Siemens S7-300 CPU 315-2DP to LAMTEC BT300 / PBM100: PROFIBUS DP Integration
1. Overview
This reference covers commissioning a PROFIBUS DP link between a Siemens S7-300 CPU 315-2DP acting as DP master class 1 and a LAMTEC BT300 burner management controller fitted with the PBM100 PROFIBUS module (LAMTEC part number 667R0700-1). The integration moves 60 input bytes from the BT300 into the PLC and accepts 14 output bytes from the PLC into the BT300, which matches the BT300 BT300/ETAMATIC PBM100 data profile.
The PBM100 PROFIBUS chipset implemented in the ETAMATIC/BT300 platform supports bus speeds up to 1.5 Mbit/s. The 1.5 Mbit/s ceiling is a hard limit on the slave, so the master's PROFIBUS network parameters (baud rate, Tslot, Max Tsdr, Min Tsdr) must be configured to match what the PBM100 can actually drive. If you need a network running above 1.5 Mbit/s, you must isolate the BT300 on its own segment or use a repeater boundary.
Because the BT300 input payload (60 bytes) exceeds the S7-300 standard word (2-byte) consistency window, the integration must use SFC14 (DPRD_DAT) for reads and SFC15 (DPWR_DAT) for writes. These SFCs deliver the slot data as one consistent block instead of tearing it across two scan cycles.
2. Prerequisites
| Item | Requirement |
|---|---|
| Siemens S7-300 PLC | CPU 315-2DP (e.g. 6ES7315-2AF03-0AB0 or 6ES7315-2AH14-0AB0) with integrated DP master on port X2 (MPI/DP) |
| STEP 7 version | STEP 7 V5.5 / V5.6 (HW Config) for classic projects. TIA Portal V13 or higher also supported on the S7-300 DP master side, but LAMTEC's DMD-based GSD import path is cleanest in STEP 7 V5.x |
| LAMTEC device | BT300 burner controller with PBM100 module (REF 667R0700-1) installed in slot A or B per BT300 hardware manual |
| GSD / DMD file | LAMTEC PBM100 GSD (sometimes bundled in a .DMD container) obtained from LAMTEC downloads portal (login required) or directly from LAMTEC support via LAMTEC contact page
|
| BT300 manual | BT300 user manual (English or German) covering Profibus data tables; downloadable from the LAMTEC downloads portal |
| ETAMATIC Profibus reference | BA-Profibus-DLT6100-EN.pdf for cross-reference (the DLT6100 / ETAMATIC PBM family uses the same PROFIBUS chipset as BT300's PBM100) |
| PROFIBUS cable | Shielded twisted pair, type A (solid core, e.g. Siemens 6XV1830-0EH10). Maximum segment length at 1.5 Mbit/s: 200 m without repeaters |
| Terminators | Active PROFIBUS terminator at both physical ends of the segment; S7-300 DP port does not provide internal termination |
3. Obtaining the LAMTEC PBM100 GSD File
LAMTEC distributes the PBM100 device description through two mechanisms:
- Download portal – register an account on the LAMTEC service & support downloads page. After login, the BT300 documentation package and (depending on account tier) the device description file can be downloaded directly. The BT300 manual includes the data table layouts for both input and output bytes.
- Direct request – open a support ticket through the LAMTEC contact page and request the GSD file (or DMD container) for the PBM100 module with the part number 667R0700-1. LAMTEC support will e-mail the file or ship it on CD.
The LAMTEC PBM100 GSD is sometimes delivered as a .DMD (Device Description Manager) archive, which contains the standard .GSD plus a bitmap and any associated type files. STEP 7 V5.x can import a DMD directly; if you only have the inner .GSD, install it manually under HW Config → Options → Install GSD File.
4. Hardware Topology
Place PROFIBUS termination at both physical ends of the segment. The S7-300 CPU does not terminate internally. The PBM100 is a passive slave; termination is provided by the BT300's external PROFIBUS connector or by a DP terminator plug.
