Commissioning Siemens ET200S IM151-8PN with WinCC TCP/IP

Overview

The SIMATIC ET200S is a modular, bit-modular distributed I/O station with IP20 protection, designed for cabinet-mounted applications where space is constrained and Profinet or Profibus connectivity is required. When the head station is the IM151-8 PN/DP (order number 6ES7151-8AB01-0AB0 for the standard variant, or 6ES7151-8AB00-0AB0 for earlier revisions), the station acts as a Profinet IO Device on the higher-level controller network, while still retaining an RS485-style Profibus master/slave option on the backplane. This makes the IM151-8PN a versatile gateway for mixed-vintage sites that need to bridge Profinet controllers with Profibus DP slaves, or simply terminate Profinet I/O at the field level.

The procedure below covers the canonical use case where the ET200S is wired to an external managed switch, the IM151-8PN is assigned a fixed Profinet IP address, and a WinCC station on the same Ethernet segment needs to read and write process tags directly to the ET200S without an intervening SIMATIC S7 PLC. The technique is identical when a downstream SIMOTION controller is later installed; the WinCC channel definition simply changes from a direct S7 or TCP/IP source to a routed SIMOTION OPC UA or Named Connection path.

Prerequisites

• Hardware
  • ET200S backplane (e.g., 6ES7193-4CA50-0AA0 TM-E15C26-A1 terminal module + 6ES7193-4CB10-0AA0 TM-E15C24-01 power terminal).
  • IM151-8 PN/DP interface module (6ES7151-8AB01-0AB0).
  • Minimum one I/O electronic module (e.g., 6ES7131-4BD01-0AA0 DI 4×24 V or 6ES7132-4BD01-0AA0 DO 4×24 V/0.5 A).
  • Power feed module if intermediate 24 V segregation is required (6ES7193-4DA20-0AA0 PM-E).
  • Managed or unmanaged Ethernet switch supporting Profinet (e.g., SCALANCE XB005, 6GK5005-0BA00-1AB2).
  • Standard Profinet cabling (RJ45, Cat 5e minimum, 100 Mbit/s full duplex).
  • 24 V DC power supply, fused 2-4 A depending on module count.
• Software
  • SIMATIC Step 7 V5.5 + SP2 or later (with the matching GSD file for IM151-8PN installed). For TIA Portal users, the equivalent portal version is V13 SP1 or later with HSP for ET200S.
  • SIMATIC WinCC V7.x or WinCC Professional V13 SP1+ for runtime HMI.
  • PG/PC Ethernet interface driver installed from the Step 7 / TIA Setup under "SIMATIC Device Drivers."
• Network parameters
  • Profinet device name and IP address reserved for the IM151-8PN (example: et200s-im151, 192.168.0.50 / 255.255.255.0, no router).
  • PC IP address on the same subnet (example: 192.168.0.10 / 255.255.255.0).

Hardware Topology

The ET200S line-up is mechanically self-stacking. The IM151-8PN clamps onto a TM-E15Cxx terminal module, and each subsequent electronic module seats onto its own terminal module. The order from left to right is mandatory:

1. TM-E15S26-A1 power feed terminal (leftmost) — feeds the backplane electronics.
2. IM151-8PN interface module — Profinet/Profibus head station, occupies slot 0.
3. Power modules (PM-E) as needed for additional 24 V load segments.
4. Digital and analog electronic modules (DI, DO, AI, AO), addressed by slot index beginning at 1.

The IM151-8PN has three RJ45 ports labeled PN1, PN2, and a DP (Profibus) 9-pin D-sub. PN1 and PN2 are an internal 2-port switch, allowing a linear Profinet topology without an external switch. When a separate managed switch is used (recommended for service diagnostics and for the PG/PC connection), connect only one port to the switch and leave the second port open or looped to the next station.

Step 1 — Power-On Verification

Before opening Step 7, verify the backplane mechanics and bus terminations:

1. Apply 24 V DC to the leftmost power terminal. The IM151-8PN status LED SF (red) and BF (bus fault, red) should illuminate briefly, then extinguish. ON (green) remains lit; LINK LEDs on PN1/PN2 light when a live Ethernet partner is detected.
2. Confirm the PG/PC and the IM151-8PN share the same subnet. From a Windows command prompt run ping 192.168.0.50 with the IM151-8PN disconnected — it should fail with "Destination unreachable," confirming no rogue device occupies the address.
3. With the IM still unconfigured, connect the PG/PC Ethernet cable directly to PN1 of the IM151-8PN. Run ping to the factory-default fallback IP 0.0.0.0 if your PG is on a temporary 0.0.0.0/0 subnet — the IM151-8PN will not respond until it has a name assigned.

