Problem Details
When commissioning a SIMATIC S7-1500 station with a large PROFINET topology, TIA Portal (V16, with current updates) reports a compile-time or topology-validation error stating that the PROFINET device number is already used in the IO system. The message appears for three or more remote IO stations of type IM 155-6 PN ST (ET 200SP PN interface module), even though the offending device numbers are not visible in the project tree and no other device occupies them.
Typical environment where this fault appears:
- Controller: CPU 1516-3 PN/DP (6ES7516-3AN02-0AB0), firmware V2.9 or later
- Communications module: CM 1542-1 (6GK7542-1AX00-0XE0) added to expand PROFINET IO capacity
- Engineering: TIA Portal V16, fully patched
- IO: ET 200SP stations with IM 155-6 PN ST (6ES7155-6AU00-0BN0) interface modules
- Total device count: ~90 PROFINET IO devices, plus 210 PROFIBUS slaves reachable through IE/PB Gateways (e.g. CM 1542-1 acting as PN/PB coupler or external IE/PB Link PN IO)
The fault is reported both on the integrated PROFINET interface X1 of the CPU and on the X1 port of the CM 1542-1. One device number is duplicated on the CPU port, two on the CM 1542-1 port. Manual remediation attempts — removing the affected devices, re-adding them, re-numbering, and rebuilding the project from scratch — do not release the numbers.
Root Cause
The PROFINET device number is a station-level identifier (1..255) used inside the IO system. TIA Portal allocates these numbers to two distinct families of devices:
- Direct PROFINET IO devices (drives, remote IO heads, valves, identification systems, switches).
- PROFIBUS slaves that are mapped through a PN/PB gateway. When the gateway's PROFINET proxy is configured, each downstream PROFIBUS slave is exposed to the IO controller as a PROFINET device with its own device number.
On a CPU 1516-3 PN/DP, the IO controller resources are split between the integrated interface X1 (max. 256 IO devices) and the second PROFINET interface X2 (max. 32 IO devices). A CM 1542-1 adds another 128 IO device slots on its own PROFINET segment. The PROFINET device numbers must be unique within a single IO system, regardless of which physical interface the device is wired to. With ~90 direct PROFINET devices and 210 PROFIBUS slaves funnelled through gateways, the number pool can approach the controller ceiling, and TIA Portal will surface the first collision it detects.
The decisive setting is the PROFIBUS Gateway operating mode on the IE/PB Link or on the PN/PB coupler. Two modes exist:
| Mode | Behavior | PROFINET device number impact |
|---|---|---|
| Standard | Each PROFIBUS slave is represented as a single PROFINET device with its own PN device number inside the parent IO system. | Consumes 1 PN device number per PROFIBUS slave. Clear 1:1 mapping, predictable numbering. |
| Network Gateway | All PROFIBUS slaves behind a single gateway are bundled into one shared PN device number range managed by the gateway itself (slot-based, with the gateway acting as a DP master proxy that owns the addressing). | Aggregates multiple PROFIBUS slaves under one PROFINET device number, but the number allocation logic is governed by the gateway and can clash with the IO controller's own device-number bookkeeping — especially when several gateways of the same type coexist in one IO system. |
When the gateway is left in Network Gateway mode, TIA Portal can hand out overlapping PN device numbers across multiple gateway instances because the device-number range is reserved by the gateway objects before the IO controller validates uniqueness. Because the numbers are owned by the gateway, removing and re-adding the visible ET 200SP stations in the project tree does not free them — the gateay still holds the reservation. This matches the field behavior of the original report: deleting the offending remote IOs in the topology, rebuilding the project, and even changing the CPU did not clear the conflict until the gateway mode was flipped to Standard.
S7-1500 PROFINET IO Device Limits
Confirm the controller is not the bottleneck before changing the gateway mode. TIA Portal displays the relevant ceilings in the device properties of the CPU and the CM:
| Component | Order number | Max. PROFINET IO devices | Notes |
|---|---|---|---|
| CPU 1516-3 PN/DP (X1) | 6ES7516-3AN02-0AB0 | 256 | Integrated PROFINET interface with PN IO controller role. |
| CPU 1516-3 PN/DP (X2) | 6ES7516-3AN02-0AB0 | 32 | Second PROFINET interface, separate IO system. |
| CM 1542-1 | 6GK7542-1AX00-0XE0 | 128 | Adds a third PROFINET segment, configured as separate IO system. |
| CPU 1517-3 PN/DP (X1) | 6ES7517-3AP00-0AB0 | 512 | Use as scaling target if the controller ceiling is the actual limit. |
The PROFIBUS slaves behind an IE/PB Link PN IO are counted as PROFINET IO devices of the host controller for licensing and resource purposes. With 210 PROFIBUS slaves mapped through gateways, the 256-device limit of the CPU 1516 X1 interface is not necessarily exceeded if the slaves are distributed across the CPU and the CM 1542-1, but the per-interface ceiling is the first number to verify with a quick swap test to a CPU 1517.
