PROFIsafe F-Address Assignment on ET200SP IM 155-6 PN/2 HF V4.2 — Diagnostic and Resolution Reference

Field engineers commissioning fail-safe I/O on an ET 200SP station headed by an IM 155-6 PN/2 HF interface module (firmware V4.2) frequently hit a wall when the station is projected through a GSDML file inside STEP 7 Classic V5.6: the right-click context menu entry "Assign PROFIsafe address…" never appears, and the F-modules stay in the unassigned state. The same symptom shows up under TIA Portal in some legacy firmware/GSDML combinations ("Unassigned", no Confirm dialog). This reference captures the architectural reason, the three engineering paths that actually work, the diagnostics to confirm the fix, and a fault matrix for the most common secondary symptoms.

1. Problem Statement

An F-CPU (e.g., CPU 416F-3 PN/DP) is configured in STEP 7 V5.6 with a downstream ET 200SP station. The IM is 6ES7155-6AU30-0CN0 (IM 155-6 PN/2 HF) at firmware V4.2, projected from the GSDML file GSDML-V2.34-Siemens-ET200SP-20190718.xml (or later). F-modules such as the digital F-DI / F-DQ or F-AI / F-AQ are slotted into the station. The commissioning engineer cannot:

• Right-click the F-module and select "Assign PROFIsafe address…" in HW Config.
• Trigger the F-destination address assignment through the standard menu path used for catalog-inserted stations.
• Confirm the F-addresses in the online diagnostics view; the modules remain in "Unassigned / Not assigned" state.

The standard library version of the same interface module — IM 155-6 PN HF V3.3 — does expose the context-menu option because it ships in the STEP 7 hardware catalog with a built-in F-address type, but it has a different order number, lower functional scope, and does not match the hardware on the field.

2. Affected Hardware, Firmware, and Engineering Software

3. Root Cause Analysis

The PROFIsafe address of an F-module has two halves:

1. F-source address — assigned to the F-host (the F-CPU), a property of the PROFINET device relationship.
2. F-destination address — assigned to the F-module, an attribute of the F-I/O record (PROFIsafe services CR + CRC over the slot).

For stations projected from the STEP 7 / TIA hardware catalog, the F-destination address is generated and stored inside the project, then downloaded as part of the F-configuration. For stations projected from a GSD/GSDML file, the slot-level F-parameter record is not represented in HW Config with sufficient granularity for STEP 7 to manage the address. The "Assign PROFIsafe address…" menu is therefore intentionally disabled. Siemens routes this responsibility to a dedicated tool — the S7-FCT (S7-Fail-safe Configuration Tool) — that talks to the engineering system through the TCI (Tool Calling Interface) Communication Server. See the SIMATIC Safety manual's Configuring F-I/O chapter for the architectural overview and the list of supported head modules per firmware generation.

The companion PDF on the ET 200SP product family confirms that PROFINET port behavior (auto-negotiation, MDI-X assignment, ring-port reconfiguration) is firmware-dependent on the IM 155-6 PN/2 HF as of V4.x, and that the F-parameter set has been extended in V4.2 versus V3.x — which is exactly why the older catalog entry cannot be used as a drop-in.

In TIA Portal, the same limitation manifests as "Unassigned" in the F-I/O identification view when the safety system version is older than the GSDML/FW combination installed. The fix there is to enable Use IEC 61784-3:2010 V2.2 mode in the safety program settings, which forces the F-parameter negotiation to the protocol version the older F-CPU/Safety-System combination can actually digest.

4. PROFIsafe Address Type — Why It Matters

PROFIsafe supports two address-type schemes on the slot:

IM 155-6 PN/2 HF V4.2 and IM 155-6 PN/3 HF V4.2 modules use PROFIsafe address type 2. Per the SIMATIC Safety documentation, the F-source and F-destination addresses of type-2 devices can only be set by a certified engineering tool, and that tool is S7-FCT (or TIA Portal's integrated safety editor for catalog-projected stations). STEP 7 Classic HW Config explicitly refuses to expose the assignment UI for these devices — by design.

5. Solution Architecture — Three Engineering Paths

Pick exactly one path. Mixing paths on the same station causes F-parameter record mismatches and PASSIVATION of the F-modules at runtime.

Figure 1 — Three certified engineering paths from a GSD-projected IM 155-6 PN/2 HF V4.2 to a fully assigned F-I/O relationship.

