SIMOTION D435 _readRecord I&M0 on ET 200S IM151-3PN HF Fix 0x80A3

Problem Overview

When attempting to read the Identification & Maintenance (I&M) data of an ET 200S distributed I/O station headed by an IM151-3PN HF (Siemens part number 6ES7 151-3BA23-0AB0) from a SIMOTION D435 controller, the system function block _writeRecord fails immediately and returns the 32-bit error code:

16#FFFF_80A3

The corresponding _readRecord call against the same logical address and the same I&M index returns valid data without issue. The same symptoms are observed regardless of whether the request is initiated from a MotionTask, a background Task, or the servo/IPO cyclic task. The diagnostic buffer of the SIMOTION CPU records the record call as a PROFINET IO error with the secondary error code 0x80A3 ("Record not supported / Index not available") for the write path, while the read path completes with 0x0000_0000.

This article documents the underlying cause, the constrained set of PROFINET record services that the IM151-3PN HF actually supports, the correct call sequence for retrieving I&M0 in a SIMOTION user program, and an extension that uses _getSegmentIdentification and _getNextLogAddress to discover every submodule in the ET 200S rack so the same record scan can be executed per slot.

Hardware and Software Stack

Verify the IM151-3PN HF firmware against the product release list. The -0AB0 MLFB with HF suffix indicates high-feature functionality (supports diagnostic interrupts, value status, isochronous operation) and was shipped with several firmware releases (e.g. V7.0, V7.1, V8.x). Confirm the device label matches the entry in HW Config and that the GSD file used (e.g. GSDML-V2.31-Siemens-ET200S-...) is at least as new as the firmware loaded on the device. Mismatch between GSD and firmware is a common source of index-not-supported responses on record calls.

PROFINET I&M Record Indexes and Data Layout

PROFINET IO defines five I&M record blocks per slot. They are addressed as PROFINET data records using the standard index range 0xAFF0..0xAFF4:

The I&M0 block is fixed by the manufacturer and cannot be overwritten by an IO Controller. This is the fundamental reason the write path on the IM151-3PN HF fails. Per the PROFINET specification, an IO Device must reject any write request to index 0xAFF0 with error code 0x80A7 ("Resource access denied / write-protected") or, when the index is not offered for the slot at all, 0x80A3 ("Record not supported"). Both responses are observed across different firmware versions of the IM151-3PN HF family.

Root Cause of Error 16#FFFF_80A3

The 32-bit value 16#FFFF_80A3 is composed of two layers:

• Upper word 0xFFFF: SIMOTION user-program wrapper flag. The block returns this sentinel whenever the underlying PNIO record service reports a non-zero PNIO error code. It is not a SIMOTION firmware bug but a passthrough of the device's record response.
• Lower word 0x80A3: PROFINET IO error code defined in IEC 61784-2 / the PROFINET record-handling specification. 0x80A3 means "Record not supported / Index not available". The IO Device has no implementation for the requested combination of (slot, subslot, index).

For the IM151-3PN HF the slot-level write access to I&M0 is not implemented because the data is manufacturer-assigned and read-only by definition. The device correctly answers with 0x80A3 instead of 0x80A7 because the index itself is not advertised as writable on that slot by the device's GSDML/record-support enumeration.

Working _readRecord Implementation in Structured Text

The following snippet executes correctly against the IM151-3PN HF when configured for the D435 PROFINET interface. The IM data is deposited into im0_data as a 64-byte buffer; the I&M0 record per PROFINET spec is 34 bytes of fixed fields followed by 32 bytes of vendor-specific padding, totaling 66 bytes on most Siemens devices.

