Connecting Wireless Pressure Transmitters to PLCs

David Krause13 min read
Industrial NetworkingSiemensTutorial / How-to
Licensed PE Working through this on a live machine? A Maine-licensed engineer can take it from here — included with IMD hardware, by the hour for everything else. Book an engineer

Overview: Wireless Pressure Transmitter to PLC Architecture

Wireless pressure transmitters remove the need for hard-wired 4–20 mA loops and conduit runs, replacing them with a battery-powered field device that publishes its process variable over a self-organizing mesh network. In an industrial plant, the typical architecture is three layers:

  1. Field layer – battery-powered wireless pressure transmitters (e.g., Siemens SITRANS P280, Yokogawa EJX310B, Honeywell XYR 600 SmartLine).
  2. Gateway layer – a WirelessHART gateway that terminates the 2.4 GHz mesh and exposes the data to the control network. For Siemens systems this is the IE/WSN-PA LINK (article number 6GK1411-5AC00).
  3. Control layer – the PLC, which reads the gateway over Ethernet using MODBUS TCP/IP (or PROFINET/PROFIBUS where supported).

The PLC must therefore have an Ethernet port capable of running a MODBUS TCP client. Most modern controllers (Siemens S7-1200/S7-1500, Allen-Bradley CompactLogix/ControlLogix, Schneider Modicon M340/M580, ABB AC500) already meet this requirement. If the controller only has serial RS-485, add a MODBUS TCP-to-RTU bridge such as the Phoenix Contact FL EPA 2 or the Wago 750-362.

Wireless Protocol Stack: HART 7 and WirelessHART (IEC 62591)

The dominant open standard for wireless process instrumentation is WirelessHART, defined in IEC 62591 and maintained by the FieldComm Group. Key technical parameters:

Layer Specification
Standard IEC 62591 (HART 7.5)
Physical / RF 2.4 GHz ISM band, IEEE 802.15.4 DSSS, 250 kbps
Channel access TDMA with 10 ms slots, channel hopping across 15 channels
Topology Self-organizing, self-healing mesh
Max devices per network 250 (per WirelessHART spec); practical gateway limit ~100
Security AES-128 encryption, per-device join keys
Burst rate 1 s to 60 min, configurable per device
Range Up to ~250 m LOS between adjacent mesh nodes; longer via hops

Because WirelessHART is a HART 7 superset, every wireless field device still exposes the standard universal commands (0, 1, 2, 3, 6, 7, 8, 12, 13, 14, 15, 48) plus the new WirelessHART commands (768–798). This allows both legacy handheld communicators and modern PLC interfaces to interrogate the same device.

Compatibility note: A device labeled "HART" alone is a wired 4–20 mA + HART device. A wireless pressure transmitter must explicitly support HART 7 or later and publish a WirelessHART device descriptor (DD) file. Plain HART 5/6 devices will not join a WirelessHART mesh.

Siemens SITRANS P280 Wireless Pressure Transmitter

The Siemens SITRANS P280 (order number 7MP3110-…) is a battery-powered, gauge or absolute pressure transmitter designed for wireless process measurement. It is the wireless counterpart to the wired SITRANS P300 and integrates directly with the IE/WSN-PA LINK gateway.

Key specifications

Parameter Value
Measured variable Gauge or absolute pressure (model-dependent)
Sensor ranges 0.25 / 1.0 / 4.0 / 16 / 63 bar (gauge); 4 / 16 / 63 bar (absolute)
Turndown 100:1
Accuracy 0.25 % of calibrated span (typical)
Stability ≤ 0.05 % per year of upper range limit
Update time (burst rate) 1 s to 60 min (programmable)
Battery 1 × 3.6 V lithium D-cell, replaceable (e.g., Tadiran TL-5930)
Battery life Up to 10 years at 16 s update and 25 °C
Antenna Integral whip (thumb-shaped) or remote-mount variant
Enclosure Aluminum, IP66/IP67
Ambient temperature −40 to +85 °C
Configuration SIMATIC PDM with HART DTM (EDD)

All variants communicate using HART 7 with the WirelessHART extensions, so the P280 can coexist on the same mesh with other vendors' WirelessHART devices.

