Implementing Compact FieldPoint to Siemens Profibus Communication

Overview

Connecting a National Instruments Compact FieldPoint (cFP) backplane to a Siemens S7 or S5 programmable logic controller (PLC) over Profibus or MPI is a common integration challenge in mixed-vendor supervisory, control, and data acquisition (SCADA) systems. The cFP family provides deterministic, ruggedized analog and digital I/O modules controlled by a LabVIEW Real-Time field-programmable controller (FPC), but the controller does not include a native Profibus DP slave or MPI interface. All Profibus/MPI traffic must therefore be terminated by a protocol gateway, an embedded PC running Siemens Prodave, or a Modbus-capable bridge that proxies the S7 data into a transport the cFP can consume (typically TCP/IP, Modbus/TCP, or RS-232/485).

This reference documents the three field-proven topologies for joining a cFP chassis to a Siemens S7-300, S7-400, S7-200 (with EM 277), or S7-1200/1500 controller. Each topology is mapped to a firmware and software stack, a list of compatible gateways with catalog numbers, an addressing and tag map, and a step-by-step commissioning procedure. A troubleshooting matrix closes the article with symptom-to-cause mappings based on field experience.

Protocol Foundation: MPI vs Profibus DP

Selecting the correct gateway depends first on which Siemens protocol the target PLC exposes. MPI and Profibus DP share the same EIA-485 physical layer (RS-485, 9.6 kbit/s to 12 Mbit/s) and the same Siemens proprietary frame format on top of Profibus FDL, but they differ in addressing, master arbitration, and accessible data areas.

For cFP integration, MPI is almost always the simpler choice when the target CPU is a S7-300 or S7-400 with its onboard MPI/DP port set to MPI mode. Profibus DP is preferred when the PLC is configured as a DP slave and you are using a CP 342-5/443-5 master or a third-party gateway acting as DP Class-1 master.

Hardware Gateway Architectures

Three reference architectures are widely used in the field. Each has different latency, deterministic, and cost characteristics.

Architecture A: MPI/Ethernet Gateway

An MPI-to-Ethernet gateway terminates the Profibus cable and presents the S7 data over TCP/IP. The cFP FPC runs LabVIEW Real-Time and exchanges S7 protocol frames (wrapped in a vendor-proprietary ASCII or binary protocol) with the gateway over a standard Ethernet socket. The gateway handles token passing on the MPI bus, freeing the cFP from real-time Profibus constraints.

Architecture B: Profibus DP Master with Modbus/TCP Bridge

A standalone DP Class-1 master (Siemens ET 200S IM 151, Helmholz, or Anybus X-gateway) scans Profibus slaves and exposes the cyclic I/O image to a Modbus/TCP server. The cFP reads the data using the LabVIEW Modbus library or the Modbus I/O Server. This topology is preferred when the cFP must coexist with Siemens HMI panels and a Siemens PG/PC on the same Profibus segment.

Architecture C: PC-Hosted Prodave MPI

An industrial PC (IPC) on the same MPI segment uses the Siemens Prodave MPI/TCP DLL to read/write S7 data blocks, then forwards the values to the cFP via a custom TCP socket or by writing to a shared file/NFS mount. Prodave is a Windows-only API and cannot be loaded on the cFP FPC itself; therefore, Architecture C requires the cFP to treat the IPC as a data concentrator.

IBHsoftec IBH Link S7/MPI Gateway Configuration

The IBHsoftec IBH Link (formerly IBH Link S7/MPI) is the most commonly deployed gateway in cFP-Siemens integrations. It supports MPI 9.6 kbit/s to 12 Mbit/s, Profibus DP, and S7-TCP, exposes its services on TCP port 1099, and includes a built-in web configuration interface.

Catalog numbers and variants

Step-by-step configuration

1. Connect a PG/PC to the IBH Link's service port or to the same Ethernet subnet. Browse to http://192.168.1.100 (default). The default credentials are admin / admin on firmware 4.x and later.
2. Open Configuration > MPI/DP. Set the baud rate to 187.5 kbit/s for S7-300/400 MPI or 1.5 Mbit/s for Profibus DP. Set the highest station address (HSA) to 31 for MPI or 126 for DP.
3. Set the IBH Link's MPI/DP address to 0 (master). For DP, the address must be unique on the segment; the CPU's MPI/DP port can be set to MPI at address 2 simultaneously if the PLC is in MPI/DP combined mode and the routing is enabled in STEP 7 / TIA Portal.
4. Under Configuration > S7 Connections, define one or more S7 connections. Specify the target PLC's MPI/DP address, the rack and slot (typically rack 0, slot 2 for S7-300), and the connection resource (local TSAP 01.01, remote TSAP 02.01 for an S7-300).
5. Open Configuration > Ethernet. Assign a static IP (e.g., 192.168.1.100), subnet mask, and gateway. Disable DHCP for deterministic behavior on the cFP side.
6. Save and reboot. After reboot, verify with the built-in Diagnostics > S7 Status page. The PLC must show Connected with a green status icon. If the status shows Timeout, double-check the PROFIBUS termination (both ends, 220 Ω, switch on), the cable shield bonding, and the baud-rate match.
7. From the cFP FPC, open a TCP socket to port 1099 and issue a S7 read request, or use the IBHsoftec OPC server on a host PC and re-publish the data through the cFP via Modbus/TCP.

