Transferring REAL Values from S7-200 to S7-300 over PROFIBUS DP

Overview

Moving a floating-point value from a Siemens SIMATIC S7-200 to a SIMATIC S7-300 across a PROFIBUS DP link is a recurring field problem because the S7-200 PROFIBUS slave (EM277) exchanges I/O as bytes and words only, while the source value is a 32-bit IEEE 754 single-precision REAL. When the application is configured to send a single 16-bit word, only the lower mantissa bits survive the transfer and the receiver sees the value truncated to an integer.

This reference covers the two practical methods engineers use to recover the fractional component on the S7-300 side:

1. Direct REAL transfer – copy the 4-byte REAL into two contiguous 16-bit words on the S7-200, transmit both words over PROFIBUS, and reconstruct the REAL on the S7-300.
2. Scaled-integer transfer – multiply the REAL by 10, 100, 1000, etc. on the S7-200, truncate to DINT, transmit, then divide by the same factor on the S7-300.

Prerequisites

• S7-200 CPU with EM277 PROFIBUS DP slave module (e.g. 6ES7 277-0AA22-0XA0) configured for V-memory I/O mapping.
• S7-300 CPU with built-in PROFIBUS DP master port (e.g. CPU 315-2 DP 6ES7 315-2AG10-0AB0) or CP 342-5.
• STEP 7 Micro/WIN V4.0 SP9 for the S7-200 program.
• STEP 7 V5.5 or TIA Portal V16+ for the S7-300 program.
• Siemens GSD file for the EM277 (SIEM089D.GSD) installed in the hardware catalog.
• Consistent PROFIBUS baud rate (typically 1.5 Mbps or 12 Mbps) terminated on both ends.

Understanding the Data Format Mismatch

REAL Storage in S7-200

The S7-200 stores REAL values as 32-bit IEEE 754 single-precision in little-endian byte order, occupying four consecutive V-memory bytes. The address decomposition of a REAL stored at VD200 is:

V-Memory Address	Byte	IEEE 754 Field
VB200	Byte 0 (LSB)	Mantissa [7:0]
VB201	Byte 1	Mantissa [15:8]
VB202	Byte 2	Exponent [7:0]
VB203	Byte 3 (MSB)	Sign + Exponent [8] + Mantissa [22:16]

REAL Storage in S7-300

The S7-300 uses the same IEEE 754 single-precision layout and stores it in little-endian byte order. The format is identical bit-for-bit, so the byte image from an S7-200 REAL can be moved verbatim into an S7-300 REAL tag as long as the four bytes remain in the original order. See the official SIMATIC data-type reference for the explicit conversion options: Explicit conversion of REAL (S7-300, S7-400) – TIA Portal documentation.

Why a 1-Word Transfer Truncates the Value

PROFIBUS DP via the EM277 exposes only byte/word I/O. If the configuration reserves a single word per value (for example IW0 on the S7-300), only the lowest 16 bits of the REAL are transmitted. For a value of 3.4 (0x40566666), the lowest 16 bits are 0x6666, which the receiver interprets as decimal 26214 or, when the engineer mistakenly displays it as an integer, the floor of the original value is observed. Recovering the fractional component requires either transmitting all four bytes of the REAL or sending an integer scaled by an integer factor.

Method 1 – Direct REAL Transfer (2 Words per Value)

EM277 V-Memory Layout

Configure the EM277 for 16 words output / 16 words input starting at VB200. The exchange addresses are:

Direction	S7-200 Address	Bytes	S7-300 Address
Output (S7-200 → S7-300)	VB200..VB231	32	QB0..QB31 / IW0..IW14
Input (S7-300 → S7-200)	VB232..VB263	32	IB0..IB31 / IW0..IW14

S7-200 Program – Pack REAL into Two Words

Move the source REAL at VD300 (the actual process value, e.g. temperature) to the EM277 output area starting at VW200. Use BMB (Block Move Byte) to copy four bytes with a single instruction so the words remain contiguous:

// Network 1 – copy source REAL to PROFIBUS output area
LD     SM0.0
BMB    VB300, VB200, 4    // copies 4 bytes from VD300 into VD200

If the source REAL is held in a V-memory location that is already byte-aligned with the EM277 output window, the BMB instruction is the only copy required. If byte alignment cannot be guaranteed, copy the low word and the high word separately with MOVW:

// Network 1 – alternative two-instruction copy
LD     SM0.0
MOVW   VW300, VW200       // low word (bytes 0,1)
MOVW   VW302, VW202       // high word (bytes 2,3)

The two instructions are equivalent to BMB for an aligned source and avoid byte-swap hazards.

