Configuring S7-300 CPU317-DP PROFINET for LVDT Sensors

Overview

The CPU 317-2 DP integrates PROFIBUS DP master functionality natively but ships without a PROFINET interface. To exchange cyclic I/O data with a PROFINET-capable LVDT displacement sensor, the S7-300 station requires a CP 343-1 communications processor configured as the PROFINET IO Controller. The LVDT sensor becomes a PROFINET IO Device on the same Ethernet segment and is integrated into the STEP 7 V5.5 project through its vendor-supplied GSDML file.

This reference covers the complete procedure for commissioning a PROFINET IO link from an S7-300 (CPU 317-2 DP) station to a generic LVDT displacement sensor in the SIMATIC Manager V5.5 environment. It applies whether the LVDT is from Balluff (BTL7 with PROFINET option), ifm electronic (PN7 series), Pepperl+Fuchs (PMI series), MTS Sensors (Temposonics with PROFINET), or any other manufacturer that provides a GSDML file conformant to the PROFINET specification.

Compared with PROFIBUS DP, the PROFINET IO link offers faster update times (typically 1 ms versus 12 ms), full-duplex 100 Mbps Ethernet, and standard TCP/IP for parameterization and diagnostics. The trade-off is that PROFINET IO Controller configuration in S7-300 requires an additional hardware module (CP 343-1) and a vendor GSDML file, rather than the universal GSD used by PROFIBUS.

Prerequisites

CP 343-1 vs IM Modules: Selecting the Correct Interface

The frequent confusion between IM modules and CP modules stems from their different roles in the PROFINET topology:

• CP 343-1 - Communications processor for the S7-300 CPU. Plugs into the S7-300 rack, communicates with the CPU over the backplane (P bus / K bus), and exposes a PROFINET interface on the front panel. Acts as PROFINET IO Controller.
• IM 151-3 PN - Interface module for ET 200S distributed I/O. Plugs into the ET 200S base unit, connects to PROFINET on the front panel, and exposes an internal backplane for ET 200S I/O modules.
• IM 153-4 PN - Interface module for ET 200M distributed I/O. Same role as IM 151-3 PN but for ET 200M stations that accept standard S7-300 I/O modules.

IM modules are used when an ET 200 distributed I/O station must communicate on PROFINET. They are not used in the S7-300 CPU itself. For direct connection of an LVDT PROFINET sensor to an S7-300, the correct choice is the CP 343-1.

If the LVDT sensor must be wired through a remote ET 200M station (for example for distributed I/O consolidation), then an IM 153-4 PN at the ET 200M plus the standard LVDT signal conditioner would be the correct topology. For direct PROFINET connection to the S7-300, the CP 343-1 path is correct.

Creating the Project in SIMATIC Manager V5.5

1. Launch SIMATIC Manager from the Windows Start menu (Start → SIMATIC → SIMATIC Manager).
2. Close the STEP 7 Wizard if it opens automatically.
3. File → New → User Project. Enter a project name (e.g. S7-300_LVDT_PNIO) and select a storage path on the local drive or file server.
4. Right-click the project in the right pane → Insert New Object → SIMATIC 300 Station. Name the station (e.g. S7300_Station1).
5. Double-click the new station → double-click the Hardware icon. HW Config launches.
6. In HW Config, drag components from the hardware catalog (View → Catalog if not visible) into the rack:
   1. SIMATIC 300 → RACK-300 → Rail (e.g. 6ES7390-1AE80-0AA0, 530 mm) → Slot 0.
   2. SIMATIC 300 → PS-300 → PS 307 5A (e.g. 6ES7307-1EA01-0AA0) → Slot 1.
   3. SIMATIC 300 → CPU-300 → CPU 317-2 DP → variant matching the actual hardware (e.g. 6ES7317-2AK14-0AB0 V3.x) → Slot 2.
   4. SIMATIC 300 → CP-300 → CP 343-1 → variant matching the actual hardware (e.g. 6GK7343-1EX30-0XE0) → Slot 4 (or first free communication slot).
7. Save and compile the configuration (Station → Save and Compile).

Configuring the CP 343-1 Ethernet Interface

1. Double-click the CP 343-1 in HW Config.
2. In the Properties dialog → Ethernet interface → click New to create a PROFINET IO System line.
3. Enter IP address parameters for the CP:
   • IP address: e.g. 192.168.0.1
   • Subnet mask: 255.255.255.0
   • Router address: leave blank unless a router is needed for cross-subnet diagnostics
4. Click OK. The CP 343-1 now has a virtual PROFINET IO System (PN-IO) line attached, ready to accept IO Devices.

