Resolving GetStationInfo Error 8093 in TIA Portal V16 PROFINET

Problem Overview: GetStationInfo Error 8093 in TIA Portal V16

Engineers integrating PROFINET IO devices into SIMATIC S7-1200/S7-1500 controllers commonly attempt to use the GetStationInfo instruction to verify that a remote PROFINET partner (such as a UR universal robot, an ET200 station, a SINAMICS drive, or a third-party PROFINET device) is present and reachable on the PROFINET network. In TIA Portal V16 the FB returns error code 8093 (hex W#16#8093) on first invocation, or it remains stuck returning busy status 7001/7002 when the device is unplugged, depending on firmware version, hardware configuration, and the way the MODE / LADDR parameters are wired. This article documents the root cause analysis for error 8093 and the proven alternatives — DeviceStates and GET_DIAG — that resolve the practical use case of detecting a missing PROFINET station.

The Siemens manual entry for GetStationInfo: Read the IP or MAC address of a PROFINET IO device describes the instruction's official role: read the IP/MAC of a PROFINET IO device in the local IO system or in a PROFINET IO system reachable over a PN/PN coupler. It was not designed as an online presence detector, which is the misapplication that triggers 8093 in many field reports.

Root Cause Analysis

The error matrix below summarizes the failure modes observed on S7-1500 CPUs (firmware V2.6 through V2.9) and S7-1200 CPUs (firmware V4.4 through V4.6) running TIA Portal V16, Update 7 (V16.0.0.7) projects.

The 8093 issue typically resolves to one of three causes in field reports:

1. Mismatched variant UDT. The instruction ships with multiple RESULT structure variants based on the MODE parameter. MODE=1 returns the 2-byte status only; MODE=2..6 return increasing amounts of slot, module, and stack information. If a programmer copies an existing instance and reuses the same UDT across modes, the byte count expected by the FB does not match the byte count of the destination data block, so the runtime system raises 8093.
2. Hand-declared DB instead of multi-instance. TIA Portal V16 introduces the multi-instance call pattern for the function; calling it as a single instance against a separately declared DATA AnyPointer loses the system-implicit length header.
3. Unsupported device on the PROFINET line. PROFINET devices that implement only the minimum LLDP-MIB exchange (legacy SNMP-v1 PROFINET I/O devices, certain third-party gateways) do not implement the PNIO Read Station Info record (index 0xF840). The CPU honors the call by returning 8093 instead of 80B0, which is counter-intuitive but documented in the TIA Portal help text for the instruction.

Engineers report that even when GetStationInfo returns a sensible status without 8093, unplugging the device from the line does not produce a fresh error code; the FB simply retains the last valid result because the underlying record is cached in the PROFINET stack. This behavior disqualifies GetStationInfo as a reliable online-presence detector. The diagnostic-correct path is DeviceStates, which reads the CPU's live module status table.

Solution Path: Replace GetStationInfo with DeviceStates

The DeviceStates instruction (FB / FC, available since TIA Portal V15.1 with full support in V16) returns the current state of every configured PROFINET IO device and module in the controller's IO system. Because the data is read from the controller's own diagnostic buffer rather than from a per-device record, it produces an authoritative answer even when the partner is physically disconnected.

