SIMATIC S7-1500H, CPU 1518HF-4 PN, central processing unit with 9 MB work memory for program and 60 MB for data, 1st interface: PROFINET RT with 2-port switch, 2nd interface: PROFINET, 3rd interface: PROFINET, 4th/5th interface: H-SYNC, SIMATIC Memory Card required
Product Type: Industrial Automation Component
General
| Article number |
6ES7518-4JP00-0AB0 |
General information
| Product type designation |
CPU 1518HF-4PN |
| HW functional status |
FS04 |
| Firmware version |
V3.1 |
| ● FW update possible |
Yes |
Product function
| ● I&M data |
Yes; I&M0 to I&M3 |
| ● Isochronous mode |
No |
| ● SysLog |
Yes |
Engineering with
| ● STEP 7 TIA Portal configurable/integrated from version |
V19 (FW V3.1) / V17 (FW V2.9) or higher |
Display
| Screen diagonal [cm] |
6.1 cm |
Control elements
| Number of keys |
6 |
| Mode selector switch |
1 |
Supply voltage
| Rated value (DC) |
24 V |
| permissible range, lower limit (DC) |
19.2 V |
| permissible range, upper limit (DC) |
28.8 V |
| Reverse polarity protection |
Yes |
Mains buffering
| ● Mains/voltage failure stored energy time |
5 ms |
| ● Repeat rate, min. |
1/s |
Input current
| Current consumption (rated value) |
1.55 A |
| Current consumption, max. |
1.95 A |
| Inrush current, max. |
1.95 A; Rated value |
| I²t |
0.4 A²·s |
Power
| Infeed power to the backplane bus |
12 W |
| Power consumption from the backplane bus (balanced) |
30 W |
Power loss
Storage
| Number of slots for SIMATIC memory card |
1 |
| SIMATIC memory card required |
Yes |
Work memory
| ● integrated (for program) |
9 Mbyte |
| ● integrated (for data) |
60 Mbyte |
Load memory
| ● Plug-in (SIMATIC Memory Card), max. |
32 Gbyte |
Backup
CPU processing times
| for bit operations, typ. |
4 ns |
| for word operations, typ. |
6 ns |
| for fixed point arithmetic, typ. |
6 ns |
| for floating point arithmetic, typ. |
24 ns |
CPU-blocks
| Number of elements (total) |
20 000; Blocks (OB, FB, FC, DB) and UDTs |
| ● Number range |
1 ... 60 999; subdivided into: number range that can be industrial by the user: 1 ... 59 999, and number range of DBs created via SFC 86: 60 000 ... 60 999 |
| ● Size, max. |
16 Mbyte; For DBs with absolute addressing, the max. size is 64 KB |
| ● Number range |
0 ... 65 535 |
| ● Size, max. |
1 Mbyte |
| ● Number range |
0 ... 65 535 |
| ● Size, max. |
1 Mbyte |
| ● Size, max. |
1 Mbyte |
| ● Number of free cycle OBs |
100 |
| ● Number of time alarm OBs |
20 |
| ● Number of delay alarm OBs |
20 |
| ● Number of cyclic interrupt OBs |
20; with minimum OB 3x cycle of 1 ms |
| ● Number of process alarm OBs |
50 |
| ● Number of DPV1 alarm OBs |
3 |
| ● Number of startup OBs |
100 |
| ● Number of asynchronous error OBs |
4 |
| ● Number of synchronous error OBs |
2 |
| ● Number of diagnostic alarm OBs |
1 |
Nesting depth
| ● per priority class |
24; Up to 8 possible for F-blocks |
S7 counter
Retentivity
| — adjustable |
Yes |
| — adjustable |
Yes |
| — adjustable |
Yes |
| — can be set |
Yes |
IEC counter
| ● Number |
Any (only limited by the main memory) |
S7 timer
IEC timer
| ● Number |
Any (only limited by the main memory) |
Data areas and their retentivity
| Retentive data area (incl. timers, counters, flags), max. |
768 kbyte; In total; available retentive memory for bit memories, timers, counters, DBs, and technology data (axes): 700 KB |
Flag
| ● Size, max. |
16 kbyte |
| ● Number of clock memories |
8; 8 clock memory bit, grouped into one clock memory byte |
Data blocks
| ● Retentivity adjustable |
Yes |
