S7-1500 I-Device to S7-300 PROFINET Bidirectional Troubleshooting

Problem Summary

A field scenario that surfaces routinely during brownfield integration: an existing SIMATIC S7-300 station (engineered in SIMATIC Manager / STEP 7 V5.5 or V5.6) must accept status flags from a new S7-1500 controller (engineered in TIA Portal V16, V17, or V18). The S7-1500 is configured as a PROFINET I-Device, the GSD is exported and installed on the S7-300 side, and the IO Controller slot is wired. The observed result is asymmetric: S7-300 outputs reach the S7-1500 inputs correctly and respond to forcing on the controller side, but S7-1500 outputs never appear at the S7-300 inputs. This is a directional defect, not a media, GSD, or wiring fault. The fix is procedural and resolves into three checks: transfer area direction, program-side block presence, and byte-granular I/O access.

Affected Components, Catalog Numbers, and Firmware

Root Cause Analysis

Three failure modes produce the exact symptom reported — one direction works, the reverse direction appears dead. They appear in order of statistical frequency on support tickets.

Cause 1: Transfer Area Direction Reversed on the S7-1500 I-Device

In TIA Portal, when the S7-1500 is configured as an I-Device (Device → Properties → PROFINET interface → Operating mode → I-Device), the Transfer areas table contains rows with a Direction column settable to either Input or Output from the I-Device's perspective. The same area is automatically inverted at the IO Controller: an S7-1500 Output transfer area appears as an S7-300 Input slot, and vice versa. If the engineer defines the area intended for S7-1500 → S7-300 traffic as Input on the I-Device, the I-Device reads from the IO Controller every PROFINET cycle, and any local writes to that byte are overwritten by the controller's transmit buffer within a few milliseconds. Forcing the bit on the S7-300 transmitter side then works (Cause 2 is correct on that path), but writing on the S7-1500 side has no observable effect downstream.

The fix is to set the transfer area holding the S7-1500 outputs to Output on the I-Device. The same area then appears as Input on the S7-300 GSD import, and bit forcing on the I-Device propagates correctly.

Cause 2: Missing PNIO_SEND / PNIO_RECV Blocks on the S7-300

When the S7-300 PROFINET interface is hosted by an external CP 343-1 (not the CPU-integrated X2 port), the IO Controller functionality runs on the CP. The CPU user program is responsible for shuttling I/O data between the CP's dual-port RAM and the S7-300 process image. This exchange is performed by two function blocks:

• PNIO_SEND (FC11) — pushes outputs from the S7-300 process image into the CP's transmit buffer.
• PNIO_RECV (FC12) — pulls received inputs from the CP's receive buffer into the S7-300 process image.

These blocks are not in the standard STEP 7 library. They ship with the SIMATIC_NET_CP library, which is part of the SIMATIC NET PC software or the optional S7-300/400 PN-CP installation package. Without these blocks being called from OB1 (or a higher-priority cyclic OB), the CP's I/O data never crosses the backplane to the CPU, and the process image remains at its last-known or zero state on one or both sides.

If the S7-300 uses its CPU-integrated PROFINET port (X2 on the CPU 315-2 PN/DP, CPU 317-2 PN/DP, CPU 319-3 PN/DP), PNIO_SEND / PNIO_RECV are not required because the I/O update is performed automatically by the CPU firmware.

Reference: Siemens Entry ID 109476499 — S7-300 PN IO Controller configuration example.

Cause 3: Bit-Level Access Inside a Byte-Granular Slot

PROFINET IO exchanges slot data in byte-aligned units. The minimum slot length is 1 byte; there is no bit-granular I/O transfer on PROFINET or PROFIBUS-DP. A boolean tag at I46.0 occupies one bit inside byte IB46, but the entire byte IB46 travels on the wire. If the S7-300 program references only I48.0 while the I-Device is writing to bits in byte IB46 that are not I48.0, the S7-300 reads back the byte, masks a wrong bit, and concludes the link is dead. This is harmless in one direction if the controller happens to write only the bits of interest, but it surfaces immediately in the reverse direction the moment the S7-300 program starts to use boolean logic against bits the I-Device is not actually controlling.

The fix is to access the byte as a unit and mask the bit, or assign symbolic names that resolve through the byte. Example patterns:

L IB46
T MB100
A M100.0
= Q48.0

Or use the symbolic I/O names from the S7-300 HW config (e.g., I_Device_In.Byte0.X0) rather than absolute addresses that may collide with the slot boundary.

Architecture and Data Flow

The bidirectional exchange is two independent transfer areas. Each direction has its own byte-aligned slot. The slot IDs must not overlap, and each must be declared with the correct direction on both sides.

The two paths are physically the same PROFINET frame, but they are logically independent transfer areas. A defect in one path leaves the other untouched, which is precisely the asymmetry reported in the field ticket.

