PROFIsafe

What is PROFIsafe?

PROFIsafe is an open safety profile from PROFIBUS & PROFINET International (PI) that carries safety signals up to SIL 3 over the same ProfiNET or Profibus network as ordinary process data. A Safety PLC can thus exchange emergency stop, door and light curtain signals with fail-safe I/O, drives and sensors without separate safety wiring. PROFIsafe has been an international standard as IEC 61784-3-3 since 2007, is approved by TÜV and the German IFA, and is used across industrial automation and process automation.

Within OT convergence, PROFIsafe is a special case: safety traffic shares the network with SCADA, DCS, HMI systems and engineering stations, yet must never come to depend on them.

🧠 How does PROFIsafe work?

PROFIsafe follows the black channel principle. The underlying network, with its switches, copper, fibre, wireless links or backplane, is treated as unreliable and plays no part in the safety assessment. All error detection sits in a thin safety layer in the two endpoints: the F-Host (the safety controller) and the F-Device (for example a fail-safe input module or a drive).

The two cyclically exchange a PROFIsafe message that travels as ordinary payload inside a PROFINET or PROFIBUS telegram. Each message contains:

• Safety data - up to 12 bytes with a 3-byte CRC, or up to 123 bytes with a 4-byte CRC
• Status or control byte - used among other things to signal fail-safe values and restarts
• CRC signature - calculated over the data, the parameters and a virtual consecutive number

Because PROFIsafe does not rely on the network’s own error detection, it makes no difference to safety integrity whether the packet travels over copper, fibre or WLAN. Determinism, however, comes from the network itself: PROFINET RT or IRT provides predictable cycles, while PROFIsafe only monitors whether that timing is met.

The black channel is not entirely free of rules. PI permits any type of switch, but fewer than 100 in a row and only one F-Host per submodule. Codenames (F-addresses) must be unique within a so-called PROFIsafe island, and islands sharing the same address space must be separated by routers. Transitions from PROFINET to PROFIBUS DP and on to the intrinsically safe PROFIBUS PA variant MBP-IS are permitted.

🔐 Which safety mechanisms does PROFIsafe use?

IEC 61784-3 lists the faults a safety communication protocol must catch: corruption, repetition, incorrect sequence, loss, unacceptable delay, insertion, masquerade and addressing errors. PROFIsafe covers them with four measures:

If a check fails, the F-Device switches to fail-safe values: outputs are de-energised and inputs pass their safe value (usually 0) to the safety logic. Siemens calls this passivation. A connection only recovers after a deliberate acknowledgement, so a machine does not restart unexpectedly.

The F-parameters themselves, such as the F-address, watchdog time and SIL, are also protected by a CRC. A device description in a GSD file that contains F-parameters additionally carries its own safety CRC.

📊 Which safety levels does PROFIsafe achieve?

PROFIsafe is suitable for applications up to SIL 3 according to IEC 61508 and IEC 62061, and therefore up to PL e according to ISO 13849. For SIL 3, a complete safety function may have fewer than 1 dangerous failure per 10^7 hours. IEC 61784-3 typically reserves 1% of that for communication, so PROFIsafe’s residual error rate must stay below 10^-9 per hour: roughly one undetected error every 114,000 years.

Note that this level applies to the communication only. Whether the overall function reaches SIL 3 depends on the sensor, the safety controller, the actuator and the architecture. You determine that through a risk assessment, HAZOP or LOPA and a SIL determination, following IEC 61511 in the process industry.

🕰️ How did PROFIsafe come about?

PI released the first specification for safety communication in 1999, initially for PROFIBUS DP. Version 2 (2005) made the profile suitable for PROFINET, among other things with a larger address range for Ethernet networks. Since 2007 PROFIsafe has been an international standard as IEC 61784-3-3.

For you as a user this means that a new F-Device can no longer be certified on V2.4 alone. V2.4 remains relevant mainly when you replace devices in existing installations, where the F-Host determines which versions can run together. The second watchdog time is intended for use cases such as changing parameters during operation (Parameterization in Run), and per-channel passivation means a fault no longer has to force the whole module to fail-safe values.