5. CPU 315-2DP PROFIBUS Master Configuration
The CPU 315-2DP integrates the DP master on interface X2 (MPI/DP). The X1 (MPI) port cannot be used as a DP master on this CPU family — leave it as MPI for programming/OP connectivity. On the X2 port the interface mode must be switched to DP master.
- Open HW Config in STEP 7 V5.x and place the CPU 315-2DP from the hardware catalog.
- Double-click the X2 (MPI/DP) port. In Interface → Interface Type choose PROFIBUS and set Configuration to DP master.
- Set the PROFIBUS address of the master (default 2 is fine if no other master is on the segment).
- Open the Properties → Network Settings tab and select the bus profile DP. Then set Transmission Rate = 1.5 Mbit/s (the highest baud the PBM100 will reliably support; 500 kbit/s or 187.5 kbit/s are valid fallbacks if the cable plant is borderline).
- Click Bus Parameters to inspect / override the master-side timing. The default DP profile at 1.5 Mbit/s normally populates:
Tslot_Init = 100 µs, Max Tsdr = 250 µs, Min Tsdr = 11 µs, Tset = 8 µs, Tqui = 0 µs, GAP factor = 10, Retry limit = 3. - Click OK and save / compile the hardware configuration.
6. Installing and Placing the PBM100 as a DP Slave
- Install the LAMTEC PBM100 GSD: HW Config → Options → Install GSD File… and select the
.DMD(or.GSD) file. After install, the device appears under PROFIBUS DP → Additional Field Devices → LAMTEC → BT300 PBM100 (folder name depends on the GSD vendor string). - Drag the PBM100 onto the DP master system. Set the PROFIBUS address to a unique value (e.g. 3). Avoid addresses that conflict with the CPU's MPI/DP master address (default 2) or any other slave.
- Open the slave's slot configuration. The PBM100 GSD exposes a single slot for the application I/O. Configure the slot for 60 bytes input (BT300 → PLC) and 14 bytes output (PLC → BT300). If the GSD offers a pull-down for consistency, choose Total Length (the S7-300 default is word-consistent and would tear the 60-byte block).
- Note the I and Q start addresses assigned by HW Config for the slot, e.g.
I 100..159for inputs andQ 200..213for outputs. These addresses are what the SFC14/15 calls reference. - Save and download the HW Config to the CPU.
Set the PBM100 PROFIBUS address physically on the BT300 (DIP switch on the module or via BT300 service menu, depending on hardware variant) to match the value you entered in HW Config. A mismatch is the most common reason for a Station Failure diagnostic at startup.
7. BT300 Data Map
The BT300 PBM100 is a fixed-layout device; the byte order is defined by the BT300 firmware. The 60 input bytes carry the burner status, measured values, flame signal, and command feedback. The 14 output bytes carry commands (start, stop, reset, setpoint changes, etc.). Refer to the BT300 manual's Profibus data tables for the exact field layout. The byte count itself is what matters for the S7-300 side — do not edit or remap these values in the PLC without LAMTEC engineering approval.
| Direction | Bytes | Source → Sink | Content (BT300 documentation) |
|---|---|---|---|
| Inputs (I area) | 0..59 (60 bytes) | BT300 / PBM100 → S7-300 CPU 315-2DP | Burner status, fault codes, analog process values, flame signal, fuel-air ratio feedback, hours-run counters, last-fault history |
| Outputs (Q area) | 0..13 (14 bytes) | S7-300 CPU 315-2DP → BT300 / PBM100 | Start / stop / reset / lockout commands, setpoint writes, control-word bits, manual override flags |
8. SFC14 / SFC15 Programming (STEP 7 V5.x, STL or LAD)
The S7-300 CPU 315-2DP does not deliver the full 60-byte payload with word consistency, so direct I/O access (L PIW 100, etc.) would only return a torn snapshot. The correct approach is to copy the whole slot as one consistent block into a data block using SFC14 / SFC15.
Create two data blocks:
-
DB100 – mirror of the BT300 input area (60 bytes). Type:
STRUCTorARRAY[0..59] of BYTE. -
DB200 – mirror of the BT300 output area (14 bytes). Type:
ARRAY[0..13] of BYTE.
