Troubleshooting S7-1200 SF LED Flashing Red: PROFINET HW_ID 270

An S7-1200 CPU in a PROFINET IO network shows a flashing red SF LED with a diagnostic event "IO Station Failure" reporting HW_ID = 270 and event code 02:39CB. The CPU remains in RUN with a solid green RUN LED, the application is still exchanging data with the PC-based Simatic OPC server, and the commissioning tool (Scout/Startdrive) can still read and write symbols on the PLC. This article breaks down what each signal means, how to map HW_ID 270 to a real PROFINET device, and how to clear the fault without disturbing the running process.

S7-1200 LED Indicator Reference

The S7-1200 front panel integrates three status LEDs that together describe the controller's operating state. Each LED has a specific meaning, and the SF (System Fault) LED distinguishes between a fatal fault and a non-fatal diagnostic event by its blink pattern. Per the S7-1200 Programmable Controller System Manual (entry ID 109741593), the following states apply:

Understanding PROFINET IO Architecture in the Reported Topology

The reported installation uses three PROFINET roles in parallel, and the fact that one of them is healthy is a strong clue that the fault is isolated:

1. IO Controller — the S7-1200 CPU (typical article number 6ES7215-1AG40-0XB0 for a CPU 1215C DC/DC/DC, firmware V4.4 or later). The S7-1200 owns the PROFINET IO stack and runs the cyclic real-time exchange.
2. IO Supervisor — the engineering PC running Simatic OPC Server. The OPC Server uses S7 communication (ISO-on-TCP, port 102) over a standard commercial NIC. A standard NIC cannot act as a PROFINET IO controller; it can only supervise or program.
3. IO Devices — Sinamics drives, ET 200 stations, or third-party PROFINET devices that exchange cyclic I/O data with the S7-1200. These are the devices that the PROFINET IO controller interrogates on each update cycle.

Scout (SIMOTION Scout or Startdrive) also uses standard TCP/IP on the same PC NIC. The fact that Scout can read and write PLC symbols only proves that the S7 communication channel (acyclic, class A services) is healthy. It does not prove that PROFINET IO cyclic data exchange is healthy for every device. A device can respond to acyclic read/write requests while its cyclic PROFINET IO application relationship (AR) is down.

Architecture summary in the user's installation:

• S7-1200 ↔ PC (Simatic OPC) — S7 protocol over TCP, port 102, no PROFINET IO involved.
• S7-1200 ↔ Drives / ET 200 — PROFINET IO cyclic real-time (RT) or isochronous real-time (IRT) traffic.
• PC ↔ Drives — Scout/Startdrive direct acyclic, bypasses the S7-1200 IO stack entirely.

This is the architectural reason the user sees a flashing SF LED and a green RUN LED simultaneously: the diagnostic is "PROFINET IO station failure," not "CPU stopped" and not "communication channel down." The OPC server sits on a different layer and remains functional.

HW_ID 270 and Error Code 02:39CB Decoded

Two identifiers appear in the diagnostic buffer entry the user observed. They are not interchangeable; they answer different questions.

HW_ID (Hardware Identifier)

The HW_ID is a 16-bit unsigned integer assigned by TIA Portal at compile time. It is a stable, project-wide reference to a hardware object (CPU, submodule, IO device, port, or slot). To map HW_ID = 270 to a real device:

1. In TIA Portal, open the project and select the S7-1200 station.
2. Open Project tree → PLC → Device view.
3. Navigate to PLC tags → Show all tags → System constants (or right-click the IO device head module and select Properties → System constants).
4. Search the system-constants table for the value 270. The matching symbolic name (e.g., <Drive name>_Head, ET200SP_Station3, PNdevice_Interface) identifies the device that produced the diagnostic event.

HW_IDs in a typical S7-1200 project are organized as follows:

HW_ID 270 falls inside the PROFINET IO device/submodule range. It is the head module or a specific slot of one IO device on the S7-1200's PROFINET segment. Confirming the exact device name is step one of the entire troubleshooting flow — the rest of the procedure is meaningless until the engineer knows which physical device is the culprit.

Event Code 02:39CB

The format 02:39CB is Siemens' hex-prefixed event identifier used inside the diagnostic buffer. The first byte (0x02) classifies the event family:

02:39CB is the PROFINET IO Station Failure event. The IO controller has lost the cyclic PROFINET IO connection to the device referenced by HW_ID 270. The device is either:

• Power cycled or unpowered.
• Disconnected from the Ethernet segment (broken cable, removed connector, dead switch port).
• Reset to factory defaults and therefore missing its PROFINET device name.
• Reporting an internal fault that prevents AR establishment (drive in fault state, ET200 submodule pulled).