IE/WSN-PA LINK Gateway

The Siemens IE/WSN-PA LINK (6GK1411-5AC00) is the access point that terminates the 2.4 GHz mesh and forwards the data to the control network. Two variants exist:

Variant Article No. Fieldbus Output
IE/WSN-PA LINK 6GK1411-5AC00 Ethernet (MODBUS TCP, PROFINET, OPC)
IE/WSN-MODBUS/PN Gateway 6GK1411-0AA00 (legacy) Ethernet (MODBUS TCP only)

Gateway capabilities

  • Manages up to 100 wireless devices in a single mesh (WirelessHART spec allows 250, but the LINK is sized for 100 for deterministic update timing).
  • Acts as the network manager, security manager, and access point.
  • Provides a built-in web server for diagnostics (joined devices, signal strength RSSI, battery voltage, burst rate, neighbor table).
  • Exposes each device's process variables as MODBUS holding registers (function codes 3 and 4) over TCP port 502.
Topology note: Every wireless field device is also a router. When a new transmitter is powered up, it automatically discovers the gateway and any nearby peers, then forms a mesh. There is no need to manually configure routing tables. Battery-powered devices act as "non-routing" or "routing" depending on configuration; routing participation shortens battery life by ~20–30 %.

PLC Configuration: MODBUS TCP Example (S7-1200/S7-1500)

The following procedure uses TIA Portal V17+ with a CPU 1515-2 PN. The same pattern applies to other PLCs using their native MODBUS TCP client instructions.

Prerequisites

  • CPU with Ethernet interface and firmware ≥ 2.0 (for MB_CLIENT ≥ V4).
  • IE/WSN-PA LINK reachable on the plant network (default IP 192.168.0.55/24, configurable via Web UI).
  • At least one SITRANS P280 commissioned and showing "Joined" in the gateway.

Step-by-step

  1. Add the gateway as an unprotected MODBUS connection. In the device configuration of the CPU, enable "Permit MODBUS/TCP connections via passive partner" or create an explicit MB_CLIENT connection block.
  2. Determine the MODBUS register address. Each wireless device exposes four consecutive registers starting at 40001 + (device_index × 4). For example, device index 1 → registers 40001–40004; device index 2 → registers 40005–40008. Registers 40001/40003 contain the primary variable (PV) as IEEE 754 float (low word/high word).
  3. Insert a MB_CLIENT instruction in the OB1 cyclic interrupt (e.g., OB35 at 100 ms). Example SCL:
// S7-1500 SCL – read PV of two SITRANS P280 devices every 500 ms
#mb_client(REQ := TRUE,
            CONNECT := "connIE_WSN",        // TCON_IP_v4 data block
            MB_MODE := 0,                  // 0 = read holding registers
            MB_DATA_ADDR := 40001,
            MB_DATA_LEN := 8,              // 8 registers = 2 floats
            MB_DATA_PTR := "dbWSNdata".registers,
            DONE => "dbWSNstatus".done,
            BUSY => "dbWSNstatus".busy,
            ERROR => "dbWSNstatus".err,
            STATUS => "dbWSNstatus".status);

// Interpret registers as floats
"dbWSNdata".pv_device1 := REAL_TO_LREAL(WORD_TO_BLOCKWORD_INT("dbWSNdata".registers[0]) * 65536.0
                                         + WORD_TO_INT("dbWSNdata".registers[1]));
"dbWSNdata".pv_device2 := ... ;
  1. Scale to engineering units. The PV comes back in the device's configured unit (Pa, kPa, bar, psi, mH₂O). Apply the device's lower and upper range value (LRV/URV) to convert to percent of span, then to the unit your control loop expects.
  2. Build a watchdog bit. Use the burst-mode "Device Health" flag (register 40003 bits 24–31 = HART device status) to set a "bad quality" tag if the gateway stops receiving updates within 3 × update time.

Alternative Wireless Platforms

Yokogawa EJX310B Wireless Differential Pressure / Pressure Transmitter

The Yokogawa EJX310B uses a single-crystal silicon resonant sensor and ISA100.11a (not WirelessHART) over 2.4 GHz. It integrates with Yokogawa's YFGW510 field wireless gateway, which publishes data via MODBUS TCP/IP to the PLC. Specify EJX310B when:

  • You need 0.075 % reference accuracy (better than P280).
  • You want 1-second update rate for fast control loops (P280 default is 16 s to preserve battery).
  • The plant already runs ISA100.11a devices from multiple vendors.
Interoperability: ISA100.11a and WirelessHART (IEC 62591) are not directly interoperable at the device level. A plant must pick one protocol, or run two parallel gateways.

