KTP700F Mobile PROFIsafe Connection Troubleshooting on S7-1500F

Problem Overview

The SIMATIC KTP700F Mobile (KTF700F) is a 2nd generation wireless HMI that integrates fail-safe I/O and an E-Stop into a PROFINET/PROFIsafe network. A recurring commissioning failure is that the standard PROFINET (non-safe) connection comes up without errors, but the parallel PROFIsafe channel never establishes. The safety program block F_FB_KTP_Mobile reports STATUS = 0 (or stale) and no QBAD / ACK_REI transitions occur, so the F-CPU cannot passivate, the panel cannot be brought into safe state, and the E-Stop chain stays undefined.

This guide consolidates the field-proven diagnostics for the configuration pairing CPU 1517F FW 3.0.3 + TIA Portal V18 + KTP700F Mobile FW V17.00.00.05_02.01, but the procedure generalises to any S7-1500F controller and any KTP700F / KTP900F Mobile panel from the same firmware generation.

Affected Hardware and Software Versions

Root Cause Analysis

PROFIsafe is a "black-channel" protocol layered on top of PROFINET. Five independent parameters must match between the F-CPU configuration, the panel's GSD/Profinet device description, and the on-panel runtime configuration before the F-connection is permitted to start. The five parameter groups are:

1. F-Destination Address (F-DA) – assigned to the panel in HW Config, must equal the value stored on the device.
2. F-Source Address (F-SA) – assigned to the F-CPU's PROFIsafe slot, must match the slot on the panel side.
3. PROFIsafe Monitoring Time (F_WD_Time / F_WD_TIME_1) – minimum 2× the worst-case PROFINET update time, typically 100–1000 ms.
4. PROFIsafe Profile / iParameter (CRC length, version V2.4 / V2.6) – must be identical on both sides.
5. E-Stop Box ID and PROFINET device name – the F-Box in the safety program references the device by PROFINET name, not IP address.

When normal PROFINET works but PROFIsafe does not, the IP, subnet, and PROFINET name are demonstrably correct. The failure is almost always in items 1–4 (F-address, monitoring time, profile, or F-Box wiring) or in a Windows CE / Control Panel setting on the Mobile Panel itself (PROFIsafe enable, F-DA overwrite, time-of-day synchronisation).

Diagnostic Procedure

Use the following ordered flow. Each step has a binary pass/fail and a one-line verification; do not advance until the step passes.

1. Verify the F-CPU is in RUN with F-capability active. In TIA Portal, online → CPU operator panel → check "F-activation" and the F-sign-of-life counter increments. If the F-CPU is not F-activated the safety program is simply not scheduled and F_FB_KTP_Mobile will never update.
2. Confirm the F-runtime group is error-free. Online → Safety → "Acceptance test status / F-runtime group information\*. A red SF on the F-CPU halts the entire F-cycle.
3. Check the PROFINET device name and IP. The Mobile Panel Control Panel → "PROFINET" must show the same device name and IP configured in the project. If the device name was assigned by PRONETA or topology editor, the runtime will pick up the IP but still need the name.
4. Open the Control Panel on the Mobile Panel. Start → Settings → "PROFINET settings" (or "Network & Diagnostics"). PROFIsafe must be explicitly enabled on the device with a destination address that matches the HW Config slot.
5. Compare the F-Destination Address byte-for-byte. Hex 0 on one side, 1 on the other is a classic issue; many F-DAs start at 1 because address 0 is reserved.
6. Match the PROFIsafe profile version. A V2.4 panel will not negotiate a V2.6 host and vice-versa. The PROFINET interface diagnostic in TIA Portal exposes the negotiated iParameter set.
7. Validate the F-monitoring time. If F_WD_Time is too short for the wireless round-trip, the F-connection is repeatedly torn down. A 500–1000 ms value is typical for IWLAN panels.
8. Re-compile and re-load the safety program. Offline → Safety → "Compile". The right-click "Download to device → Software (all)" is required, not "Hardware only".
9. Perform a full power cycle of the panel. Many F-parameters are only committed on cold start, not on WinCC restart.

Configuration Checklist – F-CPU (TIA Portal)

Configuration Checklist – KTP700F Mobile (Control Panel)

The on-panel configuration is reached via Start → Control Panel → PROFINET (or "PROFINET settings" depending on the image). Critical entries:

After any change in the Control Panel, reboot the panel. The PROFIsafe stack reads configuration on cold start, not on WinCC reload.

