S7-300 Profibus DP: Connecting Multiple CPUs to SCADA

1. Overview

The recurring engineering question for a multi-PLC plant is whether the S7-300 CPU's integrated Profibus DP interface can be reused for SCADA traffic, or whether a separate CP module is mandatory. The answer depends on the role the port is already playing (DP master for distributed I/O and drives, or DP slave on a higher-level controller) and on the S7 connection-resource budget remaining on the CPU.

This reference covers the four practical integration patterns for connecting six or more S7-300 CPUs to a single SCADA, with specific attention to the case where the integrated Profibus port is already configured as a DP slave. It includes STEP 7 / NetPro configuration, WinCC driver selection, bus-load analysis, S7 connection resource budgeting, and a field commissioning checklist.

The detailed S7-300 system documentation is published in the Siemens Industry Online Support portal under entry ID 84922882, and the CPU 31x manual under entry ID 8859629.

2. S7-300 Profibus Interface Reference

S7-300 CPUs are shipped with a Profibus-capable interface on the CPU itself. The exact port depends on the CPU generation:

Each Profibus interface on the CPU can independently be configured as:

• DP master class 1 (DPV0, DPV1, DPV2 depending on CPU and firmware)
• DP slave (with the standard I/O data interface)
• S7 server for S7 communication (HMI/PG functions, PUT/GET)

The role is a software property set in STEP 7 or TIA Portal, not a hardware one. The CPU firmware version defines which DP features are available. DPV2 (isochronous, slave-to-slave) requires specific firmware releases. Confirm version-specific capabilities in the S7-300 CPU 31x manual (entry ID 8859629).

3. Profibus Protocol Stack: DP, S7, and PG/OP

The S7-300 CPU's Profibus interface implements multiple protocol layers above the physical RS-485 bus. They share the same cable and connector but use different Service Access Points (SAPs) and telegram types:

Key consequence: a single Profibus port can simultaneously act as a DP master (or DP slave) and as an S7 HMI/PG server. The DP role is responsible for cyclic I/O data; S7 HMI uses acyclic transfers and does not interfere with the cyclic I/O timing on the bus. This is the basis for the answer to the original question: the integrated port can be reused for SCADA communication without adding hardware, in either role.

4. Option 1: S7 Communication on a DP Master Port

If the S7-300 CPU is the DP master of a Profibus subnet carrying ET200S, ET200M, or drives, the same port can host S7 HMI connections to a SCADA. NetPro defines an S7 connection with the partner being the SCADA node (WinCC station, WinCC Flexible Runtime, OPC server, or another S7 CPU).

Procedure:

1. In the S7 project, the S7-300 station is configured in HW Config with the Profibus subnet and the DP slaves assigned to the master.
2. In NetPro, right-click the CPU and select Insert New Connection. The connection partner is an S7 HMI or another CPU.
3. Select the local interface as the integrated Profibus DP port. The connection type is S7 connection.
4. Compile and download. The S7 connection is established at runtime using the standard S7 HMI functions (S7PUT/S7GET on the HMI side; the CPU acts as the S7 server).

The SCADA reads process data via the S7 HMI protocol. Each connection consumes one S7 connection resource on the CPU and one on the SCADA node.

5. Option 2: S7 Communication on a DP Slave Port

This is the case raised in the original question. The S7-300 CPU's integrated Profibus port is configured as a DP slave of an upstream PLC (a higher-level master). The CPU is exchanging I/O data cyclically with that master.

The same port can also be an S7 HMI/PG server. The DP slave role uses cyclic I/O transfers; the S7 HMI role uses acyclic SD3/SD4 transfers with a different SAP. Both can be active concurrently on the same physical port on most S7-300 CPUs. This is documented in the S7-300 system manual (entry ID 84922882) under the interface description.

To make this work:

1. In NetPro, the integrated Profibus port is already bound to the subnet as a DP slave (passive node on the master).
2. Add an S7 connection from the CPU to the SCADA. The local interface is the same Profibus port. The partner is the SCADA's CP 5611 / CP 5613 in PROFIBUS mode.
3. The connection type is S7 connection. The S7 HMI protocol stacks on top of the S7 connection.
4. The SCADA uses the S7 protocol suite to read the CPU's process image. The DP master of the bus and the SCADA are separate nodes on the same bus.

Limitations to check:

• The DP master must allow passive nodes (DP slaves) on the bus to be S7 partners. Most DP masters do, but the bus parameter set should be reviewed. S7 HMI acyclic transfers are typically given a lower priority than cyclic DP and are processed in the gaps. They do not extend the DP cycle time in any significant way.
• The CPU's S7 connection resources must be sufficient. Each SCADA connection consumes 1 resource on the SCADA node and 1 resource on the CPU.
• Verify that the CP 5611 / CP 5613 in the SCADA PC is configured to use the S7 protocol and that the S7 partner address matches the CPU's Profibus address.

