August 11, 2026 · Comparison

PROFINET vs S7 Communication: What's the Difference

When someone says "we use PROFINET to talk to the PLC," they usually mean one of two very different things. They might mean the PLC exchanges cyclic I/O with PROFINET field devices over a deterministic fieldbus, or they might mean a SCADA system reads data blocks from that PLC over standard Ethernet. Both statements get called "PROFINET" in conversation, but they describe different layers of the same network stack.

This guide untangles the two. PROFINET IO and S7 communication are not competing protocols — they coexist on every Siemens PROFINET controller, serve different purposes, and run on different timelines. Once the split is clear, decisions about ports, timing, configuration, and macOS tooling fall into place. For background on the read/write protocol itself, see the S7 communication protocol guide; for picking a controller line, see S7-1200 vs S7-1500.

They Are Not Competing Protocols

The Siemens Ethernet world has three distinct things that all get called "PROFINET" in casual speech:

• The physical Ethernet network carrying the traffic.
• PROFINET IO (PN-IO), a real-time fieldbus running on that Ethernet for cyclic I/O exchange with field devices.
• S7 communication, an application-layer protocol running on TCP/IP over that same Ethernet, used for reading/writing data and engineering access.

The first is just cabling. The second and third are different protocols at different OSI layers. PN-IO lives at layers 2–4 with its own real-time scheduling; S7 communication lives at layer 7 over ISO-on-TCP (RFC 1006) on port 102. They share a cable and coexist on the same controller, but they have essentially nothing else in common.

PROFINET IO: The Real-Time Fieldbus

PROFINET IO is the fieldbus. It connects an IO Controller (the PLC's PROFINET interface) to IO Devices — ET 200SP distributed I/O, SINAMICS drives, PROFINET-compatible sensors, code readers, weighing terminals. The controller polls each device cyclically and exchanges input and output data on a fixed schedule.

Two performance classes matter in practice:

• RT (Real-Time): cyclic traffic scheduled by software, deterministic in the low single-digit milliseconds. Covers most factory automation — remote I/O, drives, standard sensors.
• IRT (Isochronous Real-Time): hardware-scheduled cyclic traffic with bus cycle times down to 31.25 µs and jitter under 1 µs, used for servo drives, multi-axis motion coordination, and applications that need clock-synchronized control loops.

PROFINET defines conformance classes that stack: CC-A is basic RT without media redundancy, CC-B adds MRP media redundancy, CC-C adds IRT with time synchronization. Devices are configured in TIA Portal using GSDML files — XML device description files provided by the manufacturer that tell TIA Portal how to assemble each device's cyclic telegram.

Beyond cyclic data, PROFINET IO supports acyclic record-data access (read/write records) used for parameterization at startup and diagnostics during operation. But the workhorse is the cyclic exchange — that is what makes it a fieldbus.

S7 Communication: The Acyclic Application Protocol

S7 communication (sometimes written S7-protocol or S7comm) is something else entirely. It is an application-layer protocol that runs over ISO-on-TCP (RFC 1006), which in turn runs over TCP/IP on port 102. It is the protocol your SCADA uses to read data block DB1 from the PLC, your HMI uses to update marker flags, and TIA Portal itself uses for online programming and diagnostics.

Every S7 connection targets a specific CPU on a specific rack and slot. On a single-controller project that is rack 0, slot 1 — the CPU's slot in the PROFINET IO view. On projects with proxy controllers or submodules, routing rules in TIA Portal forward the S7 connection through the right PROFINET device to reach the target CPU. See rack and slot routing for the details that bite integrators.

Because S7 communication is acyclic, it is best-effort. Each request — read 32 bytes from DB1 at offset 0 — gets queued, processed between PLC scans, and answered. Round-trip latency on a healthy LAN is a few milliseconds, but there is no determinism guarantee. S7 is the right tool for "give me the current value of these process variables" and the wrong tool for "toggle this output every 125 µs."

The protocol was reverse-engineered years ago. Open-source implementations (snap7, libnodave) and commercial ones (MacTools S7 Explorer's Rust core) all speak S7 over the same RFC 1006 transport. Most third-party Siemens integration done today is S7 communication, not PROFINET IO. To enable it on a modern S7-1200/1500 you must explicitly permit external access — see enabling PUT/GET on S7-1200/1500.

Why People Confuse Them

Siemens ships one Ethernet connector on the CPU and labels it "PROFINET." Everything — PN-IO cyclic traffic, S7 read/write traffic, OPC UA server traffic on S7-1500, HMI traffic, the PLC's web server — flows through that same RJ-45. So in conversation, "PROFINET" becomes shorthand for "the Siemens Ethernet world," and the question are you using PROFINET or S7? sounds meaningful when the real answer is almost always "both, plus maybe OPC UA."