Honeywell SmartLine Wireless Transmitters

The Honeywell SmartLine Wireless Universal I/O (XYR 600 series) accepts mA, V, thermocouple, RTD, and discrete inputs, then publishes them as either WirelessHART (XYR 600W) or OneWireless (Honeywell's ISA100.11a variant) to a Honeywell Field Device Access Point (FDAP). Use a Honeywell WDM (Wireless Device Manager) or a MODBUS TCP-to-Experion gateway to bring the values into a non-Honeywell PLC.

TE Connectivity Wireless Pressure Transducers

The TE Connectivity wireless pressure transducers are typically Bluetooth Low Energy (BLE) or proprietary 900 MHz / 2.4 GHz devices intended for machine-condition monitoring rather than process control. They are useful for retrofitting rotating or portable assets where cable routing is impossible. For control loops requiring IEC 62591 compliance or >1 year battery life, prefer WirelessHART devices from the suppliers above.

Network Topology and MESH Planning

Although WirelessHART automatically forms a mesh, the field engineer controls the topology quality by following these rules:

Rule Recommendation
Spacing between adjacent nodes ≤ 50 % of measured line-of-sight range (typically 30–60 m in industrial indoor settings)
Metallic obstructions Avoid single hop through > 2 metal walls; use additional devices as routers
Vertical drops (e.g., vessel to grade) Add one routing device per 8–10 m of elevation change
Antenna orientation Vertical, away from large metal surfaces; remote-mount antenna kit available for P280
RSSI target −75 dBm or better per hop; −85 dBm minimum acceptable
Latency budget (#hops × 1 s) + gateway cycle time; keep under 30 s for non-critical monitoring, under 5 s for control

For a network of more than 30 devices, deploy at least 20 % of devices as "always-on" routers powered from the plant mains (e.g., SITRANS AW200 adapters with line power) so the mesh remains stable when battery-powered transmitters enter their deep-sleep cycle.

MODBUS Register Map and Engineering Unit Scaling

The IE/WSN-PA LINK exposes a fixed MODBUS register layout that is identical for every joined wireless device. The layout depends on the gateway firmware; the table below covers firmware ≥ V4.1 (current as of the SITRANS P280 product line).

Offset Content Type Notes
+0 PV low word UINT16 IEEE 754 float, low word / high word order
+1 PV high word UINT16
+2 Status low word UINT16 Bit 0–7: HART device status
+3 Status high word UINT16 Bit 8–15: WirelessHART health (battery, RSSI, join state)

Per-device base register = 40001 + (device_index × 4). Device_index is assigned by the gateway in the order devices joined, visible on the gateway Web UI at Wireless Devices → Device List → Index.

To convert the raw float to engineering units:

EU = LRV + (PV_percent / 100) × (URV − LRV)
where PV_percent = (PV_raw − LRV_raw) / (URV_raw − LRV_raw) × 100
Endianness: The IE/WSN-PA LINK stores floats in big-endian word order. On a little-endian S7 CPU, swap the words before using REAL_TO_LREAL. Allen-Bradley Logix Designer and Modicon M580 require the same swap when the gateway is configured for "Modicon" byte order.

Commissioning Procedure

  1. Mount the P280 on the process tap with a block-and-bleed manifold. Hand-tighten the process connection; do not use PTFE tape on tapered threads as it can crack the diaphragm housing.
  2. Insert the battery (3.6 V lithium D-cell, Tadiran TL-5930 or Siemens-recommended equivalent) within 30 seconds of stripping the activation tab; the device will power up and broadcast a join request.
  3. Open the IE/WSN-PA LINK Web UI at https://192.168.0.55. Default credentials are admin / sitrans. Change the password on first login.
  4. Add a join key. Navigate to Security → Join Keys and enter a 16-byte join key (the P280 label shows the factory default; replace it with a plant-specific key for AES-128 security).
  5. Set the burst rate. In the device's HART configuration (PDMG/PDM or the gateway UI), choose an update rate. For 10 years battery life, use 16 s; for 5 years, use 8 s; for 2 years, use 2 s.
  6. Configure LRV/URV and units. Match the P280 to the engineering range of the tap (e.g., 0–10 bar gauge).
  7. Test routing. From the gateway UI, observe the neighbor table; the device must show ≥ 2 neighbors with RSSI ≥ −85 dBm for reliable operation.
  8. Map to PLC. Add the MODBUS register pair to the PLC scan list and verify the float value matches the HART hand-held reading within ±0.1 % of span.