S7-300 Hardware Configuration

1. Open HW Config (STEP 7 V5.5) or the device view in TIA Portal.
2. Insert the EM277 from the hardware catalog (install SIEM089D.GSD if missing).
3. Drag the EM277 onto the PROFIBUS DP master system.
4. Set the slot configuration to 16 words in / 16 words out (matches the EM277 DIP-switch / V-memory configuration).
5. Assign PROFIBUS address 2 to the EM277 (default for a slave).
6. Compile and download the hardware configuration.

S7-300 Program – Reassemble the REAL

The S7-300 receives two 16-bit words per REAL value in its input image. Reassemble them into a double-word memory location and use the combined value directly as a REAL, because the IEEE 754 layout is identical. Example STL (STEP 7 V5.5):

// Network 1 – assemble low word from PROFIBUS input
L     IW      0          // low word of REAL (VB200..VB201)
T     MW     10

// Network 2 – assemble high word from PROFIBUS input
L     IW      2          // high word of REAL (VB202..VB203)
T     MW     12

// Network 3 – combine and store as REAL
L     MD     10
T     MD     14          // RealValue (REAL)

If the value displayed on the S7-300 side is wildly wrong (for example +1.#QNAN or an obviously garbage mantissa), the two words are in reversed order. Add a word swap before the double-word transfer:

L     MD     10
CAD                     // Change Accumulator Double Word – swap words
T     MD     14

In TIA Portal, use the equivalent SWAP instruction or simply route the second input word to MW10 and the first input word to MW12 to swap by addressing. Always cross-check the result against a known constant (for example send 3.4 from the S7-200 and confirm 3.4 is observed in the S7-300 VAT table).

Performance and Cycle Considerations

Each REAL value consumes four bytes of PROFIBUS I/O. A 16-word output area therefore carries four REAL values. For a process with more than four values, either increase the EM277 I/O size (the EM277 supports up to 244 bytes in / 244 bytes out, configurable in 1-word increments) or use a separate V-memory window with a second EM277.

Method 2 – Scaled-Integer Transfer

When to Use This Method

Use the scaled-integer method when the I/O budget is tight, when the receiving controller is a third-party PROFIBUS master that only interprets integers, or when legacy code on the S7-300 already expects an integer representation of an analog value (for example, 0–10000 representing 0.00 %–100.00 %).

Choosing the Scale Factor

Decimal Places Required	Multiplier	Example (3.4567)	Scaled DINT Range Limitation*
1	10	34	±2,147,483,647 / 10
2	100	345	±2,147,483,647 / 100
3	1000	3456	±2,147,483,647 / 1000
4	10000	34567	±2,147,483,647 / 10000

* The DINT range assumes the source REAL is within the standard ±3.402823e+38 IEEE 754 range; for typical process values (e.g. temperature, pressure) this limit is not reached.

S7-200 Program – Multiply, Truncate, Move

STEP 7 Micro/WIN supports the *R (multiply REAL) and TRUNC (truncate REAL to DINT) instructions. The full sequence for one decimal place:

// Network 1 – ScaleSource := SourceReal * 10.0
LD     SM0.0
MOVR   VD300, VD400      // copy source REAL to scratch area
*R     10.0, VD400        // VD400 := VD400 * 10.0
TRUNC   VD400, VD404      // VD404 := DINT(VD400)

// Network 2 – send scaled DINT to PROFIBUS output area
MOVW   VW404, VW200      // low word of scaled DINT
MOVW   VW406, VW202      // high word of scaled DINT

Two decimal places use a multiplier of 100.0 and three use 1000.0. Use the same multiplier consistently on both ends.

