Troubleshooting 3964(R) GSD File: Reading PIW from a Profibus-DP Field Device on S7-300

A frequent field problem on Siemens SIMATIC S7-300 Profibus-DP networks involves a device whose GSD file is labelled 3964(R). The PLC establishes cyclic DP communication, SFC14 (DPRD_DAT) returns valid status bytes, and the slave enters Data Exchange state, yet the actual measured process values never appear in the PIW (Process Input Word) area of the CPU. The temperature, pressure, or flow value stays at zero or at the configured substitute value while the diagnostic buffer reports a clean DP cycle.

This article isolates the root cause, presents the diagnostic procedure in STEP 7 / TIA Portal, and walks through the configuration changes that recover the PIW readout. It also covers the protocol confusion that the label 3964(R) frequently causes, and shows the alternative wiring path when the device truly does require a 3964(R) point-to-point link instead of Profibus-DP.

1. Problem Description

1.1 Hardware in the Failure Case

• CPU: SIMATIC S7-300 CPU 315-2 (6ES7 315-2EH14-0AB0 or compatible), firmware V3.x
• CP: CP 343-1 Lean (6GK7 343-1CX10-0XE0) – used for Ethernet / PG access, not relevant to the DP issue itself
• DP master interface: CPU 315-2 integrated MPI/DP port (X2) configured as PROFIBUS-DP master
• DP slave: third-party temperature / process instrument, Profibus-DP slave with a GSD file supplied by the instrument vendor (often labelled 3964(R))
• Bus: standard Profibus cable, 1.5 Mbaud, terminated at both ends

1.2 Observed Symptom

• SFC14 (DPRD_DAT) is called with a correctly set LADDR; the return value RET_VAL = 0 (W#16#0000), no DP_PRM_ERROR, no DP_OPERATION fault flag.
• Status bytes read back correctly (e.g. device ready, measurement active, range OK).
• PIW addresses configured for the slave always read 0 (or the configured substitute value W#16#7FFF for analog inputs).
• No diagnostic interrupt is queued. SFC13 (DPNRM_DG) returns the standard 6-byte slave diagnostic block without device-specific diagnostic payload.

1.3 Why SFC14 Works but PIW Does Not

Many engineers first reach for SFC14 (DPRD_DAT) because it reads consistent data from a DP slave. In a Profibus-DP slave, however, the process data (the bytes that the slave places in the cyclic I/O image) are also written into the process image of the CPU only if the slot module is inserted into HW Config and the corresponding input bytes are mapped into PIW addresses. SFC14 then reads from that same PII region.

If the GSD file was added to HW Config but no module was dragged into the slot table of the DP slave, the slave provides its status information through standard DP diagnostics (which SFC13 / SFC14 can read), but no process values are placed in the cyclic I/O image. The result is exactly the symptom above: status works, PIW is zero.

2. Root Cause Analysis

2.1 Primary Root Cause: Missing Module in DP Slave Slot Configuration

The Profibus-DP slave GSD describes a list of modules and the I/O length of each module. Until at least one module is inserted into the slot of the DP slave in HW Config, the master does not allocate any I/O area for the slave, and the cyclic I/O image contains no process data for that slave.

2.2 Secondary Root Causes

2.3 The 3964(R) Naming Confusion

Many GSD files for older process instruments carry the project name 3964(R) because the engineering tool that produced them was the same one used to build serial 3964(R) drivers. The device itself is almost always a Profibus-DP-V0 or DP-V1 slave. Treat the GSD name as a project reference, not a protocol indicator.

Only if the device is genuinely a serial partner (no Profibus option board fitted) does the alternative path in Section 7 apply: configure a true 3964(R) link using FB P3964_Config and FB Send_P2P / FB Receive_P2P on a CM 1241 or on the S7-300 serial interface (CP 340 / CP 341).

