PLC Scan Cycle and PROFIBUS DP Setup with Siemens S7-300

Overview

Programmable Logic Controllers (PLCs) are deterministic microcomputers optimized for real-time industrial control. They replace hard-wired relay logic with software-resident ladder, function-block, and structured-text programs, and they form the data source layer for Supervisory Control and Data Acquisition (SCADA) systems. A SCADA station typically polls multiple PLCs and Remote Terminal Units (RTUs) over industrial fieldbuses, stores the data in a historian, and renders it on operator HMIs.

This tutorial covers the four foundational areas every new PLC/SCADA engineer must internalize before touching hardware:

1. The PLC scan cycle and why it is fundamentally different from text-based languages like C or BASIC.
2. PROFIBUS DP network topology, termination, and D-sub connector wiring.
3. Siemens STEP 7 hardware configuration for the S7-300 CPU 313C-2 DP as a DP master.
4. OPC server bridging between PROFIBUS devices and SCADA clients such as WinCC, Citect, or LabVIEW.

Prerequisites

• Working knowledge of at least one text-based language (C, BASIC, Pascal, or LabVIEW dataflow).
• Familiarity with binary logic, relay ladder diagrams, and Boolean algebra.
• A Windows PC capable of running Siemens STEP 7 V5.x or TIA Portal V16+ for project engineering.
• A PROFIBUS DP master interface card for the engineering station (PCI or PCMCIA) plus the vendor's communication server / DTM software.
• PROFIBUS DP cable (purple, type A, impedance 135-165 Ω, capacitance ≤ 30 pF/m) and 9-pin D-sub PROFIBUS connectors with integrated termination and PG socket.
• A Siemens S7-300 CPU 313C-2 DP (order code 6ES7 313-6CF03-0AB0 or equivalent) on a DIN rail with a PS 307 power supply and signal modules as required.

PLC vs Traditional Programming: The Execution Model

A PLC is not a desktop PC. It runs a single, repeating loop that reads physical inputs, evaluates user logic exactly once, and writes the resulting values to physical outputs. The cycle time is deterministic and bound by the program length, I/O count, and communication overhead. Typical S7-300 CPUs execute between 0.1 ms and 10 ms of bit logic per scan, depending on the instruction mix.

The implication is profound:

• No event-driven interrupts by default. A PLC will not react to a rising edge on a digital input unless you poll it inside the OB1 scan, attach a hardware interrupt OB (OB40-OB47), or configure a cyclic interrupt OB (OB30-OB38).
• Variables persist between scans. Unlike a C function, OB1 is not called and discarded; it is re-entered. Holding flags (Merker/M), data blocks (DB), and I/O images retain their values across scans.
• Race conditions are usually impossible by design. Because logic evaluates once per cycle in a fixed order, the input image is frozen at the start of the cycle and the output image is committed atomically at the end. This eliminates most races that plague threaded C code.

The PLC Scan Cycle in Detail

The Siemens S7-300 executes the following fixed sequence every scan, defined in Siemens entry ID 109751784 (S7-300 CPU 31xC Technological Functions manual):

1. Operating system startup. Cold restart, warm restart, or hot restart based on mode selector and CPU configuration.
2. Process image update (PII / PIQ). All digital inputs are read into the Process Image Input (PII) area in bit memory; analog inputs are read into PII words. Outputs are written from the Process Image Output (PIQ) at the end of the cycle.
3. User program execution (OB1 and subordinate blocks). The CPU evaluates the program in the order defined by the call hierarchy. Each call consumes deterministic time.
4. Communication processing. PROFIBUS DP, MPI, and (if configured) Industrial Ethernet / PROFINET services run partly in parallel via the communication processor's firmware. Time-slice budget is configurable.
5. Output write. PIQ values are committed to the physical outputs.
6. Self-diagnostics and housekeeping. Watchdog, memory object bit tests, and OB82/OB85/OB86 fault calls are evaluated.

Minimum cycle time, maximum cycle time, and cycle time monitoring are set in HW Config → CPU Properties → Cycle/Clock Memory. Recommended starting values for an educational lab rig:

SCADA Architecture Fundamentals

SCADA is the supervisory layer; the PLC remains the controller. According to the GE Vernova overview on PLC, HMI, and SCADA and the Inductive Automation "What is SCADA?" reference, a SCADA architecture contains the following elements:

The data flow is unidirectional at the field level (sensor → PLC → SCADA) and bidirectional at the supervisory level (operator command → PLC setpoint). Citect, mentioned in the SCADA tools lineage, is now maintained under the AVEVA Plant SCADA family and remains a popular choice for legacy installations.

