S7-1200 PLC-to-PLC I/O Exchange Over PROFINET: PUT/GET vs IO Device

Exchanging discrete input and output states between two identical SIMATIC S7-1200 1212C DC/DC/DC controllers over PROFINET is a routine application in panel-to-panel and line-to-line architectures. This reference covers both the PUT/GET S7 communication path and the PROFINET IO Device path, then shows how to extend the same model to a LOGO! 8 smart relay acting as a third node. The goal is to keep the on-CPU program logic identical to a single-CPU design while the network takes care of mirroring physical inputs to remote outputs (and vice versa) with deterministic timing.

1. Overview of PLC-to-PLC I/O Architectures on S7-1200

The S7-1200 family acts as a PROFINET IO Controller by default. Starting with firmware V4.0, an S7-1200 CPU can also be configured as a PROFINET IO Device, which is the basis for two common PLC-to-PLC patterns:

1. PUT/GET S7 Communication – Both CPUs remain IO Controllers. They exchange data through the Siemens S7 protocol on top of TCP/IP. The TIA Portal block pair PUT and GET reads/writes a data area on the partner CPU.
2. IO Controller / IO Device with virtual slots – One CPU keeps the controller role; the other CPU is configured as an IO Device and exposes its process image as submodules. The controller CPU sees the partner I/O as if it were a distributed ET 200 station.

For the 1212C DC/DC/DC (article number 6ES7212-1AE40-0XB0 and earlier 6ES7212-1AE31-0XB0 / 6ES7212-1AE34-0XB0 releases), both methods are supported. Choose PUT/GET when the project is small, asymmetric, and benefits from tag-level access; choose the IO Device method when reaction time, deterministic update, and cyclic I/O semantics are priorities.

2. Prerequisites

3. Method 1 — PUT/GET S7 Communication

The PUT instruction writes data from this CPU to a partner CPU. The GET instruction reads data from the partner CPU into this CPU. Both blocks trigger an asynchronous job that is reported through DONE, ERROR, and STATUS outputs.

3.1 PUT/GET Block Interface

3.2 Configuration Steps in TIA Portal

1. Open the project that contains both PLC_A and PLC_B devices.
2. Select Devices & Networks > Networks view > Connections and add a new S7 connection between PLC_A and PLC_B.
3. On the connection properties, set the partner's IP address (e.g., 192.168.0.11) and the local ID (e.g., W#16#0001).
4. On PLC_B's properties, open Protection & Security > Connection mechanisms and tick Permit access with PUT/GET communication from remote partner.
5. Download hardware configuration to both CPUs.
6. In PLC_A's Main [OB1], insert a PUT instance. The instance DB is created automatically.

3.3 Example: PLC_A writes to PLC_B outputs

// PLC_A: tag %MW100 = 8 bytes of mirrored outputs going to PLC_B
// Triggered every 50 ms by a cyclic interrupt OB
"PUT_DB".REQ := "Clock_50ms";          // BOOL, rising edge
"PUT_DB".ID  := W#16#0001;            // matches S7 connection ID
"PUT_DB".ADDR_1 := P#M100.0 BYTE 8;   // partner CPU source pointer (remote M area)
"PUT_DB".SD_1   := P#M200.0 BYTE 8;   // local send area

IF "PUT_DB".DONE THEN
    "PUT_Done_Cnt" := "PUT_Done_Cnt" + 1;
END_IF;
IF "PUT_DB".ERROR THEN
    "LastPutStatus" := "PUT_DB".STATUS;  // capture 0x80xx codes
END_IF;

3.4 Example: PLC_A reads PLC_B inputs

// PLC_A: receive 8 bytes from PLC_B and place into local %M300
"GET_DB".REQ := "Clock_50ms";
"GET_DB".ID  := W#16#0001;
"GET_DB".ADDR_1 := P#M400.0 BYTE 8;   // partner CPU source pointer (remote M area)
"GET_DB".RD_1   := P#M300.0 BYTE 8;   // local receive area

3.5 Common PUT/GET STATUS Codes

4. Method 2 — PROFINET IO Controller / IO Device with Virtual Slots

This method makes CPU_B look like a distributed I/O station. The benefit is that CPU_A reads and writes to standard I/O addresses (e.g., %I0.0 – %I7.7, %Q0.0 – %Q7.7) just as it would for an ET 200SP. The latency is deterministic and bounded by the configured send clock, not by user program scan time.

4.1 Hardware View Configuration

1. Open Devices & Networks and add the second S7-1200 as a real device (do not start from the catalog stub). It must be the same article number so the device view matches.
2. Right-click the PROFINET interface X1 of CPU_B and choose Properties > General > PROFINET interface > Operating mode. Tick IO Device and clear IO Controller.
3. In the same dialog, add a new transfer area under Transfer areas for the partner:
   • Type: DI (inputs to controller) and/or DQ (outputs from controller)
   • Length: 1, 2, 4, 8, or 16 bytes per slot
   • Address: the local I/O address on CPU_A (e.g., I 0..7)
4. Assign CPU_A as the IO Controller for CPU_B by dragging the PROFINET cable from CPU_A.X1 to CPU_B.X1. TIA Portal automatically allocates the device name (default io-device-1).
5. Assign the PROFINET device name to CPU_B through the Online > Accessible devices > Assign PROFINET device name function. The MAC address on the CPU front panel matches the assignment.

