Reading S7 1200 Data from Hilscher NT 100 RE PN in TIA Portal

Overview

The Hilscher NT 100-RE-PN is a Profinet IO device that exposes up to 512 bytes of input and 512 bytes of output data on the Profinet side and mirrors them onto a Modbus TCP or Modbus RTU server. Inserted into a SIMATIC S7-1200 Profinet network, the gateway behaves like any distributed I/O head: it occupies slots, exposes sub-modules, and contributes %I/%Q addresses that the PLC can move into local tags or data blocks with standard Ladder, FBD, or SCL logic. Deploy it when the S7-1200 hardware layout is fixed, when a downstream Modbus master (SCADA, RTU, or third-party PLC) needs registered access to DB-resident process data, or when an IM 151-8 PN in the loop lacks the Modbus server blocks and the license dongle is undesirable.

This article documents the production integration path validated on TIA Portal V13.2 SP1 through V20 with S7-1200 firmware V4.0 and higher. SYCON.net gateway configuration, sub-module slot assignment, and S7-1200-side data exchange using MOVE, MOVE_BLK, and consistent-view transfers via the standard Profinet read/write instructions are covered step by step.

Network Topology

Prerequisites

• TIA Portal V13.2 SP1 minimum. V14, V15, V16, V17, V18, V19, and V20 are fully compatible; later versions inherit GSD imports and add Profinet security diagnostics.
• S7-1200 CPU firmware V4.0 or higher (any CPU 1211C, 1212C, 1214C, 1215C, 1217C). V4.2 is the minimum for consistent-view transfers without warning.
• Hilscher NT 100-RE-PN gateway, host name label visible on the housing.
• SYCON.net configuration software (current LTS revision, downloaded from Hilscher). The DBM template for the NT 100-RE-PN is installed with SYCON.net.
• GSDML file matching the gateway firmware revision. Use the version Hilscher tags on the device label (for example GSDML-V2.31-Hilscher-NT100-REPN-20221115.xml).
• Industrial Ethernet managed switch (Scalance, IE, Phoenix FL, Cisco IE) for topology and DCP-based commissioning. An unmanaged switch works for static point-to-point setups.
• PG/PC Ethernet adapter with routing rights to the CPU subnet.
• Modbus master for verification: Modbus Poll, CAS Modbus Scanner, or the host PLC with MB_CLIENT.
• Shielded Profinet cable (Cat 5e or higher) and RJ45 connectors rated for industrial use.

Step 1 — Install the GSDML into TIA Portal

1. Open the project in TIA Portal and close the hardware catalog pane to avoid refresh conflicts during install.
2. Choose Options > Manage device description files (GSD).
3. Set Source path to the folder holding the unpacked GSDML.
4. Select the relevant GSD row and click Install.
5. Confirm the message "Device description file has been successfully installed".
6. Open Hardware catalog > Other field devices > PROFINET IO > Gateway > Hilscher > NT 100-RE-PN. The device icon should now appear.
7. For TIA Portal V14 or higher, install the matching HSP if Hilscher publishes one; this is optional but speeds future firmware roll-outs and offers signed firmware trust chains.

Step 2 — Add the Gateway to the Profinet Subnet

1. Open Devices & Networks.
2. Drag the NT 100-RE-PN from the catalog onto the Profinet subnet. A dotted link appears, indicating an unbound IO controller.
3. Drag from the S7-1200 Profinet port to the gateway port to bind the IO controller assignment; the dotted line becomes solid and the gateway shows the CPU owner.
4. Open the gateway's Properties > General tab.
5. Assign an IP address on the same subnet as the CPU, outside the DHCP/DCP pool of any managed switch.
6. Set the Profinet device name; record it on the device label and inside the cabinet drawing for maintenance.
7. Confirm the watchdog time and send clock under Properties > Profinet Interface > Advanced.

Step 3 — Slot and Sub-Module Assignment

The NT 100-RE-PN provides slots 0 through 31. Slot 0 is the head module (always present). Slots 1 through 31 are populated with read, write, or read/write sub-modules. Each populated slot contributes 20, 32, or 64 input bytes, output bytes, or both, and the sum cannot exceed 512 input + 512 output bytes globally.

