Configuring SIMOTION to S7 PROFINET I-Device PZD Communication

Overview: Coupling SIMOTION to SIMATIC S7

SIMOTION is Siemens' motion-control PLC platform. It does not use Datenbausteine (DBs) the way SIMATIC S7 does, and it has no fixed control word / status word bit pattern in the PROFIdrive sense. Instead, SIMOTION exposes its peripheral slots as plain process images (binary/byte/word I/O) that the application program reads and writes. S7 controllers (for example a CPU 319F-3 PN/DP) communicate with SIMOTION by exchanging this process image with their own DBs using one of the following mechanisms:

• PROFINET I-Device (also called I-Slave in older documentation) – the recommended method when both controllers are PROFINET-capable. The SIMOTION is configured as an I-Device on the same PN subnet; S7 uses SFC14 / SFC15 to read/write the transferred slots.
• PROFIBUS DP Slave – for legacy CPUs without PROFINET. The SIMOTION acts as a DP slave and exposes its I/O via slots. S7 uses SFC14 / SFC15 against the DP master interface.
• TCP / UDP / ISO-on-TCP via the SIMOTION _receive/_send blocks – useful for slow, non-deterministic handshakes; not recommended for axis control words.
• OPC UA on SIMOTION V4.5+ – for SCADA/MES data exchange, not for hard-realtime axis control.

The remainder of this document focuses on the PROFINET I-Device path, which is the most commonly deployed configuration for the Hoist / Gantry / Trolley axis families referenced in typical crane, hoist, and port-crane SIMOTION projects.

Terminology: PZD, PCD, and I-Device Slots

Engineers coming from SINAMICS drives (S120, G120) expect a fixed PZD (Prozessdaten) structure with control word 1 (STW1) and status word 1 (ZSW1). With SIMOTION the equivalent construct is the transfer area configured in HW Config and exposed as a SIMOTION address:

For a CPU 319F-3 PN/DP sending, for example, DB213.DBW36 as a Hoist-1 control word, the data path is:

1. DB213.DBW36 in the S7 user program (any value, any structure).
2. Copied to a configured output transfer area via SFC15 (DPDAT, DPWR_DAT).
3. Transported over PROFINET to the SIMOTION's transfer area input address (e.g. %IW100).
4. The SIMOTION program copies %IW100 into a structure the axis technology object can interpret, or drives the technology object directly.
5. The reverse path (status, position, current) travels back the same way to DB213.DBWx in the S7.

Prerequisites

• SIMATIC STEP 7 V5.5 + SP4 or later (SIMATIC Manager) with the SIMOTION option package installed, or TIA Portal V15.1+ with the SIMOTION V5.4+ HSP.
• SIMOTION SCOUT or SCOUT TIA V5.4 / V5.5 SP1+.
• A SIMOTION controller with PROFINET interface (D4x5, D4x5-2, C240 PN, P320-4, etc.). The PROFINET interface firmware must be at least V2.2 for full I-Device support; V2.6 is recommended.
• A SIMATIC CPU with PROFINET controller capability (S7-300 CPU 31x PN/DP, CPU 319F-3 PN/DP, S7-1500, ET 200S CPU).
• GSDML file for the SIMOTION exported from SCOUT (for the S7 side) and a GSDML for the S7 exported from STEP 7 (for the SIMOTION side), or use the I-Device wizard which auto-generates them.
• Familiarity with the SIMOTION axis technology objects TO_ServoAxis, TO_SpeedAxis, or TO_SynchronousAxis used by the Hoist, Gantry, and Trolley axes.

Step 1: Configure the SIMOTION as an I-Device (PROFINET)

Open the SIMOTION project in SCOUT, expand the SIMOTION device, right-click the PROFINET interface and select Properties → PROFINET IO → I-Device. Enable the role I-Device and define the transfer areas.

Typical transfer areas for a 3-axis crane application:

The PROFINET device name must be unique on the subnet. For an I-Device that will be wired into a higher-level S7 PROFINET, use a name like simotion-hoist1. Make sure the PROFINET device number is in the range 1..255 and matches the HW Config on the S7 side.

Export the SIMOTION as a GSDML via Options → Export GSDML. Import this GSDML into STEP 7 (or TIA Portal) on the S7 side.

Step 2: Configure the S7 Side and Insert the SIMOTION GSD

In the S7 project (example: CPU 319F-3 PN/DP, order number 6ES7318-3FL01-0AB0), open the PROFINET IO system on the PN interface, install the SIMOTION GSD, and drag the SIMOTION as an IO device. Insert the same number of slots with the same lengths as defined in step 1:

These are physical PROFINET I/O addresses, not the DB addresses that the S7 application uses. Application code must always read/write these addresses with SFC14 (DPRD_DAT) and SFC15 (DPWR_DAT) when consistency is > 1 byte, which is the default for SIMOTION transfer areas.

