Both protocols certify safety up to SIL3, Cat 4, PL e. Both use the Black Channel principle. Both have been deployed for nearly two decades and are used extensively across industries worldwide, with very large installed bases. On paper, CIP Safety and PROFIsafe look almost interchangeable.
In practice, choosing between them is one of the most consequential decisions in a machine design. The two protocols force completely different engineering workflows, lock you into different controller ecosystems, and follow different conventions for everything from addressing to time monitoring. Once you commit, swapping is rarely worth the cost.
This article skips the marketing comparisons and looks at how the two protocols actually differ — at the wire level, in the engineering software, and in the field. Whether you searched for CIP Safety vs PROFIsafe or PROFIsafe vs CIP Safety, the comparison goes both directions. For background on either protocol individually, see our CIP Safety Explained article.
Table of Contents
The short answer most engineers are looking for
If you are building on Rockwell Allen-Bradley (GuardLogix, ControlLogix with safety, Kinetix safety drives): CIP Safety.
If you are building on Siemens (S7-1500F, S7-1200F, ET 200SP F): PROFIsafe.
If you have a free choice and the market is North America with heavy automotive, packaging, or material handling work: CIP Safety. The install base and supplier network is deeper.
If you have a free choice and the market is Europe with heavy process automation, drives, or general machinery: PROFIsafe. The Siemens ecosystem dominates and the third-party support follows.
If you are stuck with mixed equipment from both ecosystems: you will run both. They cannot bridge each other safely.
Bottom line: CIP Safety and PROFIsafe achieve the same safety integrity level but are not interoperable. Your choice is almost always dictated by your controller platform. Trying to choose the “better” safety protocol independently of the PLC ecosystem is the wrong question.
CIP Safety vs PROFIsafe at a glance
| Factor | CIP Safety | PROFIsafe |
|---|---|---|
| Standard network | EtherNet/IP | PROFINET |
| Main ecosystem | Rockwell | Siemens |
| Safety identifier | SNN + Connection ID | F-Addresses |
| Time supervision | Time Coordination | F-Watchdog |
| Engineering tool | Studio 5000 | TIA Portal |
| Typical regions | North America | Europe |
The detailed analysis below explains the why behind each row.
CIP Safety vs PROFIsafe: which should you choose?
| If your priority is… | Choose |
|---|---|
| Rockwell GuardLogix ecosystem | CIP Safety |
| Siemens S7-1500F ecosystem | PROFIsafe |
| EtherNet/IP backbone | CIP Safety |
| PROFINET backbone | PROFIsafe |
| North American automotive supply chain | CIP Safety |
| European process automation | PROFIsafe |
| Sercos III motion safety | CIP Safety |
| Integration with Siemens drives (SINAMICS) | PROFIsafe |
| Integration with Rockwell drives (Kinetix, PowerFlex) | CIP Safety |
| Multi-protocol plant with existing PROFIsafe | PROFIsafe |
| Multi-protocol plant with existing CIP Safety | CIP Safety |
The rest of this article explains why each row reads the way it does.
How they are fundamentally similar
Before the differences, the similarities. Both protocols:
- Use the Black Channel principle. The underlying network is treated as untrusted. Safety logic at each endpoint detects communication errors. The network does not need safety certification.
- Certify to IEC 61508 SIL3 and support Cat 4 / PL e under EN ISO 13849-1.
- Are part of IEC 61784-3 — the international standard for safety-related communication. CIP Safety is IEC 61784-3-2 (CPF 2). PROFIsafe is IEC 61784-3-3 (CPF 3).
- Detect the same seven communication error types (corruption, repetition, sequence, loss, delay, insertion, masquerade) using protocol-specific mechanisms.
- Allow safety and non-safety devices to share the same network. The safety layer coexists with standard cyclic and acyclic data.
- Are vendor-neutral within their ecosystem. Both have certified devices from dozens of manufacturers.
- Are mature. Both have been in deployment since the mid-2000s.
The Black Channel principle is so similar that an engineer who understands either protocol can read documentation for the other without confusion. The conceptual model is the same. The implementation details are not.
PROFIsafe vs CIP Safety architecture — the fundamental difference
This is where the protocols diverge.
PROFIsafe — F-Parameters and F-Addresses
PROFIsafe identifies every safety device by a pair of addresses: an F-Source Address (the safety PLC) and an F-Destination Address (the safety device). Each safety device must have a unique F-Destination Address in the network. The pair forms the unique identifier for a safety relationship.
