S7-1500F Failsafe CPU Communication via PROFINET I-Device

Overview: Failsafe CPU-to-CPU Communication Across S7-1500F Projects

When two or more SIMATIC S7-1500F controllers must exchange safety-related data — for example, to cross-shut down two independent machines that share a common hazard zone — the failsafe payload must travel over a black-channel link using PROFIsafe. PROFIsafe runs as a safety layer on top of PROFINET (or PROFIBUS), and it is the only Siemens-approved mechanism for transporting SIL 3 / PL e process data between F-CPUs that are not executing in the same F-Runtime group.

For TIA Portal V15 (and continuing through V16, V17, V18, V19, and V20), the supported method for exchanging failsafe data between two S7-1500F CPUs that live in separate TIA Portal projects is Safety-Related I-Device Communication: one F-CPU is configured as a PROFINET I-Device, exposes PROFIsafe transfer areas as proxy slots, and the second F-CPU consumes those slots as if they were distributed F-I/O. TIA Portal V20 introduced a simplified alternative called Flexible F-Link, which is covered in the alternate-architecture section of this article.

Architecture Options at a Glance

Prerequisites

Hardware

• Two S7-1500F CPUs from the supported catalogue. Typical choices: 6ES7515-2AM02-0AB0 (CPU 1515F-2 PN), 6ES7516-3AN02-0AB0 (CPU 1516-3 PN/DP F), 6ES7517-3AP00-0AB0 (CPU 1517-3 PN/DP F), or 6ES7518-4AP00-0AB0 (CPU 1518-4 PN/DP F). ET 200SP F-CPUs (6ES7510-1SJ01-0AB0 CPU 1510SP F, 6ES7510-1SK01-0AB0 CPU 1512SP F) can also be used as the I-Device side when the second machine is a distributed station.
• Each F-CPU must have an available PROFINET interface — the integrated X1 or X2 port is preferred. A CP 1543-1 can be used on a CPU 1510SP/1512SP that lacks an integrated PN port, but increases cycle jitter.
• Both F-CPUs must run firmware that supports the PROFIsafe profile selected in TIA Portal. TIA Portal V15 defaults to PROFIsafe V2.4; V17 and later default to PROFIsafe V2.6.1. Mismatched profiles are accepted only if the lower V-number is configured on the higher-V CPU; the engineering tool will warn on download.
• One PROFINET cable, or an existing PROFINET ring, connecting the two F-CPUs. A managed switch (e.g., SCALANCE XC206-2) is permitted but not required for a point-to-point F-link.
• F-capability must be enabled in the device configuration of both CPUs (CPU Properties → Safety → "Use F-capability of the CPU"). The F-activation checkbox exposes the F-Runtime group objects in the project tree.

Software and Licensing

• TIA Portal V15 (or later) with the STEP 7 Safety Advanced option package (article number 6ES7833-1FC02-0YA5 for V15.x) installed on the engineering station. Without Safety Advanced, the F-Blocks and PROFIsafe transfer areas are read-only.
• Matching Hardware Support Package (HSP) for both CPU firmware versions, installed via TIA Portal → Options → Support Packages.
• An F-collective signature / F-password set on each F-CPU's safety program. Each F-CPU owns an independent safety password — these are not shared across the two projects. The password is hashed with SHA-256 and stored locally on the CPU's System Data Card.
• For the I-Device export, a GSD file is generated by the I-Device project (Export → "Export I-Device GSD file"). The exported GSD must be imported into the IO controller project before the F-CPU can be assigned to the IO controller.

Method 1 — Safety-Related I-Device Communication (TIA Portal V15+)

The official Siemens procedure is documented in the TIA Portal Safety configuration manual: Configuring safety-related communication between IO controller and i-device. The procedure below condenses the manual and adds the V15-specific menu paths.

Step 1 — Configure the I-Device side (the F-CPU that supplies the safety data)

1. Open the I-Device project's TIA Portal V15 project.
2. Select the F-CPU in the project tree → "Devices & Networks" → select the PROFINET interface that will face the partner F-CPU.
3. In the Properties → "PROFINET interface [X1]" → "Operating mode" tab, set:
   • Operating mode: I-Device
   • Assigned IO controller: not yet assigned (will be assigned after GSD import on the partner side)
4. In the same interface, set the IP address and PROFINET device name. The device name is what the IO controller will address — choose a stable, descriptive name such as pn-plc-b-1500f. PROFINET device names are case-sensitive and must match exactly on both sides.
5. Switch to the "Transfer areas" tab in the same Properties inspector. Click "Add new transfer area" and create a transfer area for Safety-related data:
   • Direction: I-Device → IO controller (inputs on the partner side) or IO controller → I-Device (outputs on the partner side) as required
   • Length: typically 1–12 bytes of F-input and 1–12 bytes of F-output payload
   • Type: PROFIsafe V2 (V2.4 by default in V15)
6. Slot: assign a free slot number, conventionally slot 1 for the first safety transfer area
7. Compile the I-Device project (Hardware → Compile).
8. Export the I-Device as a GSD file: "Project → Export → PROFINET I-Device GSD file". Choose GSDML schema V2.4 for V15 projects. Send the resulting .xml file to the engineer of the partner project via a controlled exchange folder; do not email it.

Step 2 — Import the I-Device into the IO controller project

1. Open the IO controller project's TIA Portal V15 project.
2. "Options → Manage general station description files (GSD)" → import the GSDML file exported in Step 1.
3. Drag the imported I-Device from the catalogue into the PROFINET subnet that the IO controller's PROFINET interface is connected to.
4. Assign the I-Device to the IO controller by drawing a PROFINET relationship from the IO controller's PN port to the I-Device's PN port. The tool now resolves the device name pn-plc-b-1500f to the imported I-Device.
5. Open the I-Device's device view. The transfer area created in Step 1 appears as a sub-module. Drag it into the I-Device's slot configuration. Note the assigned I/O addresses (e.g., %IW0..%IW5 for inputs, %QW0..%QW5 for outputs). These are the addresses the IO controller's standard program and F-program will reference.

