Abstract: This paper introduces a method for implementing control system communication using PROFIBUS-DP, and successfully achieves mutual communication between Hollysys CPU24x and CPU21x series PLC systems and Siemens S7-300/200 PLC systems. Keywords: PLC; PROFIBUS-DP Introduction Currently, there are many influential fieldbus standards internationally. Among them, PROFIBUS-DP is mainly used for high-speed data communication between central processing units and distributed peripheral devices, solving the communication problem between automatic control systems (such as PLCs, PCs, etc.) and distributed field devices (I/O, drives, valves, etc.) via high-speed serial buses. This paper uses PROFIBUS-DP to achieve communication interconnection between Siemens S7 series PLC systems and Hollysys CPU24x and CPU21x series PLCs. [align=center]Figure 1 Master-Slave Communication System Configuration[/align] [align=center]Figure 2 Schematic Diagram of CPU and CP Data Exchange Principle in Slave Mode[/align] System Design Holysys' CPU24x and CPU21x are generally used as master devices, while Siemens S7-300 PLC's CPU 315-2DP and CP342-5 can function as both master and slave devices. When used as slave devices, they can be designed as passive or active slaves. Passive slaves execute simple DP protocol functions, equivalent to simple slaves; active slaves can obtain tokens on the bus and then communicate with other slaves within a defined time window. Besides supporting simple DP protocol functions, they also support other services such as FDL services, S7, and PG. Additionally, the CP342-5 and PC stations with CP5611 cards can also implement a second-class DP master for programming, diagnostics, and other functions. Since Hollysys' CPU24x and CPU21x PLCs are master devices and can only function as masters in this system, this design uses Siemens S7-300 and S7-200 PLCs as slave devices, utilizing the master-slave communication principle of PROFIBUS-DP to achieve their communication. The system configuration is shown in Figure 1. In Figure 1, the Hollysys PLC uses the FM208 PROFIBUS-DP communication module to connect to the PROFIBUS-DP network. The FM208 communication module is the DP master module, acting as the DP master in the DP network. All Siemens DP slave devices can be connected to the DP network as slaves of the FM208 and achieve direct data communication with each other using the DP communication protocol. Here, Siemens' S7-300, S7-200 PLCs and frequency converters are used as slaves of Hollysys PLC's FM208 via PROFIBUS-DP communication modules CP 342-5, EM 277 and CBP2, respectively, and communicate with each other. Communication Programming User programs for DP master stations are integrated into the PROFIBUS-DP communication module FM208. Users only need to complete the following configurations and settings to complete the user programming of the master station. (1) DP network configuration, completed using WinNCS software. ① Start WinNCS software and select PROFIBUS as the network type. Then insert the master station into the PROFIBUS network. The system defaults to CPU24X as the master station. Specify its DP master station address as 2 and the bus network transmission rate as 1.5 Mbps. ② Insert DP slaves CP342-5, EM277, and CBP2 into the FM208 master station. The corresponding DP network addresses are 3, 4, and 5. CP342-5's I/O data is set to 16 words in and 16 words out, EM277's I/O data module is set to 8 words in and 8 words out, and CBP2's data type is set to PPO3. The I/O data of each slave station is automatically assigned the corresponding address in the FM208 master station in sequence. ③ Compile and save the file, and then download it to the communication processor FM208. (2) Address allocation of slave I/O data addresses configured in FM208 in CPU241. According to the number of slaves configured using WinNCS and the set I/O data start address and length, the data address can be assigned to them in the data block db1 of the PLC program. For example, the starting addresses of the slave station I/O mentioned above all start from 0, and the total data length is 28 words each. Add the address configuration instruction to DB1: `kc=uat: 0 28 0 28 ;end`. In the PLC user program, the slave station's process data can be addressed directly based on the above-set address, without additional communication programming. For the S7-300 DP slave station user program, the S7-300 PLC uses CP342-5 as the master station and the Lishi PLC as a slave station. To ensure data communication, the following steps are required: ① Configure CP342-5 as a slave station. ② Write the slave station user program and download it to the S7 PLC. ③ Start and debug the DP slave station and DP master station. ④ Diagnose communication anomalies. (1) CP Function: When used as a DP slave, the CP342-5 can be configured as an intelligent slave or a modular master by the DP master. When used as a slave, it can be configured as a passive slave or an active slave, but it is not allowed to be configured as a master at the same time as a slave. When used as an active slave, in addition to providing slave service functions, it can also provide other communication services such as FDL connection services. The main functions of the CP342-5 are: ① Receive parameters for configuration and setup from the master, including process output data and data passed to the CPU. ② Receive input data from the