Configuring S7-300 CPU 315-2 PN/DP Data Exchange via PROFINET and SCALANCE X208

Two SIMATIC S7-300 CPUs of type 6ES7315-2EH14-0AB0 (CPU 315-2 PN/DP) can exchange process data, such as temperature values, across a SCALANCE X208 industrial Ethernet switch using several protocols. This reference covers the four practical options, configuration steps in STEP 7 V5.5 and TIA Portal, the FBs used (FB14/GET, FB15/PUT, FB12/BSEND, FB13/BRCV, FB65-68/TCON family), the I/O address mapping in PROFINET, and the diagnostic OB requirements (OB82, OB86, OB87) that keep the system out of STOP on link or partner faults.

1. Communication Options at a Glance

For temperature values from a sensor block, the practical payload is typically a handful of REAL values (4 to 32 bytes per side). PUT/GET over a configured S7 connection is the lowest-effort path and is the recommended starting point when the refresh period can be 250 ms or slower.

2. Prerequisites

• Two CPU 315-2 PN/DP with order number 6ES7315-2EH14-0AB0, firmware V3.3 or higher. The integrated PROFINET interface (X1, port P1/P2) supports S7 communication and I-Device. Earlier firmware V2.x does not support I-Device.
• One SCALANCE X208 (6GK5208-0BA00-2AA2 unmanaged, or 6GK5208-0BA00-2AC2 managed) with two free RJ45 ports minimum.
• STEP 7 V5.5 + SP2 with HSP or TIA Portal V15.1 or higher (V20 referenced for the latest direct data exchange configuration in the TIA Portal V20 example for direct data exchange).
• Standard PROFINET patch cables, Cat 5e or higher, max 100 m per segment.
• IP plan: 192.168.0.1 for CPU-A, 192.168.0.2 for CPU-B, subnet mask 255.255.255.0. PROFINET devices require manual IP assignment on S7-300 PN interfaces; DHCP is not used.
• For BSEND/BRCV and TCP/ISO-on-TCP, the standard library SIMATIC_NET_CP or Standard Library > Communication Blocks must be present in the project.

3. Network Topology

For ring redundancy, use a SCALANCE XC/XR/XB family with HRP and configure two ports per CPU. The 315-2 PN/DP supports PROFINET basic switch functionality when firmware is V3.2 or higher; both CPU ports are then usable in a ring as a managed node.

4. Option A — S7 Connection with PUT/GET (Recommended for <160 B Cyclic)

PUT/GET uses a configured S7 connection. The CPU that calls FB15 (PUT) writes to the partner's data blocks; the CPU that calls FB14 (GET) reads from the partner. The blocks are single-sided: only the client CPU needs them in its program. The server CPU must have an S7 connection configured and the target DB must not be optimized (or use absolute access).

4.1 Hardware Configuration (STEP 7 V5.5)

1. Insert both CPUs in HW Config with order number 6ES7315-2EH14-0AB0. Double-click each PROFINET interface (X1) and assign IP 192.168.0.1 / 192.168.0.2 with subnet 255.255.255.0.
2. Connect both PROFINET interfaces to the same Ethernet subnet (the SCALANCE X208 is transparent at L2; no subnet entry is required on the switch itself when unmanaged).
3. Open NetPro. Right-click the CPU on the left side and select Insert New Connection > S7 Connection. Choose the partner CPU from the project. Assign connection ID 1 to 16 (each S7-300 PN supports up to 16 S7 connections; reserve ID 0 for PG/OP).
4. In the connection properties confirm Active connection establishment = On on the client side only. The server side leaves establishment on passive. The CPU acting as server should also be flagged Establish connection = Active in HW Config PROFINET properties for the PUT/GET rights checkbox to be selected.
5. Compile and download both stations.

