Scaling Siemens S7-1200 I/O Using PROFINET I-Device and ET200

1. Overview: S7-1200 I/O Architecture and Expansion Philosophy

The SIMATIC S7-1200 controller family scales from compact machine-level CPUs (CPU 1211C) to mid-range CPUs with extensive onboard I/O (CPU 1215C, CPU 1217C). Every CPU in the family supports both local signal module (SM) expansion on the right-side bus and distributed I/O over PROFINET. When a project's I/O count exceeds either the maximum SM count allowed by the CPU or the 1 kbyte process image ceiling, engineers must move expansion into the PROFINET distributed I/O domain using I-Device links and ET200 stations.

This reference covers the limits inherent to the S7-1200, the architecture choices for exceeding them, and the exact configuration steps inside TIA Portal. It treats the S7-1200 CPU as the IO-Controller on a PROFINET subnet and connects it to one or more ET200 stations or downstream S7-1200 I-Devices that publish their process data through configured PROFINET slots.

2. S7-1200 CPU Onboard I/O Inventory

Each S7-1200 CPU has a fixed set of onboard digital and analog channels. These channels consume addresses from the same 1 kbyte process image used by every signal module and PROFINET device connected to the CPU. The actual onboard channels per model are:

3. Local Signal Module Limits per CPU

Each S7-1200 CPU has a per-station SM cap that defines how many signal modules (SM) plus communication modules (CM/CP) plus battery boards can be physically attached to the right-side bus of the CPU. The relevant cap for I/O planning is the SM ceiling, since CMs and CP modules do not contribute to the process image.

The eight-SM ceiling on the CPU 1214C, 1215C, and 1217C is not a marketing choice; it is enforced by the maximum backplane current budget of the CPU and by the physical slots in the bus termination model. Adding a ninth SM at the cabinet end is impossible without a PROFINET reroute. Engineers who hit the eight-SM ceiling must move additional I/O to ET200 stations before they can scale the system further.

4. Process Image and Address Ceilings

Every S7-1200 CPU maintains a process image that is split into inputs (PII) and outputs (PIQ). The vendor default is 1 kbyte for each direction, and this value can be reconfigured inside TIA Portal under PLC properties → General → Process image:

• 1 kbyte input process image = 1024 bytes = 8192 digital bit addresses or 512 16-bit word addresses.
• 1 kbyte output process image = 1024 bytes = 8192 digital bit addresses or 512 16-bit word addresses.

The 1 kbyte process image is the hard ceiling. Engineers routinely interpret this limit incorrectly. The bytes are allocated in 1 kbyte groups, but inside that 1 kbyte you may place any combination of digital and analog channels, including mixed word and byte ranges. The S7-1200 system manual shows that the address area is "completely in the process image," so an engineer who needs 1024-bit digital outputs plus 512-bit digital inputs plus 32 AI plus 16 AO must budget the bytes against the 1 kbyte cap, not the bit count alone.

A typical CPU 1215C project with eight SMs and one PROFINET device will run out of process image around 800 bytes of input and 600 bytes of output. That is the trigger for migrating expansion nodes into PROFINET.

5. PROFINET I-Device Architecture

An S7-1200 CPU can act as an I-Device on PROFINET. An I-Device behaves like a "smart" PROFINET IO-Device whose process data is defined by the engineer rather than the vendor. The I-Device CPU runs its own user program against its locally attached I/O and exposes a configured set of transfer areas to a higher-level IO-Controller. The receiving CPU treats the I-Device exactly like any other ET200 station.

The key engineering benefit is that each I-Device can also execute semi-autonomous control logic, perform local diagnostics, and reduce the determinism load on the upper IO-Controller. Failure of one I-Device does not crash the entire system; only the affected transfer area turns bad and the rest of the system keeps cycling.

