S7-1500 F-DX-Mod: I-Slave-Slave PROFIBUS Safety Workarounds

I-Slave-Slave Communication in PROFIBUS Safety Networks

When a fail-safe PROFIBUS DP network is structured as a master with an I-slave that itself has lower-level DP slaves hanging off it, the safety data must be propagated down and back up using PROFIsafe over PROFIBUS Direct Data Exchange. The classic example is a controller (CPU-A) that talks PROFIBUS DP to a higher-level I-slave (CPU-B), and CPU-B in turn talks PROFIBUS DP to a remote I/O island such as an ET 200S. In Siemens terminology this is called I-slave-slave communication, and the data exchange mode used to forward input/output areas between slaves is the DX (Direct Data Exchange) mode. When the data being carried is PROFIsafe, the transfer area type becomes F-DX-Mod (Fail-safe Direct Data Exchange Module) rather than a plain DX area.

The problem: a project configured with an S7-1516F (or any S7-1500 F-CPU) as the DP master, an S7-315F-2DP as the PROFIBUS I-slave, and an ET 200S as the lower-level I-slave will compile and download, but the F-DX-Mod option is not offered in the TIA Portal transfer-area dialog. Only the standard DX transfer area type is available. This article explains the architectural reason, the role of the master, and the engineering workarounds that actually work in the field.

The PROFIBUS Direct Data Exchange (DX) Mechanism

PROFIBUS DP is a strictly master-driven bus. In the standard DP-V0/V1 cycle, only the active station (the master) may issue a request telegram; slaves respond when polled. Direct Data Exchange (DX) is a special DP-V1 mode in which a slave (the publisher) places its input data on the bus in its own response telegram, and a different slave (the subscriber) is allowed to consume that same data in the same bus cycle, without the master explicitly polling the subscriber for it.

The role of the master is not bypassed — the master still owns the token and still issues the poll to the publisher. What DX does is let the subscriber treat the publisher's response as if the master had forwarded the data. The bus cycle, PROFIsafe slot, and watchdog timers are all owned by the master. From a safety standpoint this is acceptable only when:

• The publisher is an I-slave that already has a defined PROFIsafe relationship with the master.
• The subscriber is a DP slave that is configured to receive those PROFIsafe telegrams.
• The master allows the I-slave-slave relationship in its configuration, which means the master's GSD/F-parameter set must list the subscriber as a DX consumer of the publisher's slot.

The PROFIsafe profile V2 (used on PROFIBUS) carries a 6-byte PROFIsafe payload prefix (CRC2 + control/status byte + consecutive number) and a configurable watchdog. The S7 F-library blocks F_SENDDP and F_RCVDP (S7-300/400) and the F-CPU runtime enforce that all PROFIsafe data crossing a DX link is treated as a separate, addressable F-relationship with its own F-monitoring time and F-destination address.

F-DX-Mod Transfer Areas: Definition and Purpose

An F-DX-Mod transfer area is the F-CPU's way of saying "this is a fail-safe data region that will be transported via PROFIBUS Direct Data Exchange, not via standard master-to-slave polling." In STEP 7 V5.x and in TIA Portal, when configuring the I-slave interface of an S7-300/400 F-CPU you see a transfer-area list where each row is one of:

The reason the project shows only DX and not F-DX-Mod is that the upper-level DP master in the project is an S7-1500 F-CPU. TIA Portal (and the underlying CPU firmware) is filtering the option out because the master cannot honor it — see the next section.

The S7-1500 F-CPU Limitation on F-DX-Mod

The SIMATIC Safety documentation is unambiguous on this point. In the SIMATIC Safety - Configuring and Programming manual, the I-slave-slave communication topology is documented in Chapter 9.1 and applies to the S7-300 and S7-400 systems only. Chapters 9.3 and 9.4 cover the S7-1200/1500 safety communication options and they do not list I-slave-slave / F-DX-Mod as a supported configuration. S7-1500 F-CPUs support the following safety communication relationships on PROFIBUS:

• F-Host-to-F-Device (PROFIsafe V2 over F-MS, master-slave)
• F-Host-to-F-I-Device on PROFINET (PROFIsafe V2.6.1 over PN)
• F-CPU-to-F-CPU over S7 communication (PUT/GET with F-attribute) on PN

