Connecting S7-400 PCS 7 to ControlLogix via PROFINET/EtherNet/IP

1. Integration Scope

This reference covers the engineering steps required to bridge a SIMATIC PCS 7 automation system based on an S7-400 CPU 417-4 (AS 410) to an Allen-Bradley ControlLogix controller over Ethernet using a third-party PROFINET IO Device ↔ EtherNet/IP gateway. It clarifies the role of the PCS 7 plant bus versus terminal bus, the relationship between Industrial Ethernet and PROFINET, the required hardware, the GSD/EDS file handling, the cyclic data sizing rules, and the diagnostic indicators you must verify on both sides.

Reference architecture assumed:

• SIMATIC PCS 7 V9.0 SPx (also applies to V8.2) on an AS 410 station
• S7-400 CPU 417-4, e.g., 6ES7417-4HT14-0AB0 with the integrated PROFINET interface (X1 / X2) enabled
• Engineering Station and OS Server on the terminal bus; AS stations and field I/O on the plant bus
• Allen-Bradley ControlLogix chassis, e.g., 1756-L82E or 1756-L85E (firmware V32+), communicating via a 1756-EN4TR or built-in EtherNet/IP port
• A PROFINET IO Device ↔ EtherNet/IP gateway such as HMS Anybus X-gateway, ProSoft PLX31-PN-EIP, Phoenix Contact FL EPL GW-PN, or Wago 750-365

2. Prerequisites

2.1 Hardware

2.2 Software

2.3 Files

• GSD (or GSDML) file for the gateway — PROFINET IO Device description
• EDS file (or AOI/profile) for the gateway — EtherNet/IP adapter/scanner description
• PCS 7 library references (APL blocks) for the I/O channels if mapping through PCS 7

3. PCS 7 Network Architecture: Plant Bus vs Terminal Bus

PCS 7 defines two Ethernet domains:

• Terminal Bus — Connects OS servers, OS clients, the Engineering Station, the Maintenance Station, and SIMATIC BATCH/Route Control. Traffic is primarily WinCC, BATCH, and engineering. It does not carry AS-to-AS or AS-to-IO data.
• Plant Bus (System Bus, AS bus) — Carries S7 connections between AS stations, the WinCC channel from the OS server to the AS, and the PROFINET IO of the S7-400. In PCS 7 V9, the plant bus is the subnet where the S7-400 integrated PROFINET interface operates.

The plant bus is the correct place to attach a PROFINET IO Device. If the ControlLogix is on a separate EtherNet/IP cell, place a routed/firewalled L3 boundary between the plant bus and the EtherNet/IP network. Open only the following UDP/TCP services:

4. Industrial Ethernet, PROFINET, and EtherNet/IP

Siemens uses Industrial Ethernet as the umbrella term for any Ethernet-based protocol in the SIMATIC world:

• PROFINET IO (real-time I/O per PROFIBUS & PROFINET International)
• PROFINET CBA (legacy component-based automation)
• S7 communication (PUT/GET, BSEND/BRCV, ISO-on-TCP, S7 connections)
• Standard TCP/IP, UDP, SNMP, etc.

PROFINET is a specific real-time protocol that uses Ethernet Layer 2 frames with EtherType 0x8892 and PROFINET IO context manager on UDP 34964. PROFINET IO defines three roles:

• IO Controller — the S7-400 CPU 417-4 in this scenario
• IO Device — the gateway (PROFINET side)
• IO Supervisor — STEP 7 / TIA Portal (diagnostics, assignment)

EtherNet/IP is the CIP-on-Ethernet stack from ODVA. It uses TCP/UDP 44818 for explicit messaging and UDP 2222 for I/O multicast. The gateway terminates PROFINET IO cyclic data and initiates CIP Class 1 connections to/from the ControlLogix.

