S7-1200 PROFINET I-Device Configuration with Beckhoff CX5120

Overview: PROFINET I-Device Communication Principle

An S7-1200 can be placed on a PROFINET network in one of two roles. The default role is PROFINET IO Controller, where the PLC masters distributed I/O on the subnet. The second role is PROFINET I-Device (Intelligent IO Device), where the S7-1200 behaves as a modular slave to an external controller. In I-Device mode the S7-1200 exposes a defined set of input and output slots to the higher-level controller, while still running its own program and serving its own lower-level PROFIBUS or PROFINET subnets. This role is supported by the S7-1200 starting with CPU firmware V4.0 and is fully integrated in TIA Portal V13 or later.

For integration with a Beckhoff CX5120 the S7-1200 must be configured as an I-Device. The CX5120 runs TwinCAT 3 with the TF6271 PROFINET RT Controller (or the TF6270 RT Device, depending on role) and acts as the PROFINET IO Controller. Communication is then a peer-to-peer exchange of process data between two CPUs: the Beckhoff controller produces output data that the S7-1200 reads, and the S7-1200 produces input data that the Beckhoff controller reads. The two sides agree on the slot layout through a GSDML (GSD Markup Language) file generated by TIA Portal and imported into TwinCAT.

System Architecture and Topology

The physical topology is a single PROFINET segment shared by two CPUs. The CX5120 owns the IO Controller role, the S7-1200 owns the I-Device role, and both connect to a managed or unmanaged PROFINET switch. Direct cross-cable connection is possible for bench testing but is not recommended for production because PROFINET diagnostics, device replacement without removable media, and topology discovery all rely on LLDP frames from switches.

Figure 1 — Single subnet PROFINET topology with CX5120 controller and S7-1200 I-Device.

Prerequisites: Hardware, Firmware, and Software

Beckhoff CX5120 Hardware Summary

Refer to the CX51x0 hardware technical data for the full dimensional drawing, weight, and approval list (CE, UL, ATEX on selected variants).

Siemens S7-1200 I-Device Configuration in TIA Portal

1. Open the S7-1200 project in TIA Portal. In the project tree select the S7-1200 CPU and open Device view.
2. Click on the PROFINET interface (X1) in the device view to open the inspector pane on the right.
3. Open Properties > General > Operating mode. Two radio buttons appear: IO Controller and I-Device. Select I-Device. The check box 'Operate as IO Device without lower-level PROFINET IO system' can be left enabled if no subordinate bus is connected.
4. Assign a fixed IP address and PROFINET device name. Recommended values for bench testing: IP 192.168.0.20, Subnet mask 255.255.255.0, PROFINET device name s71200-idevice.
5. Compile the device (right-click > Compile > Hardware and software only). This step is required before transfer areas are editable.

Defining Transfer Areas on the S7-1200

Transfer areas are the modular slots that the I-Device exposes to the higher-level controller. From the controller's point of view, each transfer area appears as a subslot with an input and/or output submodule. Up to 32 transfer areas can be defined per I-Device, with each area holding up to 1024 bytes in each direction. In practice, define the smallest number of large areas that satisfies the application — fewer areas mean less cycle overhead and lower jitter.

1. With the PROFINET interface still selected, switch to Properties > General > I-Device Communication.
2. Click 'New' in the Transfer areas table. A new row appears.
3. Configure the row with the following parameters:

   Column	Value	Description
   Transfer area name	to_beckhoff	Free text label, shown in slot diagnostics
   Type	Output (controller → device)	Direction relative to the I-Device
   Length	8 bytes	Process data length, must be ≤ 1024 bytes
   Start address	QB0	Implicitly mapped into the S7-1200 process image
   Consistency	Total length	Use 'Total length' for multi-byte consistency

4. Add a second transfer area named from_beckhoff with Type = Input, Length = 8 bytes, start address IB0.
5. Add additional areas only if the data must be logically separated. The example below uses two 8-byte areas, giving 16 bytes total cyclic payload in each direction.