// IM0_read.st - SIMOTION SCOUT V5.2 ST
// Reads I&M0 from a known ET 200S head module slot

FUNCTION_BLOCK FB_ReadIM0
VAR
    // 32-bit PNIO error code returned by _readRecord
    rdStatus     : DWORD := 0;
    // Logical device address (PROFINET IO device number)
    deviceId     : UINT  := 1;
    // Slot 0 = head module (IM151-3PN HF)
    slot         : UINT  := 0;
    // Subslot = 0 for module-level records
    subslot      : UINT  := 0;
    // I&M0 index = 0xAFF0 = 65008
    index        : DWORD := 16#AFF0;
    // Buffer length: 66 bytes covers I&M0 + vendor padding
    dataLen      : UINT  := 66;
    // Destination buffer
    im0_data     : ARRAY[0..65] OF BYTE;
    // Busy/Error latches
    busy         : BOOL;
    error        : BOOL;
END_VAR

BEGIN
    // _readRecord signature:
    //   _readRecord(device := deviceId,
    //               slot   := slot,
    //               subslot:= subslot,
    //               index  := index,
    //               data   := im0_data,
    //               len    := dataLen,
    //               done   => ,
    //               busy   => busy,
    //               error  => error,
    //               status => rdStatus);

    rdStatus := _readRecord(
        device  := deviceId,
        slot    := slot,
        subslot := subslot,
        index   := index,
        data    := im0_data,
        len     := dataLen);

    IF (rdStatus = 0) THEN
        // Success: parse im0_data per I&M0 layout
        // VendorID    @ offset 0  (UINT16)
        // OrderID     @ offset 2  (20 ASCII bytes, MLFB)
        // SerialNo    @ offset 22 (16 ASCII bytes)
        // HWRevision  @ offset 38 (UINT16)
        // SWRevision  @ offset 40 (3 x UINT8: function, bugfix, internal)
        // RevCounter  @ offset 43 (UINT16)
        // ProfileID   @ offset 45 (UINT16)
        // ProfileType @ offset 47 (UINT16)
        // IMVersion   @ offset 49 (UINT8: major, minor)
    ELSE
        // rdStatus carries 16#FFFF_8xxx in case of PNIO error
        // mask out upper word for the PNIO error code
        // e.g. 16#FFFF_80A3 -> 0x80A3 (record not supported)
    END_IF;
END_FUNCTION_BLOCK

Equivalent calls are valid from LAD/FBD using the RDREC instruction. The difference is that the SIMOTION system function _readRecord operates on logical device IDs as configured in SCOUT rather than the HW handle used by S7 PLCs.

Discovering the Slot Map with _getSegmentIdentification and _getNextLogAddress

To read I&M records from each submodule (the 5 DI, 1 DO, and 2 PM installed behind the IM151-3PN HF) the user program must enumerate every slot first. The ET 200S reserves slot 0 for the head module and slots 1..12 for I/O modules. Two SIMOTION system functions provide a direct port of the standard PNIO read-record diagnostics 0xE002 (GetSlotInfo) and 0xE003 (GetAllSlotInfo) services:

• _getSegmentIdentification: returns the API, slot count, and slot identifiers that the controller sees on the device.
• _getNextLogAddress: steps through the slot list, returning the input/output I/O addresses of the next module so the application can correlate PROFINET slot numbers with the I/O addresses configured in SCOUT.

// Build the slot map for the ET 200S
FUNCTION_BLOCK FB_ScanRack
VAR
    api       : DWORD;
    slotCnt   : UINT;
    logAddr   : UINT;
    slotNo    : UINT := 0;
    subslotNo : UINT := 0;
    done      : BOOL;
    busy      : BOOL;
    err       : BOOL;
    status    : DWORD;
END_VAR

BEGIN
    // 1. Pull the segment header
    status := _getSegmentIdentification(
        device := 1,           // logical IO device
        api    := 0,
        slotCount => slotCnt,
        ...);

    // 2. Walk all slots; log I/O addresses
    WHILE slotNo < slotCnt DO
        status := _getNextLogAddress(
            device    := 1,
            slot      := slotNo,
            subslot   := subslotNo,
            done      => done,
            busy      => busy,
            error     => err,
            status    => status,
            logAddr   => logAddr);

        IF (done AND status = 0) THEN
            // logAddr now contains the start I/O address
            // for slotNo. Use it to read slot-specific I&M0.
        END_IF;

        slotNo := slotNo + 1;
    END_WHILE;
END_FUNCTION_BLOCK

Once the slot map is known, the same _readRecord call shown above can be invoked per slot to harvest I&M0 of every I/O module (slot 1..n). The head module's I&M0 is always at slot 0; submodule-level I&M uses subslot <> 0 with the appropriate subslot index from the device GSDML.

