Sharing S7-1200 Tags Over PROFINET: PN/PN Coupler & i-Device

Problem Overview

Two independent automation systems often need to exchange a handful of status and control bits without running hard-wired interposing relays between them. A typical scenario: a machine builder is integrating a SIMATIC S7-1200 CPU 1215C (with on-board RTD and analog I/O signal modules) and must share those measurement results with a customer's existing Siemens PLC. Discrete wiring between the two cabinets is expensive, increases the I/O count on both controllers, and forces both parties to stock spare relays.

The same challenge appears in reverse: the customer's PLC must hand a small set of commands back to the 1215C (start measuring, abort on maintenance, change recipe index). Instead of pulling 24 V wires, the four common Siemens methods below move the same data over PROFINET using nothing more than a switch, a dedicated bridge, or configuration in TIA Portal.

This guide covers the four field-proven options and the firmware, part-number, and configuration details that determine which one fits a given application. For a S7-1200, the choice is driven by the firmware version on the CPU, the willingness to share a common PROFINET subnet, and whether the customer wants a single point of failure (the bridge) or fully independent networks.

Prerequisites

• SIMATIC S7-1200 CPU 1215C in one of the FW 4.x variants: 6ES7215-1AG40-0XB0 (DC/DC/DC), 6ES7215-1BG40-0XB0 (AC/DC/RLY), or 6ES7215-1HG40-0XB0 (DC/DC/RLY). i-Device mode requires firmware V4.0 or higher; PUT/GET and T-block open communication require the same.
• Customer PLC: any SIMATIC S7-1200 (FW 4.0+), S7-1500, S7-300, or S7-400 acting as the PROFINET IO Controller.
• Engineering station: TIA Portal V14 SP1 or later (V16/V17/V18 recommended for current GSDML files and the latest CPU GSDML revisions).
• Network: managed or unmanaged PROFINET switch, Cat 5e or higher cabling, separate IP subnets for the two controllers unless a PN/PN coupler is used as a logical boundary.
• Subcontractor documents: PROFINET subnet mask, IP address plan, the customer's PROFINET device name range, and any rack/port assignment rules for the network.
• Optional hardware: Siemens PN/PN coupler 6ES7158-3AD10-0XA0 for method 2 (two-port bridge between otherwise isolated PROFINET subnets).

Communication Method Comparison

Method 1 - Shared PROFINET Subnet with Open Access

If the customer will allow your S7-1200 onto the same PROFINET subnet as their IO controller, the simplest path is to assign your CPU a fixed IP address, a unique PROFINET device name, and give them a documented list of the data blocks (DB) and tag names they may read or write. The customer then addresses the 1215C as a standard PROFINET device on the controller side using the partner connection's IP/TSAP.

This method is essentially "we both trust the same network." It works without any extra hardware, but it exposes the S7-1200 to the customer's full plant network. Activate the access protection on the 1215C (TIA Portal > Properties > Protection > "Connection mechanisms") and grant PUT/GET access rights to the partner PLC explicitly rather than leaving the CPU in fully open mode.

Method 2 - PN/PN Coupler (Dedicated Bridge)

The PN/PN coupler is a Siemens gateway that electrically and logically separates two PROFINET networks. Each side sees the other as a PROFINET IO Device with a fixed slot/subslot I/O image. Up to 16 input bytes and 16 output bytes are exchanged in each direction, which is sufficient for status/control signalling between machines but not for high-volume data transfer.

Topology:

Each side configures the coupler by importing the same GSD file and dragging the desired number of input/output slots from the device catalog. The two PLCs then read the data from their local input/process image just as they would for any distributed I/O station. A PN/PN coupler is a single point of failure: if the device loses power, the data exchange stops, so plan a redundant coupler only if the application is safety-relevant (and note that the standard PN/PN coupler is not PROFIenergy or PROFIsafe).

Method 3 - i-Device (PROFINET IO Device Mode)

An i-Device is a PROFINET node that functions as an IO Controller on its lower-level network and as an IO Device on a higher-level network. For a S7-1200, the 1215C becomes an IO Device for the customer's controller, exposing a slice of its process image as standard PROFINET slots. The customer's IO Controller reads/writes those slots with the same instructions used for any ET 200 station, with no PUT/GET code on either side.

Configuration steps in TIA Portal:

1. Open the 1215C project and select the CPU's PROFINET interface.
2. In Properties > General > Operating Mode, set "IO Device" mode and enable "Assigned IO Controller."
3. Add the customer's PLC as the assigned PROFINET IO Controller by name.
4. Drag the desired inputs/outputs from the S7-1200's transfer area into the IO image (TIA Portal exposes a dedicated "Transfer area" tab where you map DB tags or process-image bits to PROFINET slots).
5. Compile and download the project to the 1215C. The CPU now appears in the customer's PROFINET topology like any other distributed I/O.

i-Device keeps the two networks logically separate (your 1215C is just a station on the customer's bus) and avoids the use of program code for communication, so the integrator does not need to touch the customer's program. Up to 1024 input bytes and 1024 output bytes are supported; for most hand-shake signalling, a 4-byte input and 4-byte output area is enough.