8.1 Read 60 bytes from BT300 (SFC14 "DPRD_DAT")
STL:
CALL "DPRD_DAT"
LADDR := W#16#100 // I-start address from HW Config (example: 100)
RET_VAL := MW 200 // Returns 0000 hex on success, error code on failure
RECORD := P#DB100.DBX 0.0 BYTE 60
NOP 0
LAD / FBD equivalent: insert the DPRD_DAT block and connect LADDR=256 (decimal of 0x100), RET_VAL to a marker, RECORD to P#DB100.DBX0.0 BYTE 60.
8.2 Write 14 bytes to BT300 (SFC15 "DPWR_DAT")
CALL "DPWR_DAT"
LADDR := W#16#200 // Q-start address from HW Config (example: 200)
RECORD := P#DB200.DBX 0.0 BYTE 14
RET_VAL := MW 202 // Returns 0000 hex on success, error code on failure
NOP 0
8.3 Recommended Call Pattern in OB1 / Cyclic OB
- Call SFC14 first at the start of the cycle to refresh DB100 from the BT300.
- Process the application logic (start permissive, fault handling, etc.) against DB100.
- Build DB200 with the new output commands.
- Call SFC15 to push DB200 to the BT300.
- Evaluate the RET_VAL of both calls. Any non-zero return means the SFC could not read/write the slave — latch a PROFIBUS Fault bit and stop further commands.
8.4 SFC14 / SFC15 RET_VAL Error Codes
| RET_VAL (hex) | Meaning |
|---|---|
| 0000 | No error |
| 8090 | Configured I/O address invalid (LADDR outside the process image or wrong length) |
| 8092 | Any FB call parameter contains a pointer of type ANY that violates limits |
| 8093 | No DP module / I/O available at the LADDR; CPU is not the DP master of this slave |
| 80A0 | Access error detected by I/O device / module |
| 80A1..80B0 | Manufacturer-specific error from the DP slave; see slave diagnostic buffer |
| 80B1 | Specified length is invalid (not equal to the configured slot length) |
| 80C0..80C2 | PROFIBUS DP protocol error (no slave, bus fault, multi-master collision) |
| 80FF | Hardware fault on the CPU's DP interface (BF LED on) |
The exact list above is documented in the STEP 7 V5.x online help under SFC14 / SFC15 → Error information and in the S7-300 system and standard functions reference manual.
9. Baud Rate and Bus Parameter Verification
Because the PBM100 is capped at 1.5 Mbit/s, the master network profile and any repeater chain must agree. The practical workflow is:
- From the BT300 service menu, confirm the PBM100 reports a valid PROFIBUS link (typically indicated by a steady RUN LED and a dark BF LED on the module).
- In STEP 7 HW Config, after the network is online, open PG → Accessible Nodes and inspect the detected baud rate. If the master is seeing the slave but at a fallback rate, the BT300 has fallen back to 187.5 kbit/s; check cable length and termination.
- Use Diagnostics → PROFIBUS Diagnostics in HW Config to read the live bus statistics: per-slave diagnostic, retry counters, and lost-token events.
| Baud rate | Max segment length (type A cable) | Suitable for PBM100? |
|---|---|---|
| 9.6 kbit/s | 1200 m | Yes (slow fallback) |
| 19.2 kbit/s | 1200 m | Yes |
| 93.75 kbit/s | 1200 m | Yes |
| 187.5 kbit/s | 1000 m | Yes (typical commissioning baud) |
| 500 kbit/s | 400 m | Yes |
| 1.5 Mbit/s | 200 m | Yes — PBM100 maximum |
| 3 Mbit/s | 100 m | No — PBM100 does not support 3 Mbit/s |
| 6 Mbit/s | 100 m | No |
| 12 Mbit/s | 100 m | No |
Do not exceed 1.5 Mbit/s anywhere on the segment where the PBM100 is connected. If higher speeds are required elsewhere on the DP master system, put a PROFIBUS repeater (e.g. Siemens 6GK1500-0AA00) between the BT300 segment and the rest of the network.
