Fieldbus in Siemens Plants: AS-i, PROFINET and PROFIBUS
PROFINET, PROFIBUS DP, AS-Interface, IO-Link and Modbus TCP on S7-1200 and S7-1500: TIA Portal integration, typical commissioning faults, diagnostics, retrofit.

A fieldbus is an industrial communication system that connects sensors, actuators and distributed I/O to a controller over a shared line instead of wiring every signal individually. It transfers process data cyclically, often parameters and diagnostics as well, and thereby fixes a plant's topology, cable lengths and response times. In Siemens plants the common representatives are PROFINET, PROFIBUS DP, AS-Interface, IO-Link and Modbus TCP.
In practice you rarely find a single bus, but a mixture that has grown over the years: PROFINET to the distributed I/O, a PROFIBUS segment from the era before that, a yellow AS-i flat cable running along the conveyors, a weighing system on Modbus TCP. This article sorts these systems out from the commissioning engineer's point of view — for project managers hiring an external contractor, and for maintenance staff whose bus landscape nobody can fully explain any more: how each bus attaches to an S7-1200 or S7-1500, what typically goes wrong during commissioning, and how to recognise it.

1.PROFINET: the backbone everything else hangs on
PROFINET is the leading Industrial Ethernet protocol under the umbrella of PROFIBUS & PROFINET International (PI), currently at specification V2.5. It offers three real-time classes — RT, IRT (isochronous) and TSN — and covers application areas through profiles: PROFIsafe for safety-related data, PROFIdrive for drives, PROFIenergy and PROFIprocess. Connectivity options include SPE and APL.
On an S7-1200 or S7-1500, PROFINET is the default: the CPU is the IO controller, distributed I/O such as ET 200SP are IO devices. Configuration in TIA Portal is unspectacular — which is exactly why the same commissioning faults keep coming back:
- Device name, not IP. PROFINET addresses devices by device name, not by IP address. A replaced device without an assigned name stays silent even though it is reachable on the network and its LED is green.
- Topology configured but not cabled. Maintained neighbourhood relations allow device replacement without a programming device — and produce a start-up fault the moment somebody swaps two patch cables.
- Update time set too ambitiously. Set too low, it produces sporadic station failures that look like a hardware defect in daily operation.
In return, the diagnostic path is the most comfortable of all the buses covered here: online status in TIA Portal, the CPU diagnostic buffer, integrated system diagnostics — and, for sporadic faults, a network capture running alongside.
2.PROFIBUS DP: the installed base that keeps running
PROFIBUS DP is the most widespread classic fieldbus: PI reports 67.4 million installed devices as of the end of 2022, standardised in IEC 61158. Its distinguishing feature is reach across both worlds — factory and process automation run on a single communication protocol over the same cable, whereas other buses need a second system for that. The PROFIBUS PA profile currently stands at V3.02.
On an S7-1500, PROFIBUS DP is not a discontinued model but an interface like any other: DP slaves appear as distributed I/O in the process image. The typical faults have been the same for decades and are almost always physical — a missing or an additional active terminating resistor at the wrong end, an overlong spur, a sloppy shield connection, a duplicated station address after a device replacement. So fault-finding here is about the cable, not the program: connect a bus monitor, count telegram repetitions, split the segment.
3.AS-Interface: the yellow flat cable at field level
AS-Interface (AS-i) is a single-master fieldbus for the sensor/actuator level, standardised to IEC 62026-2 and maintained by the AS-International Association in Gelnhausen, Germany. One master polls up to 62 slaves cyclically with 4 bits of user data per telegram; data and power share the same unshielded yellow two-wire flat cable. The association reports more than 36 million installed nodes.
The connection technique explains why AS-i persists so stubbornly in existing plants: two spikes pierce the insulation of the profiled flat cable — no stripping, no tools, no fixed tap-off point. Topology is free: line, star, tree, ring. According to the Siemens device manual the AS-i line may be up to 100 m long with free choice of topology, up to 200 m with an Extension Plug; beyond that, repeaters extend the system. What counts towards that length is every cable laid in the segment including spurs and branches — not the longest single run. Two figures circulate for the nominal voltage; the Siemens manual documents both as configurable, because duplicate address detection has to be set either to a 30 V or to a 24 V variant. Actuators are usually fed by a separate 24 V line.
3.1.AS-i on the S7-1500: the master break during a retrofit
This is the most important hardware difference between the controller generations. For the S7-300 the centrally pluggable CP 343-2 was the standard route; for the S7-1500 the Siemens documentation reviewed here contains no centrally pluggable AS-i master. The documented route runs through distributed I/O:
- CM AS-i Master ST (3RK7137-6SA00-0BC1) in an ET 200SP, attached via PROFINET: an AS-i master to specification 3.0, 20 mm wide, requiring a BaseUnit. Digital inputs and outputs sit in the cyclic process image; analogue ones do too from firmware V1.1 onwards, or acyclically via data record.
