S7-300 CPU315-2 DP: Reading DB10 Data Past 32-Byte GSD Slot Limit

Problem Overview

When a Siemens S7-300 CPU315-2 DP is configured as a PROFIBUS DP-Slave and exchanges data with a DCS acting as the DP-Master, the GSD (General Station Description) file generated for the slave limits every individual module slot to 32 bytes of consistent input/output data. If the source data sits in a data block such as DB10 at byte offsets of 40, 48, 64, 96, or higher, the master cannot map those bytes into its input area using a single GSD slot.

This is one of the most common field issues when integrating an existing S7-300 program (already written, tested, and frozen) into a PROFIBUS DP-Slave role. The PLC program is treated as immovable: the engineering team must reconcile the GSD slot size with the actual byte layout of the source DB.

Affected Hardware and Firmware

Root Cause Analysis

The PROFIBUS DP standard (IEC 61158 / EN 50170) defines the GSD as the device's electronic datasheet. It enumerates every module the DP-Slave exposes to the master, and for each module it declares a length field expressed in bytes. Two limits govern what a master can read:

1. Per-module slot cap – the GSD author declares a User_Prm_Data_Len and per-module input/output length. For the default Siemens SIEM8110.GSD / SIEM8111.GSD, the slot length is fixed at 32 bytes.
2. Per-slave cap – the standard permits a maximum of 244 bytes of input + 244 bytes of output + 244 bytes of configuration per DP-Slave node.

If the data you need in the DCS is in DB10.DBB40 (or any offset ≥ 32), the master cannot reach it through a single 32-byte GSD slot. There are four legitimate engineering responses, and the right one depends on physical wiring, available CP modules, and the willingness to alter the existing PLC program.

Solution Matrix

Option 1 — Restructure DB10 to Fit 32 Bytes

The cleanest fix is to copy the required bytes from the original offset into the first 32 bytes of a dedicated exchange DB. A cyclic OB1 segment using SFC20 (BLKMOV) keeps the original PLC program untouched.

Prerequisites

• Free 32-byte region in DB10 bytes 0..31, or create a new DB11 dedicated to the DCS interface.
• Symbolic names for source and destination.
• Reserved bit memory M10.0 for first-cycle initialization.

STL implementation (CPU315-2 DP, all firmware versions)

// OB1 - cyclic copy from offset 40 onwards into DB11 bytes 0..31
      L     W#16#0           // dummy alignment word (optional)
      T     DB11.DBW    0    // not strictly required

      CALL  SFC   20          // BLKMOV
       SRCBLK := P#DB10.DBX40.0 BYTE 32   // source offset 40
       RET_VAL:= MW   100                // error code
       DSTBLK := P#DB11.DBX0.0  BYTE 32  // destination mapped to GSD slot 0

SCL implementation

IF NOT InitFlag THEN
  InitFlag := TRUE;
  // One-time copy on startup is not enough - data is dynamic.
END_IF;

// SFC20 BLKMOV on every OB1 pass
DSTBLK  := P#DB11.DBX0.0  BYTE 32;
SRCBLK  := P#DB10.DBX40.0 BYTE 32;
RET_VAL := BLKMOV(SRCBLK := SRCBLK, DSTBLK := DSTBLK);

Option 2 — Acyclic Reads via SFC59 / SFC60

PROFIBUS DP-V1 (and the S7-300 firmware ≥ V2.0) supports Record reads using RD_REC (SFC59) and writes using WR_REC (SFC60). The DCS can poll specific byte offsets in the slave's memory without the 32-byte cyclic limit, but the data is not refreshed at PROFIBUS cycle speed – typical latency is 30–80 ms per call.

STL example (master-side, S7-300 as master with CP342-5)

// Read 32 bytes from slave #3 starting at offset 40 in slot 0
      L     B#16#3            // slave address
      T     LB    0
      CALL  FB   55           // DPREAD / RDREC wrapper
       REQ    := TRUE
       SLOT   := 0
       INDEX  := 1             // record number
       LEN    := 32
       MEMBER := P#DB10.DBX40.0 BYTE 32
       RET_VAL:= MW   200
       BUSY   := M   100.0

On the DCS side (Siemens PCS 7 / WinCC or third-party master), the equivalent call uses the PROFIBUS DP-V1 MS0 (Master-Slave, class 1) read service. Configure Slot 0, Index 1..255 in the master; each Index can address 240 bytes, which sidesteps the per-slot 32-byte cap.

Option 3 — Multi-Slot Mapping with a Custom GSD

If the existing PLC program cannot be touched, the next-best approach is to expose multiple GSD modules from the same DP-Slave, each pointing at a different region of DB10. The default Siemens GSD does not let you target arbitrary DB offsets, so you must either:

1. Use the Standard Slave configuration in HW Config (STEP 7 V5.4+) to declare modules that read from the process image or bit memory.
2. Mirror the high-offset bytes into bit memory or output process image with SFC20 in OB1, then map those M/PI bytes to GSD modules.

STEP 7 HW Config steps

1. Open HW Config, right-click the CPU315-2 DP, choose Object Properties → Interface → DP.
2. Enable DP-Slave (I-Slave) operation; record the diagnostic address, e.g. 1023.
3. Under Configuration tab, add a new module of type 32 bytes input per window you need to expose.
4. For each module, change the Input address range to point at a free M area: e.g. MB 100..131, MB 132..163, MB 164..195.
5. In OB1, use SFC20 to copy the source DB region into these M ranges each cycle.
6. Compile HW Config and download to the CPU. Export the new GSD via Options → Export GSD and provide it to the DCS engineer.

