S7-200 Ethernet Communication Setup with Smart 700 IE HMI
In modern manufacturing, connecting legacy PLCs to enterprise networks is a common challenge. The Siemens S7-200 series, widely used in small to medium automation tasks, typically communicates via PPI protocol over RS485. However, many plants now require Ethernet connectivity for data collection, remote monitoring, and integration with MES or SCADA systems. This article explores a practical case of enabling Ethernet communication for an S7-200 PLC (CPU224) while retaining an existing Smart 700 IE HMI, using a protocol conversion module.
System Overview and Requirements
A lithium battery material plant needed to upload temperature profiles, heating rates, and dwell times from a sintering furnace to the factory MES for traceability. The control system consisted of:
- Siemens S7-200 CPU224 PLC with one 9-pin D-sub port (PPI/MPI)
- Siemens Smart 700 IE touch panel connected to that port
- No spare communication interface on the PLC
The main goals were to add Ethernet connectivity without modifying the PLC program, keep the HMI fully functional, and ensure reliable operation in a harsh industrial environment.
Communication Challenge and Solution
The S7-200’s PPI protocol is not natively compatible with TCP/IP networks. Replacing the PLC with a newer model (e.g., S7-1200) would cost over $10,000 and require significant downtime. Instead, a pass-through Ethernet module was selected. This device converts PPI to Modbus TCP and S7 TCP, allowing seamless integration with the plant LAN.
Key features of the module:
- Direct plug-in between PLC and HMI cable (9-pin male to PLC, 9-pin female to HMI)
- Supports up to 32 simultaneous connections
- Auto-sensing baud rate (9.6 kbps to 187.5 kbps)
- Built-in web server for configuration
- Industrial temperature range (-40°C to +75°C)
- Powered directly from PLC port (no external supply needed)
Step-by-Step Configuration
The following procedure outlines the setup for Ethernet communication between the S7-200, Smart 700 IE, and an MES server.
1. Hardware Connection
- Power off the PLC and HMI.
- Connect the Ethernet module’s male DB9 connector to the PLC’s port.
- Connect the HMI’s communication cable to the module’s female DB9 port.
- Connect an Ethernet cable from the module’s RJ45 port to an industrial switch.
- Power on the system. The module’s power LED should light up.
2. IP Address Configuration
Access the module’s web interface by typing its default IP (usually 192.168.1.100) into a browser. Change the IP address to match the plant network (e.g., 192.168.0.50). Set the subnet mask and gateway as needed. Ensure the IP does not conflict with other devices.
3. Protocol Settings
In the web interface, configure the PPI parameters to match the PLC: station address (default 2), baud rate (typically 187.5 kbps). For the Ethernet side, enable Modbus TCP and/or S7 TCP. The module will automatically translate between protocols.
4. MES/SCADA Integration
On the MES server, use an OPC server or direct driver that supports Modbus TCP or S7 TCP. Configure the connection to the module’s IP address and port (default 502 for Modbus TCP). Map the relevant PLC memory addresses (V, I, Q, M) to tags. For example, VW100 might hold the furnace temperature.
5. HMI Communication Verification
The Smart 700 IE should continue to communicate as before, since the module passes through the PPI signals transparently. Check that all screens update correctly and control functions work.
Troubleshooting Common Issues
| Symptom | Possible Cause | Solution |
|---|---|---|
| No communication with PLC | Baud rate mismatch or station address conflict | Verify PLC settings and module configuration match |
| HMI shows no data | Loose cable or module not powered | Check connections and module LED indicators |
| MES cannot read tags | Incorrect IP/port or firewall blocking | Ping module, check firewall rules, verify Modbus mapping |
| Intermittent data loss | EMI or network congestion | Use shielded cables, check network load, enable module’s EMC protection |
Benefits and Results
After implementing this solution, the plant achieved real-time data logging to MES without any PLC code changes. The HMI continued to operate normally. Downtime for installation was less than 2 hours. Remote diagnostics became possible, reducing maintenance costs by 30%. The module’s robust design ensured stable operation in the dusty, high-temperature environment.
Key Considerations for Similar Projects
- Compatibility: Ensure the Ethernet module supports your specific S7-200 CPU firmware version.
- Network Security: Place the module behind a firewall and consider VLAN segmentation to protect the control network.
- Scalability: If multiple S7-200 PLCs need networking, a single module per PLC is typical, but some modules can handle daisy-chaining.
- Future-proofing: Look for modules with firmware upgrade capability and support for additional protocols like PROFINET.
Conclusion
Adding Ethernet to a legacy S7-200 system is a cost-effective way to meet modern data integration demands. By using a pass-through protocol converter, you can preserve existing investments in PLCs and HMIs while gaining the benefits of networked automation. This approach is applicable across many industries, from battery manufacturing to water treatment, wherever S7-200 controllers are still in service.