Reading the TIA Portal Diagnostic Buffer

The diagnostic buffer is the only authoritative source for the precise cause of an SF LED event. To read it correctly:

1. Connect the engineering PC to the S7-1200's PROFINET port (X1) directly or through the same managed switch.
2. Open TIA Portal, expand the project, and select the S7-1200 station.
3. Click Go online (the lightning-bolt icon) and choose Online & diagnostics.
4. From the navigator, open Diagnostics → Diagnostic buffer.
5. Scroll to the most recent red entry. Each entry shows:
   • Timestamp (CPU clock; verify that the time is correct, otherwise the chronological order is unreliable).
   • Event ID in the form xx:yyyy.
   • Event description (English/German depending on UI language).
   • HW_ID of the affected object.
   • Additional info: incoming vs. outgoing event, channel diagnostic bytes.
6. Click the 02:39CB entry. In the Details pane, TIA Portal lists the affected IO device and the channel-diagnostic bytes (the raw PROFINET channel error code from the device).
7. Note the next-incoming and next-outgoing events. The "outgoing" entry is the moment the fault cleared; this is invaluable for correlating with plant events (e.g., cabinet door opened, breaker tripped).

Common Root Causes of IO Station Failure

Across thousands of PROFINET installations, the failure modes for a single IO device fall into a small set. Ranked by frequency in field service:

Step-by-Step Troubleshooting Procedure

Follow this order to minimize the risk of disturbing the running process. The PLC remains in RUN throughout; the goal is to identify and clear the IO device, not the CPU.

Step 1 — Map HW_ID 270 to a Real Device

Open the system-constants table as described above. Record the device name. Typical S7-1200 projects use human-readable names such as Drive_S120_1, ET200MP_Station3, or PN_IO_4. Confirm the device's physical location in the cabinet before continuing. If the device is a Sinamics S120 with Scout, the device's PROFINET name in TIA Portal must match the name assigned to the drive's CU (Control Unit).

Step 2 — Inspect the Device Physically

1. Open the cabinet and locate the device. Most Sinamics drives have a multi-segment display; ET200SP/ET200MP have a status LED bar.
2. Read the display or LEDs. A Sinamics in fault shows an F code (e.g., F30002 for overcurrent, F07801 for motor overcurrent); ET200 stations show the channel number of the missing module.
3. Verify 24 V at the device's power terminals with a multimeter. Many PROFINET devices are powered separately from the S7-1200's 24 V; the PLC supply being healthy does not mean the device supply is healthy.

Step 3 — Verify the PROFINET Cable Path

1. Check the LINK LED on the device's PROFINET port. Solid green = link up; off = no link.
2. Check the LINK LED on the S7-1200's X1 (or X2 if used) port for the relevant port number.
3. If the device is connected through a managed switch, verify the port is "up" and not error-disabled. Use the switch's web interface or CLI to confirm.
4. Re-seat the PROFINET connectors. RJ45 plugs in industrial cabinets vibrate loose; a 0.5 mm gap is enough to lose frames under vibration.
5. If a spare patch cable is available, swap it. A cable with one intact pair can pass a LINK LED test but fail PROFINET IO because the second pair is used for cyclic traffic.

Step 4 — Verify the PROFINET Device Name

1. Install PRONETA (Siemens free tool, available from the SiePortal under "Tools & Downloads") on the engineering PC.
2. Run Network analysis from PRONETA's home screen. The tool sends a DCP identify-all to every reachable device.
3. Locate the device that should have HW_ID 270 in the result list. Read its actual device name and IP address.
4. Compare with the TIA Portal configuration:
   • Device name must match exactly (case-sensitive, including punctuation).
   • IP address must be on the same subnet and not duplicate any other device.
5. If the name is missing or wrong, use PRONETA → Assign PROFINET name to push the correct name. The IO device restarts its PROFINET stack automatically.

Step 5 — Cross-Check the GSD and Module Configuration

1. In TIA Portal, double-click the IO device in the device view and inspect every slot. The slot configuration must match the actual hardware (number of submodules, order, and article numbers).
2. If the device firmware has been updated since the TIA Portal project was last saved, the GSD may be out of date. Right-click the device head module → Change device / GSD, then re-import the latest GSD from the manufacturer.
3. Recompile the project (Project tree → right-click PLC → Compile → Hardware and software (rebuild all)) and download the hardware configuration to the S7-1200.