The CP 343-1 also exposes a separate Ethernet interface that supports S7 communication, programming, and HMI traffic. By default, the same physical port serves both PROFINET IO and S7 communication. If separation is required (e.g. to isolate HMI traffic on a different VLAN), a managed switch with VLAN tagging is necessary - the CP 343-1 does not support VLAN tagging natively.

Installing the GSDML File for the LVDT Sensor

1. Obtain the GSDML file from the LVDT manufacturer's support portal. The file naming follows PROFINET convention:

   GSDML-Vx.x-yyyyyyyy-<vendor>-<device>-<YYYYMMDD>.xml

   Example: GSDML-V2.31-Balluff-BTL7_PNIO-20181015.xml. Accompanying bitmap files (.bmp) and any required language files should be in the same directory.
2. In HW Config: Options → Install GSD File...
3. Browse to the directory containing the GSDML file. STEP 7 parses the XML and any associated bitmap files from the same folder.
4. Click Install. After installation, the device appears in the hardware catalog under PROFINET IO → Additional Field Devices → <Vendor Name> → <Device Family>.
5. If HW Config was already open when the GSDML was installed, close and reopen HW Config to refresh the catalog.

Adding the LVDT Sensor to the PROFINET IO System

1. Drag the LVDT device from the hardware catalog onto the PROFINET IO system line in HW Config. The device icon appears at the end of the PN-IO line.
2. A PROFINET device slot - the Device Access Point (DAP) - is automatically inserted at Slot 0 of the device.
3. Double-click the LVDT icon → Properties → Ethernet:
   • IP address: e.g. 192.168.0.10
   • Subnet mask: 255.255.255.0
   • PROFINET device name: e.g. lvdtsensor1 (lowercase, no spaces, max 240 characters per PROFINET spec)
4. Insert the LVDT submodules from the catalog into slots 1, 2, etc. Typical LVDT slot configuration:
   • Slot 0: DAP (Device Access Point, mandatory)
   • Slot 1: Position Input (e.g. 4 bytes / 1 DINT - position scaled by 0.001 mm)
   • Slot 2: Status / Diagnostics Input (e.g. 2 bytes - quality code, alarm bits)
   • Slot 3 (optional): Parameter Module - no I/O but allows parameter assignment
5. STEP 7 automatically assigns input/output addresses (e.g. IW 100, ID 100, QW 110). Record these for the user program.
6. Save and compile (Station → Save and Compile).

Assigning the PROFINET Device Name and IP Address

The PROFINET device name is the unique identifier that the IO Controller uses to establish the Application Relationship (AR). Without a matching device name on the physical sensor, the IO Controller cannot start cyclic data exchange even if the IP address is correct.

1. In HW Config or SIMATIC Manager: PLC → Ethernet → Assign PROFINET Device Name.
2. In the Assign PROFINET Device Name dialog:
   • Select the PG/PC Ethernet interface connected to the network (e.g. Intel(R) Ethernet Connection...).
   • Click Update to scan accessible nodes via DCP (Discovery and Configuration Protocol). The discovered devices appear with their MAC addresses and types.
   • Select the LVDT sensor MAC address (printed on the device label or accessible via the device web server).
   • From the Device Name dropdown, select the name configured in HW Config (e.g. lvdtsensor1).
   • Click Assign Name. The CP 343-1 transmits the device name via DCP; the LVDT stores it in non-volatile memory.
3. Once the name is assigned, the IP address configured in HW Config is pushed to the device automatically when the IO Controller establishes the AR. To verify, scan again with PRONETA or browse to the LVDT IP in a web browser.

Per the Siemens TIA Portal V20 documentation on address and name assignments for PROFINET devices, all PROFINET IO devices within a network must carry a unique device name. The name is the basis for IP address assignment via DCP - when the IO Controller starts up, it locates the device by name and pushes the configured IP address automatically. Refer to the official Siemens documentation on address and name assignments for PROFINET devices for the full rule set.

For naming outside SIMATIC Manager (e.g. when commissioning multiple stations or replacing devices), the free Siemens PRONETA tool offers a graphical interface to scan, name, and assign IP addresses. PRONETA is downloadable from the Siemens Industry Online Support portal.

I/O Address Mapping and Reading the LVDT Value

After saving and compiling HW Config, the LVDT input and output modules appear in the S7 symbol/I/O table at the addresses STEP 7 assigned. The data layout depends entirely on the GSDML definition - the vendor specifies how position, status, alarms, and diagnostics are mapped to bytes.

