PROFIsafe LED Indicators: Safety Requirements Explained

Overview

PROFIsafe, defined by PROFIBUS Nutzerorganisation (PNO) under IEC 61784-3-3, is the safety communication layer wrapped around PROFINET IO and PROFIBUS DP. It enables SIL 3 / PL e / Category 4 signals to ride on the same bus infrastructure used for standard automation, without additional cabling for safety. Every PROFIsafe-capable device exposes one or more LED indicators that report the state of the PROFIsafe channel itself: address assignment, parameterisation, communication health, watchdog behaviour, and activation of fail-safe values.

A recurring commissioning question, addressed directly during the PROFIsafe Designer Workshop in October 2023, is whether these status LEDs must be implemented in a safety-related way. The short answer from the workshop is that the LEDs described by the PROFIsafe specification are not safety-related. An LED that fails or mis-displays cannot drive the system into an unsafe state, so the indicator path does not enter the safety envelope. This article documents the technical reasoning behind that classification, enumerates the LED states defined by the profile, lists the alternative indication paths the specification permits, and shows how the principle is realised in concrete hardware from Siemens SIMATIC F-CPUs and Pilz PNOZmulti controllers.

PROFIsafe Architecture and LED Placement

PROFIsafe treats the bus as a "black channel": only the F-host controller, the F-device, and the PROFIsafe protocol layer are inside the safety envelope. Everything between them - cabling, switches, diagnostic indicators - is excluded from the safety function by definition.

1. F-application in the F-host (S7-1500F, ET 200SP F-CPU, PNOZmulti 2 m B1, third-party F-PLC).
2. F-library blocks on the host side (F_IO, F_FB, F_DB, ACK_DB).
3. PROFIsafe protocol layer (V2, V2.4, or V2.6) - assembles CRC2, sequence counter, virtual Consecutive OK counter, and the F-Parameter set.
4. PROFINET IO / PROFIBUS DP transport (black channel; the bus itself is not safety-rated).
5. PROFIsafe driver on the F-device side (F-I/O module, light curtain, drive, valve).
6. F-device application (safe input / output processing, internal diagnostics, fail-safe substitution).

The status LEDs sit on the F-device side and reflect events internal to the PROFIsafe driver and to the bus coupler. They are physical manifestations of status flags held inside the device firmware. Because they mirror status - not the safety-critical decision itself - the PROFIsafe profile classifies them as diagnostic indicators rather than as parts of the safety function.

LED State Catalogue Defined by the PROFIsafe Specification

The PROFIsafe profile does not prescribe a single LED colour or blink pattern; it requires manufacturers to expose the following minimum states through either LEDs or other visual indicators. The exact coding is vendor-specific.

LED State Machine

Safety Classification Argument: Why the LEDs Are Non-Safety-Related

The PROFIsafe specification's position is direct: an LED that indicates PROFIsafe state is not a safety-related element. The reasoning follows from the safety architecture:

1. The safety function is implemented by the F-application program in the F-host and by the F-I/O firmware in the F-device. PROFIsafe guarantees that the process values exchanged between them are either (a) correct, verified by CRC2 and sequence counter, or (b) replaced by the configured fail-safe value (FV). The decision between (a) and (b) is made by the PROFIsafe protocol itself, not by an LED.
2. If the LED driver fails (open LED, shorted driver, firmware bug in the indicator routine), the PROFIsafe protocol continues to function. The host receives correct CRC-protected process data, and the F-application reacts accordingly.
3. If the LED displays the wrong colour (green instead of red, for example), the worst case is that a maintenance technician is misled during diagnostics. The safety function itself is unaffected. The same diagnostic information is also available inside the F-host's diagnostic buffer and can be retrieved via the standard PROFINET alarm mechanism.
4. If the LED is missing entirely, the F-device still establishes a PROFIsafe connection only if the F-parameter set is consistent and the watchdog is being serviced. A wrong parameterisation causes the connection to be refused; the LED is a symptom, not a cause.

The same logic applies to PROFINET diagnostic alarms, to error counters in the host, and to web-server pages on managed switches. All of these are valid alternate paths for the same diagnostic data, and none of them is in the safety envelope.

F-Parameter Set Reference

The LED states above are driven by the same F-Parameter set exchanged between host and device at PROFIsafe start-up. A consistent F_Par_CRC is the gate for entering the "communication active" state. The complete F-Parameter set is:

If any parameter in this set disagrees between host and device, the PROFIsafe driver refuses the connection and lights the parameter-error LED. The parameter mismatch is the most common cause of "red fast blink" during commissioning.