Step 3: S7 Program — Reading and Writing the Transfer Areas

Create a DB (e.g. DB213) in the S7 that holds the user-meaningful tags. The mapping between the user's DB and the physical PROFINET addresses is performed in OB1 (or a cyclic OB) using SFC14 / SFC15.

DB213 layout (Hoist-1 example)

DATA_BLOCK DB213
TITLE = 'Hoist_1_Interface'
VERSION : 0.1
  STRUCT
    ControlWord   : WORD;    // DBW0   -- STW1-style bits
    SetpointSpeed : INT;     // DBW2   -- n-set, RPM/100
    SetpointPos   : DINT;    // DBW4   -- position, 1 = 0.1 mm
    Mode          : BYTE;    // DBB8   -- 0=manual, 1=auto, 2=jog
    EnableBits    : BYTE;    // DBB9   -- bit0=on, bit1=reset, bit2=home
    Reserved      : ARRAY[0..5] OF BYTE; // DBB10..DBB15
  END_STRUCT;
END_DATA_BLOCK

OB1 — sending to SIMOTION (Hoist-1 control word)

// Slot 0: write 16 bytes to PROFINET address 256..271 (Hoist-1 CW)
CALL SFC15  // DPWR_DAT
   LADDR  := W#16#100   // 256 decimal = 0x100 (Q-address start of slot 0)
   RECORD := P#DB213.DBX0 BYTE 16
   RET_VAL:= MW100

// Optional: check for errors
L     MW100
L     0
<>I
S     M101.0   // SFC15 error flag, latch into DB213 enable bits later

The RECORD pointer P#DB213.DBX0 BYTE 16 covers DBW0..DBW14 which is the ControlWord (DBW0), SetpointSpeed (DBW2), SetpointPos (DBW4..DBW7), Mode (DBB8), EnableBits (DBB9), and 6 bytes of reserved padding to keep the slot consistent at 16 bytes.

OB1 — reading status from SIMOTION

// Slot 3: read 32 bytes from PROFINET address 256..287
CALL SFC14  // DPRD_DAT
   LADDR  := W#16#100   // 256 decimal = 0x100 (I-address start of slot 3)
   RET_VAL:= MW102
   RECORD := P#DB214.DBX0 BYTE 32

DB214 should be defined to mirror the 32-byte status block. The first 8 bytes typically hold a StatusWord (mirroring the S7 ControlWord bits), ActualSpeed (INT, RPM/100), and ActualPosition (DINT, 0.1 mm). The remaining 24 bytes are available for diagnostics, error code, warning bits, axis state, and lifetime counters.

Step 4: SIMOTION Program — Bridging Transfer Area to Axis Technology Object

SIMOTION is programmed in one of three languages: LAD/FBD, ST (Structured Text), or MCC (Motion Control Chart). ST is the most common for I/O bridging because the assignment to technology object commands is direct. Create a program organization unit (POU) in the BackgroundTask or in a CyclicTask tied to the PROFINET send clock (default 1 ms; 2 ms is more common in practice for I-Device links).

ST example: Hoist-1 axis command assignment

// Hoist_1 interface -- mapping incoming control word from %IB0..%IB15
// into the technology object Hoist_1 (TO_ServoAxis)

VAR
    cwHoist1   : WORD;       // local copy of %IB0..%IB1
    nSetHoist  : INT;        // local copy of %IB2..%IB3
    posSetHoist: DINT;       // local copy of %IB4..%IB7
    bModeAuto  : BOOL;       // bit from %IB8.0
END_VAR

// 1) snapshot the transfer area into local vars (atomic read of a WORD is fine;
//    for DINT do it as a single move; PROFINET updates the entire slot in 1 cycle)
cwHoist1    := %IW0;        // bytes 0..1 from the I-Device slot
nSetHoist   := %IW2;        // bytes 2..3
posSetHoist := %ID4;        // bytes 4..7 (DINT)
bModeAuto   := %IX8.0;

// 2) hoist enable logic
IF (cwHoist1 AND W#16#0001) <> 0 AND bModeAuto THEN
    _enable(Hoist_1);                   // axis enable
ELSE
    _disable(Hoist_1);
END_IF;

// 3) reset
IF (cwHoist1 AND W#16#0002) <> 0 THEN
    _resetAxis(Hoist_1);                // acknowledge error
END_IF;

// 4) speed / position command
IF (cwHoist1 AND W#16#0004) <> 0 THEN
    _move(Hoist_1, posSetHoist);        // absolute positioning
ELSE
    _run(Hoist_1, nSetHoist);           // open-loop speed mode (signed RPM/100)
END_IF;

// 5) send status back: write local I/O before PROFINET ships it
%QB0  := 16#0FFF;                        // ready + enabled + at-standstill
%QW2  := INT_TO_WORD(_actualSpeed(Hoist_1));
%QD4  := _actualPosition(Hoist_1);      // 0.1 mm
%QB8  := _axisState(Hoist_1);           // state enum
%QB9  := _axisErrorState(Hoist_1);      // 0=no error

The Hoist-1 control word bits are interpreted by the SIMOTION program, not by a drive. The mapping table on the SIMOTION side is application-specific, but a typical 16-bit layout for a crane Hoist axis is:

The Gantry and Trolley axes use the same pattern on slots 1 and 2 respectively, just with different axis technology object names and different bit assignments. The Gantry axis typically has synchronization bits; the Trolley axis has creep speed and cross-travel limit bits.