5. Gateway Selection and Topology

Gateway categories:

• PROFINET IO Device ↔ EtherNet/IP Adapter — ControlLogix acts as the scanner; gateway is the slave.
• PROFINET IO Device ↔ EtherNet/IP Scanner — S7-400 sends to gateway, gateway polls ControlLogix.
• Dual-role gateways (configurable per direction).

Reference topology (PROFINET line with optional MRP, EtherNet/IP star or DLR):

6. Configuring the S7-400 as PROFINET IO Controller

6.1 SIMATIC Manager / STEP 7 V5.6

1. Open the S7-400 station in HW Config. Right-click the CPU → Object Properties → Interface → confirm PROFINET IO is enabled on the integrated port.
2. Right-click the PROFINET IO System line → Add IO Device. If the gateway is not in the catalog, choose Options → Install GSD File and import the GSDML provided by the gateway vendor.
3. Drag the gateway to the PROFINET IO System. Assign:
   • IP address, e.g., 192.168.10.50 / 255.255.255.0
   • PROFINET device name (must match the DCP name assigned on the gateway physical port)
   • Update time, e.g., 1 ms for RT class 1; 250 µs for IRT class 3
4. Configure the gateway's IO slots. Most gateways expose one input and one output submodule of fixed size. Example mapping:
   • Slot 0 / Subslot 1 — Input, 32 bytes → IB 100..131
   • Slot 0 / Subslot 2 — Output, 32 bytes → QB 200..231
5. Compile and download to the CPU. Verify the gateway transitions to Connected in the online PROFINET IO diagnostics.

6.2 TIA Portal (V16+)

1. Open Devices & Networks and place the S7-400 station.
2. Options → Manage general station description (GSD) → install the GSDML for the gateway.
3. Drag the gateway from the catalog to the PROFINET subnet. In Properties → PROFINET interface set the IP and the PROFINET device name.
4. Assign IO addresses to the input/output submodules, e.g., %IB100..%IB131, %QB200..%QB231.
5. Configure Update time and Watchdog. Recommended watchdog ≥ 3 × update time to ride out transient jitter.
6. Compile and download.

7. Configuring the Gateway

1. Power up the gateway and connect to its web interface or vendor configuration tool.
2. Assign the PROFINET device name — this is the name STEP 7/TIA Portal will resolve via DCP. Example: pn-eip-gw-01. The gateway will accept DCP Get/Set frames on the PROFINET port.
3. Set the PROFINET IP address to match HW Config: 192.168.10.50.
4. Configure the EtherNet/IP side:
   • If the gateway is an Adapter: define the scanner IP (ControlLogix EtherNet/IP port), input assembly instance (commonly 0x65), output assembly (0x66), configuration assembly (0x67), and connection size.
   • If the gateway is a Scanner: add the ControlLogix as a target, set the connection path (e.g., 192.168.20.10), RPI, and trigger (cyclic / change-of-state).
5. Save and reboot. Verify the gateway is online: DCP identify from STEP 7 / TIA Portal Accessible nodes should display the gateway name and IP.

8. Configuring the ControlLogix as EtherNet/IP Scanner

1. In Studio 5000 Logix Designer, expand the Ethernet network under the 1756 backplane. Right-click → New Module.
2. Choose ETHERNET-MODULE (generic CIP) or the vendor's AOI/profile if supplied.
3. Configure the connection:
   • Name: PN_EIP_GW
   • IP: 192.168.20.50 (gateway EtherNet/IP port)
   • Input assembly instance: 101 (0x65)
   • Output assembly instance: 102 (0x66)
   • Configuration assembly: 103 (0x67)
   • RPI: 10 ms typical, 5–20 ms range
   • Connection type: Class 1 (I/O), point-to-point, cyclic or COS
4. Studio 5000 generates Local:1:I (input) and Local:1:O (output) tags. Move these to controller tags for use in logic.

