Resolving S7-1200 PROFINET Errors 16#02:39B3 and 16#02:39B4

Problem Overview

When commissioning a SIMATIC S7-1200 CPU as a PROFINET IO controller against a third-party PROFINET device (commonly a Cognex DataMan or In-Sight camera, but the symptom also appears with other vendors), the diagnostic buffer of the CPU fills with repeating I/O access errors. The PROFINET IO device is detected by TIA Portal V11 SP1 and the topology compiles cleanly, but every scan cycle the CPU raises an entry similar to the following:

The same situation has been reproduced on TIA Portal V11 SP1 (STEP 7 Basic V11 SP1, WinCC Basic V11 SP1) with the S7-1200 firmware that exposes the integrated PROFINET interface as IO controller (CPU firmware V2.0 and later). Update 2 of TIA Portal V11 SP1 contains the cumulative patches, but the patch will refuse to install if the prerequisite SP1 is not at the correct minor revision, or if the TIA Portal base version is newer than the update package. Once the patch chain is restored, the device-name mismatch described below is the most common field root cause.

Affected Components and Versions

Error Code Reference

Both event IDs belong to the S7-1200 diagnostic event class "IO access error during process image update". The CPU temporarily removes the affected slot from the process-image update cycle and retries on the next cycle. Persistent entries indicate that the IO device never returns a valid PROFINET telegram for that slot.

These IDs differ from the well-known PROFINET channel-diagnosis event 16#02:39B1 ("Station failure") and 16#02:39B2 ("Station return"). The 39B3/39B4 pair is a *process image* layer error, which means the CPU has accepted the AR (Application Relationship) and the device is reachable, but slot-level IOCR (Input/Output CR) data is missing or malformed. TIA Portal shows the device as "Not reachable" in the online view when these events accumulate.

Root Cause Analysis

Two independent root causes combine to produce the symptom:

1. Device name mismatch (primary field root cause). PROFINET IO uses the device name as the addressing key during the DCP (Discovery and Configuration Protocol) name-of-station assignment. The CPU only establishes an AR to a device whose DCP NameOfStation exactly matches the name configured in the TIA Portal project. If the name on the camera (set with the vendor configuration tool, e.g. Cognex In-Sight Explorer / DataMan Setup Tool) differs by even one character, by an underscore vs. a hyphen, or by letter case, the slot IOCR fails and the CPU logs 39B3/39B4.
2. TIA Portal V11 SP1 update chain broken (secondary root cause). The TIA Portal V11 SP1 update packages are split into a "non-SP1" and an "SP1" stream. Installing SP1 first then attempting to apply the non-SP1 Update 2 will fail with a version check, and a non-trivial number of installations end up with a partial patch state that still cannot detect PROFINET device names correctly during the online name assignment (PROFINET device naming via TIA "Assign PROFINET device name").

Prerequisites

• TIA Portal V11 SP1 (full installation media, not the floating upgrade).
• Local administrator rights on the engineering station.
• Microsoft .NET Framework 3.5 SP1 fully installed; on Windows 7 and later enable the feature via Control Panel → Programs and Features → Turn Windows features on or off → Microsoft .NET Framework 3.5.1. Verify with reg query "HKLM\SOFTWARE\Microsoft\NET Framework Setup\NDP\v3.5" /v SP returning 1.
• The Cognex (or other vendor) configuration tool installed and able to talk to the device via TCP/IP or USB.
• Online access from the engineering station to the S7-1200 CPU on the same PROFINET subnet.

Step-by-Step Resolution

Step 1 - Repair the TIA Portal V11 SP1 installation

1. Open Control Panel → Programs and Features.
2. Select Siemens TIA Portal V11 SP1 and click Repair.
3. Accept the default options; the repair re-registers the PROFINET IO device description (GSDML) import tool and the DCP "Assign PROFINET device name" service.
4. Reboot the engineering station.

Step 2 - Apply the SP1 update chain in order

1. Download the SP1-only update first (do not skip), then the SP1 Update 2 cumulative patch from the Siemens support portal (entry ID 61811973, "Updates for STEP 7 V11 SP1 / TIA Portal V11 SP1").
2. Right-click the installer and choose Run as administrator.
3. If the installer reports a version mismatch ("TIA is a newer version"), the previously applied update was from the non-SP1 stream. Use Control Panel → Programs and Features to remove the non-matching update, then re-run the SP1 Update 2 installer.
4. Verify installed version: in TIA Portal open Help → About and confirm STEP 7 Basic V11 SP1 Update 2 and WinCC Basic V11 SP1 Update 2.