- CM 1243-2 for the S7-1200, powered through the CPU's communication bus, for up to 31 standard slaves, occupying 62 bytes of address space; configuration in STEP 7 is mandatory.
- Third-party gateways, for instance from Bihl+Wiedemann, bring ASi-5/ASi-3 straight onto PROFINET, PROFIsafe, EtherCAT, EtherNet/IP or Modbus TCP — constant cycle time of 1.27 ms for 384 bits of input plus 384 bits of output data, optionally with an integrated safety monitor.
The address space trap in the ET 200SP
The CM AS-i Master ST occupies 32 bytes of address space (firmware V1.0), and up to 288 bytes from V1.1 onwards. An IM 155-6 PN ST interface module provides a maximum of 256 bytes. With the 32-byte setting, up to eight master modules therefore fit into one station — while a single module with the full 288-byte configuration no longer fits at all. That calculation belongs in hardware planning, not in the commissioning week.
Expectations about response time matter just as much. One bus cycle addresses 1 to 31 slaves, which yields a maximum bus cycle time of 5 ms; A/B address pairs are polled automatically in two consecutive cycles. Anyone hoping that a retrofit to a fast S7-1500 will speed up the field level will find the limit on the AS-i segment, not in the CPU.
3.2.What the AS-i master reports — and how to read it
Diagnostics run through three lists that you compare against each other during every commissioning: LPS (configured slaves), LDS (detected slaves) and LAS (active slaves). In configuration mode the master does not report configuration errors as alarms to the higher-level system; in protected mode it activates only slaves listed in the LPS and reports every deviation. It recognises exactly three configuration errors: a surplus slave, a missing slave, a slave of the wrong type. As an AS-i cable fault it reports a ground fault, insufficient AS-i voltage, and a peripheral fault on a slave.
The flags are right on the module: CER for configuration error, EFD for ground fault, APF (AS-i Power Fail) for insufficient supply voltage. A set LDS.0 is the classic symptom of a factory-new slave that has not been addressed yet — address 0. The error counters make a clean distinction: an active slave only counts as failed once it has not answered six consecutive master calls; a single missing slave telegram increments the counter but does not interrupt process data. That counter is precisely the early warning you read out before handover — it shows a weakening connection long before the slave drops out. Two more features help in daily operation: duplicate address detection and automatic address programming, which assigns the configured address to a replaced slave by itself, so maintenance can swap a defective module without an addressing unit.
Most common finding on an AS-i network: installation, not software
The most laborious AS-i faults are sporadic ground faults. Narrowing them down is manual work: disconnect lines one at a time, measure voltage to ground (nominal ±15 V), then disconnect slave by slave. The most common cause is an installation error, in particular an unintended coupling with the 24 V DC of the standard control equipment. And some ground-fault monitors react to EMC interference and report a ground fault that is not one. VDI/VDE 2184, "Reliable operation and maintenance of fieldbus systems", is a useful operational basis.
3.3.Safety at Work and the path to ASi-5
Safety-related components — emergency stops, door interlocks, light curtains — run on the normal AS-i network with AS-i Safety at Work: technically a second transmission protocol on the same cable, requiring its own safety monitor. It reaches SIL 3 to IEC 61508 and Performance Level e to EN ISO 13849-1; the concepts were assessed positively by TÜV and by the DGUV Institute for Occupational Safety and Health. Standard and F data therefore share a cable, but not the responsibility — assessing the safety function remains with the operator and the machine manufacturer.
ASi-5, presented in 2018, extends the system without a break: 1.2 ms cycle time for up to 24 nodes (96 nodes then at 5 ms), and up to 1,536 binary inputs and outputs per Ethernet address. The decisive point for existing plants: ASi-3 and ASi-5 components run together on the same yellow flat cable; all it takes is an extended ASi-3/ASi-5 master.
4.IO-Link: not a bus, but the layer below
IO-Link is a point-to-point interface between an IO-Link master and a single sensor or actuator, standardised under the IO-Link consortium with its own IEC standardisation and extended by the IO-Link Safety and IO-Link Wireless branches. Device descriptions (IODD) are distributed centrally by the consortium through the IODDfinder. The master is the bus node — the IO-Link device itself is not on the fieldbus.