4.2 Address Mapping Table

4.3 CPU_B Program Pattern

CPU_B needs a simple copy program. The on-CPU process image still contains the local physical terminals; the partner's words must be copied into a separate memory area to avoid aliasing between the controller-side view and the local physical I/O view.

// CPU_B is configured as IO Device of CPU_A
// "I_Image" is the process input image of the CPU (e.g., %IB0)
// "Q_Image" is the process output image (e.g., %QB0)

// Mirror physical inputs into the DI slot that CPU_A reads
%QB0 := "I_Image".Input_Byte_0;     // sent to CPU_A.IB0

// Apply the DQ slot received from CPU_A to physical outputs
"Q_Image".Output_Byte_0 := %IB0;   // %IB0 is CPU_B's view of CPU_A's slot 1

4.4 Send Clock and Watchdog

5. Method 3 — Bridging an S7-1200 with a LOGO! 8

The same two patterns extend to a LOGO! 8BM (e.g., 6ED1052-1MD08-0BA0) as the partner. Two options exist:

1. LOGO! 8 as S7 server: Use PUT/GET from the S7-1200. LOGO! 8 firmware 8.0 and later exposes a fixed set of variable areas (V areas, I/Q markers) over the S7 protocol. Up to 8 S7 connections are allowed on LOGO! 8.
2. LOGO! 8 as PROFINET IO Device: Configure the LOGO! as an IO Device of the S7-1200 IO Controller. The LOGO! automatically exposes its onboard DI/DQ as input and output submodules. No user code is required on the LOGO! beyond standard ladder logic.

5.1 LOGO! 8 Variable Mapping (S7 Server)

5.2 Example: S7-1200 PUT to LOGO! 8

// Send 4 bytes of command data from S7-1200 to LOGO! 8 VB0..VB3
"PUT_LOGO".REQ := "Send_Cmd";
"PUT_LOGO".ID  := W#16#0002;            // separate S7 connection to LOGO!
"PUT_LOGO".ADDR_1 := P#DB1.DBX0.0 BYTE 4; // LOGO! VB0..VB3
"PUT_LOGO".SD_1   := P#M500.0 BYTE 4;    // local command area

The S7-1200 side keeps its own program untouched; the LOGO! simply appears as a small data table. The deterministic latency of PROFINET IO Device mode is generally faster than the S7-server approach on the LOGO!, but the S7-server approach requires no GSD import and works for asymmetric, multi-byte exchanges that exceed the LOGO!'s native I/O count.

6. Method Comparison

7. Verification & Diagnostics

7.1 Online Watch Tables

Create one watch table per CPU. Add the mirrored tags and force (or monitor) the following diagnostics:

• Local inputs: %I0.0 … %I1.7
• Local outputs: %Q0.0 … %Q1.7
• Mirrored M area: %MW200 … %MW214
• Connection status: PUT_DB.STATUS, GET_DB.STATUS

7.2 LED Diagnostics

7.3 PROFINET Diagnostics in TIA Portal

1. Right-click the IO Device in the project tree → Online & diagnostics.
2. Open PROFINET diagnostics > Port statistics — check discarded frames and CRC errors.
3. Open Diagnostics buffer on both CPUs. Look for entries with ID 0x01E2 (connection established), 0x01E3 (connection terminated), 0x013C (IO Device failure), 0x015B (substitute value active).

8. Troubleshooting Matrix

9. Field-Commissioning Checklist

1. Power the 1212C CPUs with 24 V DC on terminals 1L and 2L. Verify PWR LED steady green.
2. Connect a managed switch between X1 P1 of both CPUs (or use a direct cable for a two-node setup).
3. Verify the LK LED on each port — must be solid green before continuing.
4. Set distinct IP addresses and identical subnet mask on both CPUs.
5. Download the hardware configuration and program to each CPU individually.
6. Use Online > Accessible devices to verify the partner is reachable.
7. For PUT/GET: trigger a known pattern (e.g., toggle a single bit in the source M area) and watch the partner's mirrored M area update in the watch table.
8. For IO Device: assign the PROFINET device name, then use PROFINET topology editor to confirm the port interconnections match the physical wiring.
9. Force a partner failure (unplug the Ethernet cable) and verify the fail-safe behaviour configured in the partner's program.
10. Restore the connection and verify automatic reconnection without restart.

10. Safety and Operational Notes

• Distributed I/O across two CPUs that control moving parts is not a safety-rated architecture. If the application requires SIL or PL classification, evaluate the SIMATIC S7-1200F variants (1214FC / 1215FC) and the S7-1200F manual for the F-CPU pairing rules.
• For machines covered by functional safety standards, the cabling between the two CPUs must follow the same segregation rules as any other safety-relevant signal; the network itself does not provide a safety layer.
• Always confirm the worst-case cycle time (OB1 + interrupt OBs + communication load) before sizing the send clock. The 1212C has a single PROFINET port shared with engineering traffic; isolate commissioning laptops on a managed switch port with VLAN if interference is observed.
• Document the IP, PROFINET device name, and slot assignment on the cabinet label so future maintenance engineers can re-establish the link without a full project download.

11. Quick Reference — Block Summary