Beyond the addresses, every PROFIsafe device carries an F-Parameter block that includes:
- F_Source_Address — the PLC’s address
- F_Destination_Address — the device’s address
- F_WD_Time — the watchdog timeout in milliseconds
- F_iPar_CRC — a CRC over the device’s safety parameters
- F_SIL — the safety integrity level (SIL2 or SIL3)
- F_CRC_Length — the length of the safety CRC (typically 3 or 4 bytes)
- F_Block_ID — protocol version identifier
- F_Par_Version — F-Parameter block version
These parameters are configured in the safety PLC’s engineering tool (TIA Portal F-Configuration for Siemens) and downloaded to the safety device during commissioning. The device validates that incoming safety messages carry the correct F-Source/F-Destination pair and that the F_iPar_CRC matches its current parameter set.
CIP Safety — SNN, SCID, and CFUNID
CIP Safety uses a different identification model. Each safety subnet has a Safety Network Number (SNN) — a 6-byte (12 hexadecimal digit) identifier shared by all devices on the subnet. Each safety configuration has a Safety Configuration ID (SCID) — derived from the configuration data and changing whenever the configuration changes. Each safety device knows its Configuration Owner Unique Network ID (CFUNID) — identifying which safety PLC owns it.
The pair that establishes a safety connection in CIP Safety is the Connection ID (assigned by the safety PLC) and the SNN (the network identifier). The SCID validates that the device’s stored configuration matches what the PLC expects. The CFUNID prevents two safety PLCs from claiming the same device.
CIP Safety vs PROFIsafe addressing — why it matters in practice
PROFIsafe’s F-Address model means every safety device on a network must have a unique F-Destination Address that the engineer assigns. This is straightforward but requires careful tracking — duplicate F-Addresses cause connection failures that can be subtle to debug.
CIP Safety’s SNN+Connection ID model means the safety PLC manages identifiers automatically through the engineering tool. The engineer sees device names, not safety addresses. Reset and replace operations rely on the SNN being correctly set in the new device.
Both approaches achieve the same goal — uniquely identifying every safety relationship — but the workflow feels very different.
Spec-by-spec comparison: CIP Safety vs PROFIsafe differences
| Aspect | CIP Safety | PROFIsafe |
|---|---|---|
| Certification | IEC 61508 SIL3, EN ISO 13849-1 Cat 4 PL e | IEC 61508 SIL3, EN ISO 13849-1 Cat 4 PL e |
| Standard reference | IEC 61784-3-2 (CPF 2) | IEC 61784-3-3 (CPF 3) |
| Certifying body (historically) | TÜV Rheinland | TÜV Süd |
| Network families | EtherNet/IP, DeviceNet, Sercos III | PROFINET, PROFIBUS |
| Safety addressing | SNN (6 bytes) + Connection ID + CFUNID | F-Source Address + F-Destination Address (unique pair) |
| Configuration validation | SCID (Safety Configuration ID) | F_iPar_CRC (parameter CRC) |
| Time monitoring | Time Coordination Messages (round-trip) + Time Expectation | F-Watchdog Time (F_WD_Time) timeout |
| Connection establishment | SafetyOpen Type 1 or Type 2A/2B | F-Parameter exchange during PROFINET startup |
| Safety CRC | 16-bit or 32-bit CRC + complement bytes | 3-byte or 4-byte F-CRC |
| Primary engineering tool | Studio 5000 Logix Designer (GuardLogix) | TIA Portal with Safety Advanced (S7-1500F) |
| Safety logic structure | Safety Task with safety tags | F-Program (F-OB, F-FC, F-FB) with F-data |
| Primary safety controllers | GuardLogix, CompactLogix safety | S7-1500F, S7-1200F, ET 200SP F-CPU |
| Steward organization | ODVA | PI (PROFIBUS & PROFINET International) |
| First commercial deployment | 2005 | 2002 |
| Current spec version (approx.) | CIP Safety Edition 2.21 | PROFIsafe V2.6 |
| Cross-network routing | Yes, via certified safety routers | Yes, but limited and ecosystem-bound |
| Multicast safety | Yes (singlecast and multicast) | Limited (PROFIsafe is typically point-to-point) |
A few entries deserve elaboration.