Step 5: Downloading and Going Online

1. Compile and download the SIMOTION project (target system flash + RAM). On the SIMOTION, the new I-Device configuration becomes active only after a power cycle or a PROFINET reconfiguration triggered from SCOUT.
2. Compile and download the S7 project. The PROFINET IO system must come up; the SIMOTION device should appear as a "partner" with green LEDs on the S7 CPU's PN port.
3. In SCOUT, go online and open the I/O Diagnostics view. Confirm that all configured slots show OK and that cyclic data is updating (force a value in DB213.DBW0 and watch %IB0 in SCOUT).
4. In STEP 7, place a VAT (variable table) on DB213 and DB214. Force a value, then run the SIMOTION program in single-step or with a watch table of axis commands to confirm motion.

Verification Checklist

Error Codes and Diagnostics

PROFINET diagnostic interrupts that frequently appear in this scenario:

• 0x001C — Station failure: SIMOTION name or IP mismatch; check topology in STEP 7.
• 0x001E — Station ok: recovery from a previous failure.
• 0x0103 — Manufacturer-specific diagnostic: the SIMOTION's PN stack detected a slot mismatch; verify that the SCOUT-exported GSDML version matches the firmware in the field.
• 0x8000..0x8FFF: extended channel diagnostic; the SIMOTION's slot-level diagnostic buffer (in SCOUT → Diagnostics → PROFINET) gives the human-readable cause.

Troubleshooting Matrix

Performance and Timing Notes

The latency from a S7 L DB213.DBW0 / T DB213.DBW0 followed by SFC15 to the corresponding SIMOTION %IB0 change is bounded by the PROFINET send clock (Tsnd) plus one full cycle of the SIMOTION task that polls the I/O. With typical settings of Tsnd = 1 ms and the SIMOTION POU in a 1 ms IPO/IPOSyncTask, end-to-end latency is 1.5 to 2.5 ms. With Tsnd = 2 ms (recommended for I-Device with cable lengths > 50 m) and a 4 ms SIMOTION task, latency rises to 5…6 ms.

If the application needs IRT (isochronous real-time) — for example, position-controlled gantry synchronization with < 1 ms jitter — the PROFINET interface on both controllers must be configured for IRT, the SIMOTION POU must run in the IPO_SynchronousTask, and the SIMOTION PROFINET stack firmware must be V2.6 or later. The S7 side is straightforward in HW Config: set the IO device to "IRT" mode in the PROFINET interface properties.

Migrating from PROFIBUS DP Slave to PROFINET I-Device

Many existing crane installations use PROFIBUS DP with the SIMOTION configured as a DP slave. The SFC14 / SFC15 calls in OB1 are identical; only the addressing changes (PROFIBUS diagnostic addresses 1023+ on the master; PROFINET slot I/O addresses on the PN interface). To migrate:

1. Export the PROFIBUS GSD from SCOUT; keep it for reference.
2. In SCOUT, change the SIMOTION interface to PROFINET and re-define the transfer areas with the same byte counts.
3. Re-export the PROFINET GSDML.
4. In STEP 7, replace the DP slave entry with the PROFINET IO device entry, keeping the same S7 application code; the only edit is the LADDR parameters of SFC14/15.

Field-Commissioning Caveats

• Always set a unique PROFINET device name on the SIMOTION. Two SIMOTIONs on the same subnet with the default "simotion" name will produce intermittent station-failure diagnostics.
• If the SIMOTION is also acting as a PROFINET controller to its own distributed I/O (e.g. ET 200SP on the same subnet), the I-Device transfer areas must use a dedicated port range; do not overlap the controller and I-Device slot ranges.
• PROFINET send clocks must be harmonized. S7 CPUs of the 31x family default to 1 ms; the SIMOTION D4x5-2 family supports 0.25/0.5/1/2/4 ms. Choose the highest common value accepted by both.
• For F-CPU configurations (CPU 319F-3 PN/DP), the safety-related PROFINET profile (PROFIsafe) is independent of the I-Device transfer areas. Do not put safety data into the I-Device transfer area; use a separate PROFIsafe slot. Mixing them violates SIL 2/3 architecture rules.

Frequently Asked Questions