Growth has been substantial. In 2018 PI counted around 11 million PROFIsafe nodes. In 2024, 3.1 million PROFIsafe devices were shipped and the installed base is estimated at about 28.7 million nodes.

🏭 Where is PROFIsafe used?

• Machine building and robotics - emergency stops, door interlocks, light curtains and safety laser scanners in a robot cell, handled by a single Safety PLC
• Drives and motion control - variable frequency drives and servo drives receive safety commands over the network
• Intralogistics - conveyors and AGVs, where wireless PROFIsafe links keep moving equipment safe
• Process industry - fire and gas detection, safe valve closure and burner management as part of a SIS. Most applications use remote I/O with F-modules for 4-20 mA or HART signals; NAMUR NE 97 additionally describes how safety field instruments work over PROFIBUS PA (MBP-IS) in ATEX zones
• Energy - turbine protection and interlocks, often with redundancy for high availability

In drives, PROFIsafe activates the functions defined in IEC 61800-5-2:

🔄 How does PROFIsafe differ from hardwired safety and CIP Safety?

The choice usually follows the control platform. In a Siemens environment with TIA Portal, PROFIsafe is the obvious option; Beckhoff supports PROFIsafe through interface terminals alongside its own FSoE for EtherCAT.

🔧 How do you set up a PROFIsafe installation properly?

1. Start with the risk assessment - define the required SIL or PL for each safety function before you choose hardware.
2. Choose certified components - the F-Host and F-Devices need a PI certificate and a TÜV or comparable assessment; check which PROFIsafe version they support.
3. Assign unique F-addresses - every F-Device gets an F_Dest_Add that is unique across the network, set via DIP switches on the device or assigned in the engineering software. Duplicate addresses lead to passivation or, worse, swapped signals.
4. Size the watchdog - F_WD_Time must comfortably exceed the actual response time of bus cycle, controller cycle and device combined, yet stay small enough for the required safety distance according to ISO 13855. Too tight causes nuisance trips, too generous gives an overly long stopping time.
5. Design the network for stability - congestion, broadcast storms, incorrect QoS or overloaded switches cause watchdog faults. Low latency and little jitter are an availability matter; ring redundancy with MRP prevents downtime after a cable break.
6. Validate and document - test every safety function during FAT and SAT, record the checksum of the safety program and control changes through change management.

When faults occur, the most common causes are a watchdog timeout due to network delay, CRC errors from EMC or wrong parameters, and address conflicts after a device replacement. Wireshark recognises PROFIsafe messages inside PROFINET traffic, which helps with analysis.

⏱️ How do you calculate the response time of a PROFIsafe safety function?

For time-critical functions, such as a press behind a light curtain, the response time determines how far the protective device must be from the hazard. PROFIsafe uses the Safety Function Response Time (SFRT) for this. The chain consists of an input F-Device, a PROFIsafe transmission, processing in the F-Host, a second transmission and an output F-Device. Adding up the maximum delay of each part gives the Total Worst Case Delay Time (TWCDT).

For safety that is not enough: if one part fails at exactly that moment, only its watchdog will notice. You therefore add the largest difference between watchdog time and worst-case delay of a single part. Only one fault at a time is assumed, so only the largest delta counts. Every F-Device must state its worst-case delay so that engineering tools such as TIA Portal can calculate the SFRT.

Worked example (illustrative): input 10 ms, transmission 8 ms, F-Host 30 ms, transmission 8 ms and output 10 ms give a TWCDT of 66 ms. With a watchdog of 100 ms and a worst-case transmission of 8 ms, the delta is 92 ms and the SFRT becomes 158 ms. With a machine stopping time of 150 ms, the total time T is 0.308 s. Under ISO 13855, a light curtain with 30 mm resolution then needs a safety distance of 1600 mm/s x 0.308 s + 128 mm = about 621 mm. Every extra 100 ms of watchdog time therefore costs roughly 16 cm of extra distance.