| ● Retentivity preset |
No |
Local data
| ● per priority class, max. |
64 kbyte; max. 16 KB per block |
Address area
| Number of IO modules |
8 192; max. number of modules / submodules |
I/O address area
| ● Inputs |
32 kbyte; All inputs are in the process image |
| ● Outputs |
32 kbyte; All outputs are in the process image |
per integrated IO subsystem
| — Inputs (volume) |
16 kbyte |
| — Outputs (volume) |
16 kbyte |
Subprocess images
| ● Number of subprocess images, max. |
31 |
Hardware configuration
| Number of distributed IO systems |
64; A distributed I/O system is characterized not only by the integration of distributed I/O via PROFINET, but also by the connection of I/O via IE/PB-Links. |
Number of IO Controllers
Rack
| ● Modules per rack, max. |
9; CPU + 2 PS + 6 CP |
Clock
| ● Type |
Hardware clock |
| ● Backup time |
6 wk; At 40 °C ambient temperature, typically |
| ● Deviation per day, max. |
10 s; Typ.: 2 s |
Operating hours counter
Clock synchronization
| ● supported |
Yes |
| ● on Ethernet via NTP |
Yes |
Interfaces
| Number of PROFINET interfaces |
3 |
Interface types
| ● RJ 45 (Ethernet) |
Yes; X1 |
| ● Number of ports |
2 |
| ● integrated switch |
Yes |
| ● RJ 45 (Ethernet) |
Yes; X2 |
| ● Number of ports |
1 |
| ● integrated switch |
No |
| ● RJ 45 (Ethernet) |
Yes; X3 |
| ● Number of ports |
1 |
| ● integrated switch |
No |
Protocols
| ● IP protocol |
Yes; IPv4 |
| ● PROFINET IO Controller |
Yes |
| ● PROFINET IO Device |
No |
| ● SIMATIC communication |
Yes; Only Server |
| ● Open IE communication |
Yes; Optionally also encrypted |
| ● Web server |
Yes |
| ● Media redundancy |
Yes |
| ● IP protocol |
Yes; IPv4 |
| ● PROFINET IO Controller |
No |
| ● PROFINET IO Device |
No |
| ● SIMATIC communication |
Yes; Only Server |
| ● Open IE communication |
Yes; Optionally also encrypted |
| ● Web server |
Yes |
| ● Media redundancy |
No |
| ● IP protocol |
Yes; IPv4 |
| ● PROFINET IO Controller |
No |
| ● PROFINET IO Device |
No |
| ● SIMATIC communication |
Yes; Only Server |
| ● Open IE communication |
Yes; Optionally also encrypted |
| ● Web server |
Yes |
| PROFIsafe |
Yes; V2.4 / V2.6 |
Services
| — Isochronous mode |
No |
| — IRT |
No |
| — Dynamic Frame Packing (DFP) |
Yes |
| — PROFIenergy |
Yes; per user program |
| — Prioritized startup |
No |
| — Number of connectable IO Devices, max. |
256 |
| — Updating times |
The minimum value of the update time also depends on communication share set for PROFINET IO, on the number of IO devices, and on the quantity of configured user data |
| — PROFINET Security Class |
1 |
Update time for RT
| — for send cycle of 1 ms |
1 ms to 512 ms |
4. Interface
| Interface type |
Pluggable synchronization submodule (FO) |
| Plug-in interface modules |
Synchronization module 6ES7960-1CB00-0AA5, 6ES7960-1FB00-0AA5 or 6ES7960-1FE00-0AA5 |
5. Interface
| Interface type |
Pluggable synchronization submodule (FO) |
| Plug-in interface modules |
Synchronization module 6ES7960-1CB00-0AA5, 6ES7960-1FB00-0AA5 or 6ES7960-1FE00-0AA5 |
RJ 45 (Ethernet)
| ● 100 Mbps |
Yes |
| ● 1000 Mbps |
Yes; Only possible at the X3 interface of the CPU 1518 |
| ● Autonegotiation |
Yes |
| ● Autocrossing |
Yes |
| ● Industrial Ethernet status LED |
Yes |
Number of connections
| ● Number of connections, max. |
384; via integrated interfaces of the CPU and connected CPs |
| ● Number of connections reserved for ES/HMI/web |
10 |
| ● Number of connections via integrated interfaces |
320 |
| ● Number of S7 routing paths |