DeviceStates Instruction Signature

Step-by-Step Implementation in TIA Portal V16

1. Open the project in TIA Portal V16 and switch the view to the S7 controller.
2. Add a global DB (for example DB_DeviceStates) that contains an Array[0..127] of BOOL variable named StateBits and a BOOL named Trigger. The array size corresponds to the maximum number of devices supported by an S7-1500 PROFINET IO system (128).
3. Insert the DeviceStates FB from Instructions > Extended Instructions > Diagnostics > PROFINET / PROFIBUS. Place it in OB1 as a multi-instance inside an existing FB or directly into a cyclic alarm OB.
4. Wire the LADDR input with the hardware identifier of the IO system. To find this value, select the PROFINET interface in Devices & Networks, choose Properties > System constants, and copy the symbolic name (for example Local PROFINET IO system_1).
5. Drive REQ with a 1-Hz clock generator (e.g. from a clock bit or a TON/TOF) so the FB does not flood the diagnostic buffer.
6. Connect MODE to a constant of 1 to return station-level states only.
7. Connect STATE to the StateBits array created in step 2. The runtime system writes one bit per device — bit index 0 = first device in the configuration order, bit N-1 = N-th device.
8. Compile the project and download to the CPU. Watch the DONE, BUSY, and ERROR outputs in an online watch table.

Bit Encoding for the STATE Array

A simplified ladder interpretation reads:

// FBD / STL pseudo-code for online detection
IF "DB_DeviceStates".StateBits[UR_DeviceIndex] = 1 THEN
    // UR is online and cyclically exchanging data
    UR_Online := TRUE;
ELSE
    UR_Online := FALSE;
END_IF;

To determine the index of a specific device in the array, open Devices & Networks, expand the IO system, and read the order in which the devices appear under the controller's PROFINET interface. The first entry is always index 0.

Alternative: GET_DIAG for Per-Device Channel Diagnostics

When the requirement is channel-granular diagnostics (which submodule returned what error), use the GET_DIAG instruction. Per the official TIA Portal V16 documentation, GET_DIAG reads the diagnostic buffer of a single hardware device using the LADDR parameter (hardware identifier) and returns a variant structure with channel status, error type, and timestamp.

The full parameter table for GET_DIAG is published at GET_DIAG: Read diagnostic information.

Comparison: GetStationInfo vs DeviceStates vs GET_DIAG

Step-by-Step: Rebuilding the Project with the Sample Library

When the inline help text and online support documentation do not provide an executable example, the fastest path is to retrieve the TIA Portal V16 instruction sample library and study the working calls.

1. Open the TIA Portal Help website and search for "Sample Library of Instructions TIA Portal".
2. Download the ZIP archive (sized around 90 MB) containing every extended-instruction example project for S7-1200/S7-1500.
3. Extract and open the project file in TIA Portal V16 (or V16 Update 7, or later).
4. Navigate to the controller under Program blocks and locate the demonstration OB containing DeviceStates and GetStationInfo examples.
5. Right-click the demonstration FB, choose Cross-reference > Detailed information, then Go to instance / call to inspect the wiring of LADDR, MODE, and STATE.
6. Reuse the same approach inside the target project, mapping the UR device to its hardware identifier in the local PROFINET IO system.

Verification Procedure

After implementing the alternative instructions, prove correct operation through these checks. They cover both the positive case (device present) and the negative case (device removed) that motivated the migration away from GetStationInfo.

1. Go online with the controller and add DB_DeviceStates to a watch table.
2. With the UR/PROFINET device powered up and connected, observe bit StateBits[UR_DeviceIndex] toggle to 1 within one OB1 cycle after the rising edge of Trigger.
3. Power down or unplug the PROFINET cable from the partner. The corresponding bit should transition to 0 within one PROFINET update cycle (typical 250 ms on S7-1500 with default UpdateTime = 1ms setting; longer for SendClock=2ms configurations).
4. Reconnect the partner. Bit returns to 1. Note the OB82 / OB86 interrupt evidence in the diagnostic buffer under Online & Diagnostics > Diagnostics Buffer — the CPU itself will log a "Station failure" entry with the hardware identifier.
5. Drive the OB86 process image: OB86_MDL_FAULT and similar inputs can be checked in OB86_PREV_CYCLE for adjacency analysis. DeviceStates complements OB86 perfectly by reporting current state regardless of timing.
6. For final acceptance, perform a long-duration so-called soak test of at least 8 hours with intentional transient cable disconnects to ensure the FB never returns stuck state and never trips an ERROR bit.

