the two pairs of blocks is determined by the data-flow model, not by the developer's preference.

For the data concentrator with a 130-byte cyclic write and 228-byte cyclic read, both directions are cyclic, and the correct blocks are DPWR_DAT (FC 15) for the outbound side and DPRD_DAT (FC 14) for the inbound side. WRREC/RDREC are correct only for the acyclic parameter channel that initializes the slave at boot.

The signature of DPWR_DAT (STEP 7 Standard Library → SIMATIC_NET_CP → CP 300/400) is:

FC15 DPWR_DAT
   LADDR  : INT    // Logical I/O address start of the configured slot (output area)
   RECORD : ANY    // Source DB area in the CPU (length must equal configured slot length)
   RET_VAL: INT    // Return value / error code

DPRD_DAT has the same signature with RECORD pointing to a destination DB. The block copies between the peripheral area and a data block in a single, non-interruptible CPU operation, which is why slot consistency must be set to "Total length" in HW Config.

Working STL Example — Cyclic Write 130 Bytes to the Concentrator

Assume the output slot is configured at PAB 256 with length 130 bytes and full consistency. The source data block is DB 100, range DBX 0.0 to DBB 129. The call would be made once per PLC cycle (or once per 500 ms as the field case requires).

// OB1 - call DPWR_DAT every cycle
CALL FC 15 // DPWR_DAT
   LADDR  := W#16#100     // 256 decimal = PAB 256
   RECORD := P#DB100.DBX0.0 BYTE 130
   RET_VAL := MW 200

// Error evaluation
L MW 200
L 0
<>I
S M 210.0    // Set "DPWR_DAT error" flag for HMI

If RET_VAL is anything other than 0000 h the transfer was not completed successfully. The most common non-zero values for the CPU 315-2 PN/DP with an integrated PROFIBUS master are:

Working STL Example — Cyclic Read 228 Bytes from the Concentrator

The input slot is configured at PAB 300 (any unused peripheral range), 228 bytes, full consistency. The destination is DB 101.

// OB1 - call DPRD_DAT every cycle
CALL FC 14 // DPRD_DAT
   LADDR  := W#16#12C    // 300 decimal = PAB 300 (logical base of input slot)
   RECORD := P#DB101.DBX0.0 BYTE 228
   RET_VAL := MW 210

// Edge-triggered copy of status byte for diagnostics
A M 0.0          // 500 ms clock from OB35
JCN _001
L DB101.DBB 0    // First status byte per concentrator byte map
T MW 220
_001: NOP 0

Acyclic Initialization via WRREC — Recommended Boot Sequence

Most DPV1 servo concentrators require an initialization record to be written during startup before the cyclic process data is valid. The block is WRREC (SFB 53), called from OB 100 (restart) or OB 1 with a one-shot flag.

// OB100 - warm restart
CALL SFB 53 // WRREC
   REQ    := TRUE
   IOID   := B#16#54      // Output ID (B#16#54 = output, B#16#55 = input, slot-based)
   LADDR  := W#16#100     // Logical address of the slave module
   RECNUM := B#16#0       // Data record index — vendor-specific (often 0 for "init")
   RECORD := P#DB200.DBX0.0 BYTE 32   // Init record from DB 200
   DONE   := M 300.0
   BUSY   := M 300.1
   ERROR  := M 300.2
   STATUS := MW 302

STATUS returned in MW 302 should be 0000 h on success. For a non-zero status consult the STEP 7 function manual (search ID 23803910 on Siemens Support). Common patterns: DF80 h = record length error, DF81 h = invalid slot/index, DF82 h = access denied (slave still booting).

Diagnostic LED Interpretation

The CPU 315-2 PN/DP front panel carries four diagnostic indicators that together tell you almost everything about the state of the bus:

For the field case where data is being placed on the wire but the slave does not respond: BF slow flash is the expected indicator — the slave is rejecting the configuration. The first place to check is the slot length and consistency declaration.

Reading the Diagnostic Buffer

Open PLC → Module Information → Diagnostic Buffer (STEP 7 V5.5) or Online & Diagnostics → Diagnostics (TIA Portal). The diagnostic buffer is the chronological log of events on the CPU and is the single most valuable troubleshooting source for PROFIBUS errors. The events to look for, in order of likelihood:

1. "DP slave parameterization fault (slave address 2)" — the configuration telegram does not match what the slave expects. Inspect the slot table.
2. "DP slave configuration fault (slave address 2)" — the Chk_Cfg response from the slave mismatches the master view. Verify the vendor GSD version against the installed firmware on the slave.
3. "Station failure (slave address 2)" — the slave dropped out of data exchange. Check cable shielding, EMC, and termination. If the issue appears at predictable times of day (e.g. when VFDs start), suspect common-mode noise from the 480 V drives.
4. "Bus fault (PROFIBUS)" — physical-layer issue. Check the segment with an oscilloscope on PROFIBUS or a PROFIBUS tester (e.g. Softing BC-700-PB, Indu-Sol PROFIN-INspektor PB).