64 |
Redundancy mode
| ● PROFINET system redundancy (S2) |
Yes |
| ● PROFINET system redundancy (R1) |
Yes |
Media redundancy
| — Media redundancy |
only via 1st interface (X1) |
| — MRP |
Yes; MRP Automanager according to IEC 62439-2 Edition 2.0 |
| — MRP interconnection, supported |
Yes; as MRP ring node according to IEC 62439-2 Edition 3.0 |
| — MRPD |
No |
| — Switchover time on line break, typ. |
200 ms; PROFINET MRP |
| — Number of stations in the ring, max. |
50 |
SIMATIC communication
| ● PG/OP communication |
Yes; encryption with TLS V1.3 pre-selected |
| ● S7 routing |
Yes |
| ● S7 communication, as server |
Yes |
| ● S7 communication, as client |
No |
Open IE communication
| ● TCP/IP |
Yes |
| — Data length, max. |
64 kbyte |
| — several passive connections per port, supported |
Yes |
| ● ISO-on-TCP (RFC1006) |
Yes |
| — Data length, max. |
64 kbyte |
| ● UDP |
Yes |
| — Data length, max. |
2 kbyte; 1 472 bytes for UDP broadcast |
| — UDP multicast |
Yes; 128 multicast circuits (of which max. 5 via X1) |
| ● DHCP |
No |
| ● DNS |
Yes |
| ● SNMP |
Yes |
| ● DCP |
Yes |
| ● LLDP |
Yes |
| ● Encryption |
Yes; Optional |
Web server
| ● HTTP |
No |
| ● HTTPS |
Yes; only via Web API |
| ● web API |
Yes |
| — Number of sessions, max. |
200 |
| — number of simultaneous HTTP calls, max. |
4 |
| — HTTP request body, max. |
131 072 byte |
OPC UA
| ● Runtime license required |
Yes; "Large" license required per CPU |
| ● OPC UA Client |
No |
| ● OPC UA Server |
Yes; Data access (read, write, subscribe), method call, custom address space |
| — Application industrialation |
Yes |
| — Security policies |
available security policies: None, Basic128Rsa15, Basic256Rsa15, Basic256Sha256, Aes128Sha256RsaOaep, Aes256Sha256RsaPss |
| — User industrialation |
"anonymous" or by user name & password |
| — GDS support (certificate management) |
No |
| — Number of sessions, max. |
32 |
| — Number of subscriptions per session, max. |
25 |
| — Sampling interval, min. |
25 ms |
| — Publishing interval, min. |
25 ms |
| — Number of server methods, max. |
100 |
| — Number of inputs/outputs per server method, max. |
20 |
| — Number of monitored items, recommended max. |
12 000; for 1 s sampling interval and 1 s send interval |
| — Number of server interfaces, max. |
10 of each "Server interfaces" / "Companion specification" type and 20 of the type "Reference namespace" |
| — Number of nodes for user-defined server interfaces, max. |
50 000 |
| ● Alarms and Conditions |
No |
Further protocols
S7 message functions
| Number of login stations for message functions, max. |
64 |
| number of subscriptions, max. |
750 |
| number of tags/attributes for subscriptions, max. |
50 000 |
| Program alarms |
Yes |
| Number of configurable program messages, max. |
10 000; Program messages are generated by the "Program_Alarm" block, ProDiag or GRAPH |
| Number of loadable program messages in RUN, max. |
10 000 |
Number of simultaneously active program alarms
| ● Number of program alarms |
4 000 |
| ● Number of alarms for system diagnostics |
1 000 |
Test commissioning functions
| Joint commission (Team Engineering) |
No |
| Status block |
Yes; Up to 16 simultaneously |
| Single step |
No |
| Number of breakpoints |
20; Breakpoints are only supported in RUN-Solo status |
Status/control
| ● Status/control variable |
Yes; without fail-safe |
| ● Variables |
inputs/outputs, bit memories, DBs, peripheral I/Os (without fail-safe), times, counters |
● Number of variables, max.
