Sharing a Data Block Between Two Siemens S7 CPUs via MPI

Overview

In a SIMATIC S7-300 or S7-400 system, a single Data Block (DB) lives in the local load memory and work memory of exactly one CPU. The CPU does not expose a DB as a shared, multi-master memory object the way an S7-1500 multi-CPU rack does. To make the same payload visible to a second CPU, you must move the contents of the local DB across the backplane or the network using a S7 communication function block pair. The SIMATIC platform provides five families of blocks for this, each with different prerequisites, maximum payload sizes, and confirmation behavior.

• X_GET / X_PUT (SFC 67 / SFC 68) — peer-to-peer over MPI or PROFIBUS, no CP required, no NetPro connection required, 76-byte cap per call.
• PUT / GET (FB 14 / FB 15 for S7-300; SFB 14 / SFB 15 for S7-400) — connection-based S7 communication, up to 462 bytes per call on recent firmware.
• USEND / URCV (FB 8 / FB 9 for S7-300; SFB 8 / SFB 9 for S7-400) — unacknowledged, slot-to-slot, ideal for cyclic mirrors.
• BSEND / BRCV (FB 12 / FB 13 for S7-300; SFB 12 / SFB 13 for S7-400) — block-oriented, segmented, up to 65534 bytes per job.
• AG_SEND / AG_RECV (FC 5 / FC 6) — required when the path includes a CP (CP 340, CP 341, CP 343-1, CP 443-1, etc.).

The choice depends on three questions: does a CP sit in the path, what is the link (MPI, PROFIBUS, Industrial Ethernet), and how many bytes must move per call. The remainder of this article walks through each method, the configuration required, sample ST calls, and a verification and troubleshooting matrix.

Prerequisites and MPI Network Setup

Hardware

• Two S7-300 CPUs (for example CPU 315-2 DP, CPU 317-2 PN/DP, CPU 319-3 PN/DP) or two S7-400 CPUs (CPU 412, 414, 416, 417) with a free MPI or PROFIBUS port. S7-1500 multi-CPU operation is out of scope for this article; that platform uses a different shared-DB mechanism.
• PROFIBUS cable with PROFIBUS connectors, or an MPI cable (6ES7901-0BF00-0AA0 for point-to-point). For multi-node MPI segments, install PROFIBUS connectors with terminating resistors ON at the first and last node and OFF at nodes in the middle.
• Optional CP modules (CP 343-1 Lean, CP 343-1 Advanced, CP 443-1, CP 341) only if the data path includes Industrial Ethernet or serial bridging that the CPU port cannot reach natively.

Software

• STEP 7 V5.5 (V5.5 SP2 / SP3 recommended) with the S7-300 / S7-400 optional packages installed. The PUT/GET and USEND/URCV blocks ship in Standard Library > Communication Blocks. For mixed S7-300/1500 operation, TIA Portal V16 or later is required; the S7-300/400 block API is not directly portable.
• The Siemens support document Entry ID 20982954 — Communication between S7-300/400 via MPI for reference on MPI limits and configuration.

Network configuration

1. In HW Config, double-click the CPU and open the MPI/DP interface properties. Set Interface type: MPI, MPI address: 2 for CPU-A, 3 for CPU-B.
2. Set the subnet to MPI(1) with Highest MPI address: 31 and Transmission rate: 187.5 kbps (default). Raise to 1.5 Mbps only on short, well-terminated segments where every node supports the higher rate.
3. Add the partner CPU to the same MPI subnet in NetPro. STEP 7 will draw a blue connection line between the two stations.
4. Save, compile, and download HW Config to both stations. From the PG, run PLC > Accessible Nodes and verify both CPUs appear with their assigned MPI addresses.

Communication Methods Comparison

Method 1 — Share a DB with SFC 67 X_GET and SFC 68 X_PUT over MPI

X_GET and X_PUT are the simplest path. They work over MPI or PROFIBUS without configuring a connection in NetPro and without a CP. The trade-off is payload size: a single call transfers 1 to 76 bytes, which is enough for handshake flags, setpoints, and small recipes but not for arrays or structures larger than 76 bytes per transaction.

