S7-1200 CM1243-5 PROFIBUS Master: Communicating with VPC3+S Slave

Overview

This reference documents how to commission a Siemens SIMATIC S7-1200 CPU fitted with a CM 1243-5 communications processor as a PROFIBUS DP Class 1 master, talking to a custom PROFIBUS DP slave built around the VPC3+S protocol ASIC. The pattern is common when prototyping a power supply, motor drive, valve manifold, or sensor head: the host microcontroller is paired with a VPC3+S, and a TIA Portal project on the S7-1200 exchanges cyclic process data plus HEX command strings with that device.

The CM 1243-5 plugs into the left-side communication bay of any S7-1200 CPU (firmware V4.0 or later recommended) and presents a 9-pin D-sub female PROFIBUS interface. The VPC3+S is a Profichip / HMS Networks PROFIBUS-DP slave controller that implements the full DP-V0 state machine and exposes a parallel or SPI host interface to the device microcontroller. Communication is fully cyclic once data exchange is reached; HEX command payloads are sent as raw bytes in the output process image, and the slave's response is read back from the input process image.

Prerequisites

Hardware

• S7-1200 CPU (1211C, 1212C, 1214C, 1215C, 1217C) with firmware V4.0 or later
• CM 1243-5 PROFIBUS DP Master module - Siemens part number 6GK7243-5DX30-0XE0
• VPC3+S-based slave device plus the vendor's GSD file (typically *.gsd with an accompanying *.bmp bitmap)
• PROFIBUS DP cable (purple, shielded twisted pair - e.g. Siemens 6XV1830-0EH10)
• PROFIBUS D-sub connectors with built-in termination resistors (activate ONLY on the two end nodes)
• 24 VDC system power supply sized for the S7-1200 plus CM 1243-5

Software

• TIA Portal V15 / V15.1 / V16 / V17 with STEP 7 Professional license
• The vendor-supplied GSD file matching the VPC3+S firmware revision

Physical Bus Limits

Maximum of 32 stations per segment. Termination is the classic PROFIBUS bias network: pull-up 390 Ω to +5 V on pin 6, pull-down 390 Ω to GND on pin 5, and 220 Ω between pins 3 and 8. Activate at both physical ends only.

Step 1: Install the GSD File

1. In TIA Portal project view choose Options → Manage general station description files (GSD).
2. Browse to the directory that contains the *.gsd file. Place the matching bitmap in the same folder so the slave appears with a vendor icon.
3. Select the file and click Install. The slave is added under Hardware Catalog → PROFIBUS DP → Other field devices → [Vendor] → [Model].
4. Close the dialog and refresh the Hardware Catalog if the device is not yet visible.

Step 2: Insert the CM 1243-5 into the S7-1200 Station

1. Open Devices & Networks and double-click the S7-1200 station.
2. From the Hardware Catalog, drag CM 1243-5 from Communication modules → PROFIBUS to slot 101 of the CPU rack.
3. Open the CM 1243-5 properties and assign:
   • PROFIBUS address (default 2 for the master is conventional, but any unused 1-126 value is valid).
   • Baud rate: Auto is recommended for the master - the VPC3+S will negotiate to the highest mutually supported rate.
4. The CM 1243-5 draws up to 150 mA at 5 V on its PROFIBUS interface per the CM 1243-5 operating instructions. The 24 V supply for the S7-1200 backplane must account for this load.

Step 3: Add the VPC3+S Slave to the Network

1. Drag the VPC3+S slave from the Hardware Catalog into the network view.
2. Click the CM 1243-5 PROFIBUS port, hold, and drop the connection on the slave - this creates the PROFIBUS subnet.
3. Open the slave properties and assign a unique PROFIBUS address (1-126). Address 0 is reserved for the master, 127 is the broadcast address.

Step 4: Configure the Telegram and Slot Layout

The slot configuration is the heart of PROFIBUS DP. The VPC3+S presents a Head module at slot 0 (the DPV0 interface) and one or more I/O modules below it. Each inserted module becomes a byte or word of cyclic process data.

1. Double-click the slave in the device view.
2. The right-hand pane shows the slot table. The Head row is always present - do not delete it.
3. From the catalog, drag I/O modules into empty slots. For a 4-byte command / 4-byte status layout, add 4 Byte Input and 4 Byte Output.
4. For each module, TIA Portal displays the starting address in the process image (e.g. 0) and the byte count. Click the address value to remap it if it conflicts with another module.

Step 5: Build a PLC Data Type (UDT) for Symbolic Access

Absolute addressing breaks the moment the slot layout changes. A UDT gives you a symbolic name that survives renumbering and is self-documenting.

1. In the project tree right-click PLC data types → Add new data type.
2. Name it UDT_VPC3S_Out and define four Byte fields for the output side:

TYPE "UDT_VPC3S_Out"
VERSION : 0.1
  STRUCT
    CmdHi  : BYTE;   // QB0 - high byte of command word
    CmdLo  : BYTE;   // QB1 - low byte of command word
    Param1 : BYTE;   // QB2 - parameter byte 1
    Param2 : BYTE;   // QB3 - parameter byte 2
  END_STRUCT;
END_TYPE

3. Create UDT_VPC3S_In for the four status bytes (mirrored structure, or with field names matching the slave firmware's status register map).