6. Path A — S7-FCT with TCI Communication Server (Recommended for STEP 7 Classic)

6.1 Prerequisites

• STEP 7 V5.6 (or later 5.x service pack) installed and licensed.
• SIMATIC Safety option package installed and licensed (gives you F-block libraries and F-runtime).
• S7-FCT (S7-Fail-safe Configuration Tool) installed on the same engineering PC; download from the Siemens Industry Online Support portal.
• TCI Communication Server — installed automatically with S7-FCT; it registers itself with Windows as a COM service and is started by S7-FCT on first launch.
• Project with the F-CPU, the IM 155-6 PN/2 HF V4.2 (GSD-projected), and at least one F-module slotted.

6.2 Engineering Workflow

1. Close STEP 7 V5.6 if open.
2. Launch S7-FCT. On the first start, a registration dialog appears — confirm that the TCI Communication Server is allowed to register.
3. From the S7-FCT menu, choose File → Open STEP 7 project… and select the relevant *.s7p project.
4. S7-FCT enumerates the F-stations in the project. The ET 200SP station with the GSD-projected IM 155-6 PN/2 HF V4.2 appears with all its F-modules listed.
5. For each F-module, set the F-destination address in the range typically 1 – 1023 (use a project-wide unique value per slot). The F-source address is the F-CPU's PROFINET device number; S7-FCT displays the value taken from the STEP 7 configuration.
6. Compile the F-station. S7-FCT writes a signed F-parameter block into the STEP 7 project via TCI.
7. Open STEP 7 V5.6, download the F-station configuration to the IM 155-6 PN/2 HF (HW Config → Station → Download to target system). The F-destination addresses are pushed to the F-modules as part of the iParameter record.
8. In online diagnostics, right-click the F-module → Operating mode. The module must show "Safety mode active / Assigned".

7. Path B — TIA Portal Pre-projection + Re-import into STEP 7

For plants that must stay on STEP 7 Classic, the only practical workaround is to:

1. Open a parallel project in TIA Portal (V16 or later recommended for V4.2 support).
2. Insert the same CPU 416F-3 PN/DP, the same IM 155-6 PN/2 HF V4.2 (catalog entry, not GSD), and the same F-modules.
3. Assign the F-addresses in the safety editor (the equivalent of the missing STEP 7 menu). Confirm and download the configuration to a dummy ET 200SP to lock the parameter record.
4. From the TIA project, export the station as a *.zap or generate a system data container with the F-parameter records.
5. Re-import the F-parameter records into the STEP 7 V5.6 project through the S7-FCT tool (Path A above), reusing the same F-source and F-destination addresses.

The addresses obtained in TIA do not automatically flow back to STEP 7. The TIA pre-projection is essentially a forcing function to expose the address values; the FCT tool is still required to land those values in the STEP 7 project. This path is labor-intensive and is recommended only when a customer mandates STEP 7 Classic for the entire fleet.

8. Path C — IEC 61784-3:2010 V2.2 Mode (TIA Portal Symptom Fix)

On TIA Portal V14 SP1 (and similar early versions) with an IM 155-6 PN ST V4.1 and CPU 1518F-4, the F-modules may also show "Unassigned" in the identification view, with no Confirm dialog. The cause is a protocol version mismatch between the safety system version of the project and the PROFIsafe implementation in the F-module firmware. The fix is to force the older protocol revision:

1. In the TIA project tree, select the F-CPU (e.g., CPU 1518F-4).
2. Open Properties → Safety → Settings.
3. Enable the option "Use IEC 61784-3:2010 V2.2 mode" (sometimes labeled Use IEC v2.2 Mode in the GUI).
4. Recompile the safety program and re-download to the F-CPU.
5. Run Identify and confirm on each F-module; the assignment dialog now appears.

9. Step-by-Step Commissioning Procedure (Path A, STEP 7 Classic)

The following sequence is the field-proven commissioning recipe when the F-CPU is a CPU 416F-3 PN/DP and the head module is IM 155-6 PN/2 HF V4.2.

9.1 Hardware Pre-checks

1. Confirm the IM 155-6 PN/2 HF is at firmware V4.2 (or later V4.x). Read the firmware version in STEP 7 → HW Config → right-click the IM → Target system → Module identification / Firmware version.
2. Confirm the GSDML file in use is dated 2019-07-18 or newer. Older GSDML files do not expose the V4.2 parameter set.
3. Power the ET 200SP station with the BaseUnit power feed-in for the F-modules. The F-modules will not respond to the assignment service without power, regardless of the IM's PROFINET link state.
4. Verify that PROFINET port 1 and (if used) port 2 are linked. The X1 Port 2 of the IM behaves as MDI-X when autonegotiation is disabled — a known caveat when forcing 100 Mbps full-duplex.