3. Preconditions Before You Start

• STEP 7 V5.5 + SPx or TIA Portal V16 or later installed and licensed
• The GSD file supplied by the instrument vendor added to the device catalog (Options > Install GSD file)
• Online connection to the S7-300 station (MPI/Profibus or Ethernet via CP 343-1 Lean)
• Access to the device manual – required to map the measurement channel to a module/slot
• PG/PC set to the same Profibus address (default 0) and same baud rate as the CPU DP master

4. Step-by-Step Diagnostic Procedure

4.1 Confirm the Slave Is in Data Exchange

1. Open Online & Diagnostics on the DP master interface.
2. Select Profibus Nodes.
3. Verify the slave's PROFIBUS address and that its state is Data Exchange (green).

4.2 Inspect the Currently Configured I/O

1. In HW Config, open the DP slave properties.
2. Click the Configuration tab (STEP 7 V5.5) or the Device view with slot list (TIA Portal).
3. Note the modules that are currently inserted in the slot table and their I/O length (e.g. 2 Bytes I + 2 Bytes O).

4.3 Compare the Configuration With the Device Manual

Open the device manual and find the section that lists the available Profibus modules. A temperature instrument typically provides:

• Module 1: Status (2 bytes input)
• Module 2: Process value, channel 1 (4 bytes input – often 1 REAL, or 2 INT for IEC 61131 representation)
• Module 3: Process value, channel 2 (4 bytes input)
• Module 4: Range / unit / diagnostic data (variable)

4.4 Check the Process Image Partition

For S7-300, the default process image is updated in OB1. If the DP slave's input address range (e.g. IW 256..259) has been assigned to a process image partition (PIP) other than PIP 1, and OB1 is set to refresh only PIP 1, the PIW will stay 0 even though the input buffer contains the correct value. Test by reading directly with PEW 256 in VAT or in a watch table.

5. Solution: Configure the Correct Modules in HW Config

5.1 Add the Process Value Module

1. In HW Config, select the DP slave on the Profibus line.
2. Open the device catalog and locate the GSD entry (right pane in STEP 7, or device catalog in TIA Portal).
3. From the catalog, drag the module that represents the process value (usually labelled Process Value, AI, Measured Value, or similar) into slot 1 of the slave.
4. Repeat for each channel defined in the device manual (e.g. PV1, PV2, status, range).
5. Click OK to close the dialog. STEP 7 / TIA Portal will display the new input and output addresses in the slave properties (e.g. IW 256..263 / QW 256..263).

5.2 Save, Compile, and Download

1. Save the project (File > Save).
2. Compile and download the hardware configuration to the CPU (PLC > Download).
3. The CPU goes through a restart; on completion, the slave re-enters Data Exchange.

5.3 Verify With a Watch Table

Open a VAT (Variable Table) and force the following status flags to monitor:

5.4 Convert the S7 Norm Value to Engineering Units

Many instruments deliver the measured value in the Siemens SIMATIC S7 norm format (0..27648) or as a 4-byte REAL already scaled to the engineering unit. The conversion is:

Process_EngUnit = (NormValue / 27648.0) × (UpperRange − LowerRange) + LowerRange

Example for a 0..200 °C range and a raw value of 13824:

Process_EngUnit = (13824 / 27648) × (200 − 0) + 0 = 100.0 °C

5.5 Example SCL Block to Read PV1 and Scale It

FUNCTION_BLOCK FB_PV_Read
VAR_INPUT
    i_Address : INT;       // Start address of PV1, e.g. 260
    i_Lower   : REAL;      // Lower range, e.g. 0.0
    i_Upper   : REAL;      // Upper range, e.g. 200.0
END_VAR
VAR_OUTPUT
    o_Value   : REAL;      // Engineering unit value
    o_Status  : WORD;      // Raw status word from slot 0
END_VAR
VAR
    wRaw      : WORD;
    rNorm     : REAL;
END_VAR
BEGIN
    // Read scaled process value (S7 norm 0..27648)
    wRaw  := WORD_TO_INT(PIW[i_Address]);
    rNorm := INT_TO_REAL(wRaw);
    o_Value := (rNorm / 27648.0) * (i_Upper - i_Lower) + i_Lower;

