Configuring Banner VE Series PROFINET Communication on S7-300 PLC

Overview: Banner VE Series over PROFINET on S7-300

The Banner VE Series smart camera is a self-contained vision system that supports PROFINET IO, EtherNet/IP, Modbus TCP, and raw TCP/IP on a single industrial M12 Ethernet port. When integrated with a Siemens SIMATIC S7-300 CPU (for example a CPU 315-2 PN/DP or CPU 317-2 PN/DP), PROFINET IO delivers deterministic, cyclic exchange of process data between the camera and the PLC without any additional gateway or OPC server in the path.

The camera exposes its inspection, trigger, and control data as PROFINET slots. After importing the Banner GSDML file into STEP 7 and inserting the camera into the PROFINET topology, each slot is mapped to a fixed range of input bytes (IB) and output bytes (QB) in the CPU process image. Reading and writing those bytes with simple load/transfer (L/T) instructions is enough to trigger inspections, read pass/fail results, and acknowledge completion.

This article is written for engineers who already have the VE Series camera physically wired, powered, and reachable on the network, who have imported the Banner GSDML, and who need to find the camera's PROFINET addresses inside the S7-300 program and read or write the data those addresses carry. The reference manual used for the slot breakdown is the Banner VE Series Smart Camera Instruction Manual, document 191666, Chapter 13.6 (PROFINET IO), specifically the slot-by-slot tables starting around page 210.

Prerequisites

Confirm each item before touching HW Config. Missing one of these is the most common reason the camera's process data appears "empty" inside the PLC.

• CPU firmware: S7-300 CPU with integrated PROFINET interface (CPU 31x-2 PN/DP family). PROFINET IO device firmware on the CPU must support at least V2.1 for the Banner GSDML revision shipped with current VE Series firmware.
• STEP 7 version: SIMATIC Manager with STEP 7 V5.5 + SP2 or later, or TIA Portal V13 SP1 or later if the S7-300 was migrated. STEP 7 V5.5 is the canonical environment for S7-300 PROFINET IO configuration with classic GSDML files.
• Banner GSDML file: Downloaded from Banner's product page or shipped with Vision Manager. The filename follows the GSDML-V<x>-Banner-VE-...xml convention. Import via Options > Install GSD File in HW Config.
• Vision Manager configuration: The inspection program is loaded into the camera, the camera has a static IP address on the same subnet as the CPU's PROFINET port, and the device name has been assigned (either through Vision Manager, the PRONETA tool, or via STEP 7 "Assign PROFINET device name").
• Network: PROFINET requires 100 Mbit/s full-duplex, auto-negotiation disabled, and DCP-compliant switches if any are in the path. A direct point-to-point cable is acceptable for bench commissioning.
• PLC project status: The HW Config has been compiled and downloaded to the CPU at least once after the camera was added. A PLC that has not received the new topology will not allocate any process image for the camera, even if the GSD is installed.

Hardware Configuration in STEP 7 HW Config

Insert the VE Series camera into the PROFINET IO system of the S7-300 CPU. The detailed click path is:

1. Open SIMATIC Manager > your S7 project > the station (for example SIMATIC 300 Station) and double-click Hardware to launch HW Config.
2. In the catalog tree on the right, navigate to PROFINET IO > Additional Field Devices > Vision > Banner Engineering > VE Series Smart Camera. The exact path is created by the GSDML and will display the model number, for example VE202G1 or VE400G2.
3. Drag the camera onto the PROFINET IO system line attached to the CPU's PN port. STEP 7 assigns it a device number (default 1) and proposes a set of input and output addresses in the process image.
4. Open the camera's properties, set the IP address to match the one configured in Vision Manager, and assign the PROFINET device name. The device name is case-sensitive and must match exactly.
5. Right-click the camera > Object Properties > confirm that the device number is unique on this PROFINET subnet.
6. Click Station > Save and Compile (Ctrl+S), then download the hardware configuration to the CPU. After a successful download the camera's BF (Bus Fault) LED should extinguish within a few seconds.

