Siemens ET 200SP UDP IO Interface for 16ms Cockpit Simulators

Overview

Full-flight and replica cockpit simulators require a deterministic, low-latency bridge between a host PC (running the aircraft's flight model and visuals) and a large bank of cockpit instruments — switches, lamps, rotary knobs, encoders, and 0–10 V analog gauges. The bridge must shuttle ~500 digital inputs, ~500 digital outputs, ~100 analog inputs, and ~20 analog outputs in both directions on a fixed 16 ms cadence (60 Hz update) and present the host with a single, well-defined User Datagram Protocol (UDP) endpoint.

The Siemens SIMATIC ET 200SP distributed I/O system combined with a SIMATIC S7-1200 or S7-1500 CPU (or an S7-1500 software controller running on the host IPC) is a field-proven topology for this class of application. The ET 200SP provides the channel density, the PROFINET backplane gives the deterministic 250 µs–1 ms update behavior you need for closed-loop motion/IO, and the SIMATIC open-user-communication library (TCON, TDISCON, TUSEND, TURCV) supports raw UDP frame exchange to the host at the 16 ms rhythm the simulator requires.

This reference covers station sizing, module selection, PROFINET topology, the UDP open-user-communication program model, OPC UA as an alternative transport, latency budgeting, and commissioning checks. It is written for automation engineers who are new to SIMATIC but familiar with industrial Ethernet and ladder/structured-text programming.

System Requirements Recap

The "no logic in PLC" constraint is important: it means the controller is a pure IO-to-UDP multiplexer. State, discretes debouncing, scaling, sign-of-life counters, and watchdog logic can be added in the PLC without violating the constraint, but the flight model itself never runs in the S7.

Recommended Hardware Architecture

Head-End Controller Selection

Three head-end options exist; the choice is driven by where you want your cycle-time source to live.

1. S7-1500 (e.g. CPU 1515-2 PN) — recommended for production simulators. Up to 1 MB program/data, OB 1 minimum cycle time 1 ms, integrated PROFINET switch with IRT capability, full open-user-communication support (TCON/TUSEND/TURCV). S7-1500 CPU 1515-2 PN manual.
2. S7-1200 (e.g. CPU 1215C DC/DC/DC) — acceptable for fixed-base trainers. 150 kB work memory, PROFINET with RT only (no IRT), open-user-communication from firmware V4.x via TCON/TUSEND/TURCV blocks. Maximum number of open UDP connections is limited per firmware release — verify against the S7-1200 system manual.
3. ET 200SP CPU (CPU 1510SP-1 PN / 1512SP-1 PN) — best of both worlds: the controller is the head module of the first ET 200SP station. Saves one DIN-rail width and one PROFINET device count. Same firmware family as the S7-1500.

ET 200SP Station Composition

Each ET 200SP station is built from a head module (IM 155-6 PN), a server module, base units (Type A0, A1, B0, etc., chosen by terminal type), and a stack of I/O modules. The ET 200SP system manual defines the maximum of 32 I/O modules / 64 channels of AI per station and 1 m station width on the backplane bus.

For ~500 DI / 500 DO / 100 AI / 20 AO the channel count fits comfortably in a single PROFINET line, but the physical station count is what matters. The 32-module-per-station limit means you must split channels across multiple ET 200SP heads.

Channel Density Math and Station Split

82 modules cannot be hosted on a single ET 200SP station (limit 32 I/O modules). Plan on three PROFINET stations with one IM each, e.g.:

• Station 1 — Discretes A: 32 DI + 16 DO (center console + forward panel)
• Station 2 — Discretes B: 16 DO + 32 AI + 5 AO (overhead, aft, pedestal)
• Station 3 — Mixed analog spares: headroom for future expansion

Each station connects to a managed PROFINET switch (e.g. SCALANCE XC-216) on the head-end. Use MRP (Media Redundancy Protocol) to provide ring redundancy in DO-178/Level-D simulator rooms.