4.2 Calling FB15 (PUT) and FB14 (GET)

The instance DBs for FB14 and FB15 are created automatically. Allocate one instance DB per connection. Sample call from OB1 in CPU-A (the client):

// One-shot or cyclic every 250 ms in OB35
// PUT: CPU-A writes 10 bytes starting at DB20.DBB0 to CPU-B DB50
CALL FB15, DB115  // PUT
   REQ    := M10.0        // trigger, edge
   ID     := W#16#0001    // connection ID from NetPro
   DONE   := M10.1        // job finished without error
   ERROR  := M10.2        // error during job
   STATUS := MW12         // detailed status, see Table 4-1
   ADDR_1 := P#DB50.DBX0.0 BYTE 10   // partner destination
   SD_1   := P#DB20.DBX0.0 BYTE 10   // local source
   LEN    := 10           // bytes to transfer

// GET: CPU-A reads 20 bytes from CPU-B DB60 into local DB21
CALL FB14, DB114  // GET
   REQ    := M10.3
   ID     := W#16#0001
   NDR    := M10.4        // new data received
   ERROR  := M10.5
   STATUS := MW14
   ADDR_1 := P#DB60.DBX0.0 BYTE 20   // partner source
   RD_1   := P#DB21.DBX0.0 BYTE 20   // local destination
   LEN    := 20

For temperature data, pack two REAL values into a small DB:

DATA_BLOCK DB20
  STRUCT
    Temp_PV1  : REAL;     // process value 1, deg C
    Temp_PV2  : REAL;     // process value 2, deg C
    Status    : WORD;     // bit flags
  END_STRUCT
END_DATA_BLOCK

4.3 PUT/GET STATUS Word — Common Values

5. Option B — BSEND/BRCV for Larger Payloads

When the payload exceeds 160 bytes (e.g., a full recipe, a string of 200 characters, or a parameter snapshot of 1 KB) the PUT limit is insufficient. Switch to FB12 (BSEND) and FB13 (BRCV) on the same S7 connection. Both sides call their FB; BSEND on one side and BRCV on the other must reference the same connection ID and matching LEN values. R_ID is a user-defined job ID (DWORD) that pairs the BSEND with a BRCV — pick a unique value per direction.

// CPU-A: send 1024 bytes from DB100 to partner
CALL FB12, DB112  // BSEND
   REQ    := M20.0        // edge-triggered
   R      := M20.1        // abort job
   ID     := W#16#0001    // same S7 connection as PUT/GET, or a dedicated ID
   LEN    := 1024
   DONE   := M20.2
   ERROR  := M20.3
   STATUS := MW22
   SD_1   := P#DB100.DBX0.0 BYTE 1024

// CPU-B: receive the same job identified by R_ID 16#00000001
CALL FB13, DB113  // BRCV
   EN_R   := M20.4        // receive enabled, static TRUE
   ID     := W#16#0001
   LEN    := 1024         // max length to accept
   NDR    := M20.5        // new data complete
   ERROR  := M20.6
   STATUS := MW24
   RD_1   := P#DB101.DBX0.0 BYTE 1024

BSEND/BRCV segments the data over multiple PDUs and reassembles on the receiver. Each segment exchange takes roughly 5 to 15 ms over a 100 Mbit link, so a 32 KB BSEND takes around 250 to 500 ms end-to-end. Status words are documented in the S7-300 communication manual. Typical non-zero STATUS values mirror the PUT/GET table: 8183, 8184 (partner unreachable), 8186 (BSEND permission), 8301 (DB missing on partner), and protocol-specific 8303 / 8304 (LEN mismatch).

6. Option C — I-Device (PROFINET Direct Data Exchange)

The I-Device role was the closest PROFINET equivalent to Profibus direct data exchange. CPU-A is configured as an IO controller on its own PROFINET subnet and as an I-Device (a PROFINET IO device providing sub-slots) to CPU-B. CPU-B sees CPU-A's pre-defined transfer areas as standard IO slots and reads them via the process image. No communication FBs are required in the user program; the runtime handles the cycle.

