Upgrade Siemens S7-200 PLC to Ethernet for CNC Machine Control

The Challenge: Connecting Legacy PLCs in a Modern CNC Environment

In a precision machining facility, twelve CNC lathes were controlled by Siemens S7-200 SMART PLCs (model ST40). These controllers handled critical tasks such as spindle speed regulation, feed rate adjustment, and tool changer sequencing. The plant aimed to integrate these machines into a centralized control system based on a Siemens S7-1500 PLC (1511-1PN) and a WinCC V7.5 SCADA. Additionally, five existing HMI panels (three Kunlun Tongtai TPC1061H and two Weinview MT8102iE) needed to remain operational for local monitoring.

The main obstacle was the S7-200’s lack of an Ethernet interface. Its only communication option was a 9-pin RS485 serial port, which limited data throughput and made integration with modern TCP/IP networks difficult. Replacing all PLCs with newer Ethernet-enabled models would have cost nearly $30,000 and required two weeks of downtime for reprogramming—an unacceptable disruption.

Solution: Serial-to-Ethernet Module Bridges the Gap

The engineering team selected a dedicated serial-to-Ethernet communication processor designed specifically for the S7-200 series. This module connects directly to the PLC’s DB9 port and provides an RJ45 Ethernet interface. It acts as a protocol converter, translating between the PLC’s native PPI protocol and standard industrial Ethernet protocols.

One critical advantage of this module is its dual-port design. While one serial port connects to the Ethernet converter, the PLC’s second serial port remains free for local HMI communication. This allowed the existing touch panels to continue operating without any hardware changes.

System Architecture and Network Design

The upgraded system follows a three-layer automation pyramid:

• Device Layer: Each CNC machine’s S7-200 PLC connects to an Ethernet module via PORT0. PORT1 is reserved for the local HMI (if present).
• Control Layer: A Siemens S7-1500 PLC acts as the master, communicating with all twelve modules over Industrial Ethernet using the S7 protocol. It collects machine status and sends control commands.
• Supervision Layer: A WinCC SCADA station communicates with the modules via Modbus TCP, displaying real-time parameters, alarms, and historical trends.

All devices connect to an industrial managed switch. VLANs segregate control traffic from monitoring traffic, preventing broadcast storms. The switch links to the control room via fiber optic cable for noise immunity.

Step-by-Step Implementation

Hardware Installation

Each module mounts on a DIN rail inside the CNC electrical cabinet, at least 5 cm away from the PLC to minimize interference. A 24 VDC power supply, shared with the PLC, feeds the module. Proper grounding (resistance ≤ 4 Ω) is essential.

The serial connection uses a shielded DB9 cable with the following pinout:

Ethernet cables (Cat5e shielded) connect the modules to the switch. Cable shields are grounded at both ends. All wiring is dressed and kept separate from power cables.

Module Configuration

Each module is configured using a dedicated software tool. The following parameters are set for each of the twelve modules (IP addresses increment from 192.168.0.101 to 192.168.0.112):

• Network: IP address, subnet mask 255.255.255.0, gateway 192.168.0.1
• Serial port: Baud rate 187500 bps, 8 data bits, 1 stop bit, no parity, PPI protocol
• Ethernet protocols: S7 Server enabled (for S7-1500), Modbus TCP Server enabled (for WinCC)
• Data mapping: S7-200 V-memory (V0.0–V500.0) mapped to Modbus holding registers 40001–45001
• Advanced: Heartbeat detection (30 s timeout), data caching (1024 bytes), auto-reconnect (5 s interval)

After writing the configuration, each module is rebooted. A network scan confirms all devices are reachable.

S7-1500 PLC Programming

Using TIA Portal V16, the S7-1500 is configured with twelve TCP/IP connections, each pointing to a module’s IP address. Communication uses the TSEND_C and TRCV_C instructions in a round-robin polling scheme with a 100 ms cycle per module.

Data blocks are structured as follows:

• Send area (DB1): Control commands (spindle start, feed override, etc.) – DBW0 to DBW20
• Receive area (DB2): Status data (actual speed, feed rate, alarm codes) – DBW0 to DBW50
• Diagnostics (DB3): Communication error codes and retry counters

Error handling includes a 500 ms timeout and up to three retries. A typical communication sequence for one module looks like this:

IF "Module1_Comm_Enable" THEN
    "TSEND_C_Module1".REQ := TRUE;
    "TSEND_C_Module1".DATA := "Control_Commands_Module1";
    IF "TSEND_C_Module1".DONE THEN
        "TRCV_C_Module1".REQ := TRUE;
        IF "TRCV_C_Module1".DONE THEN
            "Status_Data_Module1" := "TRCV_C_Module1".DATA;
            "Module1_Comm_OK" := TRUE;
        END_IF;
    END_IF;
END_IF;

SCADA and HMI Integration

WinCC SCADA: A Modbus TCP driver is added, with twelve connections pointing to the module IPs. Tags are created for the mapped Modbus addresses. Screens display machine status, real-time trends, and alarm lists. Data logging records key parameters every 5 seconds, with a 30-day retention period.

Local HMIs: The Kunlun Tongtai panels use the Siemens S7-200 PPI driver at 187.5 kbps, while the Weinview panels use Modbus RTU. Both connect to the PLC’s PORT1 without any configuration changes on the module side.

Performance and Results

After commissioning, the system underwent a 72-hour stress test with all twelve machines running simultaneously. Key performance indicators included:

The total project cost was approximately $8,000—only 27% of the estimated PLC replacement cost. The existing HMIs were fully reused, and adding two more machines later required less than one hour of configuration each.

Best Practices and Future Considerations

When implementing such an upgrade, consider the following recommendations:

• Always use shielded cables and proper grounding to ensure signal integrity in noisy environments.
• Configure VLANs to separate control and monitoring traffic, reducing the risk of network congestion.
• Enable heartbeat and auto-reconnect features to maintain robust communication.
• Document IP addresses and data mappings thoroughly for easier troubleshooting.

For future enhancements, the system could be extended with OPC UA server functionality to connect with MES/ERP systems. Modules with SNMP support would allow remote diagnostics. For applications requiring even faster response times, PROFINET-capable converters are available.

This case demonstrates that with the right serial-to-Ethernet module, older PLCs can be cost-effectively integrated into modern industrial control systems, extending their useful life and enabling smart manufacturing initiatives.