Hardware Prerequisites

1. S7-1500 CPU with PROFINET interface (firmware V2.0 minimum, V2.6+ recommended for shared-device support and TIA Portal V18 compatibility).
2. S7-300 CPU with PROFINET support — either CPU-integrated X2 (315-2 PN/DP, 317-2 PN/DP, 319-3 PN/DP) or CP 343-1 non-Lean (6GK7343-1EX30, 6GK7343-1GX31).
3. PROFINET cable (Cat 5e or higher, copper or fiber via SCALANCE) terminated at both ports. Verify link LEDs and port statistics.
4. Common Ethernet subnet (e.g., 192.168.0.0/24). S7-1500 I-Device and S7-300 IO Controller must share the same subnet mask; routing is not supported on PROFINET IO.

Software Prerequisites

• TIA Portal V16, V17, or V18 with the S7-1500 HSP (Hardware Support Package) for the exact CPU order number.
• STEP 7 V5.5 + SP2 or V5.6 with the matching CPU and CP HSPs.
• SIMATIC NET CD / installation package containing the SIMATIC_NET_CP library (needed only if a CP 343-1 is in use). Library version should match the CP firmware.
• GSD file exported from the S7-1500 project (XML, installable via HW Config → Options → Install GSD File).

Step-by-Step — S7-1500 I-Device Configuration in TIA Portal

1. Open the S7-1500 project in TIA Portal and select the CPU in the project tree.
2. Open Device view → click the PROFINET interface (X1 or X2, depending on the topology).
3. In Properties → General → Operating mode, tick I-Device. The role is now dual: the CPU remains a controller for its own lower-level PROFINET (if any) and becomes an I-Device toward the upper-level controller.
4. In Properties → General → Real time settings → Transfer areas, click Add new transfer area.
5. Configure the first transfer area as follows:
   • Name: ToS7300_StatusFlags
   • Direction: Output (data flows from S7-1500 to S7-300)
   • Start address: 46 (byte offset in S7-1500 process image)
   • Length: 1 byte
6. Add the second transfer area:
   • Name: FromS7300_Commands
   • Direction: Input (data flows from S7-300 to S7-1500)
   • Start address: 50
   • Length: 1 byte
7. Set the I-Device PROFINET device name (e.g., s7-1500-idev-01) and IP address (e.g., 192.168.0.10/24).
8. Compile the S7-1500 project and download hardware configuration.
9. Export the GSD: Project → Export → PROFINET GSD. Select the I-Device and the desired GSDML schema version. Save the ZIP.

Reference: Siemens Entry ID 109478798 — I-Device Function in Standard PN Communication (PDF).

Step-by-Step — S7-300 IO Controller Configuration in SIMATIC Manager

1. Open the S7-300 project in SIMATIC Manager. Confirm the S7-300 station is at the correct PN IP (e.g., 192.168.0.20/24).
2. In HW Config, install the GSD if not already present: Options → Install GSD File. Browse to the exported ZIP from the S7-1500 side.
3. After install, locate the I-Device in the catalog under PROFINET IO → I-Devices → <vendor> → <CPU order number>.
4. Drag the I-Device onto the PROFINET IO system. Assign it to the same subnet as the S7-300.
5. Confirm the device name matches what is configured on the S7-1500 (e.g., s7-1500-idev-01). Mismatched device names are the #1 cause of "device not found" errors during startup.
6. Double-click the I-Device slot to open its slot configuration. You will see two slots corresponding to the two transfer areas defined in TIA Portal:

7. Compile and download the HW Config to the S7-300 station.
8. Use PLC → Ethernet → Assign PROFINET device name if the S7-1500 device name was not yet assigned via TIA Portal. The tool writes the name into the I-Device's permanent storage.

Step-by-Step — PNIO_SEND / PNIO_RECV Programming on S7-300

Skip this section if the S7-300 uses its CPU-integrated PROFINET port (no CP). Apply the blocks only if a CP 343-1 is the PROFINET interface.

1. In SIMATIC Manager, open the S7-300 project and the Libraries pane.
2. Locate SIMATIC_NET_CP → CP 300 → FC11 PNIO_SEND and FC12 PNIO_RECV.
3. Drag both FBs into the S7-300 program blocks. Open OB1.
4. Call PNIO_SEND (FC11) with the parameters from the table below.
5. Call PNIO_RECV (FC12) with the parameters from the table below.

CALL FC 11 // PNIO_SEND
CPLADDR :=W#16#0100
SEND    :=P#Q 50.0 BYTE 1
DONE    :=M110.0
ERROR   :=M110.1
STATUS  :=MW112

CALL FC 12 // PNIO_RECV
CPLADDR :=W#16#0100
RECV    :=P#I 46.0 BYTE 1
NDR     :=M113.0
ERROR   :=M113.1
STATUS  :=MW114

Bidirectional Boolean Tag Exchange Example

The following ST code on the S7-1500 side demonstrates the correct read/write pattern. Bits are extracted from the byte received from the S7-300 and packed into the byte sent back. Avoid writing the same byte from both the user program and an I-Device transfer area at the same OB cycle — PROFINET IO updates at the cycle-checkpoint OB priority (typically OB82 / OB86 in background, or end of OB1), so consistent reads and writes between OB1 boundaries are safe.