6. Option 3: CP 342-5 Dedicated Profibus Expansion

If the integrated port is fully consumed by the DP slave role, or for bus-topology isolation, the S7-300 CPU accepts up to three CP 342-5 modules. The CP 342-5 is a Profibus DP master/slave module with its own firmware and its own S7 connection resources.

Key features:

• Operates as DP master class 1/2 or DP slave
• Independent Profibus interface (separate bus from the integrated port)
• Up to 16 S7 communication resources, depending on the variant
• Baud rate up to 12 Mbps
• Part of the S7-300 CPs family; see the S7-300 system manual (entry ID 84922882) for slot rules and resource consumption

The CP 342-5 is identified by a Profibus address separate from the integrated CPU port. The SCADA's CP 5611 / CP 5613 sees the CP 342-5 as the S7 partner. The integrated port remains untouched. Product information is available at the SIMATIC S7-300 CP 342-5 product support page.

Configuration in NetPro:

1. Insert the CP 342-5 in HW Config and assign it to a Profibus subnet. Define its role (DP master in this case).
2. In NetPro, the S7 connection from the CPU to the SCADA targets the CP 342-5 as the local interface. The CP 342-5 owns the connection resources, not the CPU.

This is the cleanest Profibus-only path when the integrated port's resources are exhausted or when the bus topology must be kept separate from the I/O bus.

7. Option 4: CP 343-1 / PROFINET Interface Ethernet Path

The most common modern pattern is to bring Ethernet to the S7-300 CPU and connect the SCADA over TCP/IP. The CPU 31x-2 PN/DP and 31x-3 PN/DP variants have a PROFINET interface on-board. Older CPUs require a CP 343-1 inserted in the S7-300 rack.

CP 343-1 variants:

Product information and the manual are available at the SIMATIC S7-300 CP 343-1 product support page.

STEP 7 / NetPro configuration:

1. Insert the CP 343-1 in HW Config. Configure its IP address and subnet. Activate the protocol types required (S7 communication, TCP, UDP).
2. In NetPro, the S7 connection from the CPU to the SCADA targets the CP 343-1 (or the PN interface of the CPU) as the local interface. The connection type is S7 connection over TCP/IP or ISO-on-TCP.
3. The SCADA uses the S7 protocol suite with the TCP/IP or ISO-on-TCP driver.

Advantages:

• Bus topology is fully decoupled from the I/O Profibus.
• Standard IT cabling, switches, and diagnostics apply.
• Higher available bandwidth (100 Mbit/s, full duplex).
• Easier to scale to dozens of PLCs (no bus-segment or repeater math).

For 6 PLCs to 1 SCADA, this is the recommended path. Each PLC keeps its Profibus for I/O; the SCADA talks to each PLC over Ethernet on a separate logical network. The CP 343-1 is the canonical gateway; the integrated PROFINET port of 31x-2 PN/DP and 31x-3 PN/DP CPUs is functionally equivalent.

8. PC-Side Options: CP 5611, CP 5613, and SIMATIC NET SOFTNET

To consume Profibus from a SCADA PC, Siemens offers the following PC cards:

Product information is available at the SIMATIC NET PC cards product support page.

The PC card is paired with a SIMATIC NET software component:

• SOFTNET PB (basic S7 over Profibus)
• S7-PCT (configuration)
• S7 OPC Server (for OPC DA)
• S7 OUC (Open User Communication) library

When the S7-300 CPU is a DP slave (Option 2), the CP 5611/CP 5613 in the SCADA PC sits on the same Profibus segment and reads the CPU's S7 HMI data. The PC is configured with a Profibus address (must be unique, must not collide with the DP master or any DP slave). The S7 partner is the CPU's integrated port or the CP 342-5, depending on which owns the S7 connection.

When using Ethernet, the SCADA uses a standard TCP/IP stack and a network card. The S7 protocol suite in WinCC communicates over TCP port 102 (ISO-on-TCP). CP 343-1 uses ISO-on-TCP by default.

9. STEP 7 NetPro Configuration Procedure (Classic)

The following steps apply to STEP 7 V5.x with an S7-300 station. The TIA Portal equivalent is described in section 11.