Block parameters

Sample call (ST, OB1) — Write to partner DB20

CALL "X_PUT" , DB100
     REQ     := "DB_Trigger".write_req
     CONT    := TRUE
     DEST_ID := W#16#3                    // partner MPI address 3
     VAR_ADDR:= P#DB20.DBX 0.0 BYTE 40
     SD      := P#DB10.DBX 0.0 BYTE 40    // local source DB10
     BUSY    := "DB_Trigger".busy
     RET_VAL := "DB_Trigger".x_put_err

Sample call — Read from partner DB20

CALL "X_GET" , DB101
     REQ     := "DB_Trigger".read_req
     CONT    := TRUE
     DEST_ID := W#16#3
     VAR_ADDR:= P#DB20.DBX 0.0 BYTE 40
     RD      := P#DB11.DBX 0.0 BYTE 40
     BUSY    := "DB_Trigger".busy_r
     RET_VAL := "DB_Trigger".x_get_err

Common error codes for SFC 67 / SFC 68

Method 2 — Share a DB with PUT / GET (FB 14/15 on S7-300, SFB 14/15 on S7-400)

PUT/GET are the workhorses for S7-300/400 shared-DB replication. The block signature is identical across both platforms, with the prefix differing: SFB (system function, firmware-resident) for the S7-400 and FB (library, instantiated as DB) for the S7-300.

NetPro configuration

1. Open the station in NetPro.
2. Right-click the CPU and select Insert New Connection.
3. Connection partner: unspecified CPU, type: S7 connection.
4. Local ID is assigned automatically (e.g., 1).
5. In the partner's address properties, enter the remote CPU's MPI / PROFIBUS / IP address.
6. Download the connection configuration to both CPUs.

Sample call — SFB 15 PUT on S7-400

CALL "PUT" , DB200
     REQ    := "Trigger".put_req
     ID     := W#16#1            // local ID from NetPro
     DONE   := "Trigger".put_done
     ERROR  := "Trigger".put_err
     STATUS := "Trigger".put_stat
     ADDR_1 := P#DB20.DBX 0.0 BYTE 100
     ADDR_2 := P#DB20.DBX 100.0 BYTE 100
     ADDR_3 := P#DB20.DBX 200.0 BYTE 100
     ADDR_4 := P#DB20.DBX 300.0 BYTE 100
     SD_1   := P#DB10.DBX 0.0 BYTE 100
     SD_2   := P#DB10.DBX 100.0 BYTE 100
     SD_3   := P#DB10.DBX 200.0 BYTE 100
     SD_4   := P#DB10.DBX 300.0 BYTE 100

The PUT block supports up to four pointer pairs per call, so the maximum per call is bounded by the connection's resource count (typically four active PUTs per connection on S7-400 firmware V5.x and later). The receiver's data is written to the partner's address space at the offset declared in ADDR_1 through ADDR_4.

Sample call — FB 14 PUT on S7-300

CALL "PUT" , "DB_Put"           // FB 14 from Standard Library
     REQ    := "Trig".put_go
     ID     := W#16#1
     DONE   := "Trig".put_done
     ERROR  := "Trig".put_err
     STATUS := "Trig".put_stat
     ADDR_1 := P#DB20.DBX 0.0 BYTE 76
     ADDR_2 := P#DB20.DBX 76.0 BYTE 76
     SD_1   := P#DB10.DBX 0.0 BYTE 76
     SD_2   := P#DB10.DBX 76.0 BYTE 76

Common error codes for PUT / GET

Method 3 — Share a DB with AG_SEND / AG_RECV (FC 5 / FC 6) for CP-based paths

When the data path includes a Siemens CP module (for example CP 343-1 Lean, CP 443-1 Advanced, CP 341 for serial, or any CP used as a router), the FBs above cannot be used directly. The CP does not implement the S7 protocol on its MPI/PROFIBUS port to the partner CPU. The CPU must hand the data down to the CP using AG_SEND (FC 5); the CP then forwards the data to the remote partner.

