ProfiNet to ProfiNet Gateway for PLC Dual-Network Data Exchange

Project Background

A large fine chemical company in East China built a new production line for high-performance resin with an annual capacity of 8,000 tons. The process uses a two-step polymerization method:

• Front-end: Three batching-reactor lines controlled by Siemens S7-1215C DC/DC/DC PLCs (firmware V4.5) for distributed weighing, temperature control, and stirring.
• Back-end: One centralized concentration-granulation line managed by a Siemens S7-1516-3 PN/DP PLC (firmware V3.0), which also interfaces with the MES.

The customer required real-time data exchange between the two PLCs: 144 bytes of process data (temperature, pressure, weight, valve position) from the 1200 to the 1500, and 64 bytes of control data (recipe number, target temperature, stirring frequency) from the 1500 to the 1200. The two PLCs were on different IP subnets (192.168.1.x and 192.168.2.x), and the 1200 side already had an HMI running, so changing the master-slave relationship was not allowed. The retrofit window was only 8 hours, with a total downtime limit of 2 days.

Solution: ProfiNet to ProfiNet Gateway

The team selected an industrial protocol conversion gateway with dual ProfiNet ports. This device acts as two independent ProfiNet I-Devices (slaves) – one on each network – and exchanges data via internal memory mapping. This approach avoids IP conflicts and requires no changes to the existing PLC programs.

Equipment List

Network Topology

The network is divided into two physically separate segments:

• LAN1 (Reactor Segment): 192.168.1.0/24 – includes S7-1200 PLC, HMI, and Port 1 of the gateway.
• LAN2 (Central Control Segment): 192.168.2.0/24 – includes S7-1500 PLC, MES, and Port 2 of the gateway.

The gateway internally isolates the two networks; data exchange occurs only through the shared RAM, preventing broadcast storms and ensuring security.

How the Gateway Works

The gateway hardware consists of two independent ProfiNet interfaces and a 32-bit ARM dual-core processor. Each port operates as a ProfiNet I-Device (slave):

• Port 1 is read/written by the S7-1200 PLC.
• Port 2 is read/written by the S7-1500 PLC.

Internally, it has 8 KB of shared memory that can be arbitrarily mapped. The refresh cycle is 1 ms, and end-to-end latency is less than 3 ms, which easily meets the 100 ms control loop requirement for temperature regulation.

Configuration Steps

The retrofit was completed during an 8-hour shutdown window. Here are the detailed steps:

1. Hardware Installation

• Power off the system. Mount the gateway on the DIN rail inside the S7-1200 control cabinet. Supply 24 VDC from a Siemens PM1207 power supply.
• Connect Port 1 to the SCALANCE XC208 switch (port 3) on LAN1.
• Connect Port 2 via a dedicated Ethernet cable to the SCALANCE XC208 switch (port 5) in the central PLC cabinet.
• Connect the PE terminal to the cabinet ground busbar; ensure 360° shield termination.

2. Generate GSDML and Import into TIA Portal

• Open the gateway configuration software (V3.4). Select “Dual Slave Mode” and create a new project.
• In Slot 0, insert a 144-byte Input module; in Slot 1, insert a 64-byte Output module.
• Export the GSDML file (version V2.35).
• In TIA Portal, import the same GSDML file into both the S7-1200 and S7-1500 projects.

3. S7-1200 Side Configuration

• In the network view, drag in the gateway device. Set the device name to “ReactorGW” and IP address to 192.168.1.100.
• In the device view, insert the 144-byte Input and 64-byte Output modules. The addresses are automatically mapped (e.g., IB1000 and QB1100).
• Download to the CPU and assign the device name.

4. S7-1500 Side Configuration

• Similarly, drag in the same GSDML device. Set the device name to “ReactorGW” and IP address to 192.168.2.100.
• Insert the 144-byte Input and 64-byte Output modules (e.g., IB2000 and QB2100).
• Download to the S7-1500 CPU.

5. Memory Mapping

• In the gateway configuration tool, enable “Auto Mapping”:
• PN1-Input (144 bytes) ↔ PN2-Output (144 bytes)
• PN1-Output (64 bytes) ↔ PN2-Input (64 bytes)
• Click “Download”. The gateway LEDs for PN1 and PN2 will change from flashing to steady on, indicating successful mapping.

6. Commissioning and Testing

• In the S7-1200 watch table, write 16#55AA to QB1100; the S7-1500 side should immediately see 55AA at IB2000.
• From the S7-1500, write 16#1234 to QB2100; the S7-1200 side should see 1234 at IB1000.
• Wireshark capture confirmed 1 ms frame interval with no packet loss.
• After a 72-hour burn-in test, zero faults were recorded.

Production resumed 2 hours ahead of schedule.

Operational Results

Key Takeaways and Best Practices

• Zero Program Modification: Unlike traditional routing or NAT solutions that require PLC program changes, the dual-slave gateway approach leaves existing logic untouched, reducing risk and commissioning time.
• Environmental Considerations: In fine chemical plants with ethanol or epoxy dust, the gateway (IP20) must be installed inside a sealed control cabinet. Ensure 24 VDC grounding resistance is below 1 Ω to prevent ESD damage.
• GSDML Compatibility: Always match the GSDML version with your TIA Portal version. For TIA Portal V16 or earlier, downgrade the GSDML to V2.31.
• Scalability: If data exceeds 1,440 bytes, use gateway cascading (master-slave-slave). A single gateway can handle up to 4,096 bytes in practice.
• Diagnostics: The built-in web server allows maintenance engineers to check load rates and status via smartphone, simplifying troubleshooting.

Conclusion

The ProfiNet-to-ProfiNet protocol gateway proved to be a highly effective solution for connecting Siemens PLCs on different subnets without any program modifications. Its dual-slave architecture, fast refresh rate, and easy configuration make it ideal for brownfield upgrades in the chemical industry. By enabling seamless data exchange, it helped improve production efficiency, product quality, and maintenance convenience.

For engineers facing similar challenges with legacy systems or network segmentation, this approach offers a reliable, cost-effective, and scalable alternative to complex network re-engineering.