Step 2 — Create the Step 7 Project

1. Open the SIMATIC Manager and select File → New → Project. Name the project (e.g., ET200S_WinCC_Demo).
2. Insert a new SIMATIC 300 Station in the project. The IM151-8PN is configured as a stand-alone ET200S, so a CPU is not required for the configuration view unless a SIMATIC S7 host will be added later.
3. Right-click the project and choose Insert New Object → SIMATIC PC Station. This is required because WinCC will attach to a PC station, and the PG/PC interface used for online commissioning also sits on a PC station.
4. Open HW Config on the PC Station and drag the IE General (e.g., 6GK1161-2AA01) into slot 4. Assign the IE General the same MAC that matches your physical Ethernet adapter.

Step 3 — Add the ET200S with IM151-8PN in HW Config

1. Open the catalog: PROFINET IO → I/O → ET200S → IM151-8 PN/DP. The exact GSD entry depends on the firmware version. For firmware V3.x and later, select IM151-8 PN/DP V3.0; for older revisions, select V2.0 or V1.0 to match the module sticker.
2. Drag the IM151-8PN onto the PROFINET IO system. The Properties dialog opens automatically.
3. Assign the device name et200s-im151 and the IP address 192.168.0.50, subnet mask 255.255.255.0, no router.
4. Confirm that the device number starts at 1 (the first PROFINET IO Device on the subnet).
5. From the catalog, drag each electronic module onto the slot rack beneath the IM151-8PN in the exact order it is physically mounted. Slot 1 = first module after the IM. I/O addresses are assigned automatically and can be edited (e.g., DI starting at IB 0, DO at QB 0, AI at IW 2).

Step 4 — Configure the PG/PC Interface

From the Windows Control Panel or Start menu, launch Set PG/PC Interface (in the SIMATIC Manager installation, found under SIMATIC → STEP 7 → Set PG-PC Interface):

1. Set the access point S7ONLINE to TCP/IP → <your network adapter>.
2. Click Properties and confirm the PG IP matches the Windows adapter (e.g., 192.168.0.10).
3. For the access point PG/PC, repeat the same selection if you intend to download to a CPU later.
4. Open PLC → Ethernet → Assign Profinet Device Name from the HW Config toolbar. The dialog should list the IM151-8PN with its current MAC (visible on the side label of the module). Select the device, enter et200s-im151, and click Assign Name. The IM151-8PN reboots and accepts the new IP only after it has received its Profinet name.

Step 5 — Establish Online Connectivity

1. In HW Config, right-click the IM151-8PN and choose PLC → Online → Go Online. After a few seconds, the connection should establish. Verify Diagnostic Buffer shows a clean PROFINET IO AR (Application Relationship) establishment.
2. Open PLC → Monitor/Modify on the I/O modules. Force a digital input by applying 24 V to channel 0 of the first DI module. The bit should toggle in the monitor view, confirming the slot mapping is correct.
3. From a Windows shell, run ping 192.168.0.50. Reply times should be < 1 ms on a direct connection.

Step 6 — Configure the WinCC TCP/IP Connection

WinCC cannot speak PROFINET directly as an IO controller; it must communicate either through a SIMATIC S7/1500/1200/300 CPU using the SIMATIC S7 Protocol Suite channel, or, when no PLC is present, through a raw TCP/IP channel talking to the IM151-8PN's integrated web server or via a SIMOTION/PN coupler. The most common deployment is the SIMATIC S7 Protocol Suite with the TCP/IP driver, but this requires a CPU. For the no-CPU case described in the source procedure, the practical approach is the WinCC SIMATIC S7-1200/1500 Channel with the IM151-8PN emulating S7 communication by routing through a downstream CPU, OR using the WinCC Industrial Ethernet (TCP/IP) Raw channel with a user-defined protocol.

For the canonical case where the ET200S has an S7-300 attached as the IO controller and WinCC reads via that S7-300, configure WinCC as follows:

1. In WinCC Explorer, right-click Tag Management → Add New Driver. Select SIMATIC S7 Protocol Suite.
2. Expand the suite and right-click TCP/IP → New Connection. Name the connection (e.g., ET200S_PLC).
3. In the connection properties, set:
   • IP Address: 192.168.0.40 (the S7-300 CPU that hosts the PROFINET IO system to which the IM151-8PN attaches).
   • Partner TSAP: leave default or set 03.01 for slot 1, rack 0.
   • Connection Type: TCP/IP.
4. Create a new tag group (e.g., ET200S_DI). Add tags of type Binary Tag for digital inputs, addressing e.g. DB 100.DBX 0.0 for a packed DI/DO area that the CPU program mirrors from the ET200S.