Solution
Change every PROFIBUS gateway in the project from Network Gateway to Standard mode, then recompile. TIA Portal will then assign a unique PROFINET device number per PROFIBUS slave inside the host IO system, and the duplicate-number error on the IM 155-6 PN ST stations disappears.
Prerequisites
- TIA Portal V16 with the latest HSP (Hardware Support Package) installed for the S7-1500 and the IE/PB Link PN IO families.
- Write access to the project file (online/offline). The change is performed offline and downloaded on the next project transfer.
- A current offline backup of the project (File → Archive Project).
Step-by-Step Procedure
- Back up the project. In Project view choose Project → Archive and store the .zap16 archive on a network share or removable media. This is the only rollback path if a downstream change in device numbering breaks field wiring labels.
- Identify all IE/PB gateways. In the project tree expand Devices & Networks, switch to the network view, and filter the device catalog on Network components → Gateway or right-click the topology and choose Find → IE/PB Link. Make a list of every gateway instance in the project — both the physical PN/PB couplers and any IE/PB Link PN IO used to bring PROFIBUS segments into PROFINET.
- Open each gateway's properties. Double-click the gateway device in the network or device view, then in the Inspector window select the Operating mode tab. In TIA Portal V16 the option is labeled Gateway mode with two radio buttons: Standard and Network Gateway.
- Switch the mode to Standard. Select Standard for every gateway. TIA Portal may warn that downstream PROFIBUS slaves will be re-numbered — acknowledge the warning; this is the expected behavior.
- Recompile the project. Right-click the CPU → Compile → Hardware (rebuild all). The PROFINET device number error on the IM 155-6 PN ST stations should clear immediately. The error list at the bottom of TIA Portal should now be empty or contain only unrelated warnings.
- Re-validate device numbers. In the network view, select every IM 155-6 PN ST and verify in the Inspector under PROFINET interface → Device number that each station has a unique number between 1 and 255 within its IO system. Manually re-number any device that ended up on a value already used by a PROFIBUS proxy slot.
- Download to the CPU. Connect to the CPU, perform a full download (Hardware → Load to device → Stop CPU → Download to device → Start CPU). TIA Portal will re-assign the PROFINET device names from the topology, then re-bind each ET 200SP head module to its target name during the next POWER ON or after explicit Assign PROFINET device name.
Verification
After the change is downloaded, run these checks in order to confirm the topology is healthy.
- Online → Accessible nodes. From the CPU's online view, start the PROFINET diagnostics. Every IM 155-6 PN ST should appear with status Device is OK and the assigned PROFINET device name. No node should be marked Device number assigned twice or Station failure.
- Diagnostics buffer. In the CPU's online diagnostics, scroll the diagnostics buffer for entries containing PROFINET IO and the new device numbers. Acceptable buffer entries are the initial Station return and PROFINET IO: Device x returns messages. Any persistent Duplicate station number entry indicates that a real-world IP or device-number collision is still present in the cabinet and must be resolved at the wire level.
-
Web server of the IM 155-6 PN ST. Browse to the head module's web page (default URL format
http://<IP>). The Module information → Station status page should report the assigned PROFINET device name and number, with the maintenance and fault LEDs off. - CM 1542-1 diagnostics. Open the CM 1542-1's online diagnostics, switch to the PROFINET diagnostics view, and confirm the count of Configured / Connected / Failed devices matches the project offline. With 88 IO devices on the CM segment and 0 failures, the gateway-mode fix has held.
- Number pool audit. In the project tree, export the IO system table (right-click the IO system → Export) and audit the PROFINET device number column. No two devices within the same IO system may share a number. In a healthy 1516-3 PN/DP + CM 1542-1 station the typical count is <= 256 on X1, <= 32 on X2, <= 128 on the CM segment.
