Configuring S7-1200 and S7-1500 PROFINET Communication

Overview

Both the SIMATIC S7-1200 and SIMATIC S7-1500 families ship with an integrated PROFINET (PN) interface on the CPU module. No additional communication processor (CP), Ethernet module, or third-party gateway is required to establish a direct LAN link between two controllers. The onboard PN port supports the full PROFINET IO device role, PROFINET IO controller role, and the S7 communication services that the firmware exposes for inter-PLC data exchange.

This article covers the two principal methods for connecting an S7-1200 to an S7-1500 in TIA Portal:

• I-device communication — peer-to-peer PROFINET data exchange where one CPU acts as IO controller and the other acts as an I-device (intelligent IO device). No PUT/GET blocks are required.
• S7 connection — classic S7 communication configured under Connections in the TIA Portal network view, with PUT / GET instructions or TSEND_C / TRCV_C instructions for data transfer.

Prerequisites

Onboard PROFINET Interface Specifications

The integrated PROFINET interface on the CPU is implemented as a 2-port switch (S7-1200 V4.x and S7-1500) or 2-port switch with separate MAC addresses per port (S7-1500, depending on firmware). The interface supports 100 Mbit/s full duplex and auto-negotiation/auto-crossover.

Refer to the device manuals for the exact port count, port type, and supported topology of each CPU model:

• SIMATIC S7-1200 Programmable Controller - System Manual
• SIMATIC S7-1500 Automation System - System Manual

Communication Method Comparison

Topology

The simplest physical topology is a direct patch cable between the PROFINET port of the S7-1500 and the PROFINET port of the S7-1200. For commissioning and online access from TIA Portal, a third station (the engineering PC) is added. When a PROFINET switch is used, ensure the switch supports LLDP (mandatory for PROFINET conformance class B / C) and the device priorities match the PROFINET priority scheme.

Step-by-Step: I-Device Communication (S7-1500 controller → S7-1200 I-device)

1. Open the TIA Portal project containing both CPUs. If the project is new, add both devices via Add new device → SIMATIC S7-1500 → CPU 1515-2 PN and Add new device → SIMATIC S7-1200 → CPU 1215C DC/DC/DC.
2. Switch to the Devices & networks editor. Drag a PROFINET cable between the two PN ports to create the subnet. TIA Portal will auto-assign an IP/subnet (e.g. 192.168.0.0 / 255.255.255.0).
3. Configure the IP addresses explicitly: select each CPU's PROFINET interface, open Properties → Ethernet addresses, and uncheck Use IP address from project as needed. Set:
   PLC_1 (S7-1500): 192.168.0.1 / 255.255.255.0
PLC_2 (S7-1200): 192.168.0.2 / 255.255.255.0
4. Open the S7-1200 device configuration. Right-click the PROFINET interface → Properties → Operating mode → IO device. Enable I-device and tick This IO device is used as an I-device.
5. Under Transfer areas, add one or more transfer areas. For each area set:
   Name: TA_Inputs_from_S1200
Direction: I-device → IO controller (data the S7-1200 sends to the S7-1500)
   Start address: %IB1000
Length: 16 bytes
6. Repeat for the reverse direction with Direction: IO controller → I-device if the S7-1500 must write to the S7-1200.
7. Switch to the S7-1500 device configuration. On its PROFINET interface, under Operating mode → IO controller, assign the S7-1200 as a PROFINET IO device. Use Hardware catalog → PROFINET IO → IO → S7-1200 CPU 1215C, drag it onto the S7-1500 port. The slots assigned to the S7-1500's view correspond to the transfer areas declared in step 5.
8. The transfer area inputs/outputs are now visible to the S7-1500 user program as %IW0, %QW0, etc., inside the S7-1500's I/O address space. Access them directly with standard ladder contacts or with MOVE blocks.
9. Compile both stations (Right-click device → Compile → Software (rebuild all)) and download.

For the complete Siemens-authored procedure, see the FAQ: S7 communication between SIMATIC S7-1200 and SIMATIC S7-1500.