Siemens S7-300 CPU 313C-2 DP Hardware Overview

The CPU 313C-2 DP combines a compact PLC with an integrated PROFIBUS DP master/slave port. Order codes in the 6ES7 313-6xxx family cover firmware versions V2.0 through V3.3. The integrated I/O of the 313C-2 DP includes:

Always consult the official S7-300 CPU 31xC and CPU 31x operating instructions for the exact firmware variant you are commissioning. Wiring follows the front-connector pin assignment table printed on the inside of the door.

PROFIBUS DP Network Topology

PROFIBUS DP is a token-passing master/slave bus standardized in IEC 61158/61784. Maximum practical limits per segment:

Building the D-Sub PROFIBUS Connector with Termination

A standard 9-pin D-sub (DE-9) male connector is used on every PROFIBUS node. The PROFIBUS & PROFINET International (PI) connector pinout per IEC 61158 is:

Termination is implemented inside the connector housing with a switch that engages the resistor network. For a home-built connector (e.g., Siemens 6GK1 500-0AB10 or compatible third-party), solder a 220 Ω resistor between pins 3 and 8, a 390 Ω between pin 6 and pin 3, and a 390 Ω between pin 8 and pin 5. Use a shielded twisted-pair cable with 135 Ω characteristic impedance.

1. Strip the cable jacket to expose the shield braid for 360° bonding to the D-sub metal housing.
2. Fold the shield back over the jacket; do not let strands touch the signal pins.
3. Solder pin 3 (red) and pin 8 (green) keeping the pair twist as close to the connector as possible (≤ 13 mm).
4. Solder pins 5 and 6 to the termination resistor divider.
5. Tighten the strain relief and slide the slide switch to ON for the end-of-line nodes.

PROFIBUS DP Configuration in STEP 7 / TIA Portal

For a classic STEP 7 V5.5 project (still the standard for legacy S7-300 work), the configuration sequence is:

1. Open SIMATIC Manager → File → New → Name the project.
2. Insert → Station → SIMATIC 300 Station. Drag the CPU 313C-2 DP into slot 2.
3. Open HW Config. Place the PS 307 in slot 1, the CPU in slot 2, and signal modules from slot 4 onward.
4. Double-click the X2 PROFIBUS port on the CPU. Choose PROFIBUS as the type, set the address (default 2), and click Properties → New → PROFIBUS(1) with 1.5 Mbit/s and DP profile.
5. Set the CPU's DP mode to DP Master; tick Test, Commissioning, Routing if you need PG access through the master.
6. From the catalog, drag any DP slave (e.g., ET 200S, ET 200M, or a third-party slave GSD file) onto the DP(1) subnet. Assign it a unique PROFIBUS address (3-126).
7. Map the slave's I/O into the process image by aligning byte addresses.
8. Save and compile, then download HW Config to the CPU.

For new installations using TIA Portal V18+, the equivalent workflow is in the TIA Portal S7-300/400 Getting Started guide and the TIA Portal product page. The conceptual steps remain identical.

OPC Interface: Why LabVIEW and WinCC Cannot Talk Directly to PROFIBUS

OPC (OLE for Process Control) is the standardized interface between field-level hardware and supervisory applications. It was defined by the OPC Foundation and exists in three flavors relevant here:

Because LabVIEW and WinCC do not implement PROFIBUS DP slaves, the PROFIBUS master card on the PC (e.g., Applicom PC1500PFB) ships with an OPC server. The chain is:

PLC (DP slave) ↔ PROFIBUS cable ↔ PC PROFIBUS card ↔ Vendor OPC server ↔ OPC client (LabVIEW DSC, WinCC, Citect, Ignition)

The PLC does not need to "support" OPC. OPC runs on the SCADA PC; the PLC only exposes its I/O via PROFIBUS DP. The card vendor's communication server (e.g., Applicom Communication Server) configures which DP slaves participate, the baud rate, and the tag database. The OPC client then browses this database by item name.