Exporting the S7-1200 GSDML File

1. Right-click the S7-1200 in the project tree and choose Export > GSDML file (PROFINET GSD). TIA Portal prompts for a save location and a PROFINET device name. Confirm the name as s71200-idevice to keep the slot identifiers stable across re-exports.
2. TIA Portal generates a zip archive containing the GSDML-Vx.x-xxxxxx-...xml file. Note the file name — TwinCAT will display the device type by this string.
3. Copy the GSDML to the TwinCAT engineering PC. The file is not installed on the CX5120 runtime; it is consumed by TwinCAT XAE on the development workstation.

Beckhoff CX5120 TwinCAT 3 PROFINET Controller Setup

1. Open the TwinCAT 3 XAE project for the CX5120. In the I/O tree, right-click Devices and choose Add New Item > EtherCAT if EtherCAT slaves are present; PROFINET devices are added as a sibling, not under EtherCAT.
2. Right-click Devices > Add New Item > PROFINET IO Controller (TF6271). TwinCAT inserts a new node with the configured PROFINET port (X001 or X002 of the CX5120).
3. Open the PROFINET controller node and set the station IP to 192.168.0.10, subnet mask 255.255.255.0. Verify the PROFINET port is bound to the correct physical Ethernet interface under the controller's Adapter property.
4. Right-click the controller > Install PROFINET Device GSDML and select the GSDML exported in the previous step. TwinCAT parses the GSDML and lists the I-Device under the available device catalog.
5. Right-click the PROFINET controller > Add New Item > PROFINET IO Device and select the imported Siemens S7-1200 I-Device.
6. Open the added PROFINET device and set the device IP to 192.168.0.20. TwinCAT will use DCP to assign the PROFINET device name s71200-idevice automatically when the configuration is activated; the name must match what is stored in the S7-1200.
7. Expand the PROFINET device node. The slot list mirrors the transfer areas defined in TIA Portal. Drag the input and output submodules into the slot list to enable them. TwinCAT will list Input 8 bytes and Output 8 bytes for the two-area example above.

Linking I/O in TwinCAT 3

1. Click the I/O device under the PROFINET controller. In the right pane, switch to the 'API' tab. The slots defined in TIA Portal appear as Slot 0 (head), Slot 1 (input area), Slot 2 (output area).
2. For each slot, open the 'PLC' sub-tab and create a variable. The variable becomes the process image alias for the slot. Typical variable assignments:

   Slot	Direction (TwinCAT view)	Variable	Type
   Slot 1	Inputs (read from S7-1200)	fbInputs	ARRAY[0..7] OF BYTE
   Slot 2	Outputs (write to S7-1200)	fbOutputs	ARRAY[0..7] OF BYTE

3. Link the variables to the PLC task by selecting Auto-link to PLC project or by dragging the I/O variable into the global variable list of the TwinCAT PLC project.
4. Build the TwinCAT solution and activate the configuration. TwinCAT performs DCP, then establishes the PROFINET AR (Application Relationship) with the S7-1200. A green '✓' on the device node indicates successful cyclic data exchange.

S7-1200 Program: Reading Inputs and Writing Outputs

On the S7-1200 side the transfer areas appear in the I/O address space of the CPU. With the example above, the output area (from Beckhoff's view, written by the controller) is at QB0..QB7 and the input area (written by the S7-1200, read by Beckhoff) is at IB0..IB7. Two programming patterns are commonly used.

Pattern 1: Direct I/O Access in OB1

// OB1 - main cyclic program
// Read 8 bytes from Beckhoff CX5120 (input area on the I-Device)
// These are values the Beckhoff controller wrote into the PROFINET output slot.

// 'IB0' is the first byte of the transfer area defined as Input in TIA Portal.
// The byte contains the first element of the array sent from TwinCAT.