Step 6 — Address Update-Time / Watchdog Issues

1. In TIA Portal, open the IO device's properties → PROFINET interface → IO cycle.
2. The default update time for an S7-1200 IO controller is 1 ms. If the IO device cannot keep up (older drives, ET200S, third-party devices), increase the value to 2 ms or 4 ms.
3. For drives used in motion control, evaluate IRT mode and the "Performance" view; the application may need to switch from RT_CLASS_1 to RT_CLASS_3 with the topology editor's port interconnections.

Step 7 — Acknowledge the Diagnostic and Clear the SF LED

1. Once the IO device is reachable and the cyclic exchange is restored, the PLC removes the diagnostic event. TIA Portal shows the corresponding outgoing entry in the diagnostic buffer.
2. The SF LED stops flashing as soon as the outgoing event is logged. If the LED is still flashing, a second IO device is in fault or the same event has not cleared (the device is reachable but still reporting a channel-level diagnostic).
3. If the LED persists, use Online & diagnostics → Functions → Acknowledge diagnostics on the IO device to clear the latched channel error. The device's own acknowledge mechanism (e.g., drive's "Acknowledge fault" via p3981) may be required before PROFINET clears the channel diagnostic.

Verifying PROFINET IO Communication After Repair

Confirm restoration using all three views.

1. Online & diagnostics view: TIA Portal shows the IO device with a green status; the diagnostic buffer no longer contains a pending 02:39CB entry.
2. Watch table: Open the device's IO tags in a watch table. The input values update at the configured update time; the output values you write are echoed back from the device within one cycle.
3. PRONETA: Run Topology editor → Check. PRONETA compares the discovered topology (port-to-port cabling) with the configured topology in TIA Portal. Mismatches indicate a swapped cable or a missing device.
4. Simatic OPC Server: Open the OPC Scout or OPC client. Confirm that the symbol that the user originally read with Scout now shows live data with no quality code "BAD".

Preventing Future PROFINET IO Station Failures

Three engineering practices reduce the recurrence rate to near zero:

1. Use a managed switch with PROFINET awareness. Siemens Scalance XC-200 / XB-200 / XC-300 series supports PROFINET conformance class B, prioritizes PROFINET frames via DSCP, and reports port errors to STEP 7 / TIA Portal over SNMP. Error-disable and storm-control features are documented in the Scalance XC-200 Operating Instructions (entry ID 109751635).
2. Reserve a static IP per device. Configure the DHCP server (or the TIA Portal topology) to assign the same IP and device name on every restart. Use PRONETA's "Save and restore" feature to back up device names after commissioning; a 30-second export prevents a 4-hour troubleshooting session after a field replacement.
3. Program diagnostic OB83 / OB86. The S7-1200 CPU supports OB83 (insert/remove of a module) and OB86 (failure of a rack or IO device). Adding an OB86 to the program prevents the CPU from going to STOP if an IO device disappears; instead, the application can flag the affected axes or I/O in a status word and the HMI can display the precise HW_ID that is missing. Reference the S7-1200 System Manual for OB86 parameter mapping (OB86_INPUTS includes Event_Code, IO_State, LADDR — the LADDR is the HW_ID of the failed device).

OPC Server and PROFINET IO — Independent Failure Domains

When Scout/Startdrive is functional and the OPC server is functional, the user can confirm that the S7-1200's S7 communication layer is healthy. The PROFINET IO failure is a separate layer. The standard NIC in the PC is the supervisor and is not in the IO data path. This is the key reason the user sees a flashing SF LED and a green RUN LED simultaneously: the diagnostic is "PROFINET IO station failure," not "CPU stopped" and not "communication channel down."

When troubleshooting PROFINET IO faults in this topology, isolate the failure to one of the following layers:

1. Layer 1 — physical: cable, connector, port, switch.
2. Layer 2 — DCP: device name and IP address (Discovery and Configuration Protocol).
3. Layer 3 — PROFINET IO AR (application relationship): cyclic real-time channel between controller and device.
4. Layer 4 — Application: the device's own diagnostic (e.g., drive fault, sensor overrange).

PRONETA covers layers 1, 2, and 3. The diagnostic buffer covers layers 3 and 4. Scout/Startdrive covers only the acyclic TCP path, which sits outside PROFINET IO. Each tool answers a different question; cross-correlate at least two of them before replacing hardware.

FAQ