    // Read status word from the first configured module
    o_Status := PIW[i_Address - 4];
END_FUNCTION_BLOCK

5.6 Alternative Reading With SFC14 (DPRD_DAT)

If the device's process data is grouped into a single consistent block, the SFC approach is still valid. After inserting the modules, configure the LADDR parameter to the start address of the block and read a length that covers the PV word:

CALL SFC14 (
    LADDR   := W#16#100,   // I start address (256 decimal) of the DP slave
    RET_VAL := MW100,      // 0 = no error
    RECORD  := P#DB20.DBX0.0 BYTE 12 // 12 bytes = 6 words
);

Then access DB20.DBW4 for the S7 norm PV1 value. Note that SFC14 is required when the data must be read consistently (i.e. all bytes in one bus cycle) – for a single 16-bit PV it is not strictly required, but for 32-bit REAL PVs it is strongly recommended.

6. Verification

6.1 Online Check on the Slave

1. With the project online, open the DP slave properties.
2. Click Operating Mode. The status must be Data Exchange.
3. Open DP Slave Diagnostics – no Param Fault, no Config Fault.

6.2 Check PIW Update in OB1

Use a cross-reference on the configured PIW address (e.g. PIW 260). It must appear at least once in OB1 (typically in an input scaling FB) or be in a PIP that OB1 refreshes.

6.3 Compare With Physical Reading

Apply a known reference temperature to the sensor and confirm that the scaled value in the VAT matches the device's local display within the documented accuracy.

6.4 Diagnostic Buffer

The CPU diagnostic buffer should be free of DP Slave Failure, Station Failure, and Parameter Assignment Error entries. Any such entry points to a remaining GSD / parameterization mismatch and must be resolved before declaring success.

7. Alternative Path: True 3964(R) Serial Link

If the device is a serial-only instrument (no Profibus option board installed), configure a real 3964(R) link.

7.1 Wiring on an S7-300

Use a CP 340 (6ES7 340-1AH02-0AE0, RS-232) or CP 341 (6ES7 341-1AH02-0AE0, RS-232 / 422/485) on the S7-300. Connect to the device's serial port. Set the same baud rate (typically 9600 or 19200), 8 data bits, 1 stop bit, even parity – confirm in the device manual.

7.2 3964(R) Parameters

7.3 TIA Portal FBs for 3964(R)

On S7-1200/1500 with a CM 1241 module, Siemens provides the standard point-to-point FBs described in the TIA Portal help:

• FB P3964_Config – Configures the 3964(R) protocol on a CM 1241 RS-232 or RS-422/485 module. Source: Configuring 3964(R) communication in the TIA Portal manual collection.
• FB Send_P2P – Sends a buffer over the configured CM. Documented at 3964(R) communication.
• FB Receive_P2P – Receives data into a buffer.
• FB SerialControl_Reset – Clears the receive buffer.

7.4 Third-Party Gateway: ProSoft 3964R Module for CompactLogix

When the master must be an Allen-Bradley CompactLogix controller instead of a Siemens CPU, the ProSoft Technology 3964R Network Interface Module for CompactLogix provides an in-chassis gateway that exchanges data with the Siemens 3964(R) partner and exposes the data to the Logix processor through the backplane. This is the correct product when the Profibus path is not an option and the master is Rockwell-based.

8. Commissioning Checklist

1. Confirm the device's Profibus address is unique on the segment.
2. Confirm both bus termination resistors are ON at the two physical ends only.
3. Add the GSD file to the catalog; verify the device version matches the device's actual firmware.
4. Insert the correct module(s) in the slot table – at minimum the process value module.
5. Download the HW Config and the user program.
6. Observe Data Exchange in the online diagnostic view.
7. Read PIW directly in a watch table.
8. Apply a known reference and verify the scaled engineering unit.
9. Document the slot configuration and PIW map in the project for future maintenance.

9. Common Fault Matrix

10. Frequently Asked Questions