Verification

After the IBH Link shows Connected, send a test read from the cFP using the S7 function code 0x04 (Read Input) or the IBHsoftec S7-LAN protocol wrapper. A successful read returns the S7 data area content within 50-200 ms at 187.5 kbit/s for a 4-byte read. The cFP FPC should log a non-zero response and a status word of 0x0000.

Prodave MPI/TCP Integration (Architecture C)

Prodave is the only Siemens-supplied API that can drive an MPI port from user code without STEP 7 installed. It is licensed separately and ships as a set of DLLs and a small toolbox of ActiveX controls.

Prodave product matrix

Reading a data block with Prodave

The C-style API exposes a small surface. The most common read path is:

// Pseudo-code, simplified from Prodave MPI/TCP V6.0 header
#include <Prodave6.h>

unsigned char  buffer[256];
int            handle = -1;
int            res;

// 1. Load the toolbox
res = ProDaveInit("S7ONLINE");

// 2. Open a connection to the PLC at MPI address 2
res = ProDaveConnect("MPI:2", &handle);

// 3. Read 16 bytes from DB1 starting at byte 0
res = ProDaveReadDataBlock(handle, 1, 0, 16, buffer);

// 4. Forward to cFP over TCP
sendto(cfp_socket, buffer, 16, 0, cfp_addr, cfp_port);

// 5. Close and unload
ProDaveDisconnect(handle);
ProDaveExit();

The IPC must have a CP 5611 / CP 5612 / CP 5621 Profibus card installed and configured with the Set PG/PC Interface tool. STEP 7 or at least the Simatic Net PC software is required to install the Profibus driver stack.

Modbus Gateway Bridge Architecture

Modbus is the lowest-common-denominator protocol between the cFP and a Siemens gateway. Two configurations are common:

Modbus/TCP to Profibus gateway (vendor examples)

Modbus mapping example

Configure the gateway to map a S7 data block of 32 bytes into 16 Modbus holding registers (each register = 2 bytes, big-endian or little-endian depending on gateway). A typical mapping for reading a S7-300 DB100 holding recipe parameters:

LabVIEW Shared Variable Engine and Modbus I/O Server

Starting with LabVIEW 8.0, NI introduced the Shared Variable Engine (SVE), a publish/subscribe data service that exposes LabVIEW front-panel indicators and controls over TCP/IP. The SVE also supports a built-in Modbus I/O server, eliminating the need for the standalone Modbus library on the cFP FPC.

Configuring the Modbus I/O Server on a Windows host (publisher)

1. Install the NI Modbus Library and the DSC Module (or LabVIEW Real-Time Module with SVE) on the host PC. The cFP target itself does not need the DSC Module if it consumes the variables directly.
2. In NI MAX > Tools > Real-Time > Variable Manager, or in LabVIEW Project Explorer, right-click My Computer and select New > I/O Server.
3. Select Modbus as the protocol, choose Modbus/TCP as the transport, and enter the gateway's IP address (e.g., 192.168.1.30) and the unit ID (default 1).
4. Define one Modbus register per shared variable. For each variable, specify the address (e.g., 40001), function code, and update rate. A 100 ms poll is typical for non-critical data; use 20 ms only for tight control loops.
5. Click Deploy. The SVE begins polling the gateway immediately.

Consuming shared variables on the cFP FPC

On the cFP FPC, the Shared Variable Engine on the real-time target subscribes to the published variables. From LabVIEW Real-Time, use a Shared Variable node bound to a network-published variable. Read/write semantics are baked into the SVE; the application code does not need to implement Modbus framing.

// Shared variable binding example (textual representation)
// Variable name: SV_DB100_Temp
// Data type:     Single (REAL, 32-bit)
// Source URL:    //host-pc/My Computer/ModbusLib/DB100_Temp
// Update rate:   100 ms
// Access:        Read/Write

Read/Write library fallback (LabVIEW 7.1)

On older cFP targets that ship with LabVIEW Real-Time 7.1, the SVE-based Modbus I/O server is not available. Use the Modbus Library VIs (NI Modbus Library 1.2.x) directly: MB Open Connection.vi, MB Read Holding Registers.vi, MB Write Multiple Registers.vi, and MB Close Connection.vi. The library is available free of charge and runs on all LabVIEW Real-Time targets including the cFP-2020/2120/2220/2240.

Network Topology and IP/MPI Addressing

A complete address plan is mandatory before commissioning. The following is a worked example for a single-SKU production cell with one S7-300, one IBH Link, and one cFP-2220.

