Profibus

What is PROFIBUS?

PROFIBUS (Process Field Bus) is an open serial fieldbus defined in IEC 61158 that lets a PLC or DCS exchange data deterministically with field devices such as sensors, actuators, O and drives. The standard emerged from a German joint project in the late 1980s and is managed by PROFIBUS & PROFINET International (PI). With an installed base of around 70 million devices, PROFIBUS is still one of the most widely used classic fieldbuses in the world, although new projects increasingly choose its Ethernet successor ProfiNET.

🧠 What does PROFIBUS do?

PROFIBUS replaces conventional point-to-point wiring, in which every signal needed its own pair of wires back to the control cabinet. Over a single twisted-pair cable the controller cyclically reads all inputs and writes all outputs within a fixed, predictable cycle time. Parameters, diagnostics and alarms can be exchanged alongside without disturbing the cyclic data.

In practice, “PROFIBUS” almost always means PROFIBUS DP: one protocol used in both factory and process automation. PROFIBUS PA is not a separate protocol but DP over a different physical layer that also powers the devices. In the Purdue Model, PROFIBUS sits at levels 0–1, between the field and the controller.

🕰️ How did PROFIBUS come about?

The original PROFIBUS FMS (Fieldbus Message Specification) variant has fallen out of use; DP has largely taken over its role.

🧱 Which PROFIBUS variants are there?

DP also has three functional levels:

• DP-V0 - cyclic data exchange, configuration, parameterisation and diagnostics
• DP-V1 - adds acyclic read and write services, for example for the parameters and alarms of a smart transmitter
• DP-V2 - adds isochronous mode (clock-synchronised cycles for motion control) and direct slave-to-slave communication

⚙️ How does PROFIBUS work technically?

PROFIBUS uses a hybrid medium access method. Masters (the controllers) pass a token between them; only the master holding the token may use the bus. That master then polls its slaves using the master-slave principle. A class 1 master is the PLC that exchanges cyclic data; a class 2 master is an engineering or diagnostic tool that only occasionally reads data or changes parameters. This fixed schedule makes the cycle time deterministic, which is why PROFIBUS suits real-time control.

Key characteristics and typical values:

• Addresses - 0 to 125 for devices; 126 is reserved for commissioning and 127 for broadcast
• Stations per segment - up to 32 on one RS-485 segment; with repeaters up to 126 addresses can be reached
• Data per slave - up to 244 bytes of input and 244 bytes of output data
• Device description - every device comes with a GSD file that tells the engineering software which modules, data and parameters it has
• Topology - a line (bus) structure with short drop cables; tree and star structures via junction boxes are common for PA
• Termination - every RS-485 segment must be actively terminated at both ends, otherwise reflections and communication errors occur

The maximum cable length per RS-485 segment depends on the data rate (type A cable, 150 ohm):

A PROFIBUS PA segment may be around 1,900 metres long including spurs. PA connects to a DP network through a segment coupler (transparent, but it limits the DP data rate) or a DP/PA link, which behaves as a single slave so that the DP network can keep running at full speed. In hazardous areas, the PA segment is engineered as intrinsically safe according to the FISCO model; a segment then typically carries around ten devices instead of 32.

🏭 Where is PROFIBUS used?

• Factory automation - assembly lines, packaging machines and conveyor systems, often with Siemens S7 controllers
• Process industry - chemicals, oil and gas, food and pharmaceuticals, where PROFIBUS PA connects field instruments to a DCS such as PCS 7
• Water - pumping stations and treatment plants of Dutch water boards and drinking water companies, where PROFIBUS is still common alongside ProfiNET and Modbus RTU
• Energy and utilities - pumps, compressors and fans driven by frequency converters, including building services such as HVAC plant rooms, although BACnet or Modbus are more common there

Standardised application profiles run on top of PROFIBUS: PA Devices (for PROFIBUS PA typically version 3.02) for process instruments, PROFIdrive for drives, PROFIsafe for functional safety and HART on PROFIBUS to pass HART information through. Diagnostic messages are classified according to NAMUR NE 107.

🔄 What is the difference between PROFIBUS and PROFINET?

ProfiNET is not PROFIBUS over Ethernet but a separate protocol from the same organisation that reuses the I/O model and profiles of PROFIBUS DP. Existing PROFIBUS segments are connected to a PROFINET network through a proxy.

