PROFINET I&M Data Records: Reading via SIMOTION and TIA Portal

Overview

PROFINET Identification & Maintenance (I&M) records are standardized data sets stored inside every PROFINET IO device and its submodules. They allow a controller, an engineering tool, or an asset management system to identify a device without scanning a barcode on the cabinet, to record the installed location, and to track maintenance intervals. The mechanism was originally specified in IEC 61784-2 for PROFIBUS DP-V1 and was carried forward into PROFINET as part of the Application Layer Services.

PROFINET defines six record indexes: I&M0 (mandatory, read-only identification), I&M1 (tag/function designation, writable), I&M2 (installation date, writable), I&M3 (descriptor, writable), I&M4 (signature, safety-related), and I&M5 (extended maintenance). A seventh, I&M0 of the subslot, is implicitly available on every submodule. The records are accessed through acyclic record read/write services over the PROFINET Application Layer (RPC/PROFINET IO AR).

I&M Record Architecture

Each I&M record is a structured binary block. The Application Layer treats every record as a single index number. The I&M0 through I&M5 indexes are fixed in the specification; the manufacturer may reserve additional private indexes above 0x8000 for vendor-specific data.

I&M0 Data Structure

I&M0 is mandatory on every PROFINET IO device. The first 10 octets form a fixed header that mirrors the PROFINET IO Object dictionary; the next 16 octets hold vendor and order data; the remaining 26 octets hold revision and tag data. The full layout, per the HMS Networks PROFINET CompactCom 40 reference implementation, is:

Total length is 86 octets. Per the HMS Networks documentation, the two read/write portions (function tag and location tag) are sometimes shown as belonging to I&M1 in the wire format they are appended to I&M0 so an acyclic reader can get the most-used identification values in one transaction.

I&M1 Through I&M5 Layouts

Record Index and Address Field

An acyclic read of an I&M record is a PROFINET record read with three addressing parameters:

• AR / API - the Application Process Identifier, 0 (default) for the IO subsystem, or non-zero for module-internal APIs.
• Slot - the slot number of the head module or submodule. Slot 0 is the device itself; slots 1..n are physical or virtual submodules.
• Subslot - if the record is on a submodule rather than a module, the subslot index is required. Subslot 0 means "module level".

The record index is set to the I&M number: 0xAFF0 for I&M0, 0xAFF1 for I&M1, etc. Some manufacturers also expose submodule-level I&M0 at 0xAFF0; the controller must target the correct slot/subslot or the device will return the "Invalid Slot/Subslot" error (PNIO error code 0xCA).

Reading I&M Data in SIMOTION with _readRecord

SIMOTION exposes a low-level system function _readRecord in the Motion Control / IO library. The function is declared in the SIMOTION SCOUT / TIA toolbox under "System Function Blocks / PROFINET". The signature is:

// Pseudo signature for SIMOTION D4x5 with TIA V15+
FUNCTION_BLOCK _readRecord
VAR_INPUT
  LogicalAddress   : DINT;   // PROFINET logical IO address (start address of the slot)
  RecordIndex      : WORD;   // 0xAFF0..0xAFF5
  Length           : INT;    // Number of octets to read
  pData            : POINTER TO BYTE;  // Target buffer
END_VAR
VAR_OUTPUT
  Done             : BOOL;
  Busy             : BOOL;
  Error            : BOOL;
  StatusID         : DWORD;  // PROFINET error code (PNIO_ERR_*)
  RecordDataLength : INT;
END_VAR

A working ST snippet (TIA V15, SIMOTION D455 V5.2) that returns I&M0 of the head module of an ET 200SP station at logical address 0:

VAR
  fbRead    : _readRecord;
  im0buf    : ARRAY[0..85] OF BYTE;
  busyOld   : BOOL;
END_VAR

fbRead(LogicalAddress := 0,
       RecordIndex    := 16#AFF0,
       Length         := 86,
       pData          := ADR(im0buf));

IF fbRead.Done AND NOT busyOld THEN
  // Vendor ID is at offset 0, big-endian
  vendorId := (WORD(im0buf[0]) * 256) + WORD(im0buf[1]);
  // Order ID is at offset 2, 20 ASCII chars
  orderId  := STRING(im0buf[2..21]);
  // Serial at offset 22, 4 ASCII chars
  serialNo := STRING(im0buf[22..25]);
END_IF;
busyOld := fbRead.Busy;

To read I&M1..I&M5, change RecordIndex to 0xAFF1, 0xAFF2, 0xAFF3, 0xAFF4, or 0xAFF5 respectively, and adjust Length to match the record size (34, 16, 54, 54, or vendor-specific).

Reading I&M Data from ET 200SP Submodules

Each ET 200SP submodule (DI, DO, AI, AO, F-module, motor starter, etc.) carries its own I&M0 through I&M5. To target a specific submodule, the PROFINET logical address must point to the submodule. The base address of a submodule is the start of its IO image as configured in TIA Portal / SIMOTION SCOUT. The LogicalAddress input of _readRecord must equal that base address, otherwise the AR returns "Invalid Slot/Subslot" (0xCA) or "Invalid Index" (0xB9).