1. In HW Config / TIA Portal, mark CPU-A's PROFINET interface as I-Device.
2. Define a transfer area: for example, 32 bytes input (CPU-A → CPU-B) mapped to PI start 256, and 32 bytes output mapped to PQ start 256. Up to 32 transfer areas per I-Device are allowed.
3. On CPU-B, install the GSD file of CPU-A (or drag it from the project) and add it as a PROFINET IO device on the same subnet.
4. Assign the I/O addresses. On the CPU-B side, the transfer area from CPU-A appears as standard IB/PQB, e.g. IB 256..287 for input, QB 256..287 for output.
5. For deterministic timing set the send clock to 1 ms (with reduction ratio of 1 on the I-Device side) for the I-Device sub-slots. The default 1 ms clock is fine for temperatures.

The TIA Portal V20 example: configuring direct data exchange S7-300/S7-400/S7-1500 walks through the equivalent Profibus setup; the same transfer-area logic applies to the I-Device configuration in the Devices & Networks editor of TIA Portal V15.1 and later.

7. Option D — Open Communication (TCP, ISO-on-TCP, UDP)

For non-Siemens partners or for free-form payloads, the open communication FBs of the integrated PROFINET interface on the 315-2 PN/DP can be used. The PN interface of the S7-300 CPU supports up to 8 open communication connections and up to 16 total connections including S7. The FBs are FB65 TCON, FB66 TDISCON, FB67 TSEND, FB68 TRCV, FB63 TSEND (legacy) and FB64 TRCV (legacy). They are located in the Standard Library > Communication Blocks or SIMATIC_NET_CP library.

A connection description DB (UDT 65) must be created and filled. ISO-on-TCP (RFC 1006) is the most common choice inside Siemens networks because it works through most routers and supports long messages.

// Connection DB, structured per UDT65
DATA_BLOCK DB65  // connection description
  STRUCT
    block_length    : WORD := W#16#0040;
    id              : WORD := W#16#0001;     // local connection ID
    connection_type : BYTE := B#16#12;       // 12 = ISO-on-TCP
    active_estab   : BYTE := B#16#01;        // 1 = active
    local_tsap_len : BYTE := B#16#02;
    rem_tsap_len   : BYTE := B#16#02;
    local_tsap     : ARRAY[1..16] OF BYTE := B#16#00,...;  // fill ASCII
    rem_tsap       : ARRAY[1..16] OF BYTE := B#16#00,...;
    local_port     : WORD := W#16#0000;      // 0 for ISO-on-TCP
    rem_port       : WORD := W#16#0000;
  END_STRUCT
END_DATA_BLOCK

// Establish ISO-on-TCP connection once at startup
CALL FB65, DB65_inst  // TCON
   REQ     := M30.0
   ID      := W#16#0001
   DONE    := M30.1
   BUSY    := M30.2
   ERROR   := M30.3
   STATUS  := MW32
   CONNECT := DB65

// Send 50 bytes of temperature record (struct of 4 REAL + 2 INT)
CALL FB67, DB67_inst  // TSEND
   REQ     := M31.0
   ID      := W#16#0001
   LEN     := 50
   DONE    := M31.1
   ERROR   := M31.2
   STATUS  := MW34
   DATA    := P#DB200.DBX0.0 BYTE 50

On the partner side, FB68 TRCV is called with LEN = 0 for protocol-controlled length, or with the expected length. STATUS = 0x0001 means new data was received, 0x0000 means no data, and any 0x8xxx or 0xFxxx is an error. Detailed STATUS codes are listed in the S7-300/400 Communication with SIMATIC Net manual.

8. I/O Addressing in PROFINET vs Profibus

For Profibus, the configured slot address (e.g. PIW 256) was assigned in HW Config on the DP slave. For PROFINET, the same number is assigned in the Device View of TIA Portal or in HW Config on the I-Device / IO device. The slot number no longer appears in the operand — it is encapsulated in the device name and slot mapping. The configured I/O addresses can therefore be used identically in the user program, regardless of whether the data arrived via Profibus or PROFINET.