// S7-1500 user program (TIA Portal, SCL)
// Byte received from S7-300 (Transfer Area "FromS7300_Commands", IB50)
IF "FromS7_300".Ack_Fault THEN
    "Latching_Fault_Ack" := TRUE;
END_IF;

IF "Latching_Fault_Ack" THEN
    "ToS7_300".Process_A_Running := TRUE;
END_IF;

"ToS7_300".Heartbeat := NOT "Clock_1Hz";
// Byte sent to S7-300 occupies QB46 (Transfer Area "ToS7300_StatusFlags")

On the S7-300 side (STEP 7 STL), the equivalent access:

// S7-300 OB1 — STL
// Inputs from S7-1500 I-Device occupy IB46
L IB 46          // read entire byte
T MB 100         // copy to flag byte for symbolic use
A M 100.0        // bit 0 = Process_A_Running
= Q 8.0          // local output to existing hardware

A M 100.7        // bit 7 = Process_Fault
S M 101.0        // latch fault

Diagnostics and Online Monitoring

Open the following tools to confirm the data path in real time:

1. TIA Portal — Online → Online & diagnostics → PROFINET diagnostics. The I-Device view shows whether the S7-1500 has established an AR (Application Relationship) with the S7-300. Status "Connected" with green check on the partner indicates the AR is up.
2. SIMATIC Manager — PLC → Monitor / Modify on the S7-300. Watch IB46 and QB50 in real time. If IB46 remains at 0 while QB50 changes are visible at the S7-1500 side, the issue is in the S7-300 receive path (Cause 2 — missing PNIO_RECV, or wrong CPLADDR).
3. PRONETA (free Siemens tool) provides a graphical topology and slot view. It is the fastest way to confirm the I-Device is online, the slots are configured, and the cyclic data is flowing.
4. S7-300 diagnostic buffer (PLC → Diagnostics/Settings → Diagnostic buffer). Look for events of class "IO fault" or "Station failure" on the CP slot. Common error codes:
   • 0x001E Station failure (physical layer or device name mismatch).
   • 0x001F Station return (recovery).
   • 0x0002 Module/IO access error — wrong CPLADDR or wrong slot.

Common Pitfalls and Field-Proven Checks

• Device name mismatch. The PROFINET device name on the I-Device (assigned in TIA Portal or via PRONETA) must match exactly the name placed under the I-Device slot in the S7-300 HW Config. Names are case-sensitive and must include hyphens, not spaces.
• CP 343-1 Lean used by mistake. Check the order number suffix: CX00 / CX10 = Lean (cannot be IO Controller). Use EX30 / GX31 for IO Controller capability.
• PNIO_SEND / PNIO_RECV called from the wrong OB. Call them from OB1 (priority class 1). They must not be called from OB100 (warm restart), OB101 (hot restart), or OB102 (cold restart) — the CP is not initialized at those points.
• Overlapping I/O addresses. If IB46 in the I-Device mapping overlaps a real input module on the S7-300 (e.g., an actual DI module at slot 4 also starts at IB46), the second writer wins. Either remap the I-Device area or move the local module.
• Process image partition mismatch. If OB1 uses process image partition PIP 1 and PNIO_RECV updates PIP 3, the data never reaches the cyclic OB. Configure all I/O to PIP 1 for simplicity, or align partitions.
• Symbolic vs. absolute name confusion. Avoid using absolute addresses (I46.0) directly in the user program on the S7-300; instead, use the symbol table to map symbolic names (e.g., iDev_FromS71500_Bit0) to the I-Device slot bytes. This prevents accidental overlap with future HW changes.
• Forcing inputs that are outputs from the network. Forcing IB46 on the S7-300 forces the local view but does not transmit — and may be silently overwritten by PNIO_RECV on the next call. Do not force bytes that are network-received.
• GSD version drift. After modifying the S7-1500 transfer areas, re-export the GSD and re-install on the S7-300 side. Old GSDs silently retain the previous slot configuration.

Verification Procedure

1. Power cycle both controllers. Observe PROFINET LEDs: S7-1500 port X1 BF (bus fault) LED must be off; S7-300 X2 / CP 343-1 LINK and RX/TX activity LEDs must be solid or flickering.
2. Open PRONETA and confirm both stations are reachable. Capture the network topology screenshot for the commissioning folder.
3. From TIA Portal, force a single bit on the S7-1500 in the Output transfer area (e.g., set ToS7_300.Process_A_Running := TRUE). Watch IB46 on the S7-300 — the corresponding bit must toggle within one PROFINET update cycle (typically 1 ms).
4. From STEP 7, set a bit in QB50 on the S7-300 and confirm it appears in the Input transfer area on the S7-1500 (IB50).
5. Read STATUS of FC11 and FC12 on the S7-300. Healthy state is STATUS = 0x0000 and DONE / NDR pulsing each cycle.
6. Run for 10 minutes under cyclic traffic; verify zero diagnostic buffer entries of class "IO fault".
7. Remove all test forces. Document the final I/O mapping in the project folder.

Frequently Asked Questions