10. Verification & Commissioning Checklist
- Hardware check — verify cable shield continuity, termination at both ends, address switch on PBM100 matches HW Config, 24 VDC to BT300 stable.
- LEDs on CPU 315-2DP — SF off, BF off (or momentary blink during config download), RUN steady green, DP1 interface LEDs green. A red BF LED on X2 indicates the master cannot find a healthy slave on the configured bus parameters.
- LEDs on PBM100 — RUN steady, BF off. Some BT300 hardware revisions also expose a SYS LED that should be off or steady green.
- Online diagnostics — in HW Config, right-click the master system and choose PROFIBUS → Diagnostics. The BT300 should appear in the list with no active diagnostic bytes.
-
Live data check — in STEP 7, open a VAT (Variable Table) and monitor
DB100.DBB0..DBB59. After a single call to SFC14 with RET_VAL=0, the DB should contain non-zero, plausible data (e.g. status word, flame signal in a sensible 0-100% range). -
Command loop test — with the burner in a safe, off state, write a Start command into
DB200via SFC15 and confirm the BT300 acknowledges the command (status word in DB100 transitions accordingly). Issue a Stop and confirm the burner shuts down. - Fault injection — pull the PROFIBUS connector briefly and confirm the PLC raises a station-failure diagnostic and REFUSES to keep sending the last command. Then restore the connector and confirm the BT300 reappears on the bus automatically (no CPU stop/run required).
11. Troubleshooting Matrix
| Symptom | Likely cause | Fix |
|---|---|---|
| CPU X2 BF LED red, BT300 unreachable | Wrong baud rate, missing terminator, address conflict, BT300 not powered | Verify baud ≤ 1.5 Mbit/s, check terminators at both ends, re-check PBM100 address, verify BT300 24 V supply and ground |
| CPU X2 BF LED off but SFC14 returns 80B1 | SFC14 RECORD length does not match the configured slot length (must be exactly 60 bytes) | Adjust the ANY pointer to P#DB100.DBX0.0 BYTE 60
|
| SFC14 RET_VAL = 8093 | LADDR is not assigned to the PBM100 in the project's HW Config | Open HW Config, check the input slot of the PBM100 and use that I-start address as LADDR |
| Intermittent retries, occasional SFC14 80C0 | Excessive cable length, broken shield, loose connector, EMI from VFD in same tray | Use type A cable, separate from VFD power, re-crimp D-sub, check shield < 1 ohm to ground at one end only |
| BT300 shows RUN but data is stuck at zero | SFC14 never called, or BT300 data not yet refreshed after a configuration download | Call SFC14 in OB1 / OB35; power-cycle BT300 after the new HW Config is downloaded to the CPU |
| DP master diagnostics shows 0x0B (CFG_FAULT) | GSD byte count / slot layout does not match the BT300 firmware | Re-request the GSD from LAMTEC for the exact BT300 firmware version, or use a different BT300 firmware compatible with the GSD you have |
| DP master diagnostics shows 0x0A (Prm Fault) | Bus parameters / user-prm-data rejected by the PBM100 | Reduce baud to 500 kbit/s or 187.5 kbit/s, accept default Prm data, do not override |
| S7-300 BF LED off, but commands to BT300 are ignored | Writing to I area instead of Q area, or using direct I/O (PI/PA) instead of SFC15 | Use SFC15 with the Q start address of the PBM100 slot, not the I start address |
| Output byte written but BT300 reports invalid command | DB200 contains stale / uninitialised values for reserved bits | Initialise DB200 to all-zero on startup; only set the documented command bits per the BT300 manual |
12. Field-Proven Notes
- Use the BT300 manual's data tables as the source of truth. The GSD alone does not tell you what each byte means — only how many bytes and which direction.
- If the BT300 is controlling combustion equipment, the PLC must monitor the BT300's status flags and never bypass the burner controller's own safety chain. Treat the 14 output bytes as advisory commands; the BT300 owns the safety interlock logic.