Sub-Module Insertion Procedure

1. Double-click the gateway in the network view to enter Device view.
2. Confirm slot 0 shows the head module with the assigned Profinet device name.
3. From the catalog, expand the sub-module folder under the NT 100-RE-PN entry.
4. Drag the required sub-module onto slot 1, slot 2, and so on, in the order you want bytes to appear in the process image.
5. After each insertion, hover the slot to confirm the hardware identifier (HW ID) and the auto-assigned %I/%Q start bytes (for example %IB68-%IB131 / %QB68-%QB131).
6. Continue inserting sub-modules until the total bytes suffice for the Modbus register map. Modbus register to byte conversion: 16-bit register = 2 bytes; swap byte order via SYCON.net if the master expects big-endian.
7. Compile the hardware. TIA Portal rebuilds the IO address list; record the start and end byte of every populated slot for SYCON.net mapping.

Step 4 — SYCON.net Configuration

1. Start SYCON.net, choose File > Open, select the NT 100-RE-PN template (DBM).
2. On the Profinet tab, enter the same device name assigned in TIA Portal (case sensitive).
3. Confirm the Profinet IP matches the TIA assignment.
4. Open the Modbus tab. Choose TCP/IP or RTU based on the field wiring.
5. Set the Modbus server station address (1-247 for RTU; 502 / TCP default port).
6. For RTU: set baud rate, parity, data bits, stop bits; pay attention to "Stop bits = 1" if parity is even/odd, "Stop bits = 2" if none.
7. In the Register Mapping table, assign each Modbus function-code register to a Profinet %I/%Q byte range. Holding registers 4xxxx are bidirectional, input registers 3xxxx are read-only.
8. Configure the byte order: most masters expect big-endian for register contents; Hilscher defaults to little-endian. Reverse only if the master confirms.
9. Save, then choose Online > Download through the gateway service port (USB mini-B or Ethernet DCP).

Step 5 — PLC Data Exchange

5.1 Simple Byte Move (SCL)

For non-time-critical status data, individual byte moves are adequate and easy to read:

// Copy S7-1200 tag to gateway %Q area (Modbus 4xxxx write)
"DB_ProcessData".ModbusWrite[0] := %QB68;   // Bits 0-7
"DB_ProcessData".ModbusWrite[1] := %QB69;   // Bits 8-15
...
// Copy gateway %I area (Modbus 3xxxx read) into S7-1200 tag
%IB68 := "DB_ProcessData".ModbusRead[0];
%IB69 := "DB_ProcessData".ModbusRead[1];
...

Ladder equivalent uses a single MOVE_BLK block with the byte count and the source/destination tag.

5.2 Consistent-View Transfer (PRD / PWR)

Multibyte transfers that must not be torn mid-read require a consistent-view block. Use the Profinet standard read instruction on V4.2 and later:

"PRD" (REQ := "bTrigger",
       LADDR := 100,            // HW ID of the gateway head or slot
       RET_VAL := "dbStatus".retVal,
       BUSY := "dbStatus".busy,
       RECORD := "DB_ProcessData".InputArea);

"PWR" (REQ := "bDoWrite",
       LADDR := 100,
       RECORD := "DB_ProcessData".OutputArea,
       RET_VAL := "dbStatus".retValW,
       BUSY := "dbStatus".busyW);

These instructions read or write the full sub-module consistently without interleaving with Profinet updates. The RECORD parameter must be a known-length contiguous tag — typically a structed global DB.

5.3 Identification and Maintenance Data with Get_IM_Data

The Get_IM_Data instruction reads Identification and Maintenance records from any Profinet IO device, including the Hilscher NT 100-RE-PN. Use it to confirm vendor, serial number, hardware revision, and firmware tag during commissioning or for inventory reconciliation in a CMMS.