For commissioning, that division of roles is the crucial point: in TIA Portal you configure the master as a module of the distributed I/O, and the device parameters come in through the IODD. The gain is not speed — a sensor can be parameterised without touching it, and it reports more than "signal present / signal gone". Fault-finding shifts accordingly, away from the cable and towards the mapping of port, IODD version and process data length: a device with a differing IODD revision delivers process data at the wrong byte position — in the program that looks like a defective sensor.
5.Modbus TCP: the lowest common denominator
Modbus was introduced by Modicon in 1979 and is maintained today by the Modbus Organization, a vendor-independent non-profit. It describes Modbus as a de facto standard and the most widely used network protocol in the industrial manufacturing environment; industry analysts count more than 7 million Modbus nodes in North America and Europe alone. The protocol is not industry-specific — the common denominator is its messaging structure.
In Siemens plants, Modbus TCP is rarely the backbone and almost always the bridge: to a weighing system, an energy meter, a compressor or a third-party machine that does not speak PROFINET. The S7-1200 and S7-1500 work through library blocks as either client or server. Because the protocol is deliberately lean, the effort lies not in the connection but in the interpretation: register addresses, counting from 0 or from 1, byte and word order, scaling of raw values. A swapped word in a 32-bit counter reading is the classic case — the value looks plausible and is not.
6.EtherCAT: why it appears here only for delimitation
EtherCAT was developed by Beckhoff, presented in April 2003, and is disclosed in IEC 61158; the development targets were cycle times below 100 µs with jitter below 1 µs. This is achieved by "processing on the fly": each node reads the data addressed to it as the frame passes and writes its own into the same frame — a payload rate above 90 percent, no TCP/IP stack in the cyclic path, identified by EtherType 0x88A4. In a Siemens plant, EtherCAT therefore usually appears as a foreign island: a supplier's machine module with its own controller, coupled through a gateway. What matters for integration is then not the segment itself but the data interface above it.
7.The buses compared
| Bus | Topology | Nodes | Cycle time | Typical use | Retrofit status |
|---|---|---|---|---|---|
| PROFINET | Industrial Ethernet, switched | — | three real-time classes: RT, IRT, TSN | plant backbone, distributed I/O, drives, safety | target system of the migration |
| PROFIBUS DP | — | — | — | existing peripherals; factory and process on one cable | proxy or rewiring |
| AS-Interface | free: line, star, tree, ring; 100 m per segment, 200 m with Extension Plug, repeaters beyond | up to 62 slaves (31 standard or 62 with A/B addresses), 4 bits per telegram | max. 5 ms; A/B pairs in two cycles | sensor/actuator level, feeder for PROFINET; safety up to SIL 3 / PL e | field installation stays, master changes |
| IO-Link | point-to-point, master to device | one device per port | — | parameterisation and diagnostics of individual sensors/actuators | additive, master on the existing bus |
| Modbus TCP | Ethernet | — | — | coupling to meters, scales, third-party machines | usually stays unchanged |
| EtherCAT | — | — | target ≤ 100 µs, jitter ≤ 1 µs | motion control, third-party machine modules | coupled through a gateway |
"—" here means: not documented in the underlying primary sources — not "does not exist".
8.Retrofit reality: what happens to the bus when the controller is replaced
PROFIBUS DP on a new controller. The standard route is not replacement but a proxy. An IE/PB LINK integrates existing DP slaves into a PROFINET network; from the IO controller's point of view they then behave like IO devices with an Ethernet interface. The IE/PB LINK HA version accepts up to 64 DP slaves as a PROFINET S2 device, with DP inputs and outputs limited to 2,048 bytes. That allows a gradual migration, but costs an extra component in the diagnostic chain — in the event of a fault you always have to establish whether the problem sits before or behind the coupler. Where a plant section is being rebuilt anyway, rewiring to PROFINET is the cleaner solution; where a working DP run can be left untouched, the proxy is the more economical one. Siemens describes the route in its migration guide from S7-300/400 to S7-1500 (SIOS entry ID 109478811).
Keeping an existing AS-i installation on an S7-1500. This works without touching the field installation: flat cable, piercing connections and slaves stay in place as long as a master to specification 3.0 is used — cross-vendor interchangeability is the explicit purpose of certification by the AS-International Association. Only the master necessarily changes: from the central CP 343-2 of the S7-300 to the CM AS-i Master ST in an ET 200SP or to a third-party gateway. For this route Siemens highlights the integrated system diagnostics for AS-i networks within the ET 200SP station, and positions AS-i not as a competitor to PROFINET but as its low-cost feeder.