For background on PROFIBUS diagnostics methodology and the predominance of design/installation issues, the HMS Networks whitepaper Anybus Diagnostics eBook for PROFIBUS documents that approximately 90% of PROFIBUS field problems originate at the design or installation stage, with poor physical connections as the dominant cause.

Root-Cause Matrix — Field Symptoms

Physical Layer Verification

Before any program changes, the PROFIBUS segment must be electrically validated:

• Termination — the two end connectors (one typically at the CPU side via the Active Terminating Element) must show termination ON; all intermediate connectors OFF.
• Shielding — the bus cable must be a type-A PROFIBUS cable (violet jacket, 150 Ω characteristic impedance, e.g. Siemens 6XV1830-0EH10 or equivalent). Type-B cable (twisted-pair only) is permitted but reduces maximum speed and segment length.
• Segment length — at 1.5 Mbit/s maximum segment length is 200 m without repeater. At 500 kbit/s it is 400 m. Multiple segments with repeaters (e.g. 6ES7972-0AA02-0XA0) extend the bus.
• Address uniqueness — slave address 2 must not be in use by any other device on the segment. With the CPU at address 1, slave at 2, the segment has at most 124 further addresses.
• Address switch on slave — DIP switch on the slave must agree with the address in HW Config. Most servo concentrators require a power cycle for an address change to take effect.

Verification Procedure After Correction

1. CPU in STOP. Edit HW Config, save, compile, download.
2. CPU in RUN. Observe BF LED — it must extinguish within 5 seconds.
3. In the diagnostic buffer, confirm the absence of any DP parameterization or configuration fault events.
4. Insert a watch table in STEP 7 with the input slot address (e.g. PEB 300..527) and verify values change in real time as the concentrator receives new servo data.
5. Force a known output pattern from a data block into the output slot (e.g. incrementing counter in DB 100) and verify with a PROFIBUS analyzer on the slave side that the bytes appear in the configured order.
6. Power-cycle the slave and verify that the PLC re-enters data exchange automatically without restart of the CPU (DPV1 auto-restart is configurable in HW Config under Operating Mode).

Common Pitfalls When Migrating from RSLogix or GX Works

Engineers who have written cyclic PROFIBUS communication for Allen-Bradley ControlLogix (RSLogix 5000) or for Mitsubishi GX Works (FX/Q/L Series) tend to assume that the I/O mapping model is identical. It is not. Specifically:

• Allen-Bradley uses "connections" with explicit produced and consumed tags; the slot concept exists but is hidden behind AOI blocks. Siemens exposes slots directly in HW Config.
• Mitsubishi GX Works uses the FX3U-ENET-ADP or the Q-series MELSEC buffer memory with dedicated register ranges. The Siemens ANY-pointer model is different and the boundary between process image and DB is rigid.
• Neither platform requires the DPV1 mode to be explicitly enabled; Siemens does.
• Only Siemens uses the DPWR_DAT/DPRD_DAT pair for consistent cyclic copy — equivalent functionality in Allen-Bradley is handled by the implicit CIP I/O assembly, and in Mitsubishi by direct MOV instructions from buffer memory.

For the field engineer transitioning to Siemens, the practical takeaway is: never write the application program before the slot is verified with a watch table in STEP 7. If the input bytes update correctly in the watch table, the application block will work; if they do not, no amount of code rework will fix the problem.

Standards Reference

PROFIBUS DP and DPV1 are governed by IEC 61158 and IEC 61784. The official maintenance body is PROFIBUS & PROFINET International (PI), which publishes the GSD specification (the file consumed by HW Config). The PI technical guidelines and the PROFIBUS Installation Guide are the canonical references for cable, connector, and shielding rules. The S7-300 hardware manual, the STEP 7 V5.5 system manual, and the SFB/FC reference manual for DPWR_DAT/DPRD_DAT (search ID 1176943) and WRREC/RDREC (search ID 1097514) on Siemens Industry Online Support are the canonical Siemens-side references.

FAQ