Configuring Siemens ET 200S 1SI for PROFINET to Modbus RTU

Overview

Integrating Modbus RTU field devices into a Siemens PROFINET architecture is a recurring requirement on plant retrofits, brownfield expansions, and mixed-vendor skids. The classic hardware path uses the SIMATIC ET 200S distributed I/O with the 1SI serial interface module (6ES7138-4DF11-0AB0) plugged into an ET 200S PROFINET station that is controlled by an S7-300 CPU such as the CPU 315-2PN/DP (6ES7315-2EH14-0AB0). The 1SI module converts the PROFINET-side slot I/O into an RS-232/RS-422/RS-485 channel capable of running either Modbus RTU master or Modbus RTU slave on a single 15 mm-wide electronic module.

This article walks through the engineering steps required to land Modbus RTU traffic on an ET 200S PROFINET network with two CPU 315-2PN/DP controllers and fourteen ET 200S stations. It covers hardware selection, GSD-based configuration in STEP 7 / TIA Portal, the Modbus function block (FB) layer, RS-485 wiring, and verification. Alternative gateway products (ProSoft, HMS Anybus, Advantech, Moxa) are summarised for projects where a slot-based solution is not desirable.

Prerequisites

• CPU: SIMATIC S7-300 CPU 315-2PN/DP (firmware V3.3 or higher recommended for PROFINET IO with ET 200S PN). Refer to the CPU 31x-2 PN/DP manual entry on the Siemens Support Portal.
• PROFINET interface module: ET 200S IM 151-3PN (for example 6ES7151-3BA60-0AB0) for each distributed station. The IM provides PROFINET IO Device functionality.
• Serial module: ET 200S electronic module 1SI, order number 6ES7138-4DF11-0AB0 (1-channel RS-232/422/485, supports Modbus RTU master/slave and USS).
• Software: STEP 7 V5.5 + SP2 or TIA Portal V13 SP1 / V14 / V15 / V16 (depending on CPU firmware). The Modbus sample program (zXX21_11_1SI_MODBUS.zip) targets STEP 7 V5.5 and is mirrored for TIA Portal.
• Documentation: SIMATIC ET 200S Serial Interface Modules manual and the sample program for ET 200S 1SI MODBUS.
• Wiring: Twisted-pair shielded cable, terminating resistors (120 Ω), and a defined RS-485 bus topology with biasing.

Hardware Architecture

The architecture described in the original request places two S7-300 CPU 315-2PN/DP controllers on the same PROFINET network with fourteen ET 200S stations. To add a Modbus RTU segment, an ET 200S station equipped with the 1SI module is treated as a normal PROFINET IO Device. The 1SI module occupies one slot in the ET 200S backplane, and the IM 151-3PN exposes its I/O data to the PROFINET controller as input/output bytes. From the CPU's perspective, the Modbus RTU traffic is then handled by loading Modbus FBs that read/write those I/O bytes.

For projects with multiple Modbus slaves (drives, energy meters, weigh scales, third-party PLCs), several 1SI modules can be distributed across the ET 200S stations. Each station's 1SI module uses an independent RS-485 bus. If a single bus segment must reach all slaves, use only one 1SI on the same ET 200S station as the PROFINET connection.

Hardware Configuration of the ET 200S 1SI Module

The 1SI module appears in the STEP 7 / TIA Portal hardware catalogue under ET 200S > Serial Interface > 1SI 3964/ASCII/USS-MODBUS. When dropped onto a free slot in the ET 200S rack, the IO controller automatically allocates 8 bytes of input and 8 bytes of output for parameter / control data. The slot can be modified but it must be unique inside the ET 200S station.

Module Parameters

Activate the diagnostic interrupt so that the CPU enters OB82 on a 1SI fault (broken wire, parity overrun, buffer overflow). This is critical in plants where the PROFINET scanner otherwise would not detect a silent serial failure.