Subnet mask 255.255.255.0; default gateway 192.168.1.1 (managed switch). Profibus cable must be terminated at both ends with the bus terminator switch on the connector in the ON position (220 Ω between pins 3 and 8, plus 390 Ω pull-up/down on data lines). Pinout for the 9-pin Sub-D Profibus connector: pin 1 shield, pin 3 RxD/TxD-P (B line, red), pin 5 DGND, pin 6 VP (+5 V), pin 8 RxD/TxD-N (A line, green).

Programming the cFP Logic

The cFP field-programmable controller runs a LabVIEW Real-Time VI. A typical scan cycle is implemented as a flat sequence with a deterministic loop.

1. Initialize: open the TCP socket to the gateway (port 1099) or the Modbus/TCP connection. The SVE does this automatically when the variable is bound; for direct TCP, use TCP Open Connection.vi with 192.168.1.100:1099.
2. Read: issue a S7 read for the configured data block. For the IBH Link, send the IBH S7-LAN read request frame:

// IBH S7-LAN read request frame (16 bytes header + payload)
// 0x00 0x00 0x00 0x11        - Length (17 bytes follow)
// 0x00 0x00                  - Reserved
// 0x00 0x00                  - Function group
// 0x00 0x00 0x00 0x01        - Function: Read Var
// 0x00                       - Item count: 1
// 0x12 0x0A 0x10 0x01        - Item: Var specification (S7ANY)
// 0x00 0x0E                  - Length of following
// 0x00 0x10                  - Syntax ID: S7ANY
// 0x00 0x00                  - Transport size: BYTE
// 0x00 0x00                  - Count: 16 (bytes to read)
// 0x00 0x00 0x00 0x01 0x84   - DB number 1, area DB (0x84)
// 0x00 0x00 0x00 0x00        - Byte offset 0

3. Process: parse the response payload, convert S7 REAL to LabVIEW Single, apply engineering-unit scaling, and write the result to a shared variable or a cFP analog-output module.
4. Write (optional): issue an S7 write to command setpoints back to the PLC. Use the same framing with function code 0x00000005 (Write Var).
5. Close: on shutdown, close the socket and the Modbus connection gracefully to avoid leaving the gateway with a half-open TCP state.

For deterministic execution, place the entire read/process/write block inside a Timed Loop with period 100 ms and priority 3. Use the Wait Until Next ms Multiple primitive to align the loop with the Profibus baud tick.

Diagnostics and Troubleshooting Matrix

Commissioning Checklist

1. Verify all Profibus cable shields are bonded at the cabinet entry to a clean ground bar. The shield must be continuous; do not break the shield at the connector.
2. Enable bus terminator switches on the first and last device on the segment. Disable on all intermediate devices.
3. Set unique MPI/DP addresses. Document the address plan on the cabinet door.
4. Confirm baud-rate match across all devices. Use STEP 7 PG/PC Interface > Diagnostics to read the bus statistics: bus errors should be 0, repeat count 0.
5. Power up the gateway, browse to its web UI, and confirm the S7 connection is Connected.
6. From the cFP FPC, perform a single read of 16 bytes from DB1, offset 0. Confirm the value matches a known constant in the PLC (e.g., a recipe header magic number).
7. Trigger a write of a 16-bit command word and confirm the PLC sets the corresponding bit in the diagnostic buffer.
8. Run the loop for 24 h with diagnostic logging enabled. Monitor the gateway's Uptime counter and the cFP's Connection Error shared variable. Both should remain zero.
9. Document the configuration (IP, baud, addresses, register map) in a PDF and store on the project server.

Field-Proven Caveats

• S7-1200/1500 PUT/GET protection: Starting with TIA Portal V14, Siemens enables Permit access with PUT/GET from remote partner only on explicit configuration. Without this, the IBH Link's S7 connection succeeds but reads return 0x00. Enable in Device Configuration > Properties > Protection > Connection Mechanisms.
• CP 343-1 Lean does not support S7 communication as a server: It is an exclusive client. Use CP 343-1 Advanced or onboard PN for server-side S7 access.
• Prodave floating-point conversion: Prodave returns S7 REAL as four bytes in big-endian, byte-swapped per word. S7 stores REAL in big-endian (DBD0 = bytes 0,1,2,3). On x86 the LabVIEW type cast to Single must use Swap Bytes or Swap Words depending on the data type.
• Watchdog on cFP-2020: The cFP-2020 FPC has a single-core 200 MHz Geode and no hardware FPU. Running S7 protocol parsing plus Modbus polling at < 50 ms can starve the loop. Use a cFP-2220 or cFP-2240 for sub-50 ms loops.
• Firewall on Windows Server 2019+: The default Windows Defender firewall blocks inbound TCP 502. The Modbus I/O server will report Device not responding even when the gateway is reachable. Add an explicit inbound rule for %ProgramFiles%\National Instruments\Shared\Tagger\tagger.exe.