S7-1516-3 PN/DP Capacity Planning: Connections, I/O, and HMI Limits

The SIMATIC S7-1500 CPU 1516-3 PN/DP sits in the upper-middle performance tier of the S7-1500 family and is commonly selected as a central controller for plants that mix PROFINET and PROFIBUS segments, ET 200MP stations, and HMI panels. Selecting this CPU for a large system requires planning across four independent resource pools: connection resources, PROFIBUS DP slaves, PROFINET IO devices, and the process-image / I/O address space. This reference extracts the engineering rules, worked calculations, and firmware-dependent limits needed to size a 1516-3 PN/DP project before commissioning.

1. CPU Identification and Hardware Layout

The 1516-3 PN/DP integrates three physical interfaces on the front of the module:

• PROFINET interface X1 (PN/IE): Two-port managed switch for PROFINET IO, I-Device, and TCP/IP traffic.
• PROFINET interface X2 (PN/IE): Second PROFINET port, usable as a separate PROFINET network or for I-Device separation.
• PROFIBUS DP interface X3 (DP): RS-485 master/slave port for PROFIBUS DP-V0/V1.

The PROFINET ports operate as a 2-port switch, eliminating the need for an external switch in line topologies. The DP port supports DPV1 diagnostics, equidistance, and isochronous mode on the CPU side.

2. Connection Resources: The 128 / 256 Rule

The single most-misunderstood limit on the 1516-3 PN/DP is the connection budget. Two budgets exist simultaneously and must be tracked separately:

Reserved connection resources are pre-allocated by the operating system for PG, OP, and S7-communication housekeeping. On the 1516-3 PN/DP, 10 resources are reserved by default, of which 4 are reserved for HMI/OP connections. These reserved slots count against the 128 total but are not user-configurable; the remaining 118 are available to the program.

2.1 ISO Transport Connections and CP Requirement

The ISO Transport protocol (RFC 1006) used by legacy S5 and S7-400 systems is not supported on the integrated PROFINET interface of the 1516-3 PN/DP. ISO Transport connections must be terminated on a CP (e.g., CP 1543-1 or CP 1542SP-1). A CP provides its own connection resources and consumes 4 of the station's 256 resources, not the CPU's 128.

3. PROFIBUS DP and PROFINET IO Limits

The DP and PN segments are bounded by separate counters that have no direct relationship to the 128 connection budget.

The DP segment supports up to 32 nodes per segment, with up to 4 repeaters between any two nodes. The IM 308C is a PROFIBUS DP master for the S5-95U, not a slave; if it is used as a DP slave the 125-slot budget on the 1516-3 PN/DP applies. Verify the role by inspecting the GSD file in TIA Portal.

4. I/O Address Space

The 1516-3 PN/DP provides 8 KB of input and 8 KB of output address space for the process image, expandable through the user program via the POKE_BLK / POKE instructions and the Web API. The 8 KB figure is a CPU-wide limit, not a per-segment limit.

When the address space is exhausted the CPU rejects the configuration at compile time with diagnostic entry "Address area exceeded". The error is logged in the diagnostic buffer and blocks download until either the topology is reduced or a higher-tier CPU (1517, 1518) is selected.

5. HMI Connection Budget

The 1516-3 PN/DP allocates 4 HMI/OP connections by default from the 128 budget. WinCC Unified, TIA Portal HMI panels (TP177, MP277, TP700 Comfort, TP1500 Comfort), and WinCC Runtime on PC all count as OP connections. Each panel that establishes a configured connection to the CPU consumes one slot from the reserved 4 first, then from the remaining 118 if more are declared.

If a project requires more than 4 HMI connections, the reserved count can be raised in TIA Portal under CPU Properties → Communication → Connection resources → Reserved for OP connections. The trade-off is reduced free resources for PG and S7 communication; for a 30-panel project the OP reservation should be raised to 30 and the budget re-verified.

5.1 PG Connections

PG connections (TIA Portal online access, HMI commissioning, trace, watch tables) are dynamic and short-lived. TIA Portal does not consume a permanent connection slot for the live online view; only the active online session holds a resource. With only 1–2 PGs typically online, the 128 budget is rarely stressed by PG traffic alone.

6. S5 / Legacy CPU Communication

Connecting legacy S5-95U stations or S7-300 CPUs to the 1516-3 PN/DP requires choosing a protocol that the 1516-3 PN/DP supports natively:

For a 10-CPU S7-300/1500 array exchanging 10 words in/out with the 1516, the most efficient configuration is PROFINET IO Device mode on each S7-300/1500, with cyclic I/O data mapped directly to the process image. This eliminates 10 connection slots from the 128 budget entirely. If S7 PUT/GET is mandatory for the legacy migration, allocate 10 connection resources explicitly.

7. Worked Calculation: The Reference Plant

Using the configuration from the source case as a worked example:

• 30 ET 200MP / ET 200U stations, each 64 DI / 64 DO / 8 AI / 2 AO
• 10 legacy S7-300 / S7-1500 / S5 (IM308C / 95U) controllers, 10 words in/out each
• 30 HMI panels (TP177 / MP277 / TP700)
• 4 ISO Transport connections

7.1 I/O Byte Calculation

Per ET 200 station, digital channels pack at 1 bit per channel and analog channels at 16 bits (2 bytes) per channel. S7-1500 aligns to byte boundaries:

Aggregate I/O footprint:

• Inputs from 30 ET 200: 30 × 24 = 720 bytes
• Outputs to 30 ET 200: 30 × 12 = 360 bytes
• Inputs from 10 legacy CPUs (10 words in): 10 × 20 = 200 bytes
• Outputs to 10 legacy CPUs (10 words out): 10 × 20 = 200 bytes
• Total I area: 720 + 200 = 920 bytes
• Total Q area: 360 + 200 = 560 bytes

Both totals are well within the 8 KB (8192 byte) CPU limit. I/O capacity is not the constraining factor in this design.

