I. IO Debugging Methods 

Can you debug third-party Profinet IO or Profinet gateways using the online data monitoring function of the configuration software, or can you verify debugging through Siemens (STEP 7-MicroWIN SMART, TIA Portal) and Codesys?

STEP 7-MicroWIN SMART Platform

Profinet IO debugging using the STEP 7-MicroWIN SMART platform requires an S7-200 PLC. After importing the device description file (GSD), add the device using the "Profinet Configuration Wizard." Click the device (P31V1.0.0-p18 in the figure below) to query the PLC's register mapping address for that device. For the example scenario shown, the digital input (DI) mapping address of the P31-AXAX4040G-U is %IB128, and the digital output (DO) mapping address is %QB128.

Add the corresponding monitoring points in the "Status Icon", as shown below:

Download the program to the PLC, select "Debug" from the top menu, and enable "Chart Status" monitoring. This will allow you to switch the P31-AXAX4040G-U relay status online and query the discrete input status. 

 1.1TIA Portal Platform

When using the TIA Portal platform, as with STEP 7-MicroWIN SMART, you must first connect to the PLC before debugging third-party Profinet IO. TIA Portal does not support the S7-200; you must use an S7-1200 or S7-1500 series PLC. Add the corresponding third-party device in the device configuration interface and access the corresponding device configuration interface to query the mapped point data. For example, the digital outputs (DO) of the P31-XXAX00A0G-U are mapped to %QB2 and %QB3.

When using the device's Modbus gateway function, the corresponding submodules can be configured. For example, the read register is mapped to %IW68, the write register is mapped to %QW64, and the Modbus gateway control register is mapped to %QB4-QB8. Q4.0 is the serial port enable control. (For details on the Modbus gateway control register function, refer to the corresponding device manual.)

Add the above variables to the "Monitoring and Enforcement Table"： 

After writing the program to the PLC, switch to "Online Mode" and enable variable monitoring. You can use the variable table to control the relay outputs of the P31-XXAX00A0G-U and send Modbus commands through its serial port. (Using the gateway function requires enabling %Q4.0; otherwise, no commands will be output from the serial port.)

1.2 Codesys Platform

Enabling "Always Update Variables" in the device configuration facilitates subsequent modification of variable values in the "PNIO SubModule I/O Mapping" section, eliminating the need to create a variable monitoring table.

When debugging using the Codesys platform, you can debug remote IO devices without connecting to the PLC. After importing the GSD, you can add the corresponding IO module in the device tree, double-click to enter the corresponding device configuration, and query the mapped point data. Take the following figure as an example, the DI of P31-AXAX4040G-U is mapped to %IB3, and the DO is mapped to %QB0;

Add %IB3 and %QB0 to the variable monitoring table (after turning on "Always update variables", you can directly control it in the IO properties interface), configure the input parameters in "Prepared value" or "Prepared value", and write the parameters to the device by pressing Ctrl+F7;

If you are unable to connect, first check whether the simulated PLC should be automatically shut down due to timeout (you will see the Control Win SysTray icon in the tray area in the lower right corner, click it and select Start PLC, wait for about three seconds until the icon turns red, indicating that it has started. If there is no authorization, Control Win will run for 2 hours, after which the icon will automatically turn gray), and restart the simulated PLC; 

Ⅱ. Gateway Usage

 Currently, the gateway function only supports Profinet to Modbus RTU conversion, supporting both master and slave roles (PNMB Master and PNMB Slave).

The PNMB Master role refers to the gateway acting as a master, sending Modbus RTU commands to control or query slave devices. This role is typically used to transmit RTU data (such as temperature, liquid level, and pressure data) from Modbus RTU-supported devices to the PLC. In this role, the gateway converts the Profinet commands issued by the PLC to the Modbus RTU protocol.

The PNMB Slave role refers to the PLC acting as a slave, transmitting data to the master device through the gateway. In this role, the gateway converts the data sent by the Modbus master into Profinet commands to operate the PLC.

The following example demonstrates how to enable both PNMB Master and PNMB Slave modes on the gateway device, enabling data transfer between two PLC addresses.

As per the previous tutorials, the first step is to import the gateway device descriptor file (GSDML-V2.3-EBYTE-PN1-D25).

Adjust the unique device name of the gateway. Here, use the default name. Add the device to the PLC project and assign an IP address:

Connect the network port to the PLC network;

Add modules and record the corresponding mapping addresses in the PLC:

And adjust the first address of the PNMB Master write module to 1;

PNMB Master:

Configure the Modbus Slave's 40001 to 122, and synchronize the PLC's %IW70 to 122 via the gateway.

Configure the PLC's %QW66 to 0, and modify the Modbus Slave's 40002 to 0 via the gateway.

PNMB Slave:

Configure the Modbus POLL's 40002 to 111, and modify the PLC's %IW68 to 111 via the gateway.

Configure the PLC's %QW64 to 1111, and the Modbus query on 40001 via the gateway returns 1111.