Why _writeRecord Must Not Be Used for I&M0

Even with correct slot/subslot/index arguments, _writeRecord against I&M0 will always be rejected by the IM151-3PN HF because:

1. PROFINET defines I&M0 as manufacturer-assigned, read-only data. The device firmware (regardless of GSD version) is required to reject any write access.
2. The PNIO error returned for write-protect violations on supported indexes is typically 0x80A7 ("Resource access denied"). When the device does not list the index as writable at all (which is the case here for index 0xAFF0), it returns 0x80A3 instead.
3. SIMOTION's _writeRecord passes the PNIO error code through unchanged in the low word and sets 0xFFFF in the high word, producing exactly the symptom observed: 16#FFFF_80A3.

For application-level commissioning of plant identification, use one of the official maintenance tools instead of a record write from a runtime program:

• TIA Portal (Online > Device maintenance > Assign PROFINET device name / I&M): writes I&M1 and I&M2 to the device during engineering.
• PRONETA: a free Siemens tool for offline / online I&M editing and PROFINET diagnostics.
• Web server of the IM151-3PN HF: allows I&M1 / I&M2 / I&M3 editing when the web server is enabled in the configuration.
• SIMATIC Automation Tool: bulk I&M assignment across a plant.

Loading I&M Data Through TIA Portal Instead

To populate I&M1 (Plant designation, Location identifier) and I&M2 (Installation Date), follow the standard TIA Portal maintenance flow. The same I&M1/I&M2 records can also be assigned to the SIMOTION D435 itself. From TIA Portal:

1. Open the project, navigate to Devices & Networks, and select the IM151-3PN HF device.
2. Right-click the device → Online & Diagnostics.
3. Select the Assign PROFINET device name / I&M entry.
4. Enter Plant designation (max. 32 bytes ASCII) and Location identifier (max. 22 bytes ASCII). These fields populate I&M1.
5. Enter the Installation Date in YYYY-MM-DD HH:MM format. This populates I&M2.
6. Click Assign. The device returns 0xFFFF_0000 (success) on the next _readRecord of those indexes.

For the ET 200S family, I&M0 is fixed and cannot be changed; the tooling will not even expose it as a writable field, which is the desired behavior.

Verification After the Fix

1. In SCOUT, open the D435 online connection and download the modified ST block.
2. Force the _readRecord call once (e.g. via a debug variable in the watch table).
3. Confirm rdStatus = 0 for the I&M0 read on slot 0.
4. Parse the 20-byte Order ID at offset 2; it should match 6ES7 151-3BA23-0AB0.
5. Confirm the Serial Number at offset 22 matches the label on the physical device.
6. Use PRONETA or the device web server to verify the read-side I&M1/I&M2 values match what was assigned.
7. Check the SIMOTION diagnostic buffer: no new entries of class "Communication" / "PROFINET IO Record error" should appear for the IM151-3PN HF slot 0.

PNIO Record Error Code Reference

SIMOTION wraps any non-zero PNIO error in 16#FFFF_xxxx. Always mask the low word to extract the true PNIO error and map it through the table above.

Commissioning Checklist for ET 200S PROFINET Record Access

Related References

• Siemens Support Entry 53705461 - Reading module information on PROFINET (SIMOTION example project)
• SIMOTION Motion Control - Communication Functions (PDF)
• Loading I&M data to PROFINET IO devices and modules
• SIMOTION Controller with PROFINET IO Drive (TIA cloud documentation)