For a direct read/write without a PLC, the IM151-8PN does not expose an S7 server by default. In this scenario, deploy one of:

• SIMOTION or S7-1200/1500 with PUT/GET enabled: the CPU reads the ET200S PROFINET IO and WinCC tags are sourced from CPU DBs.
• OPC UA server: an S7-1500 or SIMOTION P with OPC UA publishes the ET200S tags; WinCC Professional or WinCC V7.4 SP3+ consumes OPC UA.
• Raw TCP/IP: a custom script exchanges framed telegrams with the IM151-8PN's diagnostic web server (port 80, HTTP GET on /diag.xml for I/O state). Useful only for low-volume diagnostics, not for control loops.

Step 7 — Read and Write Variables from WinCC

Once the connection is online (green check in WinCC Explorer under the connection), build tags as follows for typical ET200S signals:

The PLC program (in the S7-300/400 or S7-1500 IO controller) must copy the process image to/from DB100. Example SCL for copying DI on the S7-1500:

// SCL: mirror PROFINET IO process image to DB100
"di_local" := "ET200S DI 4x24V".I0..I3;
"DB100".di_word.%B0 := "di_local";

In WinCC, drag the tags onto a screen using I/O field, bar graph, or checkbox controls. Verify round-trip behavior by toggling a DO via the WinCC input and probing the physical output terminal with a multimeter.

Step 8 — SIMOTION Extension

To upgrade the architecture with a SIMOTION D or P controller that owns the ET200S as a PROFINET IO Device, the changes are minimal:

1. In SIMOTION SCOUT, export the ET200S configuration from Step 7 HW Config as an XML, then re-import it into the SIMOTION project.
2. Set the SIMOTION controller as the IO Controller; the IM151-8PN retains the same Profinet name and IP.
3. In WinCC, switch the S7 Protocol Suite channel to point at the SIMOTION's IP, or replace the channel entirely with OPC UA using the SIMOTION OPC UA server.

This path keeps the field wiring untouched while modernizing the controller and HMI layers.

Verification and Diagnostics

Use the following checklist before releasing the system to operations:

1. From the PG, open HW Config, right-click the IM151-8PN, and select Module Information → Diagnostic Buffer. Confirm zero PROFINET IO errors and zero port/link-down events.
2. In WinCC Explorer, all channels should show a green online state. Open Tools → Channel Diagnosis; cycle each tag and confirm the Quality Code remains Good (0xC0).
3. Force a physical disconnect on PN1: the IM151-8PN BF LED lights and the diagnostic buffer logs an "AR abort." Reconnect; AR should re-establish within 3-5 seconds.
4. Run a sustained read/write load (WinCC Tag Logging with 100 ms acquisition) for at least 10 minutes; verify zero lost telegrams by checking the WinCC System Diagnostics for connection-loss events.

Troubleshooting Matrix

Best Practices and Field-Proven Caveats

• Profinet cable length: 100 m maximum copper run (per IEC 61784-5-3). For longer distances, use SCALANCE X switches as repeaters or fiber media converters.
• Update time: when configuring the IM151-8PN in HW Config, leave the PROFINET update time at 1 ms only if every electronic module on the rack is rated for that update. Otherwise leave at 2 ms or 4 ms to avoid module-internal overruns.
• Spare part alignment: when ordering spares, match the firmware version printed on the IM151-8PN label (e.g., V3.0.4). A downgrade or a major-version mismatch can require a full HW Config re-import.
• Watchdog: configure a WinCC script watchdog that pings the IM151-8PN every 5 seconds; if three consecutive pings fail, switch critical outputs to a fail-safe state via the PLC program. This guards against single-direction failures where the TCP channel still shows online but the I/O has stopped updating.
• Web server: the IM151-8PN exposes diagnostics on port 80. In production environments, restrict the port using the managed switch's ACL, because the web server does not authenticate viewers.

Glossary of Key Acronyms

• PN: Profinet.
• DP: Decentralized Periphery (Profibus DP).
• DCP: Discovery and Configuration Protocol — used for Profinet name assignment.
• AR: Application Relationship — the Profinet IO session between controller and device.
• TSAP: Transport Service Access Point — the addressing primitive in S7 over TCP/IP.
• LLDP: Link Layer Discovery Protocol — used by Profinet for topology detection.