⚠️ Does PROFIsafe protect against cyberattacks?

No. PROFIsafe protects against random faults, not against an attacker who knows the protocol. The CRC is not a cryptographic signature and there is no authentication or encryption. An attacker with network access can therefore attempt spoofing, a man-in-the-middle attack or a denial of service. The last is the most realistic: an overloaded network lets the watchdog expire and puts the installation in a safe state, but also brings it to a standstill. Malware on an engineering station can moreover alter the safety program itself.

PROFIsafe therefore belongs in a defence-in-depth approach in line with IEC 62443:

• Network segmentation - place safety systems in their own zone within the zones and conduits model, possibly in a dedicated VLAN of the OT network
• Industrial firewalls - allow only the necessary traffic between zones
• NAC and 802.1X - prevent unknown devices from joining the safety network
• IDS and logging - detect anomalous traffic and unauthorised downloads
• Patch management and hardened engineering stations with password protection on the safety program

PI itself requires PROFIsafe networks to sit inside protected security zones. Traffic between zones across an open backbone passes through security gates using a VPN and firewall. For wireless PROFIsafe links, PI prescribes IEEE 802.11 security in infrastructure mode; ad hoc mode is not permitted.

🏗️ How is PROFIsafe evolving?

Within Industry 4.0, PROFINET is gaining a new transport layer in TSN, alongside other Industrial Ethernet traffic and OPC UA. Because PROFIsafe is a black channel protocol, it moves unchanged to new transport layers. Diagnostic data from safety devices finds its way to edge platforms and Industrial AI for predictive maintenance. The safety function itself stays in certified F-logic; Safety is moving into software, but not into uncertified software. Applications such as CNC machines also benefit from fine-grained drive safety.

❓ Frequently asked questions

Does PROFIsafe need a separate network?

No, PROFIsafe uses the same PROFINET or PROFIBUS network as the standard process data. The network does not need safety certification, because PROFIsafe performs all error detection in the endpoints. A separate segment is still sensible for availability and security.

What happens when a PROFIsafe connection is lost?

If no valid PROFIsafe message arrives within the watchdog time F_WD_Time, the F-Device switches to fail-safe values. Outputs are de-energised and the safety controller sees safe input values, so the machine stops. Restarting requires a deliberate acknowledgement.

Can PROFIsafe work wirelessly?

Yes, PROFIsafe is approved for wireless links such as WLAN and Bluetooth, because the protocol copes with bit error probabilities of up to 10^-2 in the black channel. In practice you set the watchdog time more generously to absorb roaming and interference, and PI requires WLAN in infrastructure mode with IEEE 802.11 security. This is used for AGVs, gantry robots, teach pendants and rotating machine parts.

Which SIL does PROFIsafe achieve?

PROFIsafe is suitable for applications up to SIL 3 according to IEC 61508 and PL e according to ISO 13849. The communication itself uses only about 1% of the SIL 3 failure budget, with a residual error rate below 10^-9 per hour. The level of the overall safety function depends on every component in the chain.

Is PROFIsafe only for Siemens equipment?

No, PROFIsafe is an open profile from PROFIBUS & PROFINET International and is supported by Siemens, Phoenix Contact, ABB, Pilz, WAGO and Beckhoff, among others. Siemens is, however, the best-known supplier. Devices must be certified by PI, which safeguards interoperability between brands.

What is the difference between PROFIsafe and CIP Safety?

PROFIsafe runs on PROFINET and PROFIBUS and monitors communication with consecutive numbers and a watchdog. CIP Safety runs on EtherNet/IP, DeviceNet and Sercos III and uses time stamps. Both are black channel protocols up to SIL 3; the choice usually follows the control platform.

📌 In summary

PROFIsafe carries safety signals up to SIL 3 and PL e over the ordinary PROFINET or PROFIBUS network by placing all error detection (consecutive number, watchdog, codename and CRC) in the endpoints. It saves wiring and improves diagnostics, but it does not protect against cyberattacks: segmentation and security in line with IEC 62443 remain necessary to keep the safety function available and reliable.