Step 3 — Configure the F-Destination address (F_Dest_Add)

The PROFIsafe F_Dest_Add is a 16-bit address that uniquely identifies the safety partner. It is not the PROFINET IP address — it is a separate PROFIsafe address. The I-Device engineer and the IO controller engineer must agree on the F_Dest_Add value (typically a project-specific integer such as 1 or 0x1234) and enter it on both sides. A mismatched F_Dest_Add causes the PROFIsafe stack to enter the "F-Communication error" state and passivates both ends.

1. On the I-Device side: Devices & Networks → PROFINET interface → Transfer areas → select the transfer area → Properties → "PROFIsafe" tab → F_Dest_Add = agreed value.
2. On the IO controller side: the value is stored automatically in the safety program block DB when the safety program is compiled. If you need to enter it manually, open the F-Communication DB and edit the F_DEST_ADD tag.

Step 4 — Configure the F-Runtime groups

Both F-CPUs need a valid F-Runtime group object. By default, the first F-Runtime group is created automatically when the CPU is configured as F-capable. The maximum cycle time of the F-Runtime group on each CPU must be set to a value shorter than the F-Watchdog of the partner's PROFIsafe slot:

Step 5 — Program the safety data exchange

On the IO controller side, the I-Device's safety transfer area appears as standard I/O addresses. The standard F-I/O access blocks RD_SI / RD_SO / WR_SI / WR_SO from the F-Library F_IO_LIB handle the passivation logic:

// In the F-Runtime group F-FB on IO controller side
// Read failsafe inputs from the I-Device (machine B)
#fB_estop_active := RD_SI(I_ADDR := %IW0,    // failsafe input byte 0
                           BIT_NO := 0,
                           RET_VAL := #fRetVal);

On the I-Device side, expose the local F-tag using the F-Block SENDDP or directly by mapping the F-tag to the transfer area's output address. The simplest pattern is to use SENDDP in the I-Device's standard program to copy the failsafe data into the output transfer area:

// In the standard program on the I-Device side
// SENDDP pushes the local F-result into the I-Device transfer area
SENDDP(SRC := "DB_SafetyResult".bMachineA_EstopOK,  // BOOL
       DST := %Q0.0,
       LEN := 1);

Step 6 — Compile, download, and F-Login

1. On the I-Device project: HW compile → download HW config → download safety program → enter the F-password when prompted.
2. On the IO controller project: HW compile → download HW config → download standard program → download safety program → enter the F-password.
3. Both CPUs perform an F-Login sequence. The F-CPU's "F-ACT" LED must turn solid green. The MAINT LED should be off. The LINK / RX/TX LEDs on the PROFINET port show the cyclic data exchange.
4. Check the F-Communication DB's DIAG byte. DIAG = 16#00 means the F-link is healthy. Any non-zero value indicates a passivation or wiring error.

Verification Checklist

Method 2 — Flexible F-Link (TIA Portal V20 Alternative)

TIA Portal V20 introduced Flexible F-Link, a streamlined F-CPU to F-CPU communication that does not require exporting and importing a GSD file. The official Siemens documentation is at Flexible F-Link — Safety. The high-level differences vs. the I-Device method:

If both F-CPUs are running firmware that supports Flexible F-Link and both projects are migrated to TIA Portal V20 or later, Flexible F-Link is the recommended path. For mixed V15 / V20 environments — for example, when one machine cannot be upgraded — the I-Device method remains the only option.

Redundant S7-1500F Systems (S7-1500R/H)

For applications requiring both failsafe and fault-tolerant operation (e.g., process industries where a CPU failure must not trip the plant), Siemens offers the S7-1500R/H redundant system. The CPU pair 6ES7517-3HP00-0AB0 (CPU 1517H-3 PN) and 6ES7518-4JP00-0AB0 (CPU 1518HF-4 PN) are fail-safe and redundant simultaneously. The redundant pair is configured in a single TIA Portal project, so cross-project I-Device methods are not needed for CPU-to-CPU safety data within the redundant pair. Cross-cabinet F-CPU links to a separate machine still use the I-Device method described above. Background reading: SIMATIC Safety — Siemens product portal.

Troubleshooting Matrix

Commissioning Sequence (Field-Proven)

1. Power both F-CPUs with the safety-related supply modules (PM 1507 / PM 1505 / system power modules). Verify the 24 V supply is from a SELV/PELV source as required by IEC 61131-2.
2. Establish the Ethernet link between X1 of each F-CPU. Confirm the LINK LED is solid on both sides before powering up the application.
3. Download the I-Device project first. The I-Device will enter F-Login standby state (F-ACT LED off, MAINT LED flashing).
4. Download the IO controller project. The IO controller will start PROFINET AR (Application Relationship) establishment and discover the I-Device by its PROFINET device name.
5. On the IO controller, trigger an F-Login. The CPU's online & diagnostics shows a transition from "F-Host deactivated" to "F-Host activated, F-Module active".
6. Force the failsafe input on the I-Device (e.g., open an E-stop circuit). Confirm the IO controller's RD_SI returns the correct passivated value within 2 × F-Watchdog time.
7. Reset the input. Confirm the F-I/O is reintegrated automatically (or via operator acknowledgment, depending on the ACK_REI setting in the F-Communication DB).
8. Document the F-collective signature of both safety programs and store them in the safety lifecycle file. Re-signing is required after any change to the F-program.

Parameter Reference (PROFIsafe Slot Properties)

CPU Compatibility Summary

FAQ