- Set the DP master's watchdog on the BT300 slot to a non-zero value (e.g. 200 ms). If the PLC goes to STOP or the bus is interrupted, the BT300 will see the watchdog expire and fall back to its defined fail-safe state, rather than continue to execute a stale command.
- Keep the BT300 on its own DP segment if the rest of the network has slaves running at 3 / 6 / 12 Mbit/s. The PBM100 cannot be mixed on the same electrical segment at those speeds.
- Document the BT300 PROFIBUS address and the SFC14 / SFC15 LADDR values in the project's Symbols table so the next maintainer can find the I/O mapping quickly.
13. Quick Reference: Side-by-Side Parameters
| Parameter | PLC side (S7-300 CPU 315-2DP) | Burner side (BT300 / PBM100) |
|---|---|---|
| PROFIBUS role | DP master class 1, port X2 | DP slave |
| PROFIBUS address (example) | 2 | 3 (DIP switch on module) |
| Max baud | 12 Mbit/s (CPU capability) | 1.5 Mbit/s (PBM100 limit) |
| Input payload | 60 bytes read via SFC14 from I start address | 60 bytes produced by BT300 firmware |
| Output payload | 14 bytes written via SFC15 to Q start address | 14 bytes consumed by BT300 |
| Consistency required | Total length — SFC14/15 mandatory | Total length on PBM100 |
| Device description | n/a | LAMTEC PBM100 GSD / DMD |
14. Related Documentation
- LAMTEC service & support downloads (BT300 manual, PBM100 GSD/DMD)
- LAMTEC contact / support request page
- BA-Profibus-DLT6100-EN.pdf (ETAMATIC PBM PROFIBUS reference)
For the Siemens side, consult the S7-300 system manual, the S7-300 system and standard functions reference (SFC14 / SFC15 descriptions and error codes), and the STEP 7 V5.x online help on PROFIBUS DP bus parameter profiles.
Where do I get the LAMTEC PBM100 GSD file (667R0700-1)?
Download it from the LAMTEC downloads portal (free registration required) or request it directly from LAMTEC support via the contact page. The file is often delivered as a .DMD archive that contains the .GSD, bitmaps, and type files. Install it in HW Config via Options → Install GSD File….
What is the maximum PROFIBUS baud rate for the BT300 PBM100?
1.5 Mbit/s. The PBM100 PROFIBUS chipset is hard-limited to 1.5 Mbit/s. Configure the S7-300 DP master to 1.5 Mbit/s or below (e.g. 500 kbit/s, 187.5 kbit/s) and place a PROFIBUS repeater between the BT300 and any segment running at 3/6/12 Mbit/s.
Do I need SFC14 and SFC15 for the BT300, or can I read inputs directly with L PIW?
You need SFC14 / SFC15. The S7-300 standard I/O access is only word-consistent (2 bytes), and the BT300 input payload is 60 bytes. SFC14 (DPRD_DAT) reads the whole slot as one consistent block. Using direct access on a 60-byte slot risks reading torn data across two PLC scan cycles.
What are the I and Q start addresses for the PBM100 slot?
HW Config assigns them automatically when you place the PBM100 in the DP master system. Typical values from a stock project are I 100..159 for inputs and Q 200..213 for outputs, but the values depend on what other I/O is configured. Always read the actual addresses from HW Config and use them as the LADDR of SFC14 / SFC15.
The CPU X2 BF LED is red and the BT300 does not come online. What should I check first?
Check, in order: (1) PBM100 PROFIBUS address matches HW Config, (2) bus baud rate is ≤ 1.5 Mbit/s, (3) termination at both physical ends of the segment, (4) 24 V supply to the BT300 and PBM100, (5) cable type A, shield grounded at one end, total segment ≤ 200 m at 1.5 Mbit/s. The DP master diagnostics buffer (open in STEP 7 via CPU → Diagnostics Buffer) will indicate whether the master saw the slave but rejected it (CFG_FAULT 0x0B) or never saw it at all.