Slot Configuration and I/O Address Mapping

Once the camera is in the PROFINET system, the slots define the cyclic I/O. The VE Series GSD exposes several slots. The default selection typically enables a Trigger/Status word and a Results/Inspection data block. Open the camera in HW Config to see the slots. Each slot is mapped to a starting byte in the CPU process image. STEP 7 prints the assigned addresses in italics next to each slot.

A typical S7-300 configuration with the VE Series GSD produces addresses similar to the following (your project may differ by ±2 bytes depending on GSDML revision and STEP 7 build):

The VE Series Instruction Manual 191666 Chapter 13.6 lists the exact slot contents, data types, and consistency settings for each firmware revision. Page 210 and following describe the slot you are most likely trying to read. If the addresses in your project do not start at 100, replace the example addresses below with the values STEP 7 printed in italics next to each slot.

Understanding the S7-300 Process Image and OB1 PI

The S7-300 CPU maintains a "process image" (German abbreviation: PA, Prozessabbild) of the inputs and outputs. There are two variants:

• OB1 Process Image (OB1 PA): Updated automatically once per OB1 cycle at the start of OB1 execution. STEP 7 displays these addresses normally in italics next to the slot. Reading an input word assigned to OB1 PA is as simple as L IW100 in any FB, FC, or OB1.
• Addresses outside OB1 PA: Updated only on direct read (PIB / PIW) instructions. These addresses are typically shown in a different style or require explicit access. STEP 7 prints "OB1 PI: yes" or "OB1 PI: no" in the address properties.

When the PROFINET slots are configured, STEP 7 attaches them to OB1 PI by default. That is why a simple L IW100 returns fresh data every scan. If you have ever seen an address range printed in a lighter italic with "OB1 PI: no" next to it, that range needs explicit L PIWxxx access to refresh.

Reading Camera Inputs with Load/Transfer Instructions

Once the slot is mapped and compiled, the camera data is available exactly as if it came from a local digital or analog input card. The standard pattern in LAD/FBD/ST is to load the input word into a temporary or flag word and then test its bits.

The smallest test program to verify the camera is producing data looks like this in STL (Statement List):

      L     IW 100          // Status word from camera slot 1
      T     MW 100          // "myWord" - flag word for monitoring
      L     IW 102          // Pass/Fail bit map
      T     MW 102          // "myPassFail"
      L     IW 104          // Inspection ID / counters
      T     MW 104          // "myResults"

Declare MW100, MW102, and MW104 as WORD tags in the symbol table, or use them directly as flag words. Open a Variable Table (VAT) in STEP 7, type in the symbols, and toggle Monitor (the glasses icon). When you trigger an inspection from Vision Manager, the words should change in real time.

If you prefer SCL (Structured Control Language) inside an FB, the equivalent is:

// FB100 - Banner VE PROFINET interface
VAR
    myStatus  : WORD;    // IW100
    myPassFail: WORD;    // IW102
    myResults : WORD;    // IW104
END_VAR

myStatus   := WORD_TO_INT(%IW100);
myPassFail := WORD_TO_INT(%IW102);
myResults  := WORD_TO_INT(%IW104);

Writing to the Camera: Trigger and Control Bits

The Trigger/Control slot is at QW 100 (or whatever your slot 0 shows in italics). Setting bit 0 of that word is the standard trigger pulse. The VE Series expects a rising edge: the camera sees the bit transition from 0 to 1 and fires the inspection. After firing, it returns Trigger Acknowledge on bit 2 of the Status word (IW 100).

A typical trigger routine in STL:

// Trigger one-shot pulse using edge detection
      A     M      10.0      // external trigger request (pushbutton, sensor)
      FP    M      10.1      // one-shot memory
      JCN   NO_TRIG

      SET
      =     Q     100.0      // Trigger bit - rising edge fires camera

      AN    I     100.2      // Wait for Trigger Ack from camera
      JC    NO_TRIG          // Loop until Ack arrives or timeout

      CLR
      =     Q     100.0      // Release Trigger line
NO_TRIG: NOP 0

In LADDER this collapses to a single network with a contact, a positive-edge coil, and the output bit. The important point is that the PLC drives the trigger bit, the camera drives the acknowledge bit, and the same word is never both written and read by the PLC in a way that aliases the underlying bytes.