What is missing is the master-side role that authorizes a downstream I-slave to act as a DX publisher. On S7-300/400 the DP master interface owns the configuration of which slots are visible to which consumers; this is a function that lives in the master’s PROFIBUS stack and in the DBM (Distributed Master) configuration. S7-1500 F-CPU firmware (as of V2.9 / TIA Portal V18, and including the V3.0 firmware shipped with the 1516F) does not implement the I-slave-slave bridging role on its PROFIBUS interface, and the GSD/SSP catalog it generates for the lower-level I-slave therefore only exposes the standard DX transfer type, not the fail-safe F-DX-Mod variant.

Topology Analysis of the Failure

The original configuration has three logical roles that must be served by two PROFIBUS segments and one PROFINET segment:

1. PROFINET controller — S7-1516F with PN interface #1.
2. PROFIBUS master — same S7-1516F using its PN/DP-coupled PROFIBUS interface, or an external PROFIBUS master (CM 1542-1, CM 1542-5, CP 1542-5).
3. PROFIBUS I-slave — S7-315F-2DP on the PROFIBUS segment.
4. PROFIBUS I-slave (lower level) — ET 200S with IM 151-1 / IM 151-3 PN and F-modules (e.g. 6ES7138-4FA04-0AB0).

The I-slave-slave data path requires that the PROFIBUS master (item 2) explicitly authorise the ET 200S to act as a DX consumer of an F-slot on the S7-315F. The S7-1500 line cannot perform that authorisation. A second compounding issue is that the S7-315F-2DP has only one PROFIBUS interface, and that interface can be configured as either DP master or DP slave — never both at the same time. So the 315F cannot simultaneously serve as the I-slave of the 1516F and as the master of the ET 200S. It can only be one or the other, and the only role that lets the F-modules on the ET 200S be reached is "DP master of the lower segment". This forces the I-slave-slave bridging role onto the upper master, which brings us back to the S7-1500 limitation.

Workaround A — Substitute the Master with an S7-300/400 F-CPU

This is the only configuration that retains the I-slave-slave topology and the PROFIsafe V2 transport end-to-end. The fix is to replace the S7-1516F in the role of the PROFIBUS master with an S7-300 F-CPU that supports DBM (Distributed Master Bridging) and F-DX-Mod configuration, such as:

• S7-315F-2DP (6ES7315-6FF04-0AB0) with PROFIBUS master capability
• S7-317F-2DP (6ES7317-6FF04-0AB0)
• S7-319F-3PN/DP (6ES7319-3FL01-0AB0) — verified combination by Siemens support and by end-user field testing
• S7-416F-3 PN/DP (6ES7416-3FS06-0AB0) for larger systems

All four devices, when configured with the PROFIBUS interface as DP master, expose the F-DX-Mod transfer-area type in STEP 7 V5.5 SP4+ or in TIA Portal V14 SP1+ (the S7-300/400 F-CPU must be inserted as a "S7-300/400 station" project, not via GSD import). The lower-level ET 200S is then configured as a standard DP slave of the 315F/317F/319F master, and an additional transfer area of type F-DX-Mod is added on the master side that points at the F-modules of the ET 200S.

If the S7-1500 must remain as the project’s top-level controller (e.g. for visualisation, motion, or PN/PN-coupling reasons), the recommended layout is a PN/PN coupler between the S7-1500 and the S7-300 F-master. The S7-1500 sees the S7-300 F-CPU as a normal PN device and exchanges process data across the PN/PN coupler; the S7-300 F-CPU then owns the PROFIBUS I-slave-slave segment and the F-DX-Mod relationship. This is the most common field layout when both controllers must coexist.

Workaround B — Insert a DP/DP Coupler for Master-Master Safety

When the S7-1516F must remain the only F-controller on the segment and the lower island is owned by a second F-master (for example a redundant F-system or a different machine), the standard approach is a PROFIBUS DP/DP coupler:

• Siemens DP/DP coupler, order number 6ES7158-0AD01-0XA0 (V1) or 6ES7158-0AD03-0XA0 (V2 with status bytes in diagnostic data). Up to 244 bytes of input and 244 bytes of output per direction, max 32 I/O words for the diagnostic/status interface.

