S7-200 and S7-300 SCADA Integration via Profibus and Ethernet

Overview: Plant-Wide SCADA Integration for Mixed S7-200 / S7-300 Fleets

Most brownfield plants run a mix of SIMATIC S7-200 (micro PLC class) and SIMATIC S7-300 (mid-range PLC class) controllers acquired across multiple upgrade cycles. Funneling both families into a single SCADA server is a recurring requirement, and the integration problem is fundamentally about three decisions: which physical transport both generations can speak, which PC interface acts as the bus master or Ethernet node, and which software layer (typically SIMATIC NET OPC) exposes process tags to the SCADA application.

Each S7-200 CPU (CPU 221, CPU 222, CPU 224, CPU 224XP, CPU 226) ships with one or two PPI ports. Each S7-300 CPU (CPU 312, 314, 315, 317, 319) ships with a combined MPI/DP port. Neither generation has a native Ethernet port on the low-end CPUs, so the network media is always selected by inserting a communications processor (CP) or, for S7-200, a Profibus DP slave module. The set of feasible architectures reduces to four practical options: PPI/MPI bridged, Profibus DP with a PC master card, Industrial Ethernet with CPs on every station, or a mixed Profibus-plus-Ethernet topology behind a gateway.

S7-200 Communication Interfaces and Add-On Modules

The S7-200 CPU's Port 0/Port 1 can operate as PPI, MPI slave, or freeport (USS / Modbus RTU via libraries). Default baud rate on CPU 224 / 224XP / 226 is 187.5 kbps. The CPU 224XP and CPU 226 support PPI/MPI from 9.6 kbps up to 187.5 kbps; the EM 277 module supports DP up to 12 Mbps. To use S7-200 in a Profibus network you must add an EM 277; the EM 277 appears to the master as a DP-V0 slave that exchanges one input area and one output area of up to 244 bytes per direction. The S7-200 user program reads/writes that I/O image with the MBUS_SLAVE / MBUS_INIT library calls in Micro/WIN.

To put S7-200 on Ethernet, the CP 243-1 (6GK7 243-1EX00-0XE0) is the workhorse. It supports S7 communication as a partner or server (PUT/GET), ISO-on-TCP, TCP, UDP, HTTP, FTP, and e-mail clients. Configuration is done in the S7-200 Micro/WIN "Ethernet Wizard" and stored on the CP's file system. The CP 243-1 IT variant adds an onboard web server, file system, and e-mail trigger logic on top of the same S7-comm substrate. Both CPs support up to eight S7 connections. An OPC server connection to the CP 243-1 typically consumes one of the eight S7 connections, leaving seven for HMI or peer-to-peer PUT/GET. Reference the Siemens Industry Online Support for the latest S7-200 manuals and firmware updates.

S7-300 Communication Interfaces and Add-On Modules

Every S7-300 CPU (with the exception of the original CPU 312 IFM and CPU 313 IFM) ships with a combined MPI/DP port labelled "X1" (PROFIBUS DP interface). Newer CPUs add a second PROFINET port labelled "X2" (PN interface, RJ-45). The MPI/DP port is configurable as MPI (default) or DP master/slave. In DP master mode the S7-300 can poll Profibus slaves — including EM 277s on S7-200 stations — without a CP card. CPUs with a PN port can act as PROFINET IO controller, IO device, and S7-communication server with no extra module.

For S7-300 stations that do not have a built-in PN port and where the operator wants Ethernet, the following CPs apply:

• CP 343-1 Lean (6GK7 343-1CX00-0XE0) — 10/100 Mbps, 8 S7 connections, no PG/OP routing, no ISO transport.
• CP 343-1 (6GK7 343-1EX11-0XE0) — 10/100 Mbps, 16 S7 connections, PG/OP routing, ISO transport, FTP server.
• CP 343-1 Advanced (6GK7 343-1GX31-0XE0) — adds IT functions (web server, file system, e-mail) and 32 S7 connections.
• CP 343-1 ERPC (6GK7 343-1HX40-0XE0) — connects the S7-300 to redundant Industrial Ethernet rings with HSR/PRP support.

