Siemens S7 to DIGUREG Profibus DP: Why CAW Swaps Analog Words

When you read a legacy S7-300/S7-400 FC that pushes words from DB102 into the process-output image (PQW) of a Profibus DP slave, you often see the CAW instruction used for the analog portion of the telegram but omitted for the first two words that carry binary status. The reason is not a Siemens quirk, not a Profibus protocol rule, and not a bug in the program: it is the direct consequence of the endianness difference between the SIMATIC S7 CPU and the target DP slave, combined with the fact that bit-packed binary data is not affected by a byte swap. This technical reference walks through every layer of that statement using the exact FC code that drives a Siemens DIGUREG RG3-DUR DP slave, and shows how to validate, port, and troubleshoot the same pattern in modern TIA Portal projects.

1. System Topology and Telegram Layout

The FC under discussion exchanges cyclic Profibus I/O data between a SIMATIC S7 CPU (class 1 master) and a Siemens DIGUREG RG3-DUR system connected as a DP slave. The full telegram consumed by the slave is 16 bytes of output data (S7 → DUR) and is laid out as follows:

The slave consumes the 16 bytes in the order they appear on the wire. There is no standard Profibus mechanism to declare "these bytes are Big Endian" or "these bytes are Little Endian" inside the cyclic I/O frame; the convention is whatever the device's GSD file describes. The GSD for the RG3-DUR defines the byte order of its process data, and the master programmer must respect that order. Refer to the general Profibus DP architecture described in the Beckhoff Information System – Profibus DP for how parameterization and configuration telegrams set up the cyclic I/O exchange that this FC feeds.

2. Big Endian and Little Endian: The Only Two Numbers That Matter

Endianness is the convention a processor uses to lay out a multi-byte value in memory. The 16-bit value 0x1234 can be stored as either:

• Big Endian (BE): high byte first → bytes 0x12 0x34. SIMATIC S7-300/400/1500 CPUs and most Motorola-style architectures.
• Little Endian (LE): low byte first → bytes 0x34 0x12. Intel x86/x64, ARM in most default configurations, and the Siemens DIGUREG RG3-DUR Profibus interface per the legacy signal list.

Inside the SIMATIC S7 CPU, a 16-bit word is always stored Big Endian. The bit pattern for the integer 1000 (= 0x03E8) is laid out in DBW n as:

When the FC moves that DBW directly to PQW without a swap, the bytes appear on the Profibus wire in the order 0x03, 0xE8. If the RG3-DUR interprets the telegram as Little Endian, it will read the bytes as 0x03E8 only after internally re-pairing them the same way the S7 already did. If the RG3-DUR instead treats the raw bytes as a Little Endian integer, the slave sees 0xE803 = 59395, which is a roughly 60× error on a 1000-unit setpoint. That is precisely the failure mode the CAW instruction prevents.

3. What the CAW Instruction Does in an S7 CPU

CAW is the SIMATIC mnemonic for "Change Accumulator Word byte order" – it reverses the two bytes inside ACCU 1-L (the low word of accumulator 1). The effect on the integer 0x03E8 stored in ACCU 1 is:

• Before CAW: ACCU 1-L = 0x03E8 (high byte 0x03, low byte 0xE8)
• After CAW: ACCU 1-L = 0xE803 (high byte 0xE8, low byte 0x03)

When the FC then writes the result to PQW, the bytes on the Profibus output image become 0xE8, 0x03. From the slave's Little-Endian viewpoint, the high byte comes second, the low byte first, and the slave reconstructs 0x03E8 = 1000. The S7 high/low labeling and the DIGUREG high/low labeling are now both satisfied.

For a 32-bit double word the equivalent instruction is CAD (Change Accumulator Double word byte order), which reverses all four bytes. The FC in the source code only needs CAW because every value moved to the RG3-DUR is a 16-bit word.

4. Line-by-Line Walkthrough of the FC

The complete FC body, annotated against the S7-300/400 instruction set, is shown below with the byte-order intent of every line called out.