Backplane / Wiring

Use Type B0 base units (light-colored terminals) for digital modules and Type A0/A1 (dark) for analog modules so that the analog terminals (AI/AQ) are not bridged with the 24 V supply groups. The PROFINET cable should be at least Cat 5e SF/UTP (6XV1840-2AH10) and routed at least 10 cm from any AC control wiring. Group 24 V common on a single PSU per station with a 10 A breaker; the AO modules are powered by the same bus but with their own fused 24 V tap to keep loop-impedance clean for 0–10 V outputs.

Open-User-Communication: UDP at 16 ms

The SIMATIC open-user-communication blockset provides raw UDP transport on top of the integrated PROFINET interface. The relevant blocks are summarized below.

The S7-1500 family (and S7-1200 firmware V4.0+) supports a single block namespace (FB100–FB103 in OUC V4) that unifies these services. Refer to the S7-1500 Communication function manuals for parameter set details.

Connection Configuration (TIA Portal)

1. In the device configuration of the CPU, add a new Open User Communication connection under Properties → Communication → Open User Communication.
2. Set Connection type = UDP, Local port = e.g. 2000, Remote address = host PC IP, Remote port = e.g. 2001.
3. Select Active connection establishment = on (CPU connects to host at startup).
4. Note the automatically generated Connection ID (e.g. 1). You will use this ID in the TCON, TUSEND, and TURCV instance calls.

Cycle Wiring in OB 61 (16 ms Cyclic Interrupt)

// OB61 — 16 ms cyclic interrupt, priority 20
// Triggered every 16.667 ms by S7-1500 time-of-day interrupt or OB 61
// Send 1024-byte output frame to host
#sSendREQ := TRUE;
#sSendID  := 16#0001;            // connection ID from TIA Portal
#sSendLEN := 1024;
"inst_TUSEND"(REQ:=#sSendREQ,
              ID :=#sSendID,
              LEN:=#sSendLEN,
              DATA:=#outFrame,
              DONE=>#sSendDONE,
              BUSY=>#sSendBUSY,
              ERROR=>#sSendERR,
              STATUS=>#sSendSTA);

// Receive 1024-byte input frame from host (non-blocking)
#sRcvEN  := TRUE;
#sRcvID  := 16#0001;
"inst_TURCV"(EN_R:=#sRcvEN,
             ID :=#sRcvID,
             DATA:=#inFrame,
             LEN :=#rcvLEN,
             NDR =>#sRcvNDR,
             BUSY=>#sRcvBUSY,
             ERROR=>#sRcvERR,
             STATUS=>#sRcvSTA);

Buffer Sizing

Worst-case frame payload (instrument-only, signed/unsigned packed):

• DI 500: 500 / 8 = 63 bytes (rounded to 64)
• DO 500: 64 bytes
• AI 100 × 16-bit = 200 bytes
• AO 20 × 16-bit = 40 bytes
• Status / sequence / heartbeat: 16 bytes
• Total ≈ 384 bytes; pad to 512 bytes for alignment. The 1024 used above is conservative and leaves room for 16-bit scaled engineering values, sub-status, and module health bits.

PROFINET Update vs. UDP Send Timing

The PROFINET IO update time on the IM 155-6 PN HF is configurable from 250 µs to 4 ms. For 16 ms UDP cadence, configure an update of 1 ms and reduce the device send clock to 1 ms. The I/O data is then refreshed every 1 ms inside the PROFINET stack and frozen/copied by OB 61 each 16.667 ms for transmission to the host.

Set the IO update time to 1 ms in TIA Portal: Device view → IM 155-6 PN → Properties → PROFINET interface → IO cycle → Update time. Enable RT class = IRT for the entire PROFINET subnet so jitter is bounded under 1 µs.

Alternative Transport: OPC UA Instead of Raw UDP

Modern simulators are migrating to OPC UA Pub/Sub over UDP because the S7-1500 firmware 2.9+ ships an OPC UA server, and the ET 200SP can host the server directly when the head-end is an S7-1500. OPC UA Pub/Sub over UDP (binary encoded, UADP) hits the same 16 ms cycle and is easier on the host side — no custom UDP socket; instead, a UA client SDK reads published data items.