9. Required Organization Blocks for Robustness

S7-300 CPUs STOP on a missing OB only when a class of error is reported. Insert the following OBs to keep the CPU running on link loss, partner failure, or socket error:

10. Commissioning and Verification

1. Compile and download both stations. Confirm the link LEDs on the SCALANCE X208 and on each CPU's PN port are steady green. The port LEDs (Link, Activity) sit on the front of the 6ES7315-2EH14-0AB0 next to the X1 sockets.
2. Open the online > Diagnostic Buffer on each CPU. Both should report Connection established for the S7 connection ID.
3. Force a single PUT job with the watch table. In the watch table on CPU-A, set M10.0 = 1 (REQ) and observe M10.1 (DONE) rising and STATUS = 0. In CPU-B, verify that DB50 has been written with the data from DB20.
4. For BSEND/BRCV, monitor DONE and NDR toggling and check LEN matches. Use the SFC 87 C_DIAG function block to read diagnostic counters if a job stalls.
5. For I-Device, open the Devices & Networks view online and check the IO system status — both devices should be green. Watch the I/O flags IB 256..287 on CPU-B to confirm the live update from CPU-A.
6. Pull one patch cable to simulate a link loss. The CPU must remain in RUN, OB86 should report the failure, and the connection should re-establish automatically when the cable is plugged back in.

11. Troubleshooting Matrix

12. Selection Guidance

• Use PUT/GET for slow cyclic data (update period ≥ 250 ms), small payload (< 160 B), and the lowest program effort. This is the right answer for two CPU 315-2 PN/DP stations exchanging a few REAL temperatures.
• Use BSEND/BRCV when the payload exceeds 160 B or when buffered, segmented transfer is required (e.g., a 2 KB recipe change).
• Use I-Device when the timing is hard, the data should appear in the process image (for high-speed access on every OB1 scan), and a Profibus-like direct data exchange model is preferred. I-Device is the closest analog to the Profibus direct data exchange example referenced in the original question.
• Use open TCP/ISO-on-TCP/UDP only when a non-S7 partner is in the loop, or when full control of the payload is needed (e.g., a foreign SCADA or a third-party micro).

13. Sizing the Link

Each S7 PUT/GET PDU carries up to 160 B user data. At a 100 Mbit/s link, a single PUT cycle (1 PDU each direction) takes well under 10 ms. The bottleneck is usually the OB1 / OB35 cycle in which the FBs are called, not the wire. For a 250 ms OB35 call, four parallel PUT/GET jobs of 100 B each use approximately 0.4% of the 100 Mbit/s link capacity — bandwidth is not the concern. For BSEND/BRCV carrying 32 KB, the segment count is around 200 PDUs and the time on the wire is dominated by the 200 TCP ACKs at < 5 ms total, with the rest being application turnaround on the S7-300 CPU. Plan for at least 0.5 s end-to-end for a full 32 KB BSEND.

14. Security and Network Notes

PROFINET on the 315-2 PN/DP integrated interface has no built-in access protection beyond the S7 connection IDs and the PUT/GET permission flag. For plants with an external connection, place a SCALANCE SC firewall (e.g. 6GK5304-0BD00-2AA3 SCALANCE S615) between the office and the SCALANCE X208 ring. The 315-2 PN/DP does not support TLS on its integrated interface; the SCALANCE S modules act as the secure edge. Disable unused PROFINET services (SNMP, LLDP being the most common) only if you have a specific reason — keeping them on simplifies diagnosis.

15. Final Configuration Checklist

• [ ] Both CPU 315-2 PN/DP stations have unique IP addresses in the same subnet.
• [ ] S7 connection is configured in NetPro / TIA Portal with valid ID on both sides.
• [ ] PUT/GET permission flag is set on the server CPU.
• [ ] FB14/FB15 are called with valid ANY pointers and matching LEN.
• [ ] OB82, OB86, OB87, OB121, OB122 are present on both CPUs.
• [ ] Link LEDs green on every port; SCALANCE X208 has power supply (24 V DC) on the terminal block.
• [ ] Watch table verification: PUT DONE = 1, GET NDR = 1, partner DBs show expected data.
• [ ] Fault simulation: pull a cable, confirm CPU stays in RUN and re-establishes when reconnected.