1. Open the S7 project in SIMATIC Manager. The S7-300 station should be configured in HW Config with the Profibus subnet already defined.
2. Open NetPro (Options > NetPro). The S7-300 station appears with its Profibus subnet.
3. Add a new station for the SCADA: Insert > Station > SIMATIC PC Station. Configure the PC station's CP 5611 / CP 5613 in the hardware configuration of the PC station. Set the Profibus address and baud rate to match the subnet.
4. Configure the WinCC application in the PC station's WinCC Application slot. Insert the application and select the CP 5611 as the Profibus interface.
5. In NetPro, right-click the S7-300 CPU and select Insert New Connection. Choose the partner: the WinCC application on the PC station.
6. The local interface is the integrated Profibus DP port of the CPU. The connection type is S7 connection. The Active connection establishment flag can be left on either side; S7 HMI usually uses the SCADA as the active partner.
7. Compile and download. The connection appears as a yellow line in NetPro once compiled. After download, the SCADA performs the connection establishment at runtime.

If the CPU is a DP slave (Option 2), the integrated Profibus port is already bound to a master-slave relationship. The S7 connection is added on top of this binding. Verify that the connection resources of the CPU are not exceeded.

If a CP 342-5 is used (Option 3), the local interface for the S7 connection is the CP 342-5, not the integrated port.

10. TIA Portal Configuration Procedure

In TIA Portal (V13 and later, with S7-300 supported in TIA V13-V16 depending on CPU), the equivalent configuration is:

1. Open the project in TIA Portal. Add the S7-300 device and configure the integrated Profibus port in Device View. Set the port to DP master or DP slave as required.
2. Switch to Network View. The Profibus subnet is visible. Add a PC station for the SCADA (or, more typically, add a HMI connection from the CPU to an existing HMI/PC station).
3. Right-click the CPU and select Add new connection. The partner is the HMI/PC station.
4. Select the local interface as the integrated Profibus DP port. The connection type is S7 connection.
5. Compile and download to the CPU and to the PC station.

TIA Portal also supports PROFINET-based S7 connections natively. For PROFINET, the connection type is S7 connection over the PROFINET interface; the configuration steps are analogous.

11. WinCC Connection Configuration

In WinCC 7.x (or WinCC Professional in TIA Portal):

1. Open WinCC Explorer. Expand Tag Management.
2. Right-click and select Add New Driver. Choose SIMATIC S7 PROTOCOL SUITE. The driver supports multiple connection types:
   • MPI
   • PROFIBUS
   • TCP/IP (Ethernet, ISO-on-TCP)
   • Named Connections
   • Slot PLC
3. Add a new S7 Connection under the driver. Enter:
   • IP address (for TCP/IP) or Profibus address (for PROFIBUS)
   • Rack and slot of the CPU (always 0, 2 for S7-300)
   • Connection name (free text)
4. For each PLC, repeat the connection definition. The 6 PLCs become 6 connections in the WinCC project.
5. Test with Connection Status (right-click the connection > Status). The status should be green. A red status means the connection is not established; check NetPro, partner address, and physical bus.

For Ethernet (Option 4), use the TCP/IP driver. The IP address is the CP 343-1's address. The S7 communication runs over ISO-on-TCP, which the S7 protocol suite wraps as TCP/IP.

For multiple WinCC clients, each can be configured independently. A single S7 connection can be used by one WinCC client; for redundant or multi-client setups, multiple S7 connections are defined between the same two nodes (each consumes one S7 connection resource on each end).

12. Bus Load, Timing, and Connection Resource Limits

12.1 Profibus DP segment rules

Up to 32 nodes per segment; up to 126 nodes on a Profibus network when RS-485 repeaters are used. Each repeater reduces the segment count by 1 from the available budget.

12.2 DP cycle time impact

Cyclic DP I/O exchange is deterministic. S7 HMI acyclic transfers do not extend the DP cycle. They run in the gaps (token rotation time slack). For typical I/O counts (32 bytes per slave, 12 slaves), the DP cycle is in the 5-10 ms range at 1.5 Mbps. Adding 6 S7 HMI acyclic transfers per bus cycle adds < 1 ms to the apparent bus load but does not change the DP cycle time.

12.3 S7 connection resource budget

A single SCADA can use 1 resource per S7 connection it maintains. 6 PLCs = 6 resources on the SCADA. Each PLC uses 1 resource for the connection from the SCADA. If a CP 342-5 is added, the CP 342-5 brings its own connection resources, separate from the CPU's. The CP 342-5 supports up to 16 S7 communication resources (variant dependent).