For the process industry, Ethernet-APL is the successor to PROFIBUS PA: it uses the same type A fieldbus cable, but at 10 Mbit/s and with a direct Ethernet connection all the way to the transmitter.

🔐 How secure is PROFIBUS?

PROFIBUS was designed for availability, not for cybersecurity. The protocol has no authentication and no encryption: every device on the bus can listen in, and a second master or a compromised engineering station can send commands. Because PROFIBUS is not IP-based, it cannot be reached directly from the internet, but that only shifts the risk to the systems that are connected to the network.

Stuxnet demonstrated this: the malware looked for Siemens S7-300 controllers with a PROFIBUS communication processor and manipulated the frequency converters of centrifuges over PROFIBUS. The attack entered through Windows systems, not through the fieldbus itself.

Practical measures:

• Protect the systems above the bus - PLCs, gateways, proxies and engineering stations are the gateway to the fieldbus
• Segment according to the zones and conduits of IEC 62443 and restrict remote access to engineering tools
• Secure physically - lock cabinets and avoid freely accessible D-sub connectors for diagnostics; anyone with physical access to the bus, including a malicious insider, bypasses every network control
• Take inventory of which PROFIBUS segments are connected to Ethernet via gateways; these links are often forgotten

🛠️ How do you maintain and migrate a PROFIBUS installation?

Many faults in PROFIBUS networks have a physical cause. A structured approach to maintenance:

1. Check the termination - exactly two active terminations per segment, at the ends, and make sure they are powered
2. Measure signal quality - a bus analyser such as ProfiTrace from PROCENTEC in Wateringen (part of HMS) shows oscilloscope traces, faulty telegrams and retries per station
3. Mind the cable and earthing - violet type A cable, the correct cores on pin 3 (B, red) and pin 8 (A, green) of the D-sub connector, and a properly shielded and earthed cable screen
4. Document addresses and GSD versions - as part of your asset inventory
5. Plan the migration - Siemens has moved the S7-300 into its phase-out stage, so controllers are often replaced before the fieldbus is

When migrating a brownfield plant, the PROFIBUS cabling often stays in service for years. A new PROFINET controller connects the existing segments through a proxy, and devices are only converted when they are replaced. This spreads cost and risk without shutting down the legacy installation in one go.

❓ Frequently asked questions

Is PROFIBUS still sold and supported?

PROFIBUS is still sold and maintained by PI: roughly one million new PROFIBUS devices are still added worldwide each year. The installed base of roughly 70 million devices will remain in service for years to come. For new builds, however, most vendors and end users choose PROFINET.

What is the difference between PROFIBUS DP and PROFIBUS PA?

PROFIBUS DP runs over RS-485 at up to 12 Mbit/s and is mainly used in factory automation. PROFIBUS PA uses the same protocol over an MBP cable at a fixed 31.25 kbit/s, which also powers the devices and can be engineered as intrinsically safe for hazardous areas.

How many devices can a PROFIBUS network have?

A single RS-485 segment holds up to 32 stations, including masters and repeaters. Using repeaters, a PROFIBUS DP network can contain up to 126 addresses, numbered 0 to 125.

Is PROFIBUS the same as RS-485?

No, RS-485 is only the electrical physical layer that PROFIBUS DP runs on. PROFIBUS adds the medium access method, telegrams, addressing and application profiles on top. Modbus RTU also uses RS-485 but is an entirely different protocol.

What is a GSD file in PROFIBUS?

A GSD file (General Station Description) is a text file from the manufacturer that describes which modules, data and parameters a PROFIBUS device has. Engineering software such as TIA Portal imports the GSD file so that the device can be configured.

Can PROFIBUS be hacked?

PROFIBUS has no authentication or encryption, so anyone with access to the bus or to a connected system can read data and send commands. In practice an attack goes through a compromised PLC, gateway or engineering station, as Stuxnet showed. Segmentation and physical security are therefore the most important measures.

📌 In summary

PROFIBUS is a reliable serial fieldbus defined in IEC 61158 that has been used for decades for real-time data exchange between field devices and control systems.

DP connects I/O and drives on the factory floor, while PA powers and connects process instruments right into the Ex zone. Although new builds are moving to ProfiNET and Ethernet-APL, millions of PROFIBUS devices will stay in service for years. Maintain them with attention to cabling and termination, and above all secure the systems that link the bus to the Ethernet network.