Applicom PC1500PFB Card Integration Notes

The Applicom PC1500PFB is a PCI card from the Applicom family (now under HMS Industrial Networks) that provides a PROFIBUS DP master/slave interface for industrial PCs. The bundled Applicom Communication Server software configures the card and exposes its data to SCADA clients through an OPC server interface.

If your engineering PC is older than Windows XP, see the OS compatibility notes below.

Windows 98 Compatibility Considerations

Applicom Communication Server V2.9 was originally released for Windows NT 4.0 / Windows 2000, and later refreshed for Windows XP. Running it on Windows 98 is not officially supported and presents specific risks:

If feasible, migrate the engineering station to Windows XP Professional SP3 or a 32-bit Windows 7 install. Both remain supported by legacy Siemens and Applicom runtimes and provide a stable DCOM model.

LabVIEW Integration via OPC

The recommended LabVIEW topology is:

1. The PROFIBUS card runs the vendor's communication server, which hosts an OPC DA 2.0 server.
2. LabVIEW's Datasocket Read / Datasocket Write VIs (Functions Palette → Data Communication → Datasocket) connect to opc:\<machine>\Applicom.PC1500PFB\TagName.
3. For long-running dashboards, encapsulate reads inside a polled while-loop with a 100-250 ms delay.
4. Map each PROFIBUS byte to a LabVIEW cluster element using Boolean Array to Number and Number to Boolean Array primitives.

Example pseudo-code for a 1-byte read/write loop:

while (stop button == FALSE) {
  dsRead   = dsOpen("opc://localhost/Applicom.PC1500PFB.S7_300.InputByte0", DSREAD, 250);
  dsWrite  = dsOpen("opc://localhost/Applicom.PC1500PFB.S7_300.OutputByte0", DSWRITE, 250);
  if (dsRead.status == 0) {
    BOOL arr[8];
    ByteToBoolArray(dsRead.value, arr);
    indicator[0..7] = arr;
  }
  dsWrite.value = BoolArrayToByte(control[0..7]);
  Wait(ms=200);
}

Verification and Commissioning Checklist

1. Power-on: PS 307 green LED steady; CPU SF/BF off, DC5V on, RUN not flashing.
2. PROFIBUS LEDs on slaves: Steady green on BF; flashing green indicates parameterization without data exchange.
3. Diagnostic buffer: In STEP 7, CPU → PLC → Diagnostic/Clock → Diagnostic Buffer; confirm no entries related to station failure (OB86) or peripheral access error (OB122).
4. Cycle time: PLC → Monitor/Modify → check that measured OB1 cycle is below the configured monitoring time by at least 30 %.
5. I/O loopback test: Wire a temporary jumper from DO0 to DI0 and verify in a VAT table that Q124.0 drives I124.0 within one scan.
6. OPC tag browse: From OPC Scout, enumerate the Applicom server; read and write one tag end-to-end.
7. SCADA HMI render: Confirm the tag appears in WinCC / Citect / LabVIEW with correct scaling and engineering units.
8. Fault injection: Disconnect the PROFIBUS connector; verify the CPU logs OB86 and the SCADA surfaces a "Slave 3 lost" alarm.

Troubleshooting Matrix

Field-Proven Engineering Tips

• Reserve the first two and last two PROFIBUS addresses (0, 1, 126, 127) for service tools and class-2 masters to avoid collisions with running slaves.
• Document the GSD revision and firmware version of every slave in the project header. GSD revisions are unforgiving; mismatches cause the master to refuse parameterization.
• Use fiber-optic PROFIBUS (OLM) when the cable run exceeds 100 m in an electrically noisy plant; copper cable is good for ≤ 1.2 km at 93.75 kbit/s only.
• When migrating from a working DP setup to PROFINET, the GSD file is replaced by a GSDML (XML) descriptor and the topology is reconfigured; the PLC program (OB1, DBs) is unchanged.
• For SCADA systems handling more than ~10 000 tags, design a tiered architecture: edge OPC aggregator → central historian → OPC UA client on operator stations.

Standards and Documentation References

• PROFIBUS technology page (PI - PROFIBUS & PROFINET International)
• OPC Foundation - What is OPC?
• Siemens S7-300 CPU 31xC operating instructions
• Siemens S7-300 technological functions manual
• Siemens TIA Portal product page
• Inductive Automation - What is SCADA?
• GE Vernova - Explaining PLC, HMI & SCADA

Frequently Asked Questions