Bit Reference: VE Series Trigger and Status

The exact bit layout is firmware-dependent. The values below are the most common assignments for VE Series firmware 1.x and 2.x with PROFINET GSD revision 2.x. Always cross-check against the manual 191666, Chapter 13.6.

Different PROFINET slot configurations can place Trigger Acknowledge on either I 100.1 or I 100.2 depending on GSDML version and slot selection. Always confirm by cross-checking the slot table printed in HW Config with the manual.

Verification with a Variable Table (VAT)

Create a VAT named, for example, VAT_BANNER with the following entries:

Symbol          Address    Display
myWord          MW100      HEX
myPassFail      MW102      BIN
myResults       MW104      HEX
TriggerOut      Q100.0     BOOL
Ready           I100.0     BOOL
TrigAck         I100.2     BOOL
Pass            I100.3     BOOL
Fail            I100.4     BOOL
Error           I100.5     BOOL

Go online to the CPU, click Monitor all (the glasses). Trigger the camera by hand from Vision Manager. You should see:

1. Ready (I100.0) = 1 immediately after PROFINET comes up.
2. TrigAck (I100.2) and Pass/Fail change within one inspection cycle after the trigger edge.
3. myResults shows the inspection ID or error code, useful for diagnosing "no image" or "missing sensor" faults from the PLC side.
4. Manually setting Q100.0 = 1 in the VAT for a single scan should fire one inspection on the camera.

If myWord stays at 16#0000 even after the camera is ready, the slot is mapped but the camera is not publishing data. The two most common causes are (a) the slot is not enabled in Vision Manager under Communications > PROFINET and (b) the slot is enabled but no inspection is loaded.

Troubleshooting Matrix

Performance and Timing Considerations

PROFINET IO update time for a single camera on a CPU 315-2 PN/DP is typically 1 ms with the default "Update time" automatic setting. The camera's own inspection time (often 20 ms to 200 ms depending on resolution and number of tools) dominates the end-to-end latency between PLC trigger and PLC result read.

Set the send clock in HW Config to at least 1 ms for stable operation. Avoid going below 0.5 ms: many VE Series firmware revisions do not negotiate down to the minimum sub-millisecond send clock reliably.

For deterministic handshaking, poll Inspection Complete rather than rely on fixed time delays. A typical handshake cycle:

1. PLC raises Trigger bit (Q100.0) on a rising edge.
2. Camera latches the trigger, executes the inspection, and raises Trigger Acknowledge (I100.2).
3. Camera drops Trigger Acknowledge and raises Inspection Complete (also I100.2 in many slot configurations, or I100.3 in others) once results are valid.
4. PLC reads IW102 and IW104, applies logic, drops the Trigger bit.

Add a watchdog timeout in the PLC: if Inspection Complete is not seen within the maximum expected inspection time plus 50 ms, raise a fault to the operator and drop the trigger.

Migration to TIA Portal

If the S7-300 is later migrated to TIA Portal, the Banner GSDML is imported under Options > Manage general station description files (GSD). The slot and address mapping is preserved in the device view, and the program logic translates almost line-for-line. Two differences matter:

• TIA Portal uses fully symbolic I/O access. Reading the Status word becomes "Banner_Status" := %IW100; inside an SCL block, with the symbolic name assigned in the PLC tag table.
• Optimized vs. non-optimized block access changes how bytes inside a tag are accessed. Keep the Banner I/O area mapped to a non-optimized DB if you still need bit-level access inside the DB.

Safety and Network Hardening Notes

• PROFINET IO has no authentication. Any device on the same VLAN can rename itself and impersonate the camera. Segment the vision network from the office network.
• Disable PROFINET device-name auto-assignment on the network unless commissioning is actively in progress.
• Use a managed switch with PROFINET QoS prioritization if the camera is on the same network as motion control or safety devices.
• Validate that the inspection timing meets your risk assessment. The PROFINET update time plus inspection time is the worst-case detection delay and must be included in any safety-related timing budget for stop categories.