For an additional Profibus master/slave on the S7-300 when the on-board port is already in use, the CP 342-5 (6GK7 342-5DA02-0XE0) provides a second DP port. The full S7-300 hardware and module catalog is documented under the Siemens Industry Online Support S7-300 section.

Network Architecture Options for 4 × S7-200 + 5 × S7-300

With nine PLCs plus the SCADA PC, the station count is small, but the mix of generations rules out a single media. Three realistic architectures apply:

The decision tree reduces to:

1. Can the S7-200 fleet be expanded with one EM 277 each? Bus terminator / RS-485 budget, panel space, and Profibus cable cost must be factored. If yes, run Profibus DP with a single PC CP card.
2. Is there a corporate Ethernet plant backbone that the SCADA server can sit on? If yes, equip each PLC with an Ethernet CP (CP 243-1, CP 343-1) and run a single switched Ethernet network.
3. If neither cost line is acceptable, fall back to MPI with a PC adapter — but expect >20 ms scan latency, a hard 32-station limit, and limited or no SCADA-vendor support for MPI as a primary transport.

Profibus DP Architecture: EM 277 + S7-300 Master + PC CP Card

The classic architecture is Profibus DP-V0 with the S7-300 acting as a class-1 master on its on-board DP port and the SCADA PC acting as a class-2 master through a SIMATIC NET CP card. The S7-200 stations sit behind an EM 277 (6ES7 277-0AA22-0XA0) configured as a DP-V0 slave. The DP-V0 slave image is mapped onto the S7-200 variable memory by the EM 277 and made available to the ladder program.

With nine slaves plus the master (the SCADA PC) you have 10 Profibus nodes, well below the 32-station segment limit. Profibus segment length is a function of baud rate:

Run the bus at 1.5 Mbps to keep segment length at 200 m and let all stations — including older EM 277 firmware V1.1 — participate. The lowest-capable station dictates the bus baud, so check every node's firmware revision before commissioning. Full Profibus commissioning rules and baud rate tables are in the PROFIBUS Network Configuration Manual, distributed via Siemens Industry Online Support.

Seven-segment Profibus addresses on the EM 277 are set by DIP switches on the side of the module. Valid addresses are 3 to 124 (addresses 0–2 are reserved for the class-1 and class-2 master). Set each EM 277 to a unique address, for example:

EM 277 #1 (S7-200 #1) — DP addr 3
EM 277 #2 (S7-200 #2) — DP addr 4
EM 277 #3 (S7-200 #3) — DP addr 5
EM 277 #4 (S7-200 #4) — DP addr 6
S7-300 #1 (class-1 master) — DP addr 2
S7-300 #2..#5 (class-1 masters on subnet 2) — DP addr 2..5
SCADA PC (class-2 master) — DP addr 1

Industrial Ethernet Architecture: CP 243-1 + CP 343-1 + SIMATIC NET OPC

An Ethernet architecture places an Ethernet CP on every PLC and a standard Ethernet NIC on the SCADA PC. SIMATIC NET (currently V20 for new projects) provides the S7 OPC server that maps S7-200 / S7-300 process tags to OPC DA 2.05 / 3.0 items.

For the S7-200, configure the CP 243-1 with the "Ethernet Wizard" in S7-200 Micro/WIN. Each CP 243-1 occupies one S7 connection slot out of eight; an OPC server typically consumes one slot per CP, leaving seven for HMI or peer-to-peer PUT/GET. For the S7-300, NETPRO (STEP 7 V5.5) or TIA Portal handles the CP 343-1 connections. Each CP 343-1 supports 16 active S7 connections on V2.4 firmware; an OPC server typically holds one connection per CP.

The CP 243-1 and CP 343-1 configuration examples and S7-comm partner blocks are documented in the S7 Communication between SIMATIC S7-1200 and SIMATIC S7-300 application note, which covers the same S7-comm protocol used for S7-200 to S7-300 data exchange via CP 243-1 / CP 343-1.