The confusion costs real time when picking tools. A common mistake: assuming that because the PLC "has PROFINET," a PROFINET scanner tool on a laptop can read process values from it. It cannot. PROFINET IO is controller-driven; only the IO Controller polls IO Devices. A laptop on the same wire is not in the PN-IO cycle. To read values from the PLC, you use S7 communication or OPC UA — protocols designed for client-initiated reads.

Comparison: PROFINET IO vs S7 Communication

On an S7-1500 there is also a third option running over the same cable: OPC UA, exposed by the CPU's built-in server on port 4840 with certificates and structured information models. S7 and OPC UA overlap heavily in what they expose; S7 is lighter and lower-friction, OPC UA is more standardized across vendors. See S7 vs OPC UA for Siemens PLCs for that head-to-head.

When You Use Each

• PROFINET IO — connecting field devices to the PLC. ET 200SP remote I/O, SINAMICS drives, PROFINET sensors, code readers. The PLC is the controller; the devices answer on the cycle.
• S7 communication — reading and writing PLC data from outside. SCADA polling data blocks, HMI updating marker flags, MacTools S7 Explorer browsing DBs from macOS, TIA Portal online access. See reading an S7 data block.
• OPC UA — modern, vendor-neutral, certificate-based access to the same data, typically from SCADA, IIoT gateways, or cloud connectors. S7-1500 has a full built-in server; S7-1200 has a more limited one.

Performance: Deterministic vs Best-Effort

PROFINET IRT delivers bus cycle times down to 31.25 µs with sub-microsecond jitter, which is what lets a SINAMICS drive close a current control loop over the bus. Even standard PROFINET RT lands in the low-millisecond range deterministically. S7 communication, by contrast, is TCP best-effort: a read request is queued, the PLC services it between scans, and you get an answer in a few milliseconds when nothing else is in the way.

For process monitoring, dashboards, and engineering access, S7's latency is more than adequate. For motion and tight control loops, you need PN-IO's scheduling — full stop. The two protocols are not interchangeable on the timing axis; they exist precisely because one Ethernet cable has to carry both deterministic and best-effort traffic.

Accessing Both From macOS

Here is the practical asymmetry. PROFINET IO is controller-driven, so there is nothing to "browse" from a Mac. The IO Controller (the PLC) owns the cycle; field devices answer to it on the schedule defined in TIA Portal. To see PROFINET IO data from macOS, you read the PLC's I/O image and data blocks via S7 communication — the PLC has already assembled that data from its PROFINET IO devices on every scan. MacTools S7 Explorer does exactly this: it speaks S7 over TCP port 102 to read the data blocks, marker flags, and I/O images that the PLC has already assembled from its PROFINET IO devices.

OPC UA is the other option on S7-1500: enable the built-in server and read the same data with any OPC UA client. For most macOS users the S7 path is simpler — no certificates to manage, no OPC UA server to configure, just IP + rack + slot. For connecting from a Mac in detail, see connecting to S7-1200/1500 from macOS.

Frequently Asked Questions

Are PROFINET and S7 communication the same thing?

No. PROFINET IO is a real-time fieldbus that exchanges cyclic I/O between an IO Controller (the PLC) and field devices such as ET 200SP, drives, and PROFINET sensors. S7 communication is an application-layer protocol over ISO-on-TCP (RFC1006) on port 102, used for reading and writing PLC data blocks, marker flags, and I/O images, and for engineering access. Both run on the same Ethernet cable but sit at different OSI layers and serve different purposes.

Do I need PROFINET to use the S7 protocol?

No. S7 communication only needs TCP/IP connectivity to the PLC on port 102. PROFINET IO is separate and only required if the PLC must act as an IO Controller for PROFINET field devices. For SCADA/HMI reads, data block access, and engineering work, the S7 protocol over standard Ethernet is sufficient, and on an S7-1500 OPC UA is an alternative.

Can I browse PROFINET IO devices from macOS?

Not directly. PROFINET IO is controller-driven: only the IO Controller (typically the PLC) polls IO Devices cyclically, and a laptop on the same wire is not part of that cycle. From macOS you read the PLC's view of its PROFINET IO data via the S7 protocol. MacTools S7 Explorer speaks S7 on port 102 to read the data blocks, markers, and I/O images the PLC has already assembled from its PROFINET IO devices each scan.

How do PROFINET IO, S7 communication, and OPC UA fit together on an S7-1500?

They coexist and run concurrently. PROFINET IO handles deterministic cyclic I/O to field devices using RT or IRT scheduling on the Ethernet layer. S7 communication handles acyclic reads, writes, and engineering access over ISO-on-TCP (RFC1006) on port 102. OPC UA exposes the same data through a vendor-neutral server on port 4840 with certificates and structured information models. For reading data from macOS, S7 and OPC UA are the two practical options; PROFINET IO itself is not client-accessible.

Further Reading

• S7 Communication Protocol Guide
• S7 Protocol vs OPC UA for Siemens PLCs
• Connect to Siemens S7-1200/1500 from macOS
• Industrial Protocol Comparison