DP data field of the CPU to prepare data for the DP master. ③ Prepare diagnostic data for pickup and evaluation for the DP master. ④ Prepare I/O data to be read for the two types of master. (2) Data Exchange Principle: Data exchange between the DP master and the DP slave adopts a round-robin method, which is completed using the receive buffer and transmit buffer in the DP data field. The DP master station initiates data exchange, outputs data to the output buffer, and retrieves data from the input buffer. The principle is shown in Figure 2. Data exchange between the CPU and CP is achieved by calling the dp_rece and dp_send functions of S7 in the CPU loop. Among them, the dp_rece function receives the data sent by the DP master station to the receive buffer of the slave CP, and then outputs the data to the DP data field specified by the CPU. The dp_send function transmits the data to be transmitted in the DP data field specified by the CPU to the transmit buffer of the CP, and then transmits it to the DP master station. (3) User program In the S7 PLC, the user data field in the CPU can be the process image, bit register and data block. Data blocks are used in this user program. In the blocks directory of the S7 user program, two data blocks db1 and db2 are defined to store the received and transmitted data respectively. Then, the dp_rece and dp_send functions are called in the organization block ob1 that is executed in a loop. When the DP master station changes the running mode or crashes, the operating system reacts by calling a certain ob on the slave station. If these obs are lost on the slave station, the CPU will immediately and automatically switch to stop. Therefore, to prevent this, the relevant obs must be created on the slave station. When the master station's CPU switches from run to stop, organization block ob82 (diagnostic interrupt) on the slave station will be invoked. To prevent the CPU from stopping due to the absence of ob82, organization block ob82 must be inserted into the blocks folder of the S7-300 station. Similarly, when the DP master station crashes, organization block ob86 (rack failure) will be invoked on the slave station. To prevent the S7-300 slave station's CPU from entering stop under such circumstances, organization block ob86 must be inserted into the blocks folder of the S7-300 station. User program for the DP slave S7-200 Profibus-DP communication between the master station and the Lisheng PLC and the slave S7-200 CPU226 is achieved by connecting the S7-200 CPU226 to the network as a DP slave using the FM208 module. The FM208 is a modular DP slave station with a maximum I/O data size of 32 words. It connects to an S7-200 CPU226 via a serial bus and to a PROFIBUS via a DP communication port. Its main functions include: operating at any speed between 9.6kbps and 12Mbps; receiving I/O configuration and parameter information from the master station; sending and receiving different amounts of data to and from the master station; transmitting I/O data; and supporting variable block transfers. Master station configuration includes slave address, slave variable storage area (V-storage) bias, and I/O module selection. During runtime, the DP master station first establishes the network, then initializes and starts the DP slave station, writing parameter assignment information and I/O configuration to the slave station. The master station then retrieves diagnostic information from the slave station. After confirming that the slave station has received the information, the master station gains control of the slave station. At this point, other masters on the network can read data from the slave station but cannot write data to it. The entire master station configuration is done through the device database (GSD) file siem089d.gsd. The slave station address is set via a hardware switch on the FM208 module; this switch must match the address set in the master station software. The slave I/O buffer resides in the S7-200's V memory area; therefore, the parameter assignments must include the starting position of the buffer in the V memory area and the amount of I/O data to determine the buffer size. The FM208 provides three types of data exchange: byte, word, and buffer. The communication user program for the S7-200 CPU226 PLC is as follows: network 1 // Calculate the output data pointer to register V: ldb = smb224, 2 movd &vb0,vd1000 itd smw226,ac0 +d ac0,vd1000 network 2 // Calculate the input data pointer to register V: ldb = smb224, 2 movd vd1000,vd1004 bti smb228,ac0 itd ac0,aco +d ac0,vd1004 network 3 // Set the amount of data to be transmitted: ldb = smb224, 2 movb smb228,vb1008 movb smb229,vb1009 network 4 // Transmit data: ldb = smb224, 2 bmb *vd1000,qb0,vb1008 bmb Conclusion (ib0, *vd1004, vb1009) Using the Profibus fieldbus, complex communication programming is unnecessary, allowing for easy integration of fieldbus devices from different manufacturers within a single system. Data transmission is reliable, configuration is flexible, and true plug-and-play functionality is achieved. Furthermore, the integration method is simple, and communication is reliable and fast, making it well-suited for real-time system control requirements. Some communication problems arising from the limited functionality of current manufacturer-provided communication products and services can be completely resolved through flexible configuration.