PROFINET Device Naming

Each IM 151-3PN is identified on the PROFINET network by its device name. The 1SI module inherits the parent station's PROFINET device name. After loading the HW Config, assign the device name via:

1. Open Online > Accessible Nodes in STEP 7 / Online > Accessible Devices in TIA Portal.
2. Select the IM 151-3PN MAC.
3. Right-click and choose Assign PROFINET Device Name.
4. Confirm the configured name (must match the HW Config project).

Modbus Function Block Layer

The 1SI module does not interpret Modbus frames itself; it transparently buffers raw serial bytes to the IO controller. Modbus RTU framing (CRC, address byte, function codes, PDU) is performed by FBs running in the S7-300 CPU. Siemens publishes reference Modbus FBs for ET 200S 1SI inside the sample project zXX21_11_1SI_MODBUS.zip, available at Siemens support entry 99742035.

FB Library (STEP 7 V5.5, classic example)

Supported Modbus Function Codes

Example: Master FC 03 Read Holding Register (SCL / Structured Text)

// Inputs (symbolic)
i_StartRequest    : BOOL;   // Trigger read
i_w_SlaveAddress  : WORD;   // 1..247
i_w_StartReg      : WORD;   // Modbus address (0-based)
i_w_Quantity      : WORD;   // Number of registers 1..125

// Outputs\oq_bBusy           : BOOL;
q_bDone           : BOOL;
q_bError          : BOOL;
q_w_Status        : WORD;
q_w_Data          : ARRAY[1..125] OF WORD;

// Instance: "MB_MASTER_DB" of FB_MB_MASTER
// Call sequence (cyclic OB1 + watchdog in OB35):
IF i_StartRequest AND NOT q_bBusy THEN
    MB_MASTER_DB(REQ       := TRUE,
                 SlaveAddr := i_w_SlaveAddress,
                 FuncCode  := WORD#16#03,
                 StartAddr := i_w_StartReg,
                 Quantity  := i_w_Quantity,
                 DataBuf   := q_w_Data,
                 Busy      => q_bBusy,
                 Done      => q_bDone,
                 Error     => q_bError,
                 Status    => q_w_Status);
ELSE
    MB_MASTER_DB(REQ := FALSE,
                 SlaveAddr := 1,
                 FuncCode  := 0,
                 StartAddr := 0,
                 Quantity  := 0,
                 DataBuf   := q_w_Data,
                 Busy      => q_bBusy,
                 Done      => q_bDone,
                 Error     => q_bError,
                 Status    => q_w_Status);
END_IF;

State handling is sequential: poll Busy until Done or Error. Typical Modbus turn-around on RS-485 at 19200 bit/s with 8 registers is 25-60 ms including the inter-frame gap. Avoid stacking requests on the same bus until Done is set.

OB / Execution Cycle

Place the master FB call in OB1 if the Modbus cycle can tolerate the scan time, or in a timed interrupt such as OB35 (default 100 ms) for deterministic polling. For 14 ET 200S stations sharing the PROFINET network, offloading time-critical Modbus loops to OB35 keeps OB1 short. Always enable OB82 (diagnostic interrupt) and OB85 (I/O access error) so the CPU does not enter STOP if the 1SI temporarily loses PROFINET connectivity.

RS-485 Wiring and Topology

Modbus RTU over RS-485 requires a single twisted-pair daisy-chain (no star), shielded cable with characteristic impedance ~120 Ω. The 1SI module exposes terminals A, B, and shield on its front connector. For 2-wire (half-duplex) Modbus, A and B are used for transmit and receive; for 4-wire (full-duplex) variants, separate TX and RX pairs apply.

Termination and Bias

Configuration Procedure (STEP 7 V5.5)

1. Insert the S7-300 station with the CPU 315-2PN/DP and create a PROFINET subnet (e.g. PN/IO_1).
2. Insert fourteen ET 200S stations from the hardware catalogue, each with an IM 151-3PN. Connect every IM to PN/IO_1 and assign a unique PROFINET device name (e.g. et200s_1...et200s_14).
3. In one (or more) ET 200S stations, insert the 1SI 3964/ASCII/USS-MODBUS electronic module into a free slot.
4. Open the 1SI properties: select protocol MODBUS Master, baud rate, parity, stop bits. Enable diagnostic interrupt.
5. Compile and download the HW Config.
6. Open the sample project zXX21_11_1SI_MODBUS.zip and copy the Modbus FBs and DBs into your S7 program.
7. Wire the master FB instance DB to the symbolic I/O of the 1SI slot.
8. Compile, download, and run a CPU restart (OB100).
9. Assign the PROFINET device name with the Online interface.
10. Place the 1SI module online in the device view and check status OK.