When the Problem Is Not the Gateway Mode
If the error persists after switching every gateway to Standard mode, work through this matrix before opening a Siemens support request:
| Symptom | Likely cause | Action |
|---|---|---|
| Error remains on the same three IM 155-6 PN ST even after project rebuild from scratch. | Duplicate PROFINET device name with identical MAC address still in the offline project (e.g. copied subnet with the same IM). | Compare MAC addresses (Inspector → PROFINET interface → Ethernet addresses). Delete any duplicate head module. Review the Siemens note on PROFINET device name overwrite protection for the matching device-name symptom. |
| Compile error "Maximum number of IO devices on interface X exceeded". | Controller ceiling reached. CPU 1516 X1 = 256, X2 = 32, CM 1542-1 = 128. | Re-distribute devices across the three IO systems. If re-distribution is impossible, swap the CPU to a 1517-3 PN/DP (X1 = 512) as a quick test. |
| Online diagnosis shows devices OK, offline compile still fails. | Stale project cache from a previous gateway configuration. | Close the project, delete the .srt cache, re-open, recompile. |
| Fault appears only on a single PROFINET segment after adding a new head module. | Device number assigned manually collides with a gateway proxy slot. | Pick a device number outside the reserved PROFIBUS proxy range (see note above). |
| Error appears only after firmware update on the CPU or CM. | Firmware change re-orders the IO system numbering. | Recompile, re-download, re-assign PROFINET device names from the topology. |
Field-Proven Caveats
- Gateway mode is sticky. Switching the gateway from Network Gateway to Standard does not migrate previously assigned PROFINET device numbers. After the switch, walk every PROFIBUS slave under that gateway and confirm its new number; a handful of devices usually need manual re-numbering in the 1..255 range.
- PROFINET device names survive the change. The mode switch only affects number allocation, not the assigned name. Existing wiring stays valid as long as the IM 155-6 PN ST MAC addresses are unique.
- CPU scaling is a diagnostic, not a cure. Moving from 1516 to 1517 is a useful isolation test — if the error vanishes, the original CPU's per-interface ceiling was the cause. For a permanent fix, redistribute devices or change the gateway mode as described above.
- CM 1542-1 counts. The 128-device ceiling of the CM 1542-1 is independent from the CPU's ceilings. The 88 devices already placed on the CM leave 40 free slots. If the project continues to grow, plan the next expansion against a second CM 1542-1 or against moving the largest remote-IO island to a dedicated PROFINET switch uplinked to a future CPU upgrade.
- PROFIBUS gateways are PROFINET devices too. The IE/PB Link PN IO itself occupies one PROFINET device number, plus one number per downstream PROFIBUS slave slot it exposes. With Network Gateway mode, the slot-level numbering belongs to the gateway, and the duplicate reservation is what blocks the remote IOs from claiming a fresh number.
- Watch the second PROFINET interface. CPU 1516-3 PN/DP X2 supports only 32 IO devices. Keeping the CM 1542-1 segment under 128 is not enough if the X2 interface is also in use. Use TIA's Topology view to confirm the port each device is attached to.
Summary of the Fix
- Open the project offline in TIA Portal V16.
- For every IE/PB Link PN IO and every PN/PB coupler, set Operating mode → Gateway mode → Standard.
- Recompile the S7-1500 station hardware.
- Re-number any PROFIBUS slave that received a colliding PROFINET device number.
- Download the project to the CPU 1516-3 PN/DP, restart the CPU, and verify with the accessible-nodes diagnostics.
Once the gateways are in Standard mode, the IM 155-6 PN ST head modules receive the expected unique PROFINET device numbers, the duplicate-number error in the IO system clears, and the full topology — 90 direct PROFINET devices, 210 PROFIBUS slaves through gateways, 88 devices on the CM 1542-1 — comes up clean.
Why does TIA Portal say the PROFINET device number is already used when I cannot find the conflicting device in the project?
The PROFINET device number is most likely reserved by a PROFIBUS gateway operating in Network Gateway mode. The gateway owns the slot-level numbering for its downstream PROFIBUS slaves, so the reservation is invisible in the IO system view. Switch every IE/PB Link PN IO / PN/PB coupler to Standard mode, recompile, and the conflict clears.
How many PROFINET IO devices can a CPU 1516-3 PN/DP handle?
The CPU 1516-3 PN/DP supports 256 PROFINET IO devices on the integrated interface X1 and 32 on X2. A CM 1542-1 added to the same station provides 128 additional IO device slots on its own PROFINET segment. PROFIBUS slaves reached through a PN/PB gateway count against the host controller's ceiling.
Will switching the gateway from Network Gateway to Standard break my existing PROFINET device names?
No. Device names are independent of device numbers. The mode switch only changes how the gateway allocates PROFINET device numbers to its downstream PROFIBUS slaves. As long as the IM 155-6 PN ST head modules and the IE/PB Links have unique MAC addresses, the assigned PROFINET device names survive the change.
I removed the offending ET 200SP station, recompiled, and the error persists. Why?
The duplicate PROFINET device number is held by the PROFIBUS gateway in Network Gateway mode, not by the ET 200SP head module. Removing and re-adding the head module does not free the number, which is why the conflict survives a project rebuild. Change the gateway mode to Standard to release the reservation.
How do I prevent this fault from recurring on future expansions?
Standardize every PROFIBUS gateway on Standard mode, manually reserve a contiguous PROFINET device number range (e.g. 200..255) for PROFIBUS proxy slots, keep the CPU and CM interface ceilings in the project naming convention, and audit the IO system table after every device addition. Use a CPU 1517-3 PN/DP if the 1516 ceilings are reached by future growth.