Time monitoring — the biggest practical difference
This is where the protocols differ in a way you actually feel during commissioning and troubleshooting.
PROFIsafe — watchdog timeout
PROFIsafe uses a straightforward F-Watchdog Time (F_WD_Time). Every safety device monitors the time between received safety messages. If the gap exceeds F_WD_Time, the connection fails and the device goes to safe state. Simple. Effective. Predictable.
Tuning the watchdog is a single decision: set it long enough to tolerate network jitter, short enough to meet the safety reaction time requirement. Get it wrong and you either get nuisance trips (too tight) or miss the safety reaction time (too loose).
CIP Safety — round-trip Time Coordination
CIP Safety adds a more sophisticated mechanism: Time Coordination Messages. Periodically (typically several times per second), the consumer sends a Time Coordination Message to the producer. The producer responds. The consumer measures the round-trip and compares it to its Time Expectation value. If the round trip exceeds the expectation — or if a response goes missing — the connection fails.
This catches a class of failures that a simple watchdog cannot: messages that arrive on time but are stale due to delayed processing or buffering. The trade-off is more complexity. The Time Expectation parameter has to account for round-trip variability in addition to message timing.
In practice, CIP Safety’s time monitoring is more rigorous but also has more parameters to tune. PROFIsafe’s watchdog is easier to configure. PROFIsafe relies primarily on its own safety mechanisms — watchdog supervision and F-CRC validation — for its functional safety integrity. The deterministic characteristics of PROFINET IRT can support predictable timing performance, but they are not the basis for PROFIsafe’s safety certification. The safety integrity is established at the protocol layer in both cases, independent of the underlying transport.
The engineering workflow — completely different worlds
Engineers underestimate this. The two protocols force fundamentally different engineering workflows.
CIP Safety workflow (Studio 5000 / GuardLogix)
Safety configuration. Add a GuardLogix safety controller to the project. The PLC has two CPU cores — one for the standard task, one for the safety task — both certified. Configure safety devices in the I/O tree. Each device shows safety properties (SNN, SCID, RPI, Time Expectation). Generate the SNN automatically or set it manually. Every safety subnet has one.
Programming. Create safety tags in the Safety Tag section (separate from standard tags). Write safety logic in the Safety Task — a separate task that scans independently from the main task. Use certified safety instructions (ESTOP, RESET, RIN, CROUT, etc.) in the safety task.
Validation. Studio 5000 verifies safety integrity during build. Each modification to safety code recalculates the safety signature. Changes require explicit acceptance and re-validation.
Commissioning. Download to the GuardLogix. The safety task verifies its own integrity at startup. SafetyOpen requests are issued to each safety device, validating SNN, SCID, and CFUNID before the connection runs.
Standard and safety logic coexist in the same project but in clearly partitioned areas. Standard tags can read safety tags (one-way), but standard tags cannot directly drive safety outputs.
PROFIsafe workflow (TIA Portal / S7-1500F)
Safety configuration. Add an F-CPU to the project (S7-1500F, S7-1200F, or an ET 200SP F-CPU). Configure F-modules (safety I/O) in the hardware configuration. Each F-module has F-Parameters (F-Destination Address, F-Watchdog, etc.) that the engineer assigns. Use the F-Configuration view in TIA Portal to set the F-Source Address for the PLC.
Programming. Write safety logic in the F-Program — F-OBs (organization blocks), F-FCs (functions), and F-FBs (function blocks). The F-Editor uses F-Ladder (LAD) or F-FBD with certified safety instructions. Use F-tags (variables with F-data types — F_BOOL, F_INT, etc.) inside the F-Program.
Validation. Compile the F-Program. TIA Portal verifies safety integrity and assigns the F-Collective Signature — a value that summarizes the safety configuration and program. Any change to F-data or F-logic regenerates the signature.
Commissioning. Download to the F-CPU. The PLC validates the F-Collective Signature on every cycle. F-Parameters are written to each F-module, and the F-Address pairs are validated during PROFINET startup.
Safety logic is fully separated from standard logic by the F-Program structure. Cross-references between F-data and standard data require explicit conversions.
Why the workflow difference matters
If your team already knows one workflow, switching to the other involves a significant learning curve. The concepts overlap heavily (safety tasks, safety variables, certified instructions, signature validation), but the terminology, the editor structure, and the day-to-day workflow are completely different. Cross-training engineers from CIP Safety to PROFIsafe (or the reverse) takes weeks, not days.