9.2 STEP 7 Project Configuration

1. Open SIMATIC Manager → open the *.s7p project → open HW Config.
2. Insert the CPU 416F-3 PN/DP on the rack.
3. Insert the IM 155-6 PN/2 HF as a PROFINET IO device, from the GSD file, not from the catalog. Assign the device number (1 – 511) and the PROFINET device name. The name must match what is in the PLC (TIA / Proneta / topology editor).
4. Slot the F-modules in their physical order. Each module shows a PROFIsafe slot identifier — note them; S7-FCT will need them.
5. Save and compile HW Config. Do not look for the "Assign PROFIsafe address…" menu — it will not appear.

9.3 S7-FCT Configuration

1. Start S7-FCT. If the TCI Communication Server is not running, click Start TCI Server in the Tools menu. The status bar turns green.
2. File → Open STEP 7 project. The dialog shows a list of all F-stations. Select the ET 200SP station with IM 155-6 PN/2 HF V4.2.
3. In the F-module table, the F-destination address column is editable. Set a unique value per F-module. Convention: start at 1, increment by 1 per slot. Range: 1 – 65535; project-typical 1 – 1023.
4. The F-source address column is auto-filled from the PROFINET device number of the CPU.
5. Click Compile → Check consistency. S7-FCT will flag any F-module that has a duplicate F-destination address, an out-of-range F-source address, or a missing PROFIsafe profile version.
6. Click Save. The configuration is written back to the STEP 7 project through the TCI interface.

9.4 Download to Target

1. Return to STEP 7 HW Config.
2. Select the IM 155-6 PN/2 HF station → click Download to target system. In the download dialog, tick "Consistent download — Entire station".
3. After the download completes, the IM reboots. The F-modules accept their F-destination addresses during the parameter assignment phase of PROFINET startup.
4. Open Online → Module Information on the F-module. The Operating mode should read Safety mode (assigned). The F-address line shows the F-destination address you set in S7-FCT.

10. Verification and Diagnostic Checks

After the download, validate the F-I/O relationship end-to-end with the following checks:

11. Troubleshooting Matrix

12. Field-Proven Caveats

• TCI must run as the same user as STEP 7. S7-FCT and STEP 7 share project state through a Windows COM service. Running one as Administrator and the other as a standard user breaks the IPC silently and S7-FCT reports no F-modules at all.
• Do not mix catalog-inserted and GSD-inserted stations of the same F-CPU. The PROFIsafe F-parameter compiler in STEP 7 V5.6 is a single global pass; one GSD-inserted F-station forces all F-stations to be S7-FCT-managed, even catalog-inserted ones.
• Slot numbering starts at 0 in S7-FCT, 1 in HW Config. Mind the offset when reading addresses from one tool to the other.
• Re-identifying after a GSDML upgrade. After a GSDML upgrade (e.g., from 2019-07-18 to a newer revision), S7-FCT may need to be relaunched and the project re-opened to refresh the slot list.
• Power-feed to BaseUnit. The F-modules will not respond to PROFIsafe services if the light-colored BaseUnit (BU type A0 / B0) power feed-in is not energized. This is the single most common reason for "F-module does not appear in FCT" on a bench test.
• PROFINET device name must be assigned to the IM 155-6 PN/2 HF before any F-services work. Use the topology editor, PRONETA, or the IM's web server. The name is case-sensitive.

13. References to Official Documentation

• SIMATIC Safety — Configuring F-I/O (TIA Portal V20 documentation portal) — covers PROFIsafe address type 2, the list of supported head modules including IM 155-6 PN/2 HF as of firmware V4.2, and the relationship to S7-FCT.
• ET 200SP Product Information and Catalog (Mouser-distributed PDF) — product family overview, IM 155-6 PN/2 HF V4.2 firmware notes, PROFINET port assignment (X1 Port 1 / Port 2 / MDI-X behavior), and the Equipment Manual cross-reference for IM 155-6 PN HS variants.

For the S7-FCT download and version matrix, refer to the Siemens Industry Online Support entry "S7-Fail-safe Configuration Tool (S7-FCT)" (search by that exact title in the support portal). The TCI Communication Server component is bundled with S7-FCT and is registered as a Windows service on first launch.