Each side of the coupler is a separate DP master. The 1516F is the master on side A; the second F-master is the master on side B. The F-DX-Mod relationship is then terminated on side A and re-cast as a plain F-MS on the 1516F. This loses the F-DX-Mod transfer type on the 1516F side, but PROFIsafe integrity is preserved because the DP/DP coupler is a deterministic, byte-transparent gateway with fixed propagation delay that can be budgeted into the F-monitoring time of both sides.

Workaround C — Migrate the Lower-Level Network to PROFINET

The cleanest long-term solution is to retire the PROFIBUS segment on the lower level and replace the ET 200S with an ET 200SP (or ET 200MP) on PROFINET. PROFINET supports the equivalent of I-slave-slave through the F-I-Device mechanism: an S7-1500 F-CPU can be configured as a PROFINET F-I-Device and can exchange PROFIsafe data with an F-Host using the F-I-Device interface (publisher/subscriber). The S7-1500 line has full support for:

• PROFIsafe V2.6.1 over PROFINET
• F-I-Device with shared device and module-internal F-Proxy
• F-relationship between the ET 200SP F-host and the S7-1516F F-host via PN/PN coupler

This is a hardware migration, not a software change. The ET 200S is end-of-life (the IM 151-1 / IM 151-3 PN modules were discontinued in 2018; spare-part availability runs to 2023-2024 depending on variant). ET 200SP with F-modules such as the 6ES7136-6BA00-0CA0 (F-DI 8x24VDC HF) and 6ES7136-6DB00-0CA0 (F-DO 4x24VDC/2A HF) are the supported successors. Migrating the lower island to PROFINET eliminates the F-DX-Mod question entirely.

Configuration Procedure for S7-300 F-DX-Mod (Step-by-Step)

Use this procedure when the upper F-master is an S7-317F-2DP or S7-319F-3PN/DP and the lower island is an ET 200S on PROFIBUS. Firmware pre-requisites: S7-300 F-CPU firmware V3.3 or higher; STEP 7 V5.6 + S7 Distributed Safety V5.4 SP5 (for V5.x), or TIA Portal V16+ with the S7-300/400 F-CPU package installed.

1. Insert the master station. In TIA Portal, add a new device → SIMATIC S7-300 → CPU 319F-3PN/DP (6ES7319-3FL01-0AB0). Assign a PROFIBUS address (default 2).
2. Configure the PROFIBUS interface as DP master. Open the CPU properties → DP interface [X2] → Operating mode → DP master. Set the bus parameters to standard PROFIBUS DP, 1.5 Mbps, profile "DP".
3. Insert the S7-315F-2DP as an I-slave. Drag a second S7-300 station into the project (CPU 315F-2DP, 6ES7315-6FF04-0AB0). Right-click the DP interface → Operating mode → DP slave. Set its PROFIBUS address (e.g. 3) and add a transfer area of type MS pointing at the lower-level F-modules.
4. Insert the ET 200S as a DP slave of the 315F-2DP. Drag the IM 151-1 HIGH FEATURE (6ES7151-1BA02-0AB0) and the F-DI/F-DO modules into the slot configuration. Assign PROFIBUS address (e.g. 4). The 315F must be the master of this segment; the 315F's DP interface is therefore still DP master from the ET 200S's point of view. Because the 315F is also an I-slave of the 319F, it is acting as a "master on the lower side, slave on the upper side" — this is exactly the I-slave-slave topology.
5. Enable the F-DX-Mod transfer area on the 319F master. Return to the S7-319F, open the DP interface properties, and add a new transfer area. The Type dropdown will now show F-DX-Mod. Select it. Configure:
   • Source PROFIsafe slot: the F-module slot on the ET 200S (e.g. slot 4 for F-DI 24VDC).
   • F-destination address: the unique PROFIsafe F-address of the lower module (1..65534, must match the configuration in the F-CPU's PROFIsafe slot).
   • F-monitoring time: budget for the worst-case bus cycle + the DP/DP delay + 1.5× the F-CPU F-runtime. For 1.5 Mbps with one 315F hop, a typical value is 100 ms.
6. Compile and download. Compile both stations, download the hardware configuration, and download the safety program (F-runtime group, F-signature, F-wiring check). The F-CPU will prompt for an F-signature on first start-up.
7. Run the F-wiring check. In the safety program, call F_TEST on each F-I/O channel to verify the F-source and F-destination addresses line up and that the F-monitoring time is respected.