This workflow lock-in is the most underestimated cost in safety protocol decisions. The protocol itself is just a small piece of what the engineering team experiences.
Diagnostics and troubleshooting differences
Both protocols have rich diagnostic models, but the errors you actually see in the field have different names and different first-line fixes. Recognizing the error category is the first step to fixing it.
Common PROFIsafe diagnostic errors
| Diagnostic | What it means | First check |
|---|---|---|
| F-monitoring time expired | Watchdog (F_WD_Time) timed out — safety message arrived too late or not at all | Network jitter, RPI vs F_WD_Time setting, cable issues |
| F-Address mismatch | F-Source or F-Destination address does not match what the F-CPU expects | Duplicate F-Destination on network, wrong F-Address set during commissioning |
| F-CRC mismatch | The F-CRC in a received message failed validation | EMI, marginal cable, defective device, or F-Parameter mismatch |
| F_iPar_CRC mismatch | Device’s stored F-Parameter CRC does not match expected value | Re-download safety configuration; ensure parameter set matches |
| F-Sequence error | Out-of-sequence safety message | Network reordering, severe jitter, switch buffering |
| F-Passivation | F-module entered safe state — outputs forced off, inputs report substitute values | Read the underlying F-error to find the cause |
| F-Collective Signature mismatch | The downloaded F-program signature does not match what was certified | Re-validate and re-download the safety program |
Common CIP Safety diagnostic errors
| Diagnostic | What it means | First check |
|---|---|---|
| SNN mismatch | The Safety Network Number in a SafetyOpen does not match the device’s stored SNN | Verify SNN configuration, set SNN correctly on replacement devices |
| SCID mismatch | The Safety Configuration ID does not match — device has different configuration than PLC expects | Re-download safety configuration to align SCID values |
| Time Expectation exceeded | Round-trip Time Coordination took longer than the configured Time Expectation | Loosen Time Expectation, check network jitter, verify QoS on switches |
| Connection ownership conflict (CFUNID) | Another safety PLC already claims this device | Reset device CFUNID to release; only one safety PLC can own a device |
| Safety CRC error | A Safety CRC validation failed on a received message | EMI, cable issues, marginal hardware, defective device |
| Producer/Consumer Mismatch | Producer and consumer disagree on connection parameters | Re-establish the SafetyOpen connection with matching parameters |
| Safety Task Watchdog | The Safety Task in the GuardLogix exceeded its scheduled period | Reduce safety task load, increase task period, reduce connection count |
How to read these as patterns
Both protocols give you a similar diagnostic taxonomy underneath the different names:
- “Address” mismatches — wrong identifier (F-Address or SNN) configured. Almost always a commissioning error.
- “CRC” mismatches — physical layer problem (EMI, cable, connector) or genuine corruption. Treat as a network health issue.
- “Configuration” mismatches — F_iPar_CRC vs SCID — the device has different parameters than what the safety PLC expects. Re-download configuration.
- “Time” violations — F-monitoring time or Time Expectation exceeded. Either the network is too slow or the timeout is too tight.
- “Ownership/Signature” — claim/validation conflict. F-Collective Signature on PROFIsafe, CFUNID on CIP Safety.
Once you map the protocol-specific error name to the underlying category, the diagnostic workflow is similar between the two protocols.
When CIP Safety is the right choice
Rockwell-centric installations. GuardLogix is CIP Safety native. No other safety protocol integrates as cleanly with ControlLogix and the broader Logix ecosystem. If your standard control runs on Logix, CIP Safety is the path of least friction.
Existing EtherNet/IP plants. Adding safety to a plant already running EtherNet/IP requires no new infrastructure. The safety devices share the same wire, switches, and cables. PROFIsafe would mean adding a PROFINET network alongside.
North American automotive and packaging. These industries are dominated by Rockwell and have standardized on CIP Safety. Suppliers, integrators, and OEM specs assume it.
Plants with Sercos III motion. Sercos International partnered with ODVA to adopt CIP Safety on Sercos III. CIP Safety is the predominant and standardized safety mechanism used with Sercos III networks.
Mixed-vendor safety I/O. The CIP Safety ecosystem has many third-party device manufacturers (Sick, Banner, Pilz, Schmersal, Allen-Bradley, Balluff, Pepperl+Fuchs, Phoenix Contact, Omron, and others). Multi-vendor safety device selection is generally easier.
