Configuring Siemens 6ES7336-4GE00-0AB0 F-AI: PROFIsafe Addressing

Overview: The Addressing Anomaly

When engineers first drop the Siemens SM 336F fail-safe analog input module (order number 6ES7 336-4GE00-0AB0) into an S7-300F station in STEP 7 HW Config — or into TIA Portal as a PROFIsafe GSD device — they typically see something unexpected in the address overview: the configurator reserves both input (I) and output (Q) addresses for a module whose only role is to read analog process values into the F-CPU. A 24-channel fail-safe digital input may report only 3 bytes of input channels yet occupy 10 bytes total. The SM 336F behaves the same way.

This is not a configurator bug, slot mismatch, or hardware fault. It is a direct consequence of the PROFIsafe protocol architecture, the safety profile layered on top of PROFIBUS-DP and PROFINET IO to achieve SIL 3 / Category 4 functional safety per IEC 61508 and ISO 13849-1. PROFIsafe wraps each cyclic payload with bidirectional safety metadata — a control byte, a status byte, a CRC signature, and a sequence counter — and that metadata must live somewhere in the process image, in both directions.

Module Identification and PROFIsafe Fundamentals

The SM 336F (6ES7 336-4GE00-0AB0) is the fail-safe analog input module for the SIMATIC S7-300F and ET 200S distributed I/O families. Its catalog metadata determines the address layout:

The same PROFIsafe addressing principles apply to the S7-1200F family, the S7-1500F successor module 6ES7536-1MF00-0AB0 (F-AI 8xI 0(4)…20 mA for ET 200MP, released per the Siemens Support delivery release note), and to the ET 200SP HF F-AI family documented in the Siemens S7-1200 F-Signal Modules Manual Collection. Cross-vendor equivalents such as the Allen-Bradley FLEX 5000 analog safety I/O modules use the same architectural pattern under CIP Safety rather than PROFIsafe.

PROFIsafe is the safety bus profile defined by PROFIBUS & PROFINET International (PI) for both PROFIBUS-DP and PROFINET IO. It is a black-channel implementation: the safety protocol travels alongside standard cyclic I/O data on the same physical network, without requiring a separate cable. Each PROFIsafe slot adds the following fields to its cyclic payload, regardless of whether the slot is an input, output, or mixed module:

• Control byte (1 byte, F-CPU → F-device) — host-side commands such as "passivate channel," "activate integrator," "operator acknowledgment," "iPar server request."
• Status byte (1 byte, F-device → F-CPU) — quality flags including "value valid" (FV), "channel passivated," "fault present," and vendor-specific diagnostic bits.
• CRC signature (24 bits in V1/V2, 32 bits in V2.6) — cyclic redundancy check computed over the payload, the sequence counter, and the configured F-source / F-destination address.
• Sequence counter (16 bits in V1/V2, 32 bits in V2.6) — incremented each cycle on both sides; mismatch triggers channel passivation.

Because the control byte is written by the F-CPU and read back by the F-device for verification, and the status byte is written by the F-device and read by the F-CPU, the PROFIsafe slot necessarily occupies both directions of the process image. This is true even on a pure input module, because the control byte still flows F-CPU → F-AI.

Why F-AI Modules Reserve Output Addresses

A standard (non-safe) SM 336 analog input module contributes only input words (IW) to the process image: the channel readings. The fail-safe SM 336F adds the PROFIsafe wrapper, which means the slot must carry:

1. The user's analog input words (6 channels × 16 bits = 12 bytes of process data).
2. The PROFIsafe status byte (input direction).
3. The PROFIsafe CRC-24 bytes (input direction).
4. The PROFIsafe sequence counter bytes (input direction).
5. The PROFIsafe control byte (output direction).
6. Reserved output bytes for CRC echo and iPar-server cycling (output direction).

These fields are placed at the top of the slot's address range, then the user's process data follows. The result in HW Config is shown below for a representative slot starting at IW 256 / QB 256:

The user application never touches the reserved bytes. The Siemens F-library blocks (for example the F-AI driver blocks within the S7 F-Library / Distributed Safety F-Library) and the F-runtime group manage them transparently. Manually overwriting these addresses is a frequent cause of "value invalid" and channel passivated errors at commissioning.

Memory Layout Examples

To illustrate the byte expansion, the SM 326F 24-channel F-DI reports only 3 bytes of "real" input channels (24 bits = 3 bytes) yet occupies 10 bytes total in HW Config. The breakdown is approximately:

This expansion — 3 bytes of channel data inflated to 10 bytes of input plus reserved output bytes — is the visual signature of PROFIsafe in the address overview.

For the SM 336F (6ES7 336-4GE00-0AB0) with 6 analog inputs at 16-bit resolution, the user-data portion is 6 × 2 = 12 bytes. Adding the PROFIsafe overhead (status + CRC-24 + sequence counter + reserved), the slot consumes roughly 18 bytes of input plus several output bytes. A representative allocation starting at IW 512:

The exact offset of the safety wrapper depends on the slot's start address and the PROFIsafe profile version. TIA Portal's device view shows the breakdown directly; STEP 7 V5.x shows the total input and output byte count per slot in the "Addresses" tab.

PROFIsafe Profile Versions and F-Monitoring Time

The PROFIsafe profile is selected in HW Config's object properties for the F-CPU's PROFIBUS / PROFINET interface (or in the device configuration of the F-CPU in TIA Portal). The selection matters for both the wire format and the addressing overhead:

If a profile mismatch is configured between the F-CPU and the F-AI, the slot will not pass data. Symptom: "Channel passivated" / "PROFIsafe communication error." Always match the profile on both sides, and re-issue the PROFIsafe F-source / F-destination address pair when swapping modules.