The exact scaling is documented in the LVDT vendor manual and reflected in the GSDML record definition. Common scaling conventions:

• 0.001 mm: Position value of 12500 represents 12.500 mm.
• 0.0001 inch: Position value of 12500 represents 1.2500 in.
• Counts: Raw A/D counts with separate scaling factor provided by vendor.

Direct Access in OB1 (Non-Consistent Data, ≤ 4 Bytes)

For non-consistent input data (the default for submodules ≤ 4 bytes), direct load operations work and the values are refreshed by the S7-300 operating system at the start of OB1:

// STL example - read LVDT position into flag memory
L   IW 100          // Load position (16-bit INT)
T   MW 200          // Transfer to flag word

L   ID 100          // Load full 32-bit DINT position
T   MD 204          // Transfer to flag double word

L   IW 102          // Load status / quality word
T   MW 208          // Status available for diagnostics

Consistent Data Access with SFC14 / SFC15

If the vendor defines the submodule input as consistent over the entire submodule length (> 4 bytes or vendor-defined consistency), use SFC 14 (DPRD_DAT) and SFC 15 (DPWR_DAT) to read/write the data into a flag area in one atomic operation:

// Read LVDT input submodule (consistent over 8 bytes)
CALL "DPRD_DAT"
     LADDR    := W#16#64           // Logical base address (100 dec = 0x64 hex)
     RET_VAL  := MW 300            // Return value: 0 = OK; 80xx = error
     RECORD   := P#M 400.0 BYTE 8  // Destination: 8 bytes starting at MB 400

Common SFC 14 return codes (RET_VAL):

Output Writing with SFC 15

If the LVDT supports writes (preset, zero set, parameter switching), use SFC 15:

CALL "DPWR_DAT"
     LADDR    := W#16#6E           // Logical base address (110 dec = 0x6E hex)
     RECORD   := P#M 500.0 BYTE 4  // Source: 4 bytes from MB 500
     RET_VAL  := MW 310            // Return value

Acyclic Data Exchange with FB125 (PNIO_IN) and FB126 (PNIO_OUT)

For acyclic parameter access (read/write individual records such as calibration data, serial number, or operating hours), STEP 7 V5.5 provides FB125 (PNIO_IN) for reading and FB126 (PNIO_OUT) for writing. These blocks are part of the standard STEP 7 library but must be imported from the SIMATIC_NET_CP library if not already present in the project.

1. Open the project library: SIMATIC_NET_CP → CP 300 → Blocks or copy from a reference project.
2. Drag FB125 (PNIO_IN) and FB126 (PNIO_OUT) into the project Blocks folder.
3. Create an instance DB (e.g. DB100 - PNIO_Instance) to hold the FB instances.
4. Call the FB from OB1 or a dedicated OB (e.g. OB100 for startup, OB35 for cyclic at 100 ms).

Typical FB125 call (read record index 0xAFF0 - vendor-specific parameter from LVDT slot 1):

CALL "PNIO_IN" , DB100
     REQ      := M 50.0             // Trigger read on rising edge
     IOID     := B#16#0             // 0 = input slot
     LADDR    := W#16#64            // Logical address 100
     SLOT     := 1                  // Slot 1 of the LVDT
     INDEX    := W#16#AFF0          // Record index
     LEN      := 32                 // Max record length
     BUSY     := M 50.1             // Operation in progress
     DONE     := M 50.2             // Done flag
     ERROR    := M 50.3             // Error flag
     STATUS   := MW 52              // Status / error code
     RECORD   := P#M 1000.0 BYTE 32 // Destination buffer

Refer to the SIMATIC NET PROFINET Programming Manual for the complete FB125/FB126 interface description and error code reference. Many LVDT vendors (Balluff, ifm, Pepperl+Fuchs) also supply ready-made function blocks that use FB125/FB126 internally for preset, zero-set, and teach-in functions; check the vendor's product support page.

Update Time, Reduction Ratio, and Watchdog

Open the CP 343-1 properties → PROFINET IO → Update Time. The following settings determine how often the IO Controller exchanges data with the IO Devices:

For LVDT displacement sensors, an update time of 1-10 ms is typical. Setting 1 ms on a sensor with 10 ms internal cycle wastes bandwidth and may trigger AR re-establishment if the sensor cannot keep up. Match the update time to the sensor's fastest published cycle time. Watchdog time should remain at the default 3 unless the application has specific reliability requirements.