| — of which status variables, max. |
200; per job |
| — of which control variables, max. |
200; per job |
Forcing
| ● Forcing |
Yes; without fail-safe |
| ● Forcing, variables |
peripheral inputs/outputs (without fail-safe) |
| ● Number of variables, max. |
200 |
Diagnostic buffer
| ● present |
Yes |
| ● Number of entries, max. |
3 200 |
| — of which powerfail-proof |
1 000 |
Traces
| ● Number of configurable Traces |
8 |
| ● Memory size per trace, max. |
512 kbyte |
Diagnostics indication LED
| ● RUN/STOP LED |
Yes |
| ● ERROR LED |
Yes |
| ● MAINT LED |
Yes |
| ● Connection display LINK TX/RX |
Yes |
Supported technology objects
Controller
| ● PID_Compact |
Yes; Universal PID controller with integrated optimization |
| ● PID_3Step |
Yes; PID controller with integrated optimization for valves |
| ● PID-Temp |
Yes; PID controller with integrated optimization for temperature |
| Counting and measuring |
Yes |
Ecological footprint
| ● environmental product declaration |
Yes |
Global warming potential
| — global warming potential, (total) [CO2 eq] |
570 kg |
| — global warming potential, (during production) [CO2 eq] |
96.9 kg |
| — global warming potential, (during operation) [CO2 eq] |
483 kg |
| — global warming potential, (after end of life cycle) [CO2 eq] |
-9.97 kg |
Highest safety class achievable in safety mode
| ● Performance level according to ISO 13849-1 |
PLe |
| ● SIL acc. to IEC 61508 |
SIL 3 |
Probability of failure (for service life of 20 years and repair time of 100 hours)
| — Low demand mode: PFDavg in accordance with SIL3 |
< 2.00E-05 |
| — High demand/continuous mode: PFH in accordance with SIL3 |
< 1.00E-09 |
Security
| PROFINET Security Class |
1 |
Ambient temperature during operation
| ● horizontal installation, min. |
0 °C |
| ● horizontal installation, max. |
60 °C; Display: 50 °C, at an operating temperature of typically 50 °C, the display is switched off |
| ● vertical installation, min. |
0 °C |
| ● vertical installation, max. |
40 °C; Display: 40 °C, at an operating temperature of typically 40 °C, the display is switched off |
Ambient temperature during storage/transportation
| ● min. |
-40 °C |
| ● max. |
70 °C |
Altitude during operation relating to sea level
| ● Installation altitude above sea level, max. |
5 000 m; Restrictions for installation altitudes > 2 000 m, see manual |
Programming language
| — LAD |
Yes; incl. failsafe |
| — FBD |
Yes; incl. failsafe |
| — STL |
Yes |
| — SCL |
Yes |
| — CFC |
Yes; either CFC or failsafe functionality |
| — GRAPH |
Yes |
Know-how protection
| ● User program protection/password protection |
Yes |
| ● Copy protection |
No |
| ● Block protection |
Yes |
Access protection
| ● protection of confidential configuration data |
Yes |
| ● Password for display |
Yes |
| ● Protection level: Write protection |
Yes |
| ● Protection level: Read/write protection |
Yes |
| ● Protection level: Write protection for Failsafe |
Yes |
| ● Protection level: Complete protection |
Yes |
| ● User administration |
Yes |
Cycle time monitoring
| ● lower limit |
adjustable minimum cycle time |
| ● upper limit |
adjustable maximum cycle time |
Dimensions
| Width |
210 mm |
| Height |
147 mm |
| Depth |
129 mm |
Weights
Classifications
| Version |
Classification |
| eClass |
16 |
| eClass |
14 |
| eClass |
12 |
| eClass |
9.1 |
| eClass |
9 |
| eClass |
8 |
| eClass |
7.1 |
| eClass |
6 |
| ETIM |
10 |
| ETIM |
9 |
| ETIM |
8 |
| ETIM |
7 |
| IDEA |
4 |
| UNSPSC |
15 |
General Product Approval
| EU declaration of conformity |
Yes |
| UK Declaration of Conformity |
Yes |
| Miscellaneous |
Yes |
| Manufacturer Declaration |
Yes |
| UL |
Yes |
| Miscellaneous |
Yes |
| RCM |
Yes |
| EAC |
Yes |
| TUEV |
Yes |
| China RoHS |
Yes |
| Manufacturer Declaration |
Yes |
For use in hazardous locations
| FM |
Yes |
| ATEX |
Yes |
| Type Examination Certificate |
Yes |
| IECEx |
Yes |
| Miscellaneous |
Yes |
| CCC-Ex |
Yes |
Functional Saftey
| TUEV |
Yes |
| Type Examination Certificate |
Yes |
| Type Examination Certificate |
Yes |
Test Certificates
| Type Test Certificates/Test Report |
Yes |
Maritime application
| ABS (American Bureau of Shipping) |
Yes |
| BV (Bureau Veritas) |
Yes |
| DNV (Det Norske Veritas) |
Yes |
| LR (Lloyds Register) |
Yes |
| NK / Nippon Kaiji Kyokai |
Yes |
| RINA (Registro Italiano Navale) |
Yes |
| CCS (China Classification Society) |
Yes |
| KR (Korean Register of Shipping) |
Yes |
other
Environment
| EPD Typ II/III (with life cylce assessment) |
Yes |
| last modified: |
5/21/2026 |
Applications
This Industrial Automation Component is designed for industrial automation applications, offering reliable performance and compatibility with Siemens automation systems. Suitable for manufacturing, process control, and building automation environments.