// Use case: simply copy the first 4 bytes into a tag.
"BeckhoffRxWord0" := IB0;   // BYTE
"BeckhoffRxWord1" := IB1;   // BYTE
"BeckhoffRxWord2" := IB2;   // BYTE
"BeckhoffRxWord3" := IB3;   // BYTE

// Write 8 bytes back to Beckhoff (output area on the I-Device)
// These values appear in the TwinCAT input process image.
QB0 := "MyTxByte0";
QB1 := "MyTxByte1";
QB2 := "MyTxByte2";
QB3 := "MyTxByte3";
QB4 := "MyTxByte4";
QB5 := "MyTxByte5";
QB6 := "MyTxByte6";
QB7 := "MyTxByte7";

For arrays, an SCL variant is more compact:

// SCL - data block fragment
VAR
    BeckhoffRx AT %IB0 : ARRAY[0..7] OF BYTE;   // Input from CX5120
    BeckhoffTx AT %QB0 : ARRAY[0..7] OF BYTE;   // Output to CX5120
END_VAR

// Main logic
BeckhoffTx[0] := BeckhoffRx[0] XOR 16#FF;  // Echo with bit inversion as loopback test

Pattern 2: Consistent Access with System Functions

When the transfer area exceeds 4 bytes and the application needs to ensure all bytes are from the same PROFINET cycle, use DPRD_DAT and DPWR_DAT. These functions read/write the entire area with 'Total length' consistency regardless of the process image update.

// SCL - consistent read from PN input area
// Area: 8 bytes starting at PI address 0

#stat_retval  : INT;
#stat_len     : UINT := 8;

// Read input area from PROFINET into 'rxBuffer'
DPRD_DAT(LADDR := 0, RETVAL := #stat_retval, RECORD := "rxBuffer");
IF #stat_retval = 0 THEN
    // rxBuffer now contains a cycle-consistent snapshot
    // process it here
END_IF;

// Write to PROFINET output area (S7-1200 transmits to Beckhoff)
DPWR_DAT(LADDR := 0, RECORD := "txBuffer", RETVAL := #stat_retval);

The LADDR argument is the PROFINET slot's logical base address. In TIA Portal this is visible under Properties > I-Device > Transfer areas > Address in the process image. The S7-1200 maps each transfer area starting at a multiple of 32 bytes by default.

Diagnostics, LEDs, and Verification

Live Diagnostics in TIA Portal

1. Connect TIA Portal online to the S7-1200.
2. Open Online & Diagnostics > PROFINET interface > Diagnostic buffer. The 'IO Device state' entry records AR establishment and termination events with vendor IDs and reason codes.
3. Open Online & Diagnostics > PROFINET interface > Port statistics. Discarded frames, CRC errors, and late collisions indicate physical-layer problems rather than configuration errors.

Live Diagnostics in TwinCAT 3

1. Activate the TwinCAT configuration. The PROFINET controller appears in the I/O tree.
2. Click the S7-1200 device, switch to the Online tab. The 'State' field shows INIT / CONNECT / OPERATE. Healthy operation is OPERATE.
3. Open the TwinCAT Logger and filter by the PROFINET controller task. Common log entries include PN Controller AR established, PN Controller AR aborted, reason 0xXX, and DCP identify response.

Timing, Performance, and Handshake Considerations

PROFINET RT on the S7-1200 supports a send clock of 1 ms, the shortest cycle time. In practice most I-Device integrations use 1 ms, 2 ms, or 4 ms. The reduction ratio (RT class) is set on the I-Device's PROFINET interface in TIA Portal. The TwinCAT PROFINET controller can be configured to send at 1 ms via the controller's Cycle time property in the I/O tree.

There is no hardware or protocol-level handshake on PROFINET — the controller writes outputs and the device reads them on the next cycle. The S7-1200 program runs asynchronously to the PROFINET update. If the application requires strict acknowledgment of received data, a software handshake is needed.