7.2 Connection Budget Calculation

The 30-HMI design is the headline stress. Raising OP reservation from 4 to 30 consumes 26 additional resources, leaving 128 − 30 − 10 = 88 free. If HMI traffic uses HMI tags with cyclic polling, the runtime is also impacted; consider whether all 30 panels require a permanent connection or whether a sub-set of read-only panels can be implemented as Web-API consumers (which do not consume S7 resources).

8. 1516-3 PN/DP vs 1517 / 1518

If a project consistently stresses any of the 1516 limits, the next tier is the 1517-3 PN/DP or 1518-4 PN/DP. The scaling pattern is:

The 1518-4 PN/DP adds a third PROFINET interface, doubling the PN segment capacity and isolating routing. For the 30-ET 200MP / 30-HMI design the 1516-3 PN/DP is sufficient on every published counter, but the choice should be re-evaluated if additional safety (F-CPU) integration, OPC UA servers, or high-volume Web-API consumers are added.

9. Configuration Checklist in TIA Portal

1. Open the CPU in the project tree, right-click → Properties.
2. Select Communication → Connection resources. Confirm the reserved OP/PG/S7 counts and the available free resources.
3. If HMI panel count > 4, raise the OP reservation to match.
4. Configure PROFINET interface X1 in PROFINET interface → Ethernet addresses and Operating mode → IO controller.
5. Add ET 200MP and ET 200U stations from the hardware catalog; verify the I/O byte count against the 8 KB process-image limit.
6. For legacy S7-300/1500 stations, decide between PROFINET IO Device (zero connection cost) and S7 connection (one connection slot per partner). PROFINET IO Device is the preferred migration path.
7. For S5 IM 308C / 95U partners, configure the DP port X3 as a DP master. If the IM 308C is acting as a slave to the 1516, install the GSD file and add it under PROFIBUS DP → DP slave.
8. For ISO Transport, add a CP 1543-1 to the project. Configure the ISO connections on the CP. Verify the station budget (256) is not exceeded.
9. Compile the project. Read the compile log; resolve any "Connection resources exceeded" warnings by either reducing HMI panels or migrating to PROFINET IO.
10. Download hardware configuration and software to the CPU. Verify in Online → Diagnostics → Connection resources that the in-use count matches the offline calculation.

10. Verification Procedure After Commissioning

After download, execute the following checks in the TIA Portal online view:

1. Open Online → Diagnostics → Connection resources. Verify the In use value matches the offline calculation. Any divergence indicates a partner that connected dynamically (e.g., a TIA Portal online session).
2. Open Online → Diagnostics → PROFINET topology. Confirm all ET 200MP and ET 200U devices are in OP state with no diagnostic alarms.
3. Open Online → Diagnostics &ratch PROFIBUS DP → DP slaves. Confirm all DP slaves are in data exchange. A slave stuck in "Not coupled" indicates wiring or parameter issues independent of the resource budget.
4. Trigger a full I/O scan via a watch table on the first ET 200. Verify the input bytes match the expected module layout. Repeat for outputs.
5. Check the diagnostic buffer for entries with ID "Address area exceeded" or "Connection resource exhausted"; both indicate a sizing error.

11. Firmware-Specific Behavior

Firmware 2.x on the AP03 MLFB introduces OPC UA server capability, expanded web-API surface, and revised PROFINET diagnostics. The 128 connection count is unchanged across the 1.x and 2.x firmware generations, but the default OP reservation in firmware 2.x can be configured up to 32 in TIA Portal V17+. Verify the firmware version on the CPU display or in the TIA Portal online → diagnostics before assuming a specific behavior.

12. Field-Proven Caveats

• WinCC Unified panels count as 1 OP connection each, but the underlying HmiTag subscription uses an additional PG-style connection. For an N-panel deployment, allocate N + N/4 (rounded up) connection slots.
• The S5-95U cannot act as a PROFINET device; a PROFIBUS DP segment terminated on the 1516 X3 port is the only viable path. The IM 308C can act as a DP master for an S5-95U downstream, or as a DP slave to the 1516; the GSD file determines the role.
• Web API consumers (custom dashboards, scripts) connect via the standard HTTP port and do not consume S7 connection resources. They do consume CPU work memory and scan time.
• Diagnostic cyclic services on PROFINET IO devices (e.g., port statistics, neighbor detection) cost no connection slots but increase the cyclic update time on the PROFINET segment.
• If the project must connect to a S7-400H or R/H system, the integrated PN interface of the 1516 supports S7 redundancy on a single subnet. Verify the S7-400H partner is on a compatible firmware.

13. Summary: Is the 1516-3 PN/DP the Right CPU?

For the reference plant with 30 ET 200 stations, 10 legacy PLCs, 30 HMI panels, and 4 ISO Transport connections, the 1516-3 PN/DP satisfies every published limit provided the legacy PLCs are configured as PROFINET IO Devices and the 30 HMI panels are absorbed by raising the OP reservation. I/O address space is 920 bytes in / 560 bytes out, well under 8 KB. Connection usage is approximately 46 of 128, leaving headroom for PG sessions and growth. If a future expansion adds another 50 HMI panels, more than 4 ISO Transport partners, or OUC traffic to enterprise systems, the 1517-3 PN/DP (256 CPU resources) should be considered.