CALL "AG_SEND" , "DB_AGS"
     ACT    := "Trig".ag_go
     ID     := 1
     LADDR  := W#16#100          // I/O start address of the CP
     SEND   := "Trig".send_area
     LEN    := "Trig".send_len
     DONE   := "Trig".ag_done
     ERROR  := "Trig".ag_err
     STATUS := "Trig".ag_stat

The CP must have a SEND/RECV connection configured in its parameter assignment (in HW Config under the CP properties, Communication > SEND/RECV). Without that configured connection, AG_SEND returns STATUS 0x8381 (connection not configured).

Method 4 — USEND / URCV and BSEND / BRCV for higher throughput

Use USEND/URCV for high-speed mirrors where a missed frame is acceptable (for example, axis position broadcast). Use BSEND/BRCV when a complete, segmented block must be reassembled at the receiver — this is the right answer for sharing a 4 KB recipe DB that the partner CPU reads in full.

Verification Procedure

1. Open a watch table on CPU-A. Add a flag (M0.0) and toggle it. Place the same flag in CPU-B's watch table and verify the value mirrors after the PUT cycle time.
2. In a watch table on CPU-A, set the first 40 bytes of DB10 to a known pattern (e.g., fill byte 16#AA). Force a read via the partner's X_GET block. Open the partner's DB11 in CPU-B and verify the same 16#AA pattern appears.
3. Check the RET_VAL / STATUS outputs. A sustained value of 0x7002 (job in progress) with no completion indicates the partner CPU is in STOP.
4. Use the diagnostic buffer of the CPU (PLC > Diagnostics/Settings > Diagnostic Buffer) to inspect communication errors. Look for event ID "Connection not established" or "Partner not found".
5. Run a sustained cyclic stress test (for example 1000 calls) and check that no BUSY outputs latch on. If BUSY latches, the partner is too slow or the connection resource count is exhausted.

Troubleshooting Matrix

Field-Proven Caveats and Alternatives

• No CP required for plain MPI: two CPUs do not need a CP to exchange data via X_GET / X_PUT or SFB/FB PUT/GET when the only link is the MPI port. A CP is only required when the data leaves the local rack, leaves the MPI subnet, or needs to traverse Industrial Ethernet.
• Remote access protection on S7-400: the partner CPU must have Permit access with PUT/GET from remote partner enabled under the CPU's Protection tab in HW Config. Without it, PUT/GET calls return STATUS 0x8184 (access denied) and the diagnostic buffer logs event ID 0xA090.
• Old firmware: S7-300 CPUs older than firmware V2.0 do not support the S7-300 PUT/GET blocks from the Standard Library. Use X_GET/X_PUT or upgrade firmware.
• Connection resource count: a configured S7 connection in NetPro consumes one of the CPU's connection resources. The S7-300 CPU 315-2 DP has 16, CPU 317-2 PN/DP has 16, CPU 319-3 PN/DP has 32. S7-400 CPUs scale from 16 (CPU 412) to 64 (CPU 417). Plan connection allocation before scaling up the number of PUT/GET relationships.
• USEND vs BSEND: for payload sizes that change at runtime, use BSEND/BRCV with a length field, not USEND/URCV. The USEND block sends a fixed length every cycle; the receiver cannot tell a "real" update from a repeat.
• PROFINET alternative: PROFINET-capable CPUs (CPU 315-2 PN/DP, CPU 317-2 PN/DP, CPU 319-3 PN/DP) support the same S7 PUT/GET blocks over the PROFINET interface without an additional CP. The configuration is identical — only the subnet and IP address change.
• S7-1500 multi-CPU: the S7-1500 platform provides true shared data blocks (DBs with the "Shared DB" attribute) and cross-CPU access without S7 communication blocks. This is a different paradigm; do not apply S7-300/400 SFB/FB logic to it.
• Global Data (legacy): for a single S7-400 rack with two CPUs, the global data (GD) circle mechanism is also available, but it is largely legacy and constrained to broadcast semantics.