Verification

Test Expected Result
Web UI device list Device shows "Joined" with green status, battery voltage > 3.4 V
RSSI to gateway or nearest router ≥ −75 dBm (excellent), −85 dBm (acceptable), < −90 dBm (unsupported)
MODBUS read of PV Returns float within ±0.25 % of span compared to a calibrated hand-held
Update latency PLC sees new PV within 2 × configured burst interval + 1 s mesh overhead
Simulated RF loss Power down nearest router; P280 must self-heal via alternate route within 60 s without resetting the PLC connection
Battery life estimation Gateway calculated remaining life matches the published curve for the burst rate and ambient temperature

Troubleshooting Matrix

Symptom Likely Cause Action
P280 does not appear in gateway Join key mismatch or HART version < 7 Re-enter join key from device label; verify device is HART 7 WirelessHART
Joins but drops every few minutes RSSI < −90 dBm or excessive hop count Add a routing device or relocate; reduce metallic obstructions
Battery life < 25 % of expected Burst rate too fast or device is acting as router Lower burst rate; disable routing on battery-powered devices
MODBUS read returns 0x7FA00000 (NaN) Word swap or endianness mismatch Swap low/high word before IEEE 754 interpretation
PLC sees value but "stale quality" Burst updates not arriving within watchdog Check gateway diagnostics; increase watchdog or reduce burst interval
PLC cannot open TCP/502 Firewall or wrong connection ID Disable PLC firewall for the gateway IP or add explicit TCON_IP_v4 block
Multiple gateways conflict Two gateways on overlapping channel 11 Place gateways ≥ 50 m apart or assign different network IDs
Value drifts with temperature Sensor not thermally stabilized or wrong LRV/URV Re-zero at operating temperature; verify LRV/URV match transmitter range

Field-Engineering Checklist

  • Confirm the PLC has an Ethernet port and supports MODBUS TCP or PROFINET IO.
  • Specify WirelessHART devices (IEC 62591) only when an open standard is required; otherwise ISA100.11a is acceptable.
  • Plan the mesh: ≥ 2 neighbors per device, ≥ 20 % mains-powered routers in large networks.
  • Choose burst rate to match battery-life target (16 s = 10 yr; 8 s = 5 yr; 2 s = 2 yr).
  • Document join keys in the plant security vault (16-byte AES-128 keys).
  • Map MODBUS registers once during commissioning and freeze the layout; do not reindex without updating the PLC scan list.
  • Test mesh self-healing by powering down a router and observing PLC tag freshness.

Which wireless protocol should I choose for a PLC-integrated pressure transmitter?

Use WirelessHART (IEC 62591) when you need an open standard, HART device management tools (PDM, AMS, FieldCare), and 10-year battery life on a 2.4 GHz mesh. Use ISA100.11a (e.g., Yokogawa EJX310B) when you need faster updates (1 s) or higher accuracy and you are willing to manage the vendor-specific gateway. Bluetooth-only sensors such as those from TE Connectivity are not suitable for control loops because they lack deterministic multi-hop routing.

Can a Siemens SITRANS P280 talk directly to a PLC without a gateway?

No. The P280 transmits only WirelessHART on 2.4 GHz. A PLC does not have a WirelessHART radio, so you must include an access point such as the Siemens IE/WSN-PA LINK (6GK1411-5AC00), which exposes the data as MODBUS TCP, PROFINET, or OPC to the PLC. The gateway also acts as the network and security manager for the mesh.

How many wireless pressure transmitters can one gateway handle?

The IE/WSN-PA LINK is specified for up to 100 wireless devices per mesh, although the WirelessHART standard itself allows 250. In practice, stay below 80 per gateway to keep burst latency under 30 s at 8 s update rate. Larger plants deploy multiple gateways and segment by area.

What battery life can I expect from a SITRANS P280?

Up to 10 years with a 3.6 V lithium D-cell (e.g., Tadiran TL-5930) at a 16 s burst rate and 25 °C ambient. Faster updates reduce life proportionally: 8 s ≈ 5 yr, 2 s ≈ 2 yr. Cold ambient (below −20 °C) and routing participation also reduce expected life by 20–30 %.

Why do I see the wrong value when I read the MODBUS register on the PLC?

The most common cause is word-order mismatch. The IE/WSN-PA LINK returns IEEE 754 floats in big-endian word order; most PLCs (S7-1500, CompactLogix, M580) are little-endian. Swap the low and high 16-bit words before passing the result to a REAL or FLOAT data type. Also confirm the device index in the gateway Web UI matches the offset (40001 + 4 × index) used in the MODBUS read.

Back to blog