Step 6: Declare Symbolic PLC Tags

1. Open PLC tags → Show all tags → Add new tag.
2. Create a tag CmdOut of data type UDT_VPC3S_Out with address %QB0.
3. Create a tag StatusIn of data type UDT_VPC3S_In with address %IB0.
4. In the tag properties enable Accessible from HMI / OPC UA and Writeable from HMI / OPC UA as needed so the PC can write HEX strings in via the HMI/OPC tag table.

Step 7: Write the Program Logic for HEX Command Strings

The PC usually delivers the HEX string over PROFINET, OPC UA, or a TCP connection terminated on the S7-1200. From there, two patterns cover almost all cases.

Pattern A - Direct symbolic assignment (OB1 cyclic code)

// Structured Text (SCL)
IF "bSendCmd" THEN
    "CmdOut".CmdHi  := 16#01;
    "CmdOut".CmdLo  := 16#10;
    "CmdOut".Param1 := 16#AA;
    "CmdOut".Param2 := 16#55;
    "bSendCmd" := FALSE;
END_IF;

Pattern B - Block move from a buffer (longer commands)

// ST - moves 16 bytes from a DB into the output process image
IF "bBurstSend" AND ("iBurstLen" <= 16) THEN
    "BLKMOV"( srcblk := "dbHexPayload".hex[0],
              dstblk := P#%QB0 BYTE "iBurstLen",
              count  := "iBurstLen" );
    "bBurstSend" := FALSE;
END_IF;

Step 8: Verification with Watch Tables

1. Add a new watch table: Add new watch table → WatchTable_VPC3S.
2. Drag the symbolic tags CmdOut and StatusIn into the table.
3. Click the Monitor all (glasses) icon. Both rows update once per OB1 cycle.
4. To force a value during commissioning, type the new value in the Modify value column and click Modify now. Acknowledge the safety prompt.
5. Expected LED pattern on the CM 1243-5: PWR solid green, DIAG solid green, DXCHG solid green when at least one slave is in data exchange.

Step 9: Bring the Slave into Data Exchange

1. Compile and download the hardware configuration. The CM 1243-5 only takes the new slot layout after a configuration download, not after a program-only download.
2. Open Online & Diagnostics → PROFIBUS → Slave diagnostics on the CM 1243-5.
3. Verify the VPC3+S slave reports state Data exchange. If it stays in Wait Prm or Wait Cfg, the parameterization or configuration telegram is being rejected - usually a GSD/ firmware mismatch.
4. Toggle a HEX value in the watch table, then use the slave's microcontroller debug port or a PROFIBUS tap to confirm the bytes arrived intact and in the right order.

Byte Order, Endianness and Alignment

PROFIBUS DP transfers bytes in the slot order without any implicit byte-swap. The VPC3+S hands the bytes to the host microcontroller in the same order they appear on the wire. If the host code interprets a 16-bit register as little-endian while the S7-1200 writes big-endian, you must swap in the PLC:

// Byte-swap a 16-bit HEX command word for an LE slave
"CmdOut".CmdLo := "iCmdHiByte";
"CmdOut".CmdHi := "iCmdLoByte";

For payloads wider than 4 bytes, the VPC3+S supports up to 244 total input bytes and 244 total output bytes - split the I/O across multiple slots (e.g. 16 Byte Input + 16 Byte Output) to get the throughput you need without bumping into the per-slot limit.

Handshake Pattern for Long Commands

If a command takes longer than one cycle to execute on the slave, the master must not overwrite the output bytes before the slave finishes. Reserve one byte in each direction as a handshake pair:

This is the simplest pattern that decouples master cycle time from slave execution time. The OB1 logic only writes the new command when byte 0 reads 0xFF, and the slave only overwrites the response buffer after the master has acknowledged the previous response.

Troubleshooting Matrix

Diagnostic Tools

• TIA Portal Online & Diagnostics on the CM 1243-5: shows slave state, last error, telegram counts, and bus statistics.
• Watch tables: real-time I/O monitoring with the ability to force values during commissioning.
• Siemens PRONETA: free network diagnostic tool that lists every PROFINET and PROFIBUS node on the bus and reports configuration drift.
• PROFIBUS Diagnostic Repeater (6ES7972-0AB01-0XA0): inline PROFIBUS tap with a web interface that decodes every telegram and logs faults with timestamps.
• Procentec ProfiHub / ProfiTrace or Softing PB-TM: third-party PROFIBUS protocol analyzers useful when chasing timing or signal-integrity issues.

Field-Proven Caveats

• The VPC3+S Ident number is hard-coded in firmware - if you swap firmware revisions (e.g. V3.4 to V4.2) without updating the GSD, the master rejects the parameterization telegram and the slave stays in Wait Prm. Always rebuild the project after a firmware update.
• The first byte of the slot table (slot 1) is not always byte 0 in the slave's host interface. Many VPC3+S designs reserve the first byte for a status word and start the user's command payload at byte 1. Read the host firmware's memory map before assuming QB0 = command[0].
• If you change baud rate or add a repeater, the CM 1243-5 will re-detect but slaves sometimes need a power cycle to renegotiate cleanly.
• The CM 1243-5 supports DPV1 (acyclic services and alarms) as a Class 1 master. Enable DPV1 in the slave's properties only if the VPC3+S firmware handles the MSAC1_Read and MSAC1_Write services, otherwise the master will time out trying to open a slot.

FAQ