"getIM0" (REQ := "bTrigger",
          LADDR := 100,
          IM_TYPE := 0,            // 0 = I&M0, 1 = I&M1, ... 4 = I&M4
          DB_VAR := "DB_ProcessData".imData,
          RET_VAL := "dbStatus".imRetVal,
          BUSY := "dbStatus".imBusy);

Valid I&M types for the NT 100-RE-PN are 0, 1, 2, and (with newer firmware) 3 and 4. A non-zero RET_VAL without BUSY indicates I&M data fetched successfully.

5.4 Block Diagram of Data Flow

Step 6 — Compile and Download

1. Mark the S7-1200, right-click, Compile > Hardware (rebuild all).
2. Right-click, Download to device > Hardware and Software.
3. Choose the PG/PC interface type (PN/IE) and select the CPU.
4. In the Profinet device name dialog, confirm nt-100-re-pn (or the assigned name) and accept.
5. Once the gateway reports "Connected" in the IO diagnostics view, proceed to online monitoring.
6. If the gateway reports a station fault, see the troubleshooting matrix.

Online Diagnostics and Monitoring

With the gateway online, TIA Portal provides several diagnostic views:

• Devices & Networks > Topology view: green links show established Profinet connections; orange indicates degraded; red signals a fault. Use this for quick cable-fault localization.
• Online & Diagnostics > PROFINET diagnostics: per-device port statistics (frame errors, send clock, sync state).
• Watch table on the gateway's %I and %Q areas: enable or force individual bits to verify SYCON.net mappings address correctly.
• SYCON.net > Online > Modbus traffic monitor: logs every Modbus frame, including FC, register address, and byte count.
• Get_IM_Data polling from the PLC: vendor "Hilscher", firmware "V4.1.42" or similar, confirms configuration committed.
• CPU diagnostic buffer entries such as "PROFINET IO: Device failure", "Sub-module fault", or "Watchdog timeout" indicate specific gateway issues that map to the troubleshooting matrix below.

Verification Checklist

• Gateway DCP name matches the TIA-assigned name; SYCON.net matches.
• All sub-module slots populated; no module-fault LED.
• Watchdog time on the gateway comfortably above the configured send cycle (at least 3×).
• Modbus register map in SYCON.net agrees with the IO address list in TIA.
• External Modbus master reads 40001 and 40017 within one Profinet send cycle of new values.
• Get_IM_Data with IM_TYPE=0 returns vendor "Hilscher" in the assigned DB.
• PRD/PWR blocks on a different controller (when migrating) report OK status.
• Substitute value behavior confirmed and documented.
• Cable shields terminated at one end on grounded cabinet rails.
• CMMS record updated with serial number and firmware tag.

Proactive Maintenance and Firmware Strategy

• Capture the initial SYCON.net project and TIA hardware configuration immediately after commissioning; archive under the cabinet drawing revision.
• Schedule quarterly diagnostics polling: Get_IM_Data for vendor and firmware, then SYCON.net > Online > Modbus traffic monitor for FC and exception counts.
• Watch the CPU diagnostic buffer for "Device return", "Device failure", or "Sub-module removed" events; even one occurrence per week signals a flake.
• Keep firmware and GSDML revision-aligned. After a gateway firmware change, immediately update the GSDML in the TIA project and re-download.
• Before any firmware upgrade, snapshot the SYCON.net project and the TIA archive. Roll forward only after a successful read-back test.
• Track spare inventory: one fully configured spare NT 100-RE-PN per line reduces MTTR on field failures.
• On V4.1.42 and higher, enable Profinet Signed Device Identification for tamper evidence; document the rotated secrets.

Multi-Gateway and Redundant Configurations

• Each gateway occupies its own IP and Profinet device name; address plan from a flat DHCP-exclusion range (for example .40-.79 for gateways).
• For read-heavy downstream SCADA, deploy two gateways in parallel: one as primary read source, one as standby, switched via Modbus TCP station address mapping inside the SCADA driver.
• Total per-direction byte capacity remains 512 per gateway; multi-gateway setups sum capacities.
• Ensure the S7-1200 firmware supports the number of Profinet IO devices you deploy; older V4.0 firmware limits to 32 IO devices; V4.4 raises to 128.
• For redundant ring topologies, use Scalance XC or Phoenix FL managed switches with MRP; the gateway itself does not need configuration change.
• For redundancy on the S7-1200 side, no standard H redundancy applies; deploy two S7-1200 CPUs in parallel, each with its own gateway, and elect a data source at the SCADA.