Alternative Indication Paths Explicitly Permitted

The PROFIsafe profile explicitly permits the following substitutions for on-device LEDs. The specification text references HMI display in several locations as a first-class indication path.

• HMI panels - SIMATIC HMI Comfort / Unified, Pilz PMI panels, or third-party panels reading PROFINET diagnostics via OPC UA or S7 tags.
• Web server of the F-CPU - S7-1500F and ET 200SP F-CPU expose diagnostic buffers and module states through the integrated web server.
• TIA Portal online diagnostics - Both TIA Portal (Siemens, V17 / V18 / V19) and PNOZmulti Configurator (Pilz) display the same LED states in their online views.
• SCADA / OPC UA - OPC UA companion specs for PROFINET expose the diagnostic information as browsable nodes.
• External indicator towers - Stack lights driven by a standard digital output wired through a non-F-DO module.

The substitution principle also covers more elaborate systems: a control room video wall driven by OPC UA tags, an SMS gateway that pages a technician on a fault, or a CMMS that opens a work order when a maintenance demand LED fires. All of these paths are explicitly outside the safety envelope.

Implementation in Siemens SIMATIC F-Systems

Siemens implements PROFIsafe in the SIMATIC Safety family. The relevant components are:

• S7-1500F / ET 200SP F-CPU - F-runtime integrated in the CPU firmware, configured in TIA Portal.
• F-I/O modules - ET 200SP F-DI / F-DO / F-AI modules (typical article numbers 6ES7136-6BA00-0CA0, 6ES7136-6DC00-0CA0, 6ES7136-6PA00-0CA0), S7-1500 F-modules (6ES7531-7KF00-0AB0, 6ES7532-5HF00-0AB0), legacy S7-300F SM 326F / SM 336F.
• STEP 7 Safety (TIA Portal) - F-block library, F-CPU password, F-collective signature.

The Siemens manual SIMATIC S7-1500F / ET 200SP F-CPU - Safety Functions documents in its "Diagnostic functions of the F-CPU" section that these LEDs are diagnostic aids only and that their loss or incorrect indication does not influence the safety function. Safety integrity is preserved by the F-protocol CRC and the watchdog, both of which operate independently of any LED.

F-Block Library on the Host Side

Inside the S7-1500F the F-runtime exposes a tag set per F-channel:

QBAD : BOOL    -- 1 = channel substituted with fail-safe value
ACK_REQ : BOOL  -- 1 = operator acknowledgment required
DIAG : BYTE     -- PROFINET channel diagnostic byte
FV_ACTIVATED : BOOL  -- 1 = fail-safe value currently output
LIFESIGN : BOOL -- watchdog heartbeat from device

These tags are the canonical source of the same state information the LED indicates. The TIA Portal online view maps them 1:1 to the LED colours. The F-application reads only the tags, never the LED - reinforcing that the LED is a downstream visualisation of a status flag, not part of the decision logic.

Implementation in Pilz PNOZmulti Systems

Pilz implements PROFIsafe through:

• PNOZmulti 2 m B1 base unit (article 772101) - integrated PROFIsafe master / slave.
• PNOZ s4 / s5 - standalone PROFIsafe I/O blocks (750104 / 750105).
• PNOZmulti Configurator - programming tool with online diagnostic view.
• PMI (Pilz Multi Interface) - HMI visualisation of PROFIsafe states, communicates with the base unit via Ethernet.

LED indicators on Pilz F-hardware include PWR, RUN, FAULT, DIAG, and per-channel input / output status. The Pilz PNOZmulti 2 Operating Manual states that LED status is for commissioning and service; the safety function is enforced by the PROFIsafe protocol and the PNOZmulti internal diagnostics, neither of which depends on LED output. The PMI panel reproduces the same RUN / FAULT / DIAG indications graphically, with optional plain-text operator messages.