6. ET200 Distributed I/O Integration

The S7-1200 treats an ET200 station as a plain PROFINET IO-Device. The PROFINET interface module is the only device the S7-1200 knows about; the SMs plugged behind the interface module are wired into the device's slot table.

For most S7-1200 expansion projects, the ET200SP IM155-6 PN ST is the dominant choice because it is small, fast, and cheap; the ET200MP is the choice when a project also needs S7-1500 SMs (such as the high-speed 32-channel digital input SM 521).

7. Multi-Master Roll-Up Architecture

An S7-1200 may also be the IO-Controller for downstream I-Devices, while those I-Devices themselves have I-Devices on their own PROFINET ports. The cascading approach is sometimes called a "data roll-up" architecture and it allows engineers to build very large I/O counts across multiple cabinets without ever exceeding the 1024-byte process image on the master.

The architectural rules are:

1. Only one IO-Controller per PROFINET subnet.
2. An S7-1200 has exactly one PROFINET port in base CPUs, and a second port on CPU 1215C and CPU 1217C; each port can host a separate subnet with its own I-Device list.
3. The maximum number of I-Devices per PROFINET port is 16 for the standard CPU, 32 for CPU 1215C, and 128 for CPU 1217C.
4. The sum of I/O bytes across I-Devices must be smaller than the 1024-byte process image of the master CPU.

In a typical mid-scale machine with three ET200SP stations carrying 64 bytes per station, the master budget becomes 192 bytes of input and 192 bytes of output on its PROFINET port, well under the 1 kbyte ceiling. That leaves ample room for the local SMs to coexist on the same process image.

8. TIA Portal Configuration Procedure

1. Add the master CPU. Open the project, drop a CPU 1215C from the hardware catalog into the project view, and assign the PROFINET interface an IP address. Configure the device name – this becomes the PROFINET station name on the wire.
2. Enable I-Device role on the downstream CPU. Open the second S7-1200, navigate to Properties → PROFINET interface → Operating mode, and tick I-Device. Add a transfer area, name it (e.g., TO_MASTER_AREA1), and define the length in bytes.
3. Compile the I-Device. Compile the slave project (or the same project, in multi-project mode). TIA Portal writes the I-Device records into the GSDML and exposes the transfer areas as slots on the device.
4. Insert the I-Device as a slave on the master. Open the master device configuration, drag the I-Device from the catalog, drop it on the PROFINET subnet, and assign the IP and device name to match what was provisioned on the I-Device.
5. Insert ET200 stations. For pure remote I/O, import an IM155-6PN GSD from the catalog (TIA Portal V16 ships with the IM155-6PN GSDML), drop it on the same subnet, and slot in the SM, AQ, DQ, AI modules you need.
6. Allocate addresses. TIA Portal assigns slot-derived addresses automatically. Watch the Address overview tab: the total bytes per direction must remain under 1024.
7. Compile and download. Compile the master project, then download to the master CPU and to each slave CPU. Cycle power on the slave CPUs if needed so the new device name takes effect.

9. Hardware Catalog Reference Numbers

10. Verification and Commissioning Steps

1. Online → Accessible nodes should list every I-Device and every ET200 station with the device name you provisioned.
2. Download the master project and confirm the IO-Controller reaches RUN. The SF LED on the CPU should be off within 5 seconds after RUN.
3. Use Online & diagnostics → PROFINET diagnostic to read port statistics. Watch for late frames on the slave port; total frame error count > 50 ppm indicates a cabling or shield problem.
4. Force each input point on the local SM and on the slave SM in turn; verify they appear in the master's input address table and in the process image view of TIA Portal.
5. Set each output point and measure voltage at the field terminal to confirm the slot-to-channel mapping. A swapped SM address appears as a wrong channel lighting up.
6. Trigger a CPU restart on the slave. The master's slot table should mark the slave's transfer area as bad, then re-establish good after 200-500 ms depending on the update time configured in the device properties.

11. Troubleshooting Matrix

12. Frequently Asked Questions