Sequence for a typical ET 200SP station with head module 6ES7155-6AU01-0BN0, 8 DI module at slot 1, 8 DO module at slot 2:

1. From the TIA Portal device view, read the start address of slot 2's first byte (e.g. I 0.0 has logical address 0).
2. Call _readRecord(LogicalAddress := 0, RecordIndex := 16#AFF0, Length := 86, pData := ADR(buf)) for the head module.
3. Call _readRecord(LogicalAddress := 0, RecordIndex := 16#AFF0, Length := 86, pData := ADR(buf)) again with the start address of slot 1 for the DI module's I&M0.
4. Repeat with the slot 2 start address for the DO module.
5. Change RecordIndex to 0xAFF3 to read each module's descriptor (plant tag) populated during commissioning.

Per the Siemens library for reading I&M data from ET 200SP, an FB block PN_IM_Data is provided that wraps RDREC / WRREC and adds convenience fields for the I&M strings. Use it as a reference if you need a quick integration path.

Reading I&M Data from TIA Portal PLC Programs

For S7-1200 and S7-1500 controllers the standard approach is the RDREC and WRREC system blocks. The block diagram is identical to SIMOTION's _readRecord:

// SCL example for S7-1500
#fbRdREC(REQ     := TRUE,
         ID      := LW#16#0,         // Hardware identifier of the device
         INDEX   := 16#AFF0,         // I&M0
         MLEN    := 86,              // max length
         VALID   => #rdValid,
         BUSY    => #rdBusy,
         ERROR   => #rdError,
         STATUS  => #rdStatus,
         LEN     => #rdLen,
         DATA    := #im0Buffer);

The hardware identifier HW_ID is obtained from the device's properties in the TIA Portal project tree. The block also accepts slot/sub-slot qualifiers; for submodules, select the subslot identifier rather than the head module identifier.

Proneta and Standalone Tools

Siemens SINEC Proneta (formerly PROFINET Network Analyser) is a free-of-charge engineering tool that walks a network, enumerates all IO devices, reads every I&M record, and exports the result to a CSV or XLSX inventory. Versions of note:

• Proneta 3.7 - Adds I&M5 browser for ET 200SP motor starters and energy meters.
• Proneta 3.8 - Adds OPC UA Asset Management export to OPC UA Companion Specifications.
• Proneta 3.10+ - Adds parallel network scanning and supports the 1 Gbit PROFINET stack on SCALANCE XC/XR.

For PROFINET conformance testing the official test bundles from PROFIBUS International include a "PROFINET I&M Tester" that validates I&M0 mandatory fields and verifies the I&M0/1/2/3 access modes. Membership in PI is required to download the bundle.

Devices Known to Support I&M5

I&M5 is optional and not all devices support it. Among products documented in vendor manuals:

To verify I&M5 support on a candidate device, perform a RDREC with INDEX = 16#AFF5 and a deliberately small MLEN (e.g. 4). A return with STATUS = 0x0000_0000 and a valid LEN confirms the record is implemented; a return with status 0xC3_xxxx "Invalid Index" or 0xB9_xxxx "Vendor specific read error" means the device only supports I&M0..I&M4.

OPC UA Asset Management Bridge

The OPC UA for PROFINET specification (OPC 30140, 5.3.2 "Asset management") maps I&M records into OPC UA nodes of the AssetManagement object. The mapping is defined in the companion specification:

An OPC UA server such as the Siemens SIMATIC S7-1500 OPC UA Server or a third-party PROFINET-to-OPC UA gateway can read the I&M records acyclically once at startup and re-publish them as standard OPC UA variables, eliminating the need for a custom application per record.

Reading the I&M Address Field (Common Pitfall)

Beginners often interpret the "address field" in the PROFINET University article as an IP address; it is not. The address is a triple of (slot, subslot, API), encoded into a single 32-bit word for some tool inputs. The breakdown:

• Bit 31..16: Submodule-level identifier, or zero if querying the module.
• Bit 15..8: Slot number.
• Bit 7..0: Sub-slot (0 = module level).

For the head module of an ET 200SP, the address is (0, 0, 0). For the first submodule of slot 1, it is (1, 1, 0). The API defaults to 0 unless the device uses a non-zero API (e.g. PROFIsafe uses API 0, some PROFIenergy profiles use non-zero API). The library referenced in the discussion uses the SIMOTION logical IO address as a flat offset; that works only because the head module is at offset 0 by default, and only when the target is at the same API as the controller AR.

Troubleshooting Matrix

Verification Checklist

1. Cycle power on the IO device; the I&M0 fields survive a power cycle (they are stored in non-volatile memory).
2. Write I&M1 / I&M2 / I&M3 with the block WRREC and confirm the data is retained after a controller stop/start.
3. Use Proneta to perform an independent scan and compare the values read by your application against the tool's report.
4. If I&M5 is required, ask the vendor for the record layout; the binary content is not standardized.
5. For an OPC UA asset management use case, validate the AssetId is mapped from the I&M1 Function Tag using an OPC UA client such as UA Expert.