// Save caller's AR1 / AR2 so the FC is re-entrant safe
TAR1  #Inhalt_von_AR1          // TEMP DWORD
TAR2  #Inhalt_von_AR2          // TEMP DWORD

// Build AR1 pointer into DB102 at byte offset supplied by caller
L     #ARRAY_StartByte_DB102   // DWORD, byte offset (e.g. 0, 2, 4, ...)
SLD   3                        // byte offset × 8 = bit pointer
LAR1                           // AR1  := P#DB102.DBX<offset>

// Build AR2 pointer into the peripheral output area
L     #S7_OUTPUT_DUR_IN        // DWORD, PQW base address (byte offset)
SLD   3                        // byte offset × 8 = bit pointer
LAR2                           // AR2  := P#PQB<offset>

OPN   "S7 --> DUR A-B"         // Open DB102 as the data source

// --- Word 0: binary status (NO CAW) ---
L     DBW [AR1,P#0.0]
T     PQW [AR2,P#0.0]

// --- Word 1: binary status (NO CAW) ---
L     DBW [AR1,P#2.0]
T     PQW [AR2,P#2.0]

// --- Word 2: analog value (CAW REQUIRED) ---
L     DBW [AR1,P#4.0]
CAW
T     PQW [AR2,P#4.0]

// ... (same pattern repeats for words 3 through 7) ...
L     DBW [AR1,P#14.0]
CAW
T     PQW [AR2,P#14.0]

Key observations from the code structure:

• SLD 3 converts byte offsets to bit pointers. The S7 cross-area pointer format is P#byte.bit, and the bit field is a 3-bit value (0–7) packed into the high bits of a double word. Shifting a byte address left by 3 is the canonical way to turn byte 4 into bit 32 so it can be loaded into AR1/AR2 with LAR1/LAR2.
• No OPN is needed for the T PQW [...] target. Process-output addresses always reference the peripheral area, independent of the currently opened DB.
• CAW is applied between the load and the transfer. The order L → CAW → T is correct. A common mistake is to write CAW after the T, which has no effect on the value just written to the process image because the transfer has already happened.
• The first two words do not get a CAW. That is the question the source author asked, and the answer is the entire topic of this article.

5. Why the First Two Binary Words Skip the Swap

There are two reasons, and either one alone would justify omitting CAW on the binary portion of the telegram. In practice both apply to the RG3-DUR project.

5.1 Bit-packed status words are byte-swap invariant

A 16-bit binary status word is a set of 16 independent Boolean flags. Reversing the two bytes of the word re-orders the bits only inside their own byte, but the standard Profibus interpretation of the telegram is that each bit is a named status, not a numeric value. Consider the bit pattern that means "Output 0 ON, Output 1 OFF, Output 2 ON, Output 3 OFF, ..." :

If the slave's signal list labels bit 0 as "Contact 1 closed" and bit 8 as "Alarm active", the without-CAW layout puts Contact 1 closed in bit 0 of byte 0 and Alarm active in bit 0 of byte 1. After CAW, Contact 1 closed moves to bit 0 of byte 1 and Alarm active moves to bit 0 of byte 0. The slave's signal list was authored against one of those two mappings; you cannot apply CAW to half a telegram and not the other without the slave receiving a logically different status pattern than the S7 program intends. The two halves of the telegram must therefore be in the same byte order, and the slave's signal list was clearly written for the S7's Big-Endian layout on the binary portion.

5.2 The legacy signal list was authored Big Endian for the binary section

The signal exchange list delivered with the RG3-DUR places the binary words first, in S7-native order, and the analog words after, in Little-Endian order. That mixed layout is the only way a single byte-swap rule can satisfy both halves: the binary section is naturally invariant to a swap that the slave does not perform, and the analog section is correctly re-mapped by the CAW. A swap on the binary section would not break the analog reading, but it would scramble the contact and alarm bits – which is what the original programmer avoided.

Put differently: the CAW is there to fix an endianness problem on the analog words. The binary words do not have an endianness problem because the slave's signal list for them was authored in the same Big-Endian order the S7 uses. Forcing CAW onto the binary words would create a problem where none exists.

6. Mapping the Endianness Logic to the Profibus Frame

Profibus DP carries process data as a flat sequence of bytes. There is no per-word endianness flag in the GSD – the entire output area is whatever the GSD declares, but the GSD only describes length and module type, not byte order. The byte order is a contract between the GSD author and the programmer. For a class 1 master that is also the slave's device designer (Siemens shipping both the S7 and the RG3-DUR), that contract is whatever the signal list says.

The Acromag Introduction to Profibus DP describes how a class 1 master sets up the cyclic I/O exchange in its startup phase: parameterization, configuration, and then the cyclic data exchange that the FC participates in. Once the cyclic phase is running, the FC's T PQW [...] is the only point in the system where the byte order can be changed. That is why every DP slave that needs a different byte order from the host CPU must be handled either in user code (this FC) or in a hardware-level converter that performs the byte swap in the slave's ASIC firmware.