Configuration Procedure (TIA Portal)

1. Add the S7-300 CPU 315-2PN/DP from the catalogue. Ensure the firmware version is supported by the TIA Portal release.
2. Add the ET 200S PN station, select the IM 151-3PN, then drag the 1SI module onto the slot table.
3. In the 1SI properties, configure protocol = Modbus Master, baud, parity, data bits, stop bits, response timeout.
4. Open the project library and import the TIA Portal version of the Modbus sample (also available inside support entry 99742035).
5. Adapt the FB call interface to the symbolic address of the 1SI input/output bytes.
6. Compile, download, and assign device names through the Online & Diagnostics view.

Alternative Gateways

If a slot-based approach is undesirable (cabinet space, fewer spare slots, hot-swap constraints), an external protocol gateway can replace the 1SI module and present the Modbus data on PROFINET as a regular IO Device. Several vendors ship PROFINET-IO-Device — Modbus Serial gateways:

With a gateway, the PROFINET controller sees a virtual ET 200S-like IO Device. Modbus registers are mapped 1:1 to PROFINET slots. Engineering effort shifts from FBs to gateway configuration (typically a web UI), and diagnostic interrupt behaviour is owned by the gateway, not by STEP 7.

Verification

1. PROFINET online diagnostics: In STEP 7 / TIA, open Online & Diagnostics on the IM 151-3PN. Status must read OK, no maintenance events.
2. 1SI module diagnostics: In the device view, right-click the 1SI module → Online & Diagnostics. Confirm No fault; if a fault is reported, the diagnostic buffer gives the cause (e.g. parameter error, frame error, break).
3. OB82 entry: Briefly disconnect the RS-485 bus to trigger a diagnostic interrupt. The CPU must call OB82 without going to STOP. Reconnect and verify OB82 executes again with the "outgoing" event.
4. Loop-back test: With no slave connected, jumper A-B at the 1SI terminals with a 120 Ω resistor and route the master's echo request to itself by configuring the slave address to the master's own address where the FB allows. Observe Done = TRUE on the read.
5. Slave roundtrip: With one Modbus RTU slave on the desk, perform FC 03 on a known register (e.g. holding register 0x0000) and verify the value matches the slave's documentation.
6. Cycle timing: With a logic analyser on A/B, capture the inter-frame delay and confirm it matches the configured 3.5 character times. The Modbus standard mandates this gap.
7. CPU load: Monitor OB1 scan time with the time-of-day clock diagnostic. Keep the OB1 extension under 5 ms to avoid jitter on PROFINET IRT.

Troubleshooting Matrix

Performance and Timing Notes

At 19200 bit/s with 8N1, one Modbus RTU byte requires ~520 µs. A FC 03 read of ten registers (8 bytes request + 25 bytes response) takes roughly 17 ms of pure serial time. Adding inter-frame gap and CPU-side scheduling, a typical polling cycle on a single 1SI master is 30-50 ms. If the application polls 20 slaves on the same bus, full sweep times around 600 ms to 1 s are realistic; spread slaves across multiple 1SI modules on different PROFINET stations to parallelise.

Safety and EMC Considerations

• Route the RS-485 cable in a separate tray from PROFINET, power, and VFD output cables. Maintain at least 200 mm separation.
• Ground the shield at the cabinet entry panel only; do not double-ground.
• When connecting to variable-frequency drives, install a fibre or RS-485 isolator on the 1SI port to break common-mode loops between the PROFINET ground and the drive ground.
• Use SELV / PELV power for the 1SI module. The 24 V supply should be fused at 2 A.

FAQ