Sample ladder snippet moving the first two words of incoming PROFINET data to controller tags:

[ XIC( Local:1:I.ConnectionStatus ) ] MOV( Local:1:I.Data[0] -> Gateway_Input_Word_0 );
[ XIC( Local:1:I.ConnectionStatus ) ] MOV( Local:1:I.Data[1] -> Gateway_Input_Word_1 );

9. Data Mapping and Cycle Time

Two timing parameters interact:

• PROFINET update time — period at which the S7-400 sends/receives IO data to/from the gateway. 1 ms minimum for RT, 250 µs for IRT.
• EtherNet/IP RPI — the ControlLogix requests data at this interval. 5–50 ms typical.

End-to-end latency is approximated by:

T_latency ≈ max(T_profinet, T_rpi) + T_gateway + T_program_scan

Where T_gateway is the internal processing delay (typically 1–3 ms) and T_program_scan is the ControlLogix task period.

Recommended settings for typical process data:

Maximum data per direction: most gateways allow 128–512 bytes, split into 1–4 submodules. The exact limit is in the GSDML.

10. Commissioning, Diagnostics, and Verification

10.1 PROFINET Side

• HW Config → PROFINET IO → Diagnostics → gateway status: must show Connected, no Diagnosis or Maintenance flags.
• LEDs on the gateway: SF off, BF off, LINK on, RX/TX activity visible.
• STEP 7 / TIA Portal → Online → Accessible nodes: gateway DCP name resolves.
• Diagnostic buffer of the S7-400: vendor-specific PROFINET alarms are recorded with slot/subslot and the channel error code.

10.2 EtherNet/IP Side

• Studio 5000 → Module Properties → Connection tab: status Running.
• AOI status bits: ConnectionStatus, RunMode, Faulted.
• RSLinx RSWho: gateway visible under the EtherNet/IP driver.
• Wireshark capture: confirm CIP Forward_Open, Forward_Close, and cyclic I/O packets.

10.3 Functional Verification

1. Force a tag on the S7-400 side, e.g., set MB 100 = 0xAA in a VAT or in the program. Verify the corresponding byte appears at the ControlLogix input tag within two RPI intervals.
2. Force a tag on the ControlLogix side, e.g., Gateway_Output_Word_0 := 0x55AA. Verify the corresponding byte appears at the S7-400 PROFINET input submodule within two update-time intervals.
3. Run a 5-minute soak test. Verify no connection drops, no PROFINET alarms, no EtherNet/IP timeout errors.

11. Troubleshooting Matrix

12. Safety and Security Notes

• This guide covers standard PROFINET IO and CIP communication only. PROFINET PROFIsafe and CIP Safety are not bridged by these gateways. Do not attempt to route safety I/O through a PROFINET–EtherNet/IP gateway; use a Safety-integrated PLC (e.g., S7-400F/FH) on the safe side and a separate Safety Logix on the safe EtherNet/IP side.
• Lock the gateway's web interface with a strong password and disable unused services (FTP, Telnet, HTTP if not needed).
• Restrict PROFINET DCP write access using the SCALANCE / Stratix switch ACL. By default, DCP Set on the plant bus allows renaming any device; lock to a set of MACs.
• Place the EtherNet/IP cell behind a Cell Protection Firewall (CPF) such as SCALANCE S615 or Stratix 5900.
• Enable CIP Security on the ControlLogix if firmware V32+ is used and the field devices support it.

13. Migration to S7-1500 / PCS 7 neo

If the S7-400 is scheduled for migration to an S7-1500/S7-1500H with PCS 7 neo, the same gateway topology is preserved. The S7-1500 integrated PROFINET interface supports PROFINET IO Controller with conformance Class C (MRP, MRPD, IRT). For migration planning reference the SIMATIC S7 to Logix5000 Application Conversion Guide for general conversion principles. Note that some legacy S7-400 I/O modules have no direct Logix5000 equivalent; the gateway may be used to keep field I/O while the controllers are upgraded.

14. Frequently Asked Questions