// SCL - simple request/response handshake
// Beckhoff sets BeckhoffTx[0] = 0x01 to request a new value
// S7-1200 detects the rising edge, computes a result, sets BeckhoffRx[0] = 0x01
// Beckhoff sees 0x01, resets its request to 0x00
// S7-1200 resets its response to 0x00 to complete the cycle

IF BeckhoffRx[0] = 16#01 AND "oldRequest" = 16#00 THEN
    // Rising edge detected - new request from controller
    "result" := "computeResult"();
    BeckhoffTx[0] := 16#01;  // Acknowledge
ELSE
    IF BeckhoffRx[0] = 16#00 THEN
        BeckhoffTx[0] := 16#00;  // Reset ack
    END_IF;
END_IF;
"oldRequest" := BeckhoffRx[0];

For sequence numbers, add a monotonically increasing byte to BeckhoffTx[1] and verify it on the Beckhoff side. This detects lost or duplicated cycles if the application requires strict event ordering.

Handshake Variant: 32-bit Field Exchange

When exchanging structured records (recipe data, axis positions, etc.), use a shared 32-bit control word and a 32-bit status word. The Beckhoff controller writes the control word with a transaction ID, the S7-1200 reads the ID, processes the data in the payload areas, then returns the same ID in the status word. The Beckhoff controller considers the response valid only if the returned ID matches the request ID.

Update Time and Watchdog Configuration

The S7-1200 I-Device supports a configurable watchdog. If the PROFINET controller does not send a new frame within the watchdog time, the I-Device issues a 'Watchdog timeout' diagnostic and replaces the input data with the configured substitute value (typically zero). Set the watchdog on the S7-1200 in TIA Portal under PROFINET interface > I-Device > Watchdog time. A safe starting value is 3 * send clock, e.g. 3 ms for a 1 ms send clock.

Troubleshooting Matrix

Edge Cases and Field-Proven Caveats

IP address persistence on the S7-1200. The IP and PROFINET name live in the S7-1200 project and are downloaded to the device. A factory reset clears both. After any firmware update or reset, re-assign the name and IP from TIA Portal or from TwinCAT DCP.

Number of I-Device transfer areas. Although 32 areas are technically supported, the S7-1200 firmware reduces diagnostic detail when more than 8 areas are configured. For maintainability, design the data exchange around 2-4 large areas rather than many small ones.

S7-1200 PUT/GET over the same port. The S7-1200 can simultaneously be a PROFINET I-Device and a PUT/GET server. The PUT/GET communication uses the same port X1 but a separate TCP connection. Do not use PUT/GET for time-critical data — use the I-Device transfer areas instead.

CX5120-01xx-9020 1.20 GHz variant. The -01xx-9020 has a slightly reduced clock rate. For PROFINET with a single I-Device and modest payload (< 64 bytes per direction), the difference is not measurable. For high-traffic setups with multiple PROFINET devices, prefer the 1.46 GHz standard CX5120.

PROFINET device name length. A PROFINET device name is limited to 240 characters and is case-insensitive. Use lowercase names to match the DCP default on the Beckhoff side.

Summary of Configuration Data Flow

1. Engineer exports the S7-1200 GSDML from TIA Portal after defining the I-Device role and transfer areas.
2. Engineer imports the GSDML into TwinCAT XAE and adds the S7-1200 as a PROFINET IO device under the CX5120 PROFINET controller.
3. TwinCAT performs DCP to assign the PROFINET device name and IP to the S7-1200.
4. The two CPUs establish the PROFINET AR and begin cyclic data exchange using the configured slot layout.
5. The S7-1200 program reads inputs from QB area and writes outputs to IB area. The Beckhoff PLC reads inputs from the linked input variable and writes outputs to the linked output variable.
6. A software handshake (control word / status word) is added when the application requires cycle-level acknowledgment.

Frequently Asked Questions