Step 3 - Assign the PROFINET device name correctly

1. Open the TIA Portal project and select the PROFINET IO device in the device tree.
2. Navigate to Device view → Properties → General → PROFINET interface → Ethernet address.
3. In the PROFINET device name field, set a name that uses only [a-zA-Z0-9-]. Use a hyphen as the separator, not an underscore. Example: dataman-line1 rather than dataman_line1.
4. Connect online (Online → Accessible devices) and select the S7-1200 interface.
5. Right-click the IO device and choose Assign PROFINET device name. Confirm the MAC address matches the camera label and click Assign name.
6. The IO device will perform a DCP restart. Wait for the green check mark next to the device in the online view.

Step 4 - Verify the converted name against the vendor configuration

1. In TIA Portal, in the same Ethernet address dialog, locate the Converted name field. This is the name that will actually be transmitted on the wire (it is normalized per RFC 3490 IDN encoding).
2. Open the Cognex configuration tool (In-Sight Explorer / DataMan Setup Tool) and read the PROFINET station name that the camera is advertising on the network.
3. Compare the two strings byte-for-byte. The IP address of the IO device must also match what is configured in the camera. Any mismatch re-introduces 39B3/39B4 within seconds of CPU RUN.

Step 5 - Compile, download, observe the diagnostic buffer

1. In the project tree, right-click the S7-1200 → Compile → Software (rebuild all).
2. Download the hardware configuration to the CPU. Place the CPU in STOP, then back to RUN.
3. Open Online → Online and diagnostics → Diagnostic buffer and clear the buffer.
4. Run the machine for at least five minutes at full I/O scan rate. No new 39B3/39B4 entries should appear.

Verification Checklist

Alternative Path: TCP Communication Instead of PROFINET IO

If the PROFINET IO device vendor does not ship a certified GSDML file, or if a stable AR cannot be established, the S7-1200 can communicate with the device over open TCP using the TCON, TSEND, TRCV and TDISCON instructions from the "Communication" palette. Cognex publishes the structure of its TCP payload (job and result acks) on the vendor support site; the Siemens-side ladder or SCL must mirror that structure. This avoids the PROFINET name-of-station compare entirely, at the cost of higher application code complexity and the loss of cyclic PROFINET diagnostics.

Typical TCP approach outline:

1. Define a TCON connection block referencing the camera's IP and TCP port (commonly 23 for Telnet-style Cognex, or 4444 for the Cognex native protocol).
2. Build the request payload in a DB matching the published Cognex job format (header, command, payload, checksum).
3. Trigger TSEND on a positive edge of a request bit; gate further requests on the DONE or ERROR output of the previous TSEND.
4. Use TRCV in ad hoc mode with a length that matches the largest expected result telegram, or use the protocol ID/length bytes in the response to determine the actual length.
5. Decode the result telegram into a structured DB and expose it to the HMI.

Troubleshooting Matrix

Field-Proven Caveats

• The S7-1200 in V11 SP1 supports PROFINET IO controller, but only a single IO controller per integrated interface. Adding a second controller in the same project causes the first AR to flap.
• Cognex In-Sight and DataMan cameras with firmware older than the In-Sight 4.x / DataMan 5.x line may not advertise a PROFINET station name at all until the PROFINET option is enabled in the device firmware configuration.
• If the engineering station has both TIA Portal V11 and TIA Portal V13/V15/V16 installed, the V11 PROFINET device-name tool may be replaced by the newer version on first use. Always launch the desired V11 version via Start → Siemens Automation → TIA Portal V11 rather than the auto-resolved shortcut.
• Some Cognex cameras require a power cycle to apply a PROFINET name change locally; allow 15 seconds after the vendor tool confirms the new name before the CPU's next DCP discovery cycle will pick it up.
• When migrating the project to TIA Portal V13 or later, the PROFINET device-name fix from V11 carries over, but the GSDML version is re-validated. Re-install the latest GSDML from the vendor before upgrading the TIA Portal project.

Standards and Reference Documents

• PROFINET Installation Guide (PROFIBUS Nutzerorganisation e.V., order no. 8.042) - cabling, naming, and commissioning rules that this fix is grounded in.
• SIMATIC S7-1200 Programmable Controller System Manual, edition 06/2012, chapter 8 ("PROFINET") - the canonical Siemens reference for S7-1200 PROFINET IO controller behavior, including diagnostic event IDs.
• SIMATIC S7-1200 Function Manuals for the TCON / TSEND / TRCV / TDISCON instructions when the TCP fallback path is chosen.

FAQ