Migrating from PUT/GET to Native PRD/PWR

Projects that started with PUT/GET blocks to push DB data to a Hilscher gateway can be migrated to native consistent-view transfer with three edits.

1. Replace the PUT block call with PWR, using the gateway HW identifier (not the slot default) and the same DB area.
2. Replace the GET block call with PRD with matching LADDR and RECORD.
3. Enable "Permit access with PUT/GET communications from remote partners" only as a temporary measure; once native blocks are stable, disable the option to harden the CPU.

Performance improves because native blocks read consistent data per Profinet frame; PUT/GET rely on local process-image copies and can tear across multiple bytes.

Troubleshooting Matrix

Variations Across Firmware and Tools

• TIA Portal V14+ offers the Profinet Security level 1 dialog; the NT 100-RE-PN supports Signed Device Identification on firmware V4.1.42 and higher.
• S7-1500 behaves identically: same slot semantics, same block interface for Get_IM_Data. The only difference is the head module OB1 cycle time budget.
• PRONETA can be used to bulk-assign DCP names across many gateways before loading the TIA config.
• STEP 7 V5.5 still supports the V2.3 GSD; slot numbering matches TIA Portal V13 and higher.
• For high-availability scenarios, slot 0 can hold an additional "redundancy" sub-module that re-issues the same register map on both channels; configure only after consulting the Hilscher application note.
• For safety applications, only Standard PROFIsafe sub-modules are supported; the gateway does not pass PROFIsafe through to the S7-1200.
• For headless commissioning without TIA, the Hilscher web UI on port 80 of the gateway exposes basic configuration download and a register monitor.

Operational and Safety Notes

• The NT 100-RE-PN must be powered from a regulated 24 V DC source compliant with IEC 61131-2; SELV/PELV on a Class 2 supply.
• Torque the RS-485 terminals to 0.22 Nm and apply a 120 Ω termination only on the two extreme ends of the bus.
• Maintain 50 mm clearance around the gateway housing for ventilation. The unit dissipates up to 3 W at full Modbus traffic.
• Configure Modbus RTU at 1/4 unit load or lower for multi-drop; otherwise RS-485 driver damage can occur if the gateway is the first or last node and the bus termination is active.
• Use shield-grounded Profinet cable (foil + braid) within 100 m of the switch to keep EMC class A.
• Do not run the gateway near variable-frequency drives or welding equipment without proper shielded cabinet design.
• Before any firmware upgrade, capture the current SYCON.net project and TIA hardware configuration for rollback.
• Document Modbus register maps in the cabinet binder; SCADA engineers usually lack TIA Portal access on field calls.

Performance and Timing

End-to-end latency from a DB write on the S7-1200 to a Modbus register update at the master is the sum of:

1. PLC scan time (typically 1-10 ms, configurable).
2. Profinet send clock × reduction ratio (typical 1 ms × 1 = 1 ms).
3. Gateway internal copy from %Q area to Modbus register bank (typical 0.5 ms).
4. Modbus RTU transmission: t_char = 11 / baud seconds per character; or TCP dominated by ACK delay (~5 ms on a local subnet).

Worked example: OB1 scan = 10 ms, send clock = 1 ms, reduction = 1, RTU baud = 19200, full 32-byte Modbus transaction approximates 20 ms transmission. Worst-case round trip ≈ 31 ms. At 115200 baud and 1 ms send clock the round trip drops under 15 ms. For Modbus TCP on the same switch the worst case is ≈ 18 ms.

Time-budget heavy phases: Profinet send clock, OB1 main scan, Modbus RTU framing. Time-budget light phases: SYCON.net register copy (deterministic), PRD/PWR block execution (typically one OB1 cycle).

FAQ