Verification and Diagnostic Steps

After configuration, run these checks in order. Any failure rolls back to the previous step.

1. PROFIBUS LED on the 315F-2DP. The BF (bus fault) LED must be off. A continuously lit BF LED with intermittent flashing indicates a configuration mismatch — the F-DX-Mod slot on the 319F is pointing at a slot the 315F does not have in its GSD export.
2. Online → Diagnostics → PROFIBUS on the 319F. The lower-level ET 200S should appear in the bus nodes list with state Data exchange.
3. F-I/O error LEDs on the ET 200S F-modules. Solid red on a channel indicates a PROFIsafe address mismatch (F-source or F-destination address not what the 319F expects). A flashing red at 0.5 Hz indicates a watchdog violation — F-monitoring time too short.
4. Diagnostic buffer of the 319F. Search for entry SF (safety fault). The text of the entry contains the failing F-relationship, the slot number, and the diagnostic event byte. Common values:
   • Byte 0x04 — F-source address mismatch (F-address in slot configuration differs from the F-address returned by the F-module).
   • Byte 0x05 — F-destination address mismatch.
   • Byte 0x06 — F-monitoring time exceeded (PROFIsafe watchdog).
   • Byte 0x10 — F-CPU is in PASSIVE state; the safety program has not been downloaded with a valid F-signature.
5. F-runtime group status. In TIA Portal, open the F-runtime group on the 319F and confirm the group status word is 0x0000 (PASSIVE → READY → RUN). A status of 0x0001 indicates that an F-I/O channel has been passivated.

Migration and Lifecycle Considerations

Before locking in any of the workarounds, verify the lifecycle status of every component with the Siemens SIMATIC Product Lifecycle tool:

For new builds, prefer the PN/PN coupler (6ES7158-3AD01-0XA0, V1) over the DP/DP coupler; it gives the same deterministic byte-transport without the PROFIBUS maintenance burden and is fully supported in TIA Portal V15+ for both F and non-F data exchange with no PROFIsafe re-termination required (the F-relationship simply lives on the F-host side of the coupler).

Field-Proven Tips and Common Pitfalls

• Don't trust the wizard. The TIA Portal "I-slave" wizard will happily create a DX (non-safety) transfer area when the master is an S7-1500. The project will compile, the CPU will go to RUN, and the inputs will toggle — but PROFIsafe integrity is not in place. Always confirm the transfer area type by reading the exported GSD of the lower station; it should contain a F-module row, not a module row.
• F-monitoring time budget. For a single 315F hop at 1.5 Mbps, the rule of thumb is T_F ≥ 3 × T_bus_cycle + T_F-runtime. With a 5 ms bus cycle and a 10 ms F-CPU runtime, T_F ≥ 25 ms. Round up to 50 ms or 100 ms for headroom.
• Don't re-use the PROFIsafe F-address. Each F-module on a PROFIBUS segment must have a globally unique F-destination address. TIA Portal will warn about duplicates but the S7-1500 master will not enforce the F-DX-Mod address uniqueness, so the check is on the engineer.
• Firmware consistency. A S7-317F-2DP running firmware V3.2 will accept the configuration, but a S7-319F-3PN/DP running firmware V3.0 will reject it with diagnostic event "Incompatible F-module in slot X". Always run the master and the I-slave on the same firmware major revision (V3.x for S7-300, V2.x for ET 200S F-modules).
• Don't split a PROFIsafe V2 relationship across a DP/DP coupler. As noted in the workaround section, the coupler must be inside the F-monitoring time budget but it must not be a black box from the F-protocol's point of view. Always terminate the F-relationship on each side of the coupler.
• Document the topology in the safety plan. The I-slave-slave relationship must be captured in the machine's SISTEMA / safety-evaluation file as a sub-system with its own PFHd, channel, and diagnostic coverage. The PROFIsafe address (F-source + F-destination) is the lookup key.

FAQ