12.4 Bus load formula

Approximate DP cycle time:

Where T_slot_i is the slot time for slave i, T_idle is the idle time, and T_gap is the bus quiet time. The slot time depends on the number of input/output bytes, the baud rate, and Tbit (bit time at the chosen baud rate). For typical Profibus design, target bus load < 50% in steady state, < 70% peak.

13. Architecture Decision Matrix

For 6 S7-300 CPUs, the recommended primary path is Option 4 (CP 343-1 or PN interface + Ethernet SCADA). Option 2 is acceptable when the budget excludes CP 343-1. Option 3 is the Profibus-clean choice when the user wants to keep SCADA traffic on Profibus.

14. S7 Connection State Machine and Event IDs

An S7 connection moves through the following states:

1. IDLE: No connection established.
2. CONNECT_PENDING: Active partner (SCADA) is attempting to connect.
3. ESTABLISHED: Connection is up; data exchange can occur.
4. DATA: Active data exchange.
5. DISCONNECT_PENDING: One partner has requested close.
6. ABORT: Connection terminated due to error (timeout, partner lost, protocol error).

Diagnostic events in the CPU's diagnostic buffer (accessible via STEP 7 > CPU > Module Information > Diagnostic Buffer) for S7 connections include:

Event IDs are CPU-firmware-version dependent. Confirm against the CPU's diagnostic buffer documentation for the specific firmware in service.

15. Commissioning and Verification Checklist

1. Hardware
   • All Profibus connectors are properly terminated (terminating resistors ON at the two bus ends only).
   • Cable shield is grounded at one end minimum.
   • Baud rate is set identically on all nodes.
   • Profibus address is unique on every node (master, slaves, CP 5611/5613).
2. STEP 7 / NetPro
   • S7 connection defined on the correct interface.
   • Local and partner interface bindings match the physical configuration.
   • Connection resources on the CPU are not exceeded.
   • S7 connection compiled and downloaded without errors.
3. WinCC
   • S7 protocol suite added and connection defined for each PLC.
   • Connection status green for all 6 PLCs.
   • Tag test: read a known process value from each PLC and confirm it updates.
4. Bus diagnostics
   • DP cycle time is within expected range.
   • Bus load is < 50% steady state, < 70% peak.
   • No S7 connection errors in the CPU's diagnostic buffer after a 24-hour burn-in.
   • No DP slave diagnostics (loss of slave, retries) during a 24-hour burn-in.
5. Failure mode tests
   • Power-cycle the SCADA PC. The PLC DP network continues to operate without disturbance. S7 connections re-establish automatically.
   • Disconnect one PLC's Profibus connector. Other PLCs continue normal operation; SCADA flags the disconnected PLC.
   • Disconnect the SCADA's Ethernet cable (Option 4). PLCs continue normal operation; SCADA loses data but the PLC process is not interrupted.

16. Diagnostics and Troubleshooting Matrix

For deeper diagnostics, the S7-300 CPU's diagnostic buffer (accessible via STEP 7 > CPU > Module Information > Diagnostic Buffer) shows S7 connection state changes with event IDs. The CP 5611 / CP 5613's diagnostic tool (SIMATIC NET Diagnostics) shows bus statistics, error counters, and partner status.

17. Field Notes and Best Practices

• The integrated Profibus port on the S7-300 CPU is fully capable of running DP and S7 HMI simultaneously. The confusion in many field discussions arises from conflating the DP role (master/slave) with the S7 role (HMI/PG server). These are independent.
• For new projects, prefer PROFINET (CP 343-1 / PN CPU) for SCADA traffic. Profibus should be reserved for the I/O network. The Ethernet path scales better, is easier to diagnose with standard IT tools, and avoids bus-load trade-offs.
• If the SCADA is mission-critical and Profibus-only, use a CP 342-5 per PLC for S7 HMI and keep the integrated port for DP. This isolates the S7 HMI traffic from the DP I/O traffic and avoids any bus-parameter interference.
• Always verify the CPU's available S7 connection resources. They are not extensible in software; they are CPU hardware limits. Adding a CP adds resources.
• For 6+ PLCs, avoid stacking all S7 HMI traffic on a single Profibus segment shared with the I/O network. Move the SCADA traffic to a separate bus (CP 342-5 per PLC, or CP 343-1 + Ethernet).
• When the CPU is a DP slave, set the bus parameters of the DP master to a slot time that allows the S7 HMI acyclic windows. Tslot must be large enough for the longest telegram; a Tslot that is too small blocks S7 HMI acyclic transfers and causes connection timeouts.
• For redundant SCADA, define two S7 connections per PLC (one per SCADA server). Each connection consumes one resource on the CPU and one on the SCADA server. Add CP 342-5 or CP 343-1 to free CPU resources if needed.