Step-by-Step: S7 Connection with PUT/GET

1. Both CPUs in the same TIA Portal project and on the same PROFINET subnet.
2. Open Devices & networks, click the Connections icon in the toolbar to enter connection mode.
3. Select S7 connection from the dropdown. Click the S7-1500 (client) first, then the S7-1200 (server). TIA Portal creates the connection with the S7-1500 as the Active connection establishment endpoint.
4. Open the connection properties. Confirm the local interface (S7-1500 PROFINET port) and partner interface (S7-1200 PROFINET port). Note the local Connection ID, e.g. 100, for use in the PUT / GET block.
5. On the S7-1200, open Properties → Protection & security → Connection mechanisms and enable Permit access with PUT/GET communication partner. This is required for unsolicited PUT/GET from outside the project; project-configured S7 connections do not need this flag.
6. Insert a PUT instruction in the S7-1500 OB1. Set:
   REQ: %M100.0
ID: W#16#0064 (decimal 100, the connection ID from step 4)
   SD_1: P#DB10.DBX0.0 BYTE 20
ADDR_1: P#DB20.DBX0.0 BYTE 20 (target on S7-1200)
7. Insert a complementary GET instruction in the S7-1500 to read S7-1200 data back.
8. Compile and download. Monitor PUT.DONE, PUT.ERROR, and PUT.STATUS to confirm success.

Virtual Memory Mapping (I-Device Detail)

The transfer areas defined on the S7-1200 I-device become:

• Input slots in the IO controller's (S7-1500) hardware view — readable in the user program as %I... words.
• Output slots in the IO controller — writable as %Q... words.

Mapping rule of thumb:

You can verify the address map in the S7-1500 Device view → slot list. The slot's I-address column shows the controller-side offset. Always keep the transfer area within the process image partition (PIP 0) to avoid update inconsistency; or use UPDAT_PI / UPDAT_PO if the area is outside PIP 0.

Configuration: TIA Portal Checklist

1. Both CPUs added under the same project.
2. PROFINET subnet created, IPs assigned, subnet mask identical.
3. PROFINET device name assigned (right-click interface → Assign PROFINET device name) before download. The S7-1200 PROFINET name must match the name in the project. Without a correct PROFINET name, the controller cannot locate the I-device.
4. Connection type chosen (I-device or S7 connection).
5. Compile → Software (rebuild all) on both stations.
6. Download. Reset to factory defaults first if reusing a CPU with an old PROFINET name.
7. Go online with both CPUs. Verify with Online & diagnostics → PROFINET IO diagnostics that the IO controller shows the I-device in Operating state and that no diagnostic interrupts are pending.

Open User Communication Alternative (TSEND_C / TRCV_C)

For non-PROFINET data, S7-1200 and S7-1500 also support TCP / UDP / ISO-on-TCP via the TSEND_C and TRCV_C blocks in the Communication palette. This method:

• Does not require a PROFINET device name.
• Uses standard TCP port (configurable). Default for ISO-on-TCP is port 102 (TSAP).
• Allows data payloads of up to 65534 bytes per call.

For SCADA / OPC UA integration (e.g. Ignition) against an S7-1200 or S7-1500, refer to the device-specific requirements: Connecting to Siemens S7-1200 and S7-1500.

Verification

1. Open Online & diagnostics on the S7-1500. Confirm the I-device is listed under PROFINET IO → IO devices with state OK.
2. Use a watch table on the S7-1500 to read %IW0 (should reflect the S7-1200's %IB1000 value) and write to %QW0. On the S7-1200 side, monitor %IB1000 and %QB1000 with a watch table.
3. For S7 connection: monitor PUT.STATUS = 0 and PUT.DONE = TRUE after a single REQ pulse.
4. Check CPU diagnostic buffer for any PROFINET alarms (station failure, name resolution error, etc.).
5. Use Online → Accessible nodes from the engineering PC to confirm both CPUs are visible and online.

Troubleshooting Matrix

Performance and Limits

Verify exact figures in the device manual because they vary by CPU order number and firmware revision.

Security Considerations

• Enable Access protection on both CPUs (TIA Portal → CPU properties → Protection & security).
• Disable Permit access with PUT/GET communication partner if all S7 connections are project-configured; this prevents unauthorized external partners from reading/writing data.
• Use a dedicated PROFINET subnet isolated from the office network. A SCALANCE firewall module (e.g. SCALANCE S615) can enforce layer 3 policy between the cells.
• For remote access, use SINEMA Remote Connect or the S7-1500 integrated VPN (firmware V2.8+) instead of opening the PROFINET port on the public internet.

FAQ