When PROFIsafe is the right choice
Siemens-centric installations. S7-1500F, S7-1200F, and ET 200SP F-CPUs are PROFIsafe native. TIA Portal’s F-Configuration workflow is built around it. Forcing CIP Safety onto a Siemens platform requires gateway hardware and significant integration cost.
Existing PROFINET plants. Adding safety to a plant already running PROFINET is direct. The safety devices coexist on the same network. CIP Safety would require running EtherNet/IP alongside.
Process automation. PROFIsafe is dominant in chemical, oil and gas, and water treatment industries. Process instrumentation, safety valves, and process drives commonly support PROFIsafe natively.
European machinery. Europe leans Siemens-heavy in general machinery. PROFIsafe is the default safety protocol for SINAMICS drives, ET 200 distributed I/O, and most third-party European safety device manufacturers.
Heavy use of Siemens drives. SINAMICS drives with integrated safety functions (STO, SS1, SS2, SLS) speak PROFIsafe natively. Using CIP Safety with SINAMICS drives is possible but adds friction.
TÜV Süd certification preference. PROFIsafe has historically been assessed by TÜV Süd, which some European procurement processes prefer for documentation purposes. The safety integrity is practically equivalent to TÜV Rheinland’s assessment of CIP Safety, but the choice of notified body can be a procurement consideration.
What about plants with both?
Many real plants run both. Different equipment from different vendors brings its native safety protocol with it. The reality:
- The protocols do not bridge for safety functions. You cannot have a CIP Safety E-stop signal trigger a PROFIsafe drive STO across a gateway. The safety chain must stay within one protocol.
- Standard data can cross the boundary. Non-safety data (status, diagnostics, setpoints) routinely crosses between EtherNet/IP and PROFINET via gateways. Safety data does not.
- Two safety PLCs are usually required. One GuardLogix for the CIP Safety side, one S7-1500F for the PROFIsafe side. They can exchange non-safety data but not safety signals.
- Plant-wide safety architectures need explicit boundaries. Define what is safety-critical, then choose which protocol owns each safety island. The safety boundaries become the islands’ edges.
This is workable but expensive. Two safety controllers, two engineering tool licenses, two sets of trained engineers. The cost of running both protocols in one plant is exactly why most facilities standardize on one.
Certification chain — both protocols
Both protocols have the same three-part certification chain:
- The protocol itself is certified to IEC 61508 SIL3. ODVA holds the CIP Safety protocol certification, historically through TÜV Rheinland assessment. PI holds the PROFIsafe protocol certification, historically through TÜV Süd assessment.
- Each safety device carries its own SIL3 / Cat 4 / PL e certificate from the manufacturer. The protocol organizations maintain protocol-level certifications through independent assessment bodies; individual device certifications may involve different notified bodies depending on the manufacturer and target market.
- Your application — the configuration, programming, and validation — is your responsibility. Both protocols require evidence that you correctly applied the safety functions according to the relevant application standards (EN ISO 13849-1, IEC 62061, or sector-specific standards).
The protocol gives you a certified communication layer. The device gives you certified hardware. The application validation is on you. This part is identical between CIP Safety and PROFIsafe.
For broader cybersecurity considerations (independent of functional safety), see our IEC 62443 foundational requirements article.
Practical migration notes
Switching between CIP Safety and PROFIsafe is rare and expensive. The cost typically includes:
- New safety controllers (cannot reuse the existing F-CPU or GuardLogix)
- New safety I/O modules (CIP Safety devices do not become PROFIsafe devices)
- New engineering software licenses (Studio 5000 vs TIA Portal Safety Advanced)
- Engineering team retraining (weeks per engineer)
- Re-validation of the safety application (the application certification does not transfer)
- New device library qualifications
For greenfield projects, choose carefully and commit. For brownfield expansions, stay with what is already there unless the existing system has failed or the customer mandates the change. The cost of running two safety protocols indefinitely is almost always less than the cost of migrating a working installation.
CIP Safety or PROFIsafe — decision checklist
When you have to choose between CIP Safety and PROFIsafe, walk these questions in order:
- What PLC platform is required? Rockwell → CIP Safety. Siemens → PROFIsafe. This usually settles it.
- What standard network is already in place? EtherNet/IP → CIP Safety. PROFINET → PROFIsafe.