S7-300 Program – Reassemble, Divide, Store

// Network 1 – assemble scaled DINT from two words
L     IW      0
T     MW     20
L     IW      2
T     MW     22

// Network 2 – convert to REAL and divide by 10.0
L     MD     20
DTR                     // DINT → REAL
L     1.000000e+001
/R
T     MD     24          // RealValue (REAL)

If byte order needs to be swapped, insert a CAD between the L MD and DTR:

L     MD     20
CAD
DTR
L     1.000000e+001
/R
T     MD     24

Why TRUNC, Not ROUND

TRUNC discards the fractional component without rounding. With a multiplier of 100, a value of 2.345 becomes 234 (not 235). This is intentional: the fractional part below the chosen resolution is lost, and the receiver reverses the operation exactly by dividing by the same factor, yielding 2.34 (not 2.35). This avoids drift caused by double rounding and keeps the result deterministic.

EM277 PROFIBUS Slave Configuration Details

DIP-Switch Settings

The EM277 has two rotary switches that set the PROFIBUS address (0–99, default 2) and a bank of DIP switches that select the I/O size:

Switches 1–6	I/O Words	V-Memory Range (output / input)
000000	None	—
000001	1 word out / 1 word in	VB200..VB203 / VB204..VB207
001111	8 words out / 8 words in	VB200..VB215 / VB216..VB231
111111	32 words out / 32 words in	VB200..VB263 / VB264..VB327

Each 1 bit adds one word to each direction. Switch state must match the configuration in HW Config, or PROFIBUS DP startup fails with diagnostic 0x0B (configuration error).

V-Memory Mapping Rule

The EM277 output area starts at VB200 and the input area immediately follows. This area is reserved for PROFIBUS exchange – do not use it for other V-memory variables. STEP 7 Micro/WIN does not warn about this conflict automatically.

GSD File

Install SIEM089D.GSD in HW Config before adding the EM277 to the PROFIBUS network. The GSD is shipped with STEP 7 V5.5 and TIA Portal, but for older STEP 7 versions it can be downloaded from the Siemens support site (search for "EM277 GSD").

Verification Procedure

1. Send a known constant from the S7-200 (e.g. set VD300 = 3.4 in a status chart).
2. Monitor VB200..VB203 in the S7-200 status chart – they should read 0x66 0x66 0x40 0x40 (little-endian IEEE 754 of 3.4).
3. Monitor the corresponding input words on the S7-300 (e.g. IW0 and IW2) – they should read 0x6666 and 0x4040 in hex.
4. Combine in MD14 and view as REAL – should display 3.4 with full mantissa.
5. Repeat for negative values (e.g. -1.5 → 0xBFC00000), zero, and a value near the maximum (e.g. 1.0e+10) to confirm exponent handling.
6. Disable PROFIBUS and confirm the S7-300 SF LED lights and the diagnostic buffer records a station failure – then re-enable and confirm auto-recovery.

Troubleshooting Matrix

Observed Symptom	Likely Root Cause	Corrective Action
Receiver sees integer floor (e.g. 3 instead of 3.4)	Only one word transferred; mantissa low bits lost	Reserve two words per REAL, copy all four bytes
Receiver sees 0 or very small value	Byte order reversed	Insert CAD on S7-300 or reverse word wiring
Receiver sees 0x7F800000 (positive infinity) or 0x7FC00000 (NaN)	V-memory overlap with user program on S7-200	Move PROFIBUS area away from user variables; respect VB200 boundary
PROFIBUS fault, SF LED on S7-300	EM277 DIP switches do not match HW Config	Set switches to match configured I/O size
Value flickers between two readings	Output is being overwritten by another network	Verify no double-write to the EM277 output area
Value sent is correct but receiver shows sign-flipped (e.g. +3.4 vs -3.4)	Word order within the double word reversed	Use CAD on S7-300, or reverse MOVW order on S7-200
TRUNC error on S7-200	Source REAL × multiplier exceeds DINT range (±2.147e9)	Reduce scale factor or split high/low words manually
PROFIBUS diagnostic 0x0B (configuration error)	GSD module mismatch or EM277 address conflict	Reinstall SIEM089D.GSD and verify slave address

Commissioning Checklist

• EM277 DIP switches set to match HW Config I/O size.
• PROFIBUS address set on the rotary switch and unique on the segment.
• V-memory area (VB200 + configured size) reserved and not used by user program.
• STEP 7 Micro/WIN cross-compiled without errors and downloaded to the S7-200.
• HW Config downloaded to the S7-300; slave visible in "Accessible Nodes" with green online state.
• Test value (e.g. 3.4) verified in VAT table on both sides.
• Diagnostic buffer on S7-300 cleared of DP faults after warm restart.

FAQ