7. Endianness Rules Cheat Sheet

8. Porting the FC to TIA Portal SCL

Modern TIA Portal projects typically re-implement this logic in SCL inside a function block, especially for S7-1500 CPUs. A direct equivalent of the FC for an S7-1500 against a Profinet/Profibus slave is:

// SCL version of the byte-swap pattern for an RG3-DUR-style slave
// SlotIn: 16 bytes of structured data (2 binary words + 6 analog words)
// SlotOut: source of the data that the S7 pushes to the slave

FOR #i := 0 TO 1 DO
    // Binary status words: NO byte swap
    %QW(SlotOut + #i * 2) := UINT_TO_WORD(#binStatus[#i]);
END_FOR;

FOR #i := 0 TO 5 DO
    // Analog words: byte swap before transfer
    #tempWord := WORD_TO_INT(#analogValue[#i]);
    #tempWord := #tempWord XOR 16#FF00;          // simulated CAW on a 16-bit word
    // Or use the system byte-swap block: "SWAP" / "TBL" from the Util library
    %QW(SlotOut + (#i + 2) * 2) := INT_TO_WORD(#tempWord);
END_FOR;

For an S7-1500, the canonical primitive is the SWAP instruction in the extended instruction set, or the WORD_TO_BLOCK_DB/TAW equivalents that the S7-1500's compiler recognizes. The principle – swap only the words whose interpretation by the slave differs from the S7's native byte order – is identical.

9. When to Apply (and When Not to Apply) CAW

The decision tree for any single word in a DP output telegram is short:

1. Identify what the slave's GSD/signal list says about the word's byte order.
2. If the slave's high byte is the byte the S7 stores at the lower DBW address, the orders match and no swap is needed.
3. If the slave's high byte is the byte the S7 stores at the higher DBW address, a swap is needed. Use CAW (or CAD for 32-bit).
4. For pure Boolean data packed into 16 bits where the slave's signal list matches the S7's bit order, no swap is needed – the byte swap is a no-op semantically because the slave's bit numbering matches the S7's bit numbering.
5. When in doubt, capture a Profibus trace with a class 2 monitor (e.g. a ProfiTrace or a Softing Profibus tester) and inspect the on-the-wire bytes against the documented signal list.

10. Diagnostics and Verification Procedure

When troubleshooting a similar FC against a Profibus DP slave, the field-proven verification steps are:

1. Force a known integer in the source DB. Write 1000 to DB102.DBW 4 via the VAT table and stop the CPU before the FC runs to prevent it from overwriting the value.
2. Single-step the FC in the S7 online view. Watch ACCU 1 after the L DBW [...] and after the CAW. Record both values in hex.
3. Read the process image online. Use the S7 monitor to view PQW [AR2,P#4.0] after the T. The byte order should match the byte order of the byte-swapped accumulator.
4. Capture a Profibus trace on the slave's input side. Compare the bytes arriving at the slave to the slave's signal list. If the analog values are off by a factor of 256 or read in reverse digit order, the CAW was missed or doubled.
5. Run a consistency check. For all 8 words in the telegram, force 0x0000, 0xFFFF, 0x1234, and 0xAAAA in sequence. Verify each word at the slave matches the expected post-swap value. This isolates which words, if any, are still being sent in the wrong order.

11. Related Siemens S7 Instructions and Common Confusions

A common alternative to CAW for fixed all-word swaps is to declare a WORD-typed tag in a STRUCT and use the SWAP function from the STEP 7 / TIA Portal "Util" library. For an S7-1500, the function block is SWAP in the "Bit logic / Byte swap" palette. The semantics are identical to CAW on a single 16-bit word and to CAD on a 32-bit double word.

12. Summary of the Engineering Decision

The FC in the source code is correct, and the omission of CAW on the first two binary words is intentional, defensible, and aligned with how the Siemens DIGUREG RG3-DUR signal list was authored. The end result is a clean separation between the two halves of the telegram:

• Words 0 and 1 (binary status): written as-is because the slave's signal list matches the S7's Big-Endian bit numbering. A CAW would have scrambled the bit positions relative to the documented signal names.
• Words 2 through 7 (analog values): passed through CAW because the slave interprets those words as Little-Endian integers. Without the swap, every analog setpoint would arrive at the slave with its high and low bytes reversed, producing read-back values that are wrong by a factor of 256 (for 16-bit setpoints near the low end of the range).

This is the standard pattern for any S7 master driving a Little-Endian DP slave whose signal list mixes binary and analog sections: swap only the words whose numeric value the slave interprets, and leave the bit-packed words alone.

FAQ