Slot allocation example (3 windows = 96 bytes of input)

Option 4 — Migrate to Industrial Ethernet

PROFIBUS DP's 32-byte slot is rooted in the protocol's 1990s-era frame layout. Industrial Ethernet and PROFINET lift the cap entirely; you can transfer up to 4 KB per IO device per update. The S7-300 CPU315-2 DP does not have an integrated PROFINET port, so a CP module is required.

Hardware add-ons

PUT/GET configuration with NetPro

1. Insert a CP 343-1 in HW Config and set the IP address (e.g. 192.168.1.10, mask 255.255.255.0).
2. Open NetPro, add an S7 connection with the DCS as the partner (IP 192.168.1.20).
3. Place a PUT block (FB15) and GET block (FB14) in OB35 (cyclic 100 ms) or OB1.
4. Configure the connection ID returned by NetPro (typically 1).

STL PUT example (S7-300 → DCS, 64 bytes from DB10 offset 40)

      CALL  FB   15           // PUT
       REQ    := M    50.0    // trigger every OB35 pass
       ID     := 1            // connection ID from NetPro
       DONE   := M    60.0
       ERROR  := M    60.1
       STATUS := MW   62
       ADDR_1 := P#DB10.DBX40.0 BYTE 32  // any byte 1..64
       ADDR_2 := P#DB10.DBX72.0 BYTE 32
       ADDR_3 := P#M   200.0   BYTE 0   // unused
       ADDR_4 := P#M   200.0   BYTE 0
       SD_1   := P#DB10.DBX40.0 BYTE 32
       SD_2   := P#DB10.DBX72.0 BYTE 32
       SD_3   := P#M   200.0   BYTE 0
       SD_4   := P#M   200.0   BYTE 0

For 64-byte chunks that exceed the 32-byte single-field S7 Communication limit, split across ADDR_1..ADDR_4. Each S7 Communication field is capped at 32 bytes; with four fields you can move 128 bytes per PUT call.

Mapping the GSD Byte Lengths to the PLC

For those staying on PROFIBUS, the following table cross-references the GSD slot types used by Siemens DP-Slave GSDs against the actual byte count in the input/output range of the S7-300.

Modules above 32 bytes per slot are vendor-specific. Some third-party GSDs (Siemens ET 200S, Beckhoff BK 3xx0) permit slot sizes of 64 or 128 bytes. Beckhoff's PROFIBUS coupler documentation describes these longer module types.

Verification Procedure

1. Open STEP 7 → Online → Monitor/Modify, navigate to the configured input range (e.g. MB 100..131 for Slot 1).
2. On the DCS, read the cyclic input image and verify byte-for-byte match with the source DB10 content from offset 40 onward.
3. Force a known value into the source DB: e.g. L 16#AAAA; T DB10.DBW 40. Confirm the same value appears at the master's mapped address within one PROFIBUS cycle (typical 5–10 ms at 1.5 Mbaud).
4. Read the DP diagnostic buffer: PLC → Module Information → Diagnostic Buffer. Watch for SF (system fault) or BF (bus fault) on the CP, and decode event IDs:

Troubleshooting Matrix

Process Image Partition (PIP) Strategy

For a single-DB exchange of up to 32 bytes, the cleanest PROFIBUS solution is to assign the configured input range to a process image partition and tie its update to a DP cycle. STEP 7 allows you to assign PIB 0..31 (for example) to PIP 1, and update it from OB40 (hardware interrupt) or directly from the DP cycle interrupt. The master's read of the input slot is then guaranteed consistent because the PIP is updated atomically.

HW Config setup for PIP

1. Double-click the DP-Slave module in HW Config.
2. Open Addresses → Process Image tab.
3. Tick Update of process image for the configured input range.
4. In OB1, attach the SFC20 BLKMOV to update the PIP input range from DB10 byte 40.

Decision Flowchart

Long-Term Recommendation

For new installations, the PROFIBUS DP-Slave model is increasingly obsolete. New deployments of the S7-300 family (or its successor ET 200SP) should use PROFINET IO, which lifts the per-slot cap to the IO device's total data length (commonly 256 bytes per slot, up to 4 KB per device). For greenfield sites, retrofitting the S7-300 with a CP 343-1 Advanced and migrating the DCS to PROFINET avoids the 32-byte slot discussion entirely.

Field-Commissioning Notes

• Always set the PROFIBUS baud rate to the lowest common denominator. Many DCS masters default to 1.5 Mbaud; check the diagnostic buffer for the negotiated rate.
• Activate bus termination only at the two physical ends of the segment. Mid-segment termination corrupts the signal at high baud rates.
• For consistent data above 8 bytes, do not split SFC20 calls across OB35 priorities – the master may read partially updated data.
• Document the GSD revision in the cabinet drawing. Master projects on a different GSD revision will not start up cleanly.
• If the DCS imports the GSD and only shows modules up to 32 bytes, the master is reading the default module set, not the extended set. Some masters require a key switch in the import dialog to unlock all module types.

References to Official Documentation

• OPC UA GSDML data type mapping (B.1)
• Beckhoff GSD File – Maximum 244 bytes
• Emerson FieldVue DVC6200P PROFIBUS PA module definitions