Method 4 - PUT/GET (S7 Communication)

PUT/GET is the legacy S7-1200-to-S7 partner protocol carried over ISO-on-TCP (RFC 1006) or TCP. The 1215C runs a PUT and a GET block in its user program; each call reads or writes up to 462 bytes of a partner DB. The partner PLC must also have PUT/GET "server" access enabled, but it does not need any program code if it is the partner in only one direction (i.e., it acts as a passive server).

Example ladder-style call (in TIA Portal, drag PUT or GET from Instructions > Communication > S7 Communication):

// ST - Send 10 bytes from DB20 starting at byte 0 to partner DB100
// Trigger by a positive edge on tag "bSendTrigger"
IF bSendTrigger THEN
  "PUT_DB".REQ    := TRUE;
  "PUT_DB".ID     := 1;                    // Connection ID
  "PUT_DB".DONE   := "bSendDone";
  "PUT_DB".ERROR  := "bSendError";
  "PUT_DB".STATUS := "wSendStatus";
  "PUT_DB".ADDR_I := P#DB100.DBX0.0 BYTE 10; // Partner area
  "PUT_DB".SD_I   := P#DB20.DBX0.0  BYTE 10; // Local area
  bSendTrigger := FALSE;
END_IF;
"PUT_DB".REQ := FALSE;  // Clear request

Where the connection is configured in Properties > CPU > Communication > S7 Connection with the partner's IP, TSAP, and rack/slot. The customer's PLC must have PUT/GET access permitted in its protection settings.

TIA Portal Configuration Procedure (PN/PN Coupler Method)

The PN/PN coupler is the most common method chosen for clean isolation between an OEM machine and a customer's plant network. The following step-by-step reflects TIA Portal V17 / V18 with the 6ES7158-3AD10-0XA0 coupler.

1. Install the GSD file. Download the latest GSDML for the PN/PN coupler from the Siemens Product Support page and install it via Options > Manage General Station Description Files (GSD).
2. Add the coupler to the topology. Drag it from the device catalog into the network view. The device will appear with two PROFINET ports (X1 and X2); assign each port to the correct subnet (X1 to your machine subnet, X2 to the customer's subnet).
3. Configure the I/O slots. Open the device view of the coupler. From the catalog tree under the coupler, drop the desired number of input and output modules into the slots. Each module represents 1, 2, 4, 8, or 16 bytes. Stay within the 16-byte per-direction maximum.
4. Assign the IO Controller for X1. Mark the S7-1200 #1 as the IO Controller for the X1 port. Mark the customer's PLC as the IO Controller for the X2 port.
5. Assign PROFINET device names. Use Online > Accessible Nodes or the PRONETA tool to assign unique device names that match the topology.
6. Map the I/O to your program. In the S7-1200 #1, the slots appear in the standard process image (e.g., IW 0, QW 0). Move the bytes into a DB for clarity: L IW 0; T DB20.DBW 0.
7. Compile and download both projects.
8. Verify with the diagnostics view. Open Online > Online & Diagnostics on the coupler; both ports should show "Connected" with a green check on the PROFINET diagnostics page.

Bidirectional Access and Write Authority

Both PN/PN coupler slots and the i-Device transfer area can be marked as input or output on each side independently, so the question of "can the customer switch my digital inputs?" resolves to a single engineering choice.

• Inputs from your 1215C to the customer: Define those slots as PROFINET Inputs on the X1 side (your IO Controller produces them) and as Outputs on the X2 side (the customer's IO Controller consumes them).
• Outputs from the customer to your 1215C: Reverse the direction - mark them as Outputs on X1 (your IO Controller writes) and Inputs on X2 (the customer's IO Controller produces them).

Verification and Diagnostics

1. On the S7-1200 #1, open the Web server in a browser (default URL: http://<cpu-ip>). Navigate to Diagnostics > PROFINET Diagnostics and confirm that the IO Controller reports the partner device as "Connected" and the error counters are zero.
2. Force a known value in the S7-1200 #1's transfer DB. Use a watch table in TIA Portal to observe the value appearing in the partner's input area, and vice versa.
3. Check the diagnostic buffer of the 1215C: Online > Diagnostics > Diagnostic Buffer. Any PROFINET station loss appears with a PROFINET IO error code (e.g., 0xE0FE station failure, 0xE0FD station return).
4. For PN/PN coupler installations, the BC/BF/MAINT LEDs on the front of the coupler indicate bus status. A lit BF (bus fault) LED on either X1 or X2 points to a physical layer or naming problem on that port.
5. Capture a Wireshark trace of the PROFINET frames between the controller and the i-Device or PN/PN coupler; the cycle should be a steady heartbeat at the configured send clock (typically 1 ms).

Troubleshooting Matrix

Cross-Vendor Notes (EtherNet/IP Comparison)

If the customer's master is a Rockwell ControlLogix or CompactLogix instead of a Siemens PLC, the equivalent PROFINET construct is a tag-based EtherNet/IP connection. An AutomationDirect C-more panel acts as the EtherNet/IP client and reads/writes Logix tags directly without explicit MSG instruction code. The integration concept is the same: one controller becomes a "data server" that the partner addresses by tag name. For a Siemens-to-Rockwell link, however, a PN/PN-to-EtherNet/IP gateway (for example, a Siemens IE/PB Link with the appropriate gateway firmware, or a third-party Anybus X-gateway) is the practical choice. See AutomationDirect C-more EtherNet/IP Tag-Based Messaging for an example of how tag-based messaging is structured on the EtherNet/IP side.

FAQ