F_FB_KTP_Mobile Block Parameter Mapping

The F_FB_KTP_Mobile block (supplied in the KTP Mobile F-library) is the safety gateway between the panel's F-slots and the user safety program. A minimum wiring for a working E-Stop is:

F_FB_KTP_Mobile Instance DB
----------------------------------
INPUT
  ACK_REI      := "HMI_AckReset"        // ack button, failsafe
  ACK_NEC      := "HMI_NecAck"          // operator NEC ack
  E_STOP       := %I0.0                  // hardwired backup E-Stop
OUTPUT
  Q_E_STOP     := "Safety_EStopOK"
  Q_ENABLE     := "Safety_Enable"
  QBAD         := "Safety_PanelQBAD"
  DIAG         := "Safety_PanelDiag"
IN_OUT
  F_DEST_ADDR  := 1                      // must match HW Config + panel
  WD_TIME      := 1000                   // ms

If QBAD stays TRUE after a successful download, the F-connection is still not in DATA_EXCHANGE. Do not bypass the block; instead, address the underlying configuration mismatch.

PROFIsafe Address and F-Destination Address

The F-Destination Address is a 1-byte unsigned integer per F-device. It is assigned in two places:

• Project side (TIA Portal): Mobile Panel → PROFINET interface → PROFIsafe → "F-Destination Address". Typical default 1 for the first PROFIsafe device in the project.
• Device side (Control Panel): PROFINET → PROFIsafe → "F-Address".

Panel Control Panel Settings (Step by Step)

1. From the runtime, tap the gear icon (or Start → Settings) to open the Control Panel.
2. Navigate to PROFINET.
3. Confirm the IP, Subnet, Device Name fields are populated and match the TIA Portal project exactly.
4. Tap PROFIsafe; enable PROFIsafe if not already.
5. Enter the F-Destination Address (decimal) as configured in HW Config.
6. Select the profile version (V2.4 or V2.6) to match the project.
7. Apply with OK and reboot the panel.

Firmware Update Procedure

The user has confirmed updating via both TIA Portal and ProSave. For reproducible results, the recommended sequence is:

1. Update the Mobile Panel image using ProSave on a service PC connected to the panel's service port (X1). Use the OS Update → "Reset to factory defaults" option only if the existing image is unstable; otherwise perform an in-place update.
2. Reboot the panel, then re-apply the PROFINET name and IP from ProSave's "Ethernet" page.
3. Open TIA Portal, perform a "Software (all)" download to the F-CPU; this includes the safety program and PROFIsafe configuration.
4. Recompile the safety program (right-click → Compile → Safety) before the download.
5. Cycle power on the panel one more time to commit the new PROFIsafe parameters.

Verification Steps

1. Online diagnostics: TIA Portal → Online → Online & Diagnostics → PROFIsafe. The slot should show "Data exchange active".
2. QBAD flag: In the safety program, monitor QBAD from F_FB_KTP_Mobile. A healthy connection returns QBAD = FALSE within 2× F_WD_Time.
3. DIAG byte: Inspect the DIAG output for vendor-specific diagnostic codes; a non-zero value typically indicates passivation, address mismatch, or CRC error.
4. E-Stop test: Press the physical E-Stop. Q_E_STOP must go FALSE within 50 ms; the F-CPU's SF LED must NOT light up (a red SF would indicate a PROFIsafe fault, not a normal stop).
5. Enable test: Release E-Stop, press the enable button. Q_ENABLE must follow.
6. Log acceptance test: The acceptance test for the F-function must be recorded per the safety lifecycle.

Error Code Reference

Field-Proven Pitfalls

• Loading the wrong project variant. A panel that was previously bound to a different project keeps the old PROFINET name in its Control Panel. Always re-issue the name and F-DA together.
• Wireless latency. IWLAN paths through SCALANCE W access points can introduce 30–80 ms of jitter. The F-monitoring time must include a margin; 200 ms is a typical starting point, 1000 ms is conservative.
• Time-of-day drift. Although PROFIsafe V2 tolerates up to 1 second of time-of-day delta, drift above that drops the F-connection. NTP synchronisation to the F-CPU is recommended.
• Firmware mismatch. KTP700F Mobile panels running an image older than V17 may only support PROFIsafe V2.4; mixing V2.4 host with V2.6 panel or vice versa is a silent failure.
• Password-protected Control Panel. If a password was set in the Control Panel, PROFIsafe parameter changes from the runtime are blocked, and the panel keeps the old F-DA. Reset the Control Panel password from ProSave or remove it via TIA Portal transfer settings.

Acceptance and Documentation

Once the F-connection is established, the safety function must be acceptance-tested per the safety plan. Record:

1. F-Destination Address of each Mobile Panel.
2. F-monitoring time.
3. PROFIsafe profile version (V2.4 or V2.6).
4. Serial number of the panel and the image version.
5. Signature of the safety engineer and operator.

Keep the acceptance log in the project documentation; it is required for re-validation after any device exchange or firmware update.

FAQ