Verification & Commissioning Procedure

Although LEDs are not safety-related, validating that they behave as documented is part of a sound commissioning procedure. The following steps are recommended for any new PROFIsafe network:

1. Confirm the F-address assignment (DIP switch or software configuration) for each F-device matches the project.
2. Power up the F-device and observe the LED transition: address-assigned blink to communication-active steady.
3. Disconnect the PROFINET cable briefly and confirm the LED enters the bus-fault state and the F-application substitutes fail-safe values (FV_ACTIVATED = TRUE on the host).
4. Reconnect, verify the LED returns to steady green, and confirm FV_ACTIVATED returns to FALSE.
5. Force a CRC error in the test environment using a PROFIsafe-capable tester (Siemens PROFINET Diagnostic Tool, Indu-Sol PROFIBUS tester in PROFIsafe mode, or Softing PROFINET-INspektor) and confirm the LED enters the fault state.
6. Verify that the same diagnostic information is observable via the HMI panel or the TIA Portal online diagnostics - the alternative indication path must show the same state as the LED.
7. Document the LED coding (green / red / blink patterns) in the system manual and on the cabinet label so operators can interpret the indicators without consulting TIA Portal.
8. Verify the F_WD_Time setting against the worst-case PROFINET update time and the F-application OB execution time. A WD setting too low will produce spurious WD-timeout LEDs and unnecessary FV activation.
9. Trigger a parameterisation error by recompiling the F-hardware configuration and downloading only the program (not the hardware) - the F_Par_CRC mismatch should light the parameter-error LED and the host should refuse the connection.

SISTEMA / Safety-Case Reporting Scope

Because LEDs are non-safety-related, they do not appear in the safety-case documentation (SIL calculation in SISTEMA or PAScal report, Safety Manual of the F-system). The validation scope covers:

• F-application logic (F-FB, F-DB, F-IO calls, ACK handling).
• F-Parameter set per F-device (F_Source_Add, F_Dest_Add, F_WD_Time, F_Par_CRC, F_CRC_Seed, F_CRC_Length, F_Block_ID, F_Par_Version, F_iPar_CRC, F_SIL).
• Wiring of F-I/O to sensors and actuators, including cross-circuit and short-circuit protection measures.
• Reaction time of the safety function (worst-case PROFINET update time + F_WD_Time + F-application OB execution time).
• Operator acknowledgment paths (where used) and the F-Acknowledge DB structure.

LED documentation belongs in the operational / maintenance manual, not in the safety manual. This separation keeps the safety case lean and unambiguous, and avoids the common audit finding where an auditor is asked to review an LED's failure mode as if it were safety-related.

Replacement Module Procedure (iPar)

PROFIsafe V2.4 introduced iPar to support automatic parameterisation of replacement modules. The LED sequence during a module swap is:

1. Defective module removed - LED OFF on the slot.
2. New module inserted (same article number) - LED fast red blink (parameterisation pending).
3. F-host detects iPar server mismatch - LED alternates red/green (MAINT yellow on Siemens ET 200SP F-modules).
4. iPar server pushes parameters - LED fast green blink.
5. Module enters operation - LED steady green, FV_ACTIVATED = FALSE.

Every transition in this sequence is also mirrored in the TIA Portal online view and on a connected HMI panel. None of the iPar LEDs is safety-related; the F-device refuses to enter "communication active" until iPar is satisfied, but the refusal is enforced by the protocol, not by the LED.

Troubleshooting Matrix

Reaction-Time Check

When a watchdog LED fires repeatedly during normal operation, the cause is usually an F_WD_Time that is too short for the actual PROFINET update time plus the F-application OB execution time. A simple check is:

T_reaction = T_PROFINET_update + T_F_application_OB + T_profibus_blackout_margin
F_WD_Time > T_reaction * 1.5   (rule of thumb)

Typical TIA Portal default for S7-1500F is 100 ms. If the application OB35 cycle is set to 20 ms and the PROFINET update time is 4 ms, 100 ms is healthy. If the OB is set to 50 ms with a 10 ms PROFINET update, the WD margin shrinks and random WD-timeout LEDs will appear.

Industrial-Context Note: LEDs vs Leading Indicators

In occupational safety, the term "leading indicator" is used by regulators such as OSHA to describe proactive metrics that predict safety performance (training hours, near-miss reports, audit closure rates). The PROFIsafe LEDs covered here are machine-safety diagnostic outputs, not occupational leading indicators. The two share the name "indicator" but operate in different domains. LED design choices do not enter OSHA compliance calculations, but documenting LED meanings clearly does support operator understanding during commissioning and maintenance - which itself is a leading-indicator activity.

Likewise, commercial LED indicator products (such as the Banner Engineering LED indicator family) are sometimes used as external stack lights wired through a non-F-DO. Those lights are non-safety visualisation hardware and have no impact on the PROFIsafe safety function.

FAQ