SIMATIC NET OPC Server Configuration

SIMATIC NET installs two Windows services: "SIMATIC NET PC Station" and "SIMATIC NET OPC Server". The PC Station is configured in either STEP 7 (NetPro) or TIA Portal (PC Station) and must match the hardware in the PC: either a CP 5611 / CP 5621 for Profibus, an Ethernet NIC for Industrial Ethernet, or a CP 5711 USB for engineering. After the PC Station is loaded, the OPC server exposes a tag namespace identical to the S7 data blocks.

For S7-200, the OPC server uses the CP 243-1's S7-comm partner to read/write variable memory (V memory) by symbolic name. Micro/WIN's Ethernet Wizard generates a symbol table (.cwf) that SIMATIC NET imports to expose V-memory addresses as OPC items. The wizard's "Server" connection type is what enables a passive S7-comm partner for the OPC client; the "Client" connection type is used for the S7-200 to actively PUT/GET to peer devices.

Loading the PC Station is a one-time operation per hardware change. After STEP 7 / TIA Portal compiles the PC Station, "Station Configuration Editor" must download it to the local runtime. Failure to load the station before starting the OPC server results in the "No valid PC Station" diagnostic error and a "00000000" license stamp on every tag.

SITECT SCADA Tag Mapping

SITECT (Siemens Tele-Control / SCADA predecessor) and its modern successor SIMATIC WinCC read OPC DA 2.05 / 3.0 directly. Inside the SCADA project:

1. Add a new OPC channel of type "OPC DA".
2. Browse the SIMATIC NET OPC server namespace, e.g. OPC.SimaticNet.
3. Select S7 connection items by name (S7-200: V_xxxx, S7-300: DBx,DBBy / DBx,DBWw).
4. Map each item to an internal SITECT tag with the same data type (BOOL, INT, REAL, WORD, DWORD).
5. Set the acquisition cycle to 250 ms – 1,000 ms. Profibus networks should not be polled faster than 500 ms due to bus latency.
6. Enable deadband for analog tags (e.g. 0.5 % of full scale) to reduce OPC traffic.

For a SITECT-only single-server deployment the OPC layer can be skipped by using SIMATIC NET's S7 channel directly. This is recommended for S7-300 with a CP 343-1 or PN port because the S7 channel is faster than OPC DA marshaling. For S7-200, OPC remains mandatory because SITECT does not include a native CP 243-1 driver.

Comparison: Profibus vs Ethernet for Mixed S7-200 / S7-300 SCADA

For a small plant with 9 PLCs and a focus on data acquisition (not motion control), Industrial Ethernet is the lower-cost and future-proof choice. Profibus DP is justified only if the S7-200 fleet must remain on a bus for distributed I/O (e.g. ET 200M) or if the customer mandates Profibus for compliance reasons. Migration planning should reference the product phase status of each CP and CPU under Siemens Industry Online Support.

Cabling, Topology, and Grounding

For Profibus, use Siemens Profibus cable (6XV1 830-0AH10) with characteristic impedance 150 Ω, 3-wire shielded twisted pair. The shield must be bonded to ground at every bus connector and at the cabinet ground bar. Bus terminators (220 Ω between A and B, plus 390 Ω pull-up/pull-down) must be active at both physical ends of the segment only. Failure to do so causes intermittent bus errors and the CP 5621 lights up the "BF" (Bus Fault) LED. Maximum stub length is 1.5 m at 1.5 Mbps, 0.6 m at 12 Mbps.

For Industrial Ethernet, use CAT5e SF/UTP or CAT6 with shielded RJ-45 connectors. Industrial cable (e.g. 6XV1 840-2AH10) has a TPE jacket and is rated for cable carriers. Industrial switches (SCALANCE XC-200) support PROFINET conformance class A, ring redundancy (MRP), and extended temperature range. Ground the switch chassis to the cabinet ground bar with a separate 6 mm² conductor to avoid ground loops between PLC stations. Industrial Ethernet installation rules are in IEC 61784-5-3 / IEC 61918 (cabling) and Siemens' SIMATIC NET Industrial Ethernet Twisted Pair and Fiber-Optic Networks Manual, available via Siemens Industry Online Support.