Verification, Online Diagnostics, and LED Reference

1. Compile and save the project (Station → Save and Compile). Confirm no errors in the dialog.
2. Download HW Config to the CPU (PLC → Download to Target Station → Selected CPU). The CP 343-1 configuration is part of HW Config and is downloaded with the CPU.
3. Place the CPU in RUN. The CP 343-1 starts as the IO Controller and begins AR establishment with the configured IO Devices.
4. Go Online (PLC → Connect to Target System). In HW Config, the LVDT icon should show:
   • Green checkmark on slots → Cyclic IO is running.
   • Yellow triangle → Slot configured but not active (e.g. optional slot not physically present).
   • Red X → No connection / device not found / configuration mismatch.
5. Open the diagnostic buffer of the CPU (PLC → Module Information → Diagnostic Buffer) for PROFINET-related events such as "Station failure", "AR established", "AR released", or "Submodule mismatch".
6. Open a VAT (Variable Table) and monitor the LVDT input addresses (e.g. IW 100) online. Move the LVDT core and observe the position value change.
7. Modern PROFINET devices also expose a web server. Enter the LVDT IP address in a web browser (after connecting PG/PC to the same subnet) to access vendor-specific diagnostics, parameter setting, and live values.

CP 343-1 LED Status Reference

CP 343-1 Firmware Update

If the CP 343-1 firmware is older than required for current GSDML versions or for IO Controller role support, perform a firmware update via SIMATIC Manager:

1. Download the latest firmware package from the Siemens Industry Online Support portal. The file is typically a .upd archive.
2. Connect the PG/PC to the CP 343-1 Ethernet interface directly or via the same network.
3. SIMATIC Manager → PLC → Update Firmware. Browse to the .upd file.
4. Select the CP 343-1 as the target module. Click Run Update.
5. During the update, the CP 343-1 RUN LED flashes. Do not power-cycle. Update takes 1-3 minutes.
6. After the update, the CP restarts. Re-download HW Config to activate the new firmware features.

Troubleshooting Matrix

Field-Proven Caveats

• Device name persistence: PROFINET device names are stored in non-volatile memory on the device. After a successful assignment, re-assignment is only required after a factory reset, replacement, or firmware update that clears NVRAM.
• IP vs device name: During configuration, the IO Controller uses the device name to establish the AR. The IP address is then assigned automatically by the IO Controller via DCP at AR setup. Some LVDT vendors, however, ship sensors with a static IP and require manual IP configuration before commissioning - consult the vendor quick-start guide.
• Topology editor in STEP 7 V5.5: SIMATIC Manager V5.5 includes a topology editor accessible via HW Config → right-click PROFINET port → PROFINET IO Topology. For simple star topologies, manual port-to-port assignment is not required, but it is recommended for diagnostic clarity in cabinet documentation.
• GSDML version compatibility: S7-300 / STEP 7 V5.5 supports GSDML V2.0 and later. Some newer sensors ship with GSDML V2.4+; backward compatibility is generally maintained. If a sensor with GSDML V2.4 cannot be installed, request a V2.31 GSDML from the vendor.
• Replacement procedure: When replacing a faulty LVDT with an identical model, the device name can be transferred from the old unit to the new one via PRONETA (free Siemens tool) without re-engineering the SIMATIC Manager project. This is the standard "device replacement without exchangeable media" workflow.
• CPU 317-2 DP variants: Not all CPU 317-2 DP variants support the same maximum number of CP modules or same K-bus bandwidth. When using multiple CPs (e.g. CP 343-1 + CP 341 RS232), verify the CPU firmware supports the required number of communication jobs. For typical single-CP installations, the CPU 317-2 DP at firmware V3.x is fully adequate.
• STEP 7 V5.5 service packs: GSDML support has been expanded across V5.5 service packs. SP2 added initial GSDML V2.x support; later SPs and HF (hotfix) packages added specific GSDML revisions. Install the latest service pack + hotfix available to maximize vendor compatibility.
• Vendor FB for parameterization: Many LVDT vendors (Balluff, ifm, Pepperl+Fuchs) supply ready-made function blocks for preset, zero-set, and teach-in functions. These FBs use FB125/FB126 internally and simplify the user program. Download them from the vendor product support page when available.

Integration with External PROFINET Controllers (Reference)

Some PROFINET-capable LVDT feedback sensors are paired with third-party motion controllers (e.g. Delta RMC) for closed-loop hydraulic or pneumatic position control. The RMC CPU exposes its own PROFINET interface; configuration from RMCtools parallels the S7-300 procedure but uses the RMC GSDML on the Siemens side. When the S7-300 is the higher-level PLC coordinating multiple RMC controllers over PROFINET, the procedure in this article applies with the RMC as the IO Device. See the Delta Motion documentation on using Siemens S7 PLCs via PROFINET for the controller-side counterpart to this procedure.

FAQ