What happens to the bus in an S5 or S7-300 retrofit. The bus landscape belongs in the site survey, not in commissioning: which slaves are actually on the network, which exist only in the old configuration, which master feeds which segment, and does the address space of the new station suffice? The sequence of such a project is described in S5 & S7-300 retrofit: migration to S7-1500 + WinCC Unified; the service itself is at control system retrofit. In the Greater Region of Saar-Lor-Lux you frequently meet plants from the early 2000s in which PROFIBUS and AS-i have grown side by side — the controller replacement is the realistic moment to clean that structure up.
9.What an external commissioning engineer has to bring
Tools. A programming device with TIA Portal is enough for PROFINET diagnostics and the process image — it is not enough for the cable. What belongs alongside it: a meter for voltage to ground on the AS-i segment, a bus monitor or network capture for PROFINET and PROFIBUS, an addressing unit for AS-i slaves and, for sporadic faults, a permanently installed diagnostic device that records voltage, cycle time, telegram repetitions and device failures chronologically. Sporadic faults are not found by being present, but by recording.
Method. Physics first, then logic: measure and record segment by segment before the program falls under suspicion — for AS-i that means checking the power supply and voltage level, counting segment lengths including all spurs, comparing LPS against LDS and LAS, reading out the error counters. Then the functional test: every slave stimulated individually, every reaction checked. In my own projects with AS-i segments on S7-300 and S7-1500 controllers, the time for this measuring has almost always been shorter than the time a wrongly guessed cause costs.
Handover documentation. What has to end up with the operator is a short list and still often is not delivered: a slave list with address, type, profile and installation location; a segment overview with cable lengths, power supplies and repeaters; the measurement and test report per segment; the mapping of bus addresses to the symbols in the TIA project; the parameter sets of the IO-Link devices including IODD version. Whoever replaces a module later then does not have to reconstruct what used to be there.
Four questions to ask a contractor before awarding the job
Which bus systems do you measure yourself — and with what equipment? Do I get a measurement report per segment? How do you document the slave assignment? Who is responsible for the safety functions on the bus, and what records do you supply for them?
10.Conclusion
The field level determines how fast and how reliably a plant runs — not the CPU. An S7-1500 does not make an AS-i segment faster than 5 ms, and a proxy does not cure a badly terminated PROFIBUS run. The good news for existing plants: the field installation as a rule survives the change of controller — what changes is the master.
A plant with a bus landscape that has grown over the years?
Planning a commissioning or a retrofit and unsure what will become of your PROFIBUS, AS-i or Modbus runs? Get in touch for an initial assessment; an overview of all services is available here.
11.Sources
- Siemens: device manual CM AS-i Master ST (3RK7137-6SA00-0BC1), 05/2015 — PDF
- Siemens: device manual CM 1243-2 / DCM 1271 — PDF
- Siemens: AS-Interface — product overview
- Siemens: migration guide S7-300/400 to S7-1500, SIOS entry ID 109478811 — PDF
- Siemens: IE/PB LINK HA as a PROFINET proxy — entry 109807303
- AS-International Association — as-interface.net, as-interface.de and ASi-5 user benefits
- PROFIBUS & PROFINET International: PROFINET and PROFIBUS
- IO-Link consortium: What is IO-Link
- Modbus Organization: FAQ
- EtherCAT Technology Group: technology
- Bihl+Wiedemann: gateway data sheets 4018 and 3848
- Indu-Sol: ASi bus diagnostics — segment length counting, power supply functions, insulation monitoring
About the author: David Prybisch is a PLC programmer and commissioning engineer with more than ten years of hands-on experience and the founder of Prybisch Automation, based in Stadtbredimus, Luxembourg. He handles commissioning and control system retrofits on Siemens plants in Luxembourg, the Saarland and the Trier region.
Questions about your automation project?
As an automation engineer based in Stadtbredimus, Luxembourg, I offer free initial consultations for companies in the Greater Region Saar-Lor-Lux.
David Prybisch · PLC · HMI · Commissioning
Related Articles

S7-300 Retrofit: Migrating to S7-1500 and WinCC Unified
S7-300 discontinued, S5 long out of spare parts: how a control system retrofit to S7-1500/S7-1200 and WinCC Unified works — often without a new cabinet.
Read more: S7-300 Retrofit: Migrating to S7-1500 and WinCC Unified
PLC Retrofit Costs 2026: What Control System Modernization Really Costs
Old PLC, no spare parts? S7-300 runs out in 2035. We modernize your controls with minimal downtime – 30-60% cheaper than new equipment. Greater Region expert.
Read more: PLC Retrofit Costs 2026: What Control System Modernization Really Costs
PLC Troubleshooting: Find the Root Cause in 5 Steps
Troubleshooting PLC programs under pressure: five steps from the alarm view to the block, the right TIA Portal tools and five typical fault classes.
Read more: PLC Troubleshooting: Find the Root Cause in 5 Steps