Verification, Commissioning, and Troubleshooting

Verification checklist:

1. After physical install, run the SIMATIC NET "Station Configuration Editor" and confirm the PC Station name matches the OPC project.
2. Open "Communication Settings" → "Station Manager" and verify the S7 connection is in the "Connected" state, not "Disconnected" or "Fault".
3. Launch "OPC Scout V10" and read a known tag (e.g. S7-300: DB1,DBW0 = counter preset to 1234). Confirm value reads back correctly.
4. From SITECT / WinCC, force the same tag to a known value and verify the change in the OPC Scout. This validates both read and write paths.
5. For Profibus networks, check the "Diagnostics" tab in SIMATIC NET for bus errors. Bus error count should be zero after a 24 h soak.
6. For Ethernet, run a 24-hour ping test with ping -t -l 1472 <CP-IP> to detect packet loss. Acceptable loss is 0% over the test.
7. Record the firmware versions of every CP, CPU, and PC card. Update to the latest service pack per the Siemens product phase reports.
8. Verify CPU scan time at full load and confirm the OPC scan cycle does not starve the CPU's OB1. Target < 50 ms OB1 scan on S7-300.
9. Trigger a forced stop on one PLC and confirm the SCADA shows a "Quality: Bad" tag within the watchdog time (typically 2× acquisition cycle).

Troubleshooting matrix:

Edge Cases and Field-Proven Caveats

CP 243-1 firmware vs Micro/WIN version: The CP 243-1 firmware must be at least V2.1 for S7-comm to interoperate with a SIMATIC NET OPC server. Micro/WIN V4.0 SP9 can upload firmware up to V2.1.x, but V2.2 requires the dedicated firmware update tool from Siemens. Mismatched firmware is the most common cause of "Disconnected" status despite a valid IP route.

EM 277 data consistency: The EM 277 exchanges 1 input and 1 output image of up to 244 bytes. The S7-200 user program must read those bytes out of V memory and the application code must not write to that V-memory range concurrently with the EM 277 update. The MBUS_INIT and MBUS_SLAVE library calls handle this in the PLC's main scan, but a heavy interrupt routine can corrupt the image. The fix is to gate MBUS_SLAVE behind a 100 ms cyclic interrupt and let the main scan process the rest.

Class-1 vs class-2 master on Profibus: When the S7-300 on-board DP port is the class-1 master, the SCADA PC must be a class-2 master. The CP 5621 supports both. If the S7-300 is a class-2 master and the PC is also class-2, both can poll the EM 277 but cannot write to the same output bytes — the second writer is denied by the DP-V0 protocol. For safety, assign the SCADA PC as class-2 master and the S7-300 as class-1 master; let the S7-300 own all output writes.

OPC DA 3.0 vs DA 2.05: SIMATIC NET exposes both DA 2.05 and DA 3.0 servers. SITECT only consumes DA 2.05 in its standard channel. WinCC and modern SCADAs should use DA 3.0 for better deadband and complex data support. The S7-200 connection items appear in the same namespace on both servers; the choice is on the SCADA side.

Time synchronization: The S7-200 family does not support SIMATIC time-of-day synchronization. S7-300 supports it via the CP 343-1 / PN port. If the SCADA requires time-stamped data, plan to use S7-300 local time + a CP 243-1 IT daylight-savings workaround (CP 243-1 IT supports an NTP-style time-of-day fetch, but only for its own internal clock, not for the S7-200 CPU).

Migration path from S7-200 to S7-1200: For long-term support, the S7-1200 CPU 1211C / 1212C / 1214C / 1215C / 1217C with the CM 1241 (RS-485/RS-232) and CP 1243-1 (Ethernet) modules replace the S7-200 with active firmware. S7-comm protocol is preserved, so the SITECT OPC tags can be re-pointed to the new CPs without re-architecting the SCADA. Migration time is typically 2-3 hours per station for ladder programs ported via the STEP 7 "S7-200 to S7-1200" converter.

Frequently Asked Questions