- Which ecosystem dominates your industry/region? Automotive North America → CIP Safety. European general machinery → PROFIsafe.
- What does the customer specification say? Many large customers (especially in automotive and aerospace) mandate one or the other.
- What does your engineering team already know? Retraining cost is the largest hidden expense. Bias toward existing expertise unless there is a strong reason to switch.
- What safety devices does the project need? Check that the specific devices (drives, light curtains, robot interfaces) are available in your preferred protocol.
If five out of six answers point to one protocol, that is your answer. If they are split, weight by which factor is most expensive to change — usually #1 or #5.
Frequently asked questions
Is CIP Safety the same as PROFIsafe?
No. Both achieve SIL3 functional safety, but they are different protocols with different addressing, time monitoring, message structures, and engineering workflows. CIP Safety runs on EtherNet/IP, DeviceNet, and Sercos III. PROFIsafe runs on PROFINET and PROFIBUS. They are not interoperable.
Can a CIP Safety device communicate with a PROFIsafe device?
Not for safety functions. The safety chain must stay within one protocol. Standard (non-safety) data can cross between the two networks via a gateway, but safety signals cannot. A plant running both protocols typically needs two safety controllers — one for each network.
Which is more secure — CIP Safety or PROFIsafe?
Functional safety and cybersecurity are different concerns. For functional safety, both are equally rated (SIL3, Cat 4, PL e). For cybersecurity, neither protocol has strong built-in security in its standard form. CIP Security and PROFINET Security are separate optional layers that add authentication and encryption. Apply network segmentation according to IEC 62443 regardless of which safety protocol you choose.
Why is PROFIsafe more common in Europe?
PROFIsafe is the safety extension of PROFINET and PROFIBUS, both of which originated in Germany and dominate the European automation market. The Siemens ecosystem — which uses PROFIsafe natively — is significantly larger in Europe than in North America. CIP Safety has higher penetration in North America for the same reason in reverse: Rockwell Automation’s dominance in the US automotive supply chain.
Which protocol is faster?
Both protocols support communication update times in the sub-millisecond range when used with appropriate network configurations. Actual safety reaction times depend on controller execution, device processing, and the overall safety function design — the communication cycle is only one contributor. CIP Safety’s Time Coordination Messages add some round-trip overhead that PROFIsafe’s simple watchdog does not. PROFINET IRT (the deterministic mode used for high-speed PROFIsafe) and EtherNet/IP with QoS can both meet typical industrial safety reaction times. The protocol speed difference is rarely the deciding factor in machine design.
Do I need different hardware for CIP Safety vs PROFIsafe?
Yes. A GuardLogix safety controller runs CIP Safety but cannot run PROFIsafe. An S7-1500F runs PROFIsafe but cannot run CIP Safety. Safety I/O modules are also protocol-specific — a CIP Safety I/O block is not a PROFIsafe I/O block, even if both come from the same manufacturer.
Can I use both protocols on the same network?
Not on the same physical wire as full peers. CIP Safety expects EtherNet/IP. PROFIsafe expects PROFINET. These are different application protocols on top of standard Ethernet — they do not share the same network configuration. In a plant, you typically have separate physical or logical networks for each protocol, even though both use Ethernet at the physical layer.
What is the F-Source Address in PROFIsafe?
The F-Source Address is the unique identifier of the safety PLC (F-Host) in a PROFIsafe network. Combined with the F-Destination Address of each safety device, it forms the unique pair that identifies every safety relationship. Equivalent to part of CIP Safety’s SNN + Connection ID model.
What is the SNN in CIP Safety?
The Safety Network Number (SNN) is a 6-byte (12 hexadecimal digit) identifier that uniquely identifies a safety network or subnet in CIP Safety. Every safety device knows its SNN, and safety connections validate the SNN at establishment. Equivalent in purpose to PROFIsafe’s F-Address structure but implemented as a single identifier per subnet rather than per device.
Which protocol has more third-party device support?
Both have extensive third-party support — Sick, Banner, Pilz, Schmersal, Phoenix Contact, Omron, Pepperl+Fuchs, Balluff, Festo, and many others certify devices for both protocols. The third-party ecosystem is robust on both sides. Specific device categories may favor one (Siemens drives lean PROFIsafe, Rockwell drives lean CIP Safety), but for general safety I/O the choice is wide on either side.