For a 16 ms cycle, OPC UA Pub/Sub at 20 ms publish interval is too coarse; either drop to 10 ms (still loses one tick per UDP frame) or stay with raw UDP TUSEND/TURCV. Reserve OPC UA for a non-real-time supervisory channel (engineering, logging, health).

Alternative Architecture: Soft-PLC / IPC-Based PROFINET Controller

If the host IPC has a PROFINET-capable CP card (e.g. Siemens CP 1616 / CP 1626 PCIe or Intel i210/i350 with PROFINET IRT firmware), the entire S7 CPU can be omitted. The IPC then acts as the IO controller, drives the ET 200SP stations directly, and exchanges UDP frames with its own flight model. In that case:

• Use SIMATIC CP 1626 for IRT-capable PROFINET on the IPC.
• Use the PROFINET IO Base or PROFINET IO Developer Kit to run a PN-IO controller service in user space.
• Benefit: removes one source of jitter (the S7 OB cycle), at the cost of tying the fieldbus to a Windows or Linux host.

Configuration in TIA Portal — Step-by-Step

1. Add the S7-1500 / ET 200SP CPU as the controller in the project. Insert a PROFINET subnet (e.g. PN/IE_1).
2. Insert the IM 155-6 PN HF as a PROFINET device. Drag all DI, DO, AI, AQ modules from the catalog into the device. TIA Portal will auto-assign slot numbers and addresses.
3. Configure update time = 1 ms, RT class = IRT, send clock = 1 ms on the IM and on the controller port.
4. Add a server module on the last slot of every ET 200SP station to terminate the backplane.
5. Add Open User Communication in the CPU properties, type UDP, as described above.
6. Create OB 61 in the program blocks; set its cycle time to 16.667 ms and priority 20.
7. Call TCON once in OB 100 (startup) to bring up the UDP socket.
8. Call TUSEND and TURCV from OB 61 to read input frame from host and write output frame to host.
9. Compile and download to the CPU.
10. Go online and verify in the watch table that the connection has STATUS = 16#0000 (no error) and the heartbeat counter in the frame is incrementing.

Verification Procedure

Troubleshooting Matrix

Spare-Parts and Lifecycle Notes

For a long-lifecycle product like a flight simulator (15–25 years in service), select modules that are part of the active SIMATIC catalog and explicitly check the ET 200SP product page for current phase-out announcements. As a rule of thumb:

• ET 200SP modules use HF (High Feature) variants for active-spare coverage through 2034+.
• S7-1500 CPUs ship as 6ES751x-xxx02-0AB0 (work-memory-expanded second generation) and continue firmware V2.9 → V3.1 → V3.2 cadence; upgrades must be performed with the matching TIA Portal version (currently V18 / V19).
• Procure 10% of the IO count in spare modules and one spare IM 155-6 per station.

Field-Proven Engineering Caveats

• Watchdog is mandatory. The PLC must latch all DO to a defined safe state (e.g. all lamps off) if no UDP datagram is received within 6 cycles (≈100 ms). Implement a heartbeat counter in the inbound frame and decrement a watchdog timer in OB 35 (100 ms free-running).
• DI debounce — set the DI module input filter to ≥ 3 ms to prevent contact bounce from a mechanical switch being read multiple times in one 16 ms tick. The DI 16×24VDC HF has 0.05/0.1/0.5/3/15 ms filter options.
• Analog channel scaling — 0–10 V input on AI 8×U/I = 0…27648 raw integer (Siemens normalization). Convert in the host, not in the PLC, to keep the controller free of engineering units.
• Time sync — synchronize the PLC's local time-of-day to the host using NTP, or write a 64-bit Unix timestamp into the frame so the host can correlate IO samples to visual frames.
• EMC segregation — 230 V AC relay outputs (used for panel backlight) must be on a separate rack section or a separate DQ 8×230VAC/2A RLY module; do not mix AC and DC outputs in the same station unless you accept their common-mode noise riding on the 24 V rail.

FAQ