Troubleshooting Matrix

Edge Cases and Platform Notes

Several platform-specific behaviors warrant attention:

• S7-1200 vs S7-1500: The S7-1200 supports a maximum of three PROFINET IO devices in a single interface (firmware V4.5+), whereas the S7-1500 supports up to 256 depending on the CPU model (for example CPU 1515-2 PN supports 128 in the IO system). Size the STATE array accordingly. A 256-byte array returned by an S7-1200 controller will yield valid data for the first three bits only; remaining bits stay at 0 — not an error.
• PN/PN coupler usage: When the UR or other PROFINET device is connected through a PN/PN coupler instead of directly to the controller, the DeviceStates call must be issued against the IO system of the coupler side, not the local PN interface of the CPU. GetStationInfo error 8093 also frequently appears here because the IP/MAC retrieval path is blocked by the coupler's transparent mode.
• Third-party PROFINET devices: Many non-Siemens PROFINET devices expose only the minimum-conformance diagnosis; DeviceStates still works because the state is computed by the CPU's own PROFINET stack, but GET_DIAG channel details may return zero or unsupported values.
• PROFIenergy and other high-level PN services: Reading energy-saving state via PNIO Read Station Info requires the device to support PROFIenergy profile v1.0+. The PROFINET stack still reports the device as online, but service-level capabilities are independent of online state.

Safety and Operational Considerations

PROFINET device monitoring is often used to gate safety-relevant logic (for example, the UR cobot's collaborative mode). While the diagnostic instructions above provide state for non-safety logic, they do not replace a fail-safe PROFIsafe stack. For SIL-rated subsystems:

• Use PROFIsafe with the dedicated F-Peripheral modules (for example, F-CPU F-CPU S7-1500F firmware set).
• Do not derive PROFIsafe ACK_REQ or passivation signals from DeviceStates; use Passivation bit from the PROFIsafe telegram directly.
• For motion-control dominated PROFINET slaves (UR cobots, SINAMICS drives), the cycle time guarantee of DeviceStates is bounded by the PROFINET update time, not by the OB1 cycle. Plan OB1 cycle time with adequate margin.

Implementation Skeleton for SCL in TIA Portal V16

// SCL pseudo-code for periodic DeviceStates call
// Trigger every 1 s; cycle OB = OB30 / OB35

IF "Clock_1Hz" THEN
    "Instance_DeviceStates"(REQ := TRUE,
                            MODE := 1,
                            LADDR := "Local PROFINET IO system_1");
    "Clock_1Hz_Edge" := TRUE;
ELSE
    "Instance_DeviceStates"(REQ := FALSE,
                            MODE := 1,
                            LADDR := "Local PROFINET IO system_1");
END_IF;

IF "Instance_DeviceStates".DONE THEN
    // Read state bits, look up device index from cross-reference
    "RobotOnline" := ("DB_DeviceStates".StateBits["UR_Index"] = 1);
END_IF;

IF "Instance_DeviceStates".ERROR THEN
    // Log RET_VAL and trigger OB82 helper flag
    "DB_Diagnostics".LastDeviceStatesErr :=
        "Instance_DeviceStates".RET_VAL;
END_IF;

Verification Acceptance Checklist

• Compile the project in TIA Portal V16 with no warnings on the newly added blocks.
• Download hardware configuration (HMI/PLC) and software (blocks only) separately to avoid staging mix-ups.
• Confirm the UR appears online in Devices & Networks > Topology view (right click > Online > PROFINET devices).
• Confirm the watch table shows StateBits[UR_Index] = 1 within one second of going online.
• Simulate a disconnect by pulling the PROFINET cable and verifying OB86 fires; check that StateBits[UR_Index] drops to 0.
• Reconnect and verify OB86 clears and the bit returns to 1 within the configured update window.
• Sign-off form should reference Siemens manual entry GetStationInfo for traceability on the original instruction and the related Siemens S7-1200 manual cloud page GET_DIAG for the alternative diagnostic path.