PROFIsafe runs a watchdog on each side: the F-CPU expects a fresh valid payload from the F-device within F_WD_TIME, and the F-device expects a fresh control byte from the F-CPU within F_WD_TIME. If either side times out, the corresponding channels passivate to safe-state substitute values. A common commissioning guideline from the PI PROFIsafe System Description is:

where T_bus is the worst-case bus cycle time (PROFINET update time or PROFIBUS DP cycle) and T_jitter accounts for non-isochronous jitter on the network. For PROFINET IRT with isochronous mode and a 1 ms update time, F_WD_TIME of 50–150 ms is typical. For PROFIBUS DP at 12 Mbit/s, F_WD_TIME of 100–500 ms is typical. Exact values must be validated against the F-CPU and F-module manuals; the formula above is a starting point.

Configuration in STEP 7 and TIA Portal

Configuration in STEP 7 V5.x HW Config (native for SM 336F):

1. Open the S7-300F station in SIMATIC Manager → HW Config.
2. Insert the SM 336F (6ES7 336-4GE00-0AB0) into the rack. Catalog path: SIMATIC 300 → SM-300 → F-SM-300 → 6ES7 336-4GE00-0AB0.
3. Open the module's object properties. Note the start address for inputs and outputs; this is the address the application program uses for analog channel 0.
4. On the F-CPU's PROFIBUS / PROFINET interface, open "PROFIsafe" and confirm the profile version matches the module's expected profile (default V2 for SM 336F).
5. Assign the F-monitoring time. Confirm F_WD_TIME > 2 × T_bus + T_jitter.
6. Assign the F-source and F-destination addresses. The F-destination address is set either by DIL switch on the module or via PROFIsafe address assignment (slot 0 in the slave).
7. Compile and download the hardware configuration. The reserved input / output bytes appear automatically in the Address overview.
8. Insert the F-library block into the F-runtime group and wire its ADDR_IN / ADDR_OUT parameters to the module's start address.

Configuration in TIA Portal (GSD-based, since SM 336F is not a native TIA Portal device):

1. Open TIA Portal → Options → Manage general station description files (GSD). Install the SM 336F GSD.
2. Add a PROFINET IO device / PROFIBUS DP slave in the device tree and select the SM 336F GSD entry.
3. Configure the F-source / F-destination address pair in the slot properties (PROFIsafe tab).
4. Set the PROFIsafe profile version (typically V2 for this module).
5. Configure the F-monitoring time and assign the F-I/O DB number.
6. Compile and download. The reserved bytes appear in the device view's "I/O addresses" tab.

Verification

After commissioning, open the F-AI's online diagnostics in STEP 7 (right-click → "Module Information" → "Diagnostics"). Expected states:

• Module status: OK
• PROFIsafe communication: OK
• Channel quality: "value valid" (status byte FV bit = 1)
• No passivated channels
• Sequence counter incrementing on each cycle

If the F-AI shows passivated channels, the F-CPU's F-runtime group must call the F-AI driver block to re-integrate the channels. The reserved PROFIsafe bytes are written by the F-library during this reintegration — do not interfere with them.

Channel Reintegration State Machine

Once a PROFIsafe channel has been passivated (because of a CRC error, watchdog timeout, or channel-level diagnostic), it must be re-integrated by the F-CPU before the application can use its value again:

Application engineers must wire the ACK input of the F-driver block to a deliberate operator action (for example an HMI button) — never auto-ACK. Auto-ACK defeats the diagnostic intent of the passivation and can mask intermittent faults that compromise safety.

Related Modules and Cross-Vendor Equivalents

The SM 336F is one member of the broader SIMATIC F-system family. Other commonly co-deployed safety modules and the cross-vendor equivalents:

All these modules exhibit the same input/output address expansion behavior; the byte count differs by channel count and PROFIsafe profile version. The CIP Safety wrapper used by the Allen-Bradley FLEX 5000 family is structurally analogous (mode byte + CRC-32 + sequence bits) and occupies assembly bytes in both directions for the same architectural reason.

Troubleshooting Matrix

Field Tips and Best Practices

• Never edit the PROFIsafe control/status bytes from the user program. They are managed by the F-runtime group's F-library blocks. Touching them manually breaks the safety transport layer.
• Reserve enough free address space in HW Config for the additional safety bytes — common mistake is to back the next module up against the F-AI's "real" channels and overlap the reserved safety bytes.
• Document the module's reserved byte count in the project's "I/O address map" deliverable so commissioning engineers do not mistake them for free address ranges.
• Wire the ACK input of the F-driver block to a deliberate operator action (HMI button with confirmation) — never auto-ACK. Auto-ACK defeats the diagnostic intent of passivation.
• Validate F_WD_TIME against the actual measured bus cycle and jitter, not just theoretical values. Use the diagnostic buffer to log watchdog timeout events and tune accordingly.
• When wiring 0/4…20 mA safety sensors to the SM 336F, observe polarity and use shielded twisted-pair cable. Channel-level diagnostics (wire break, short circuit) require the configured measurement range to match the sensor output — a sensor wired for 4…20 mA but configured for 0…20 mA will not report wire break correctly.

Migration to S7-1500F

For projects migrating from S7-300F to S7-1500F, the addressing expansion is the same in concept but the slot details change:

The TIA Portal "Migrating S7-300/400 projects to S7-1500" toolset converts STEP 7 V5.x hardware configurations into TIA Portal V17+ device configurations, but the F-I/O DBs and the F-library blocks must be re-mapped to the new naming conventions and the new V2.6 PROFIsafe profile. Validate the migration with the Safety Acceptance Test before live operation.

FAQ