What is PROFINET?
PROFINET (Process Field Network) is an open industrial Ethernet protocol from PROFIBUS & PROFINET International (PI), defined in IEC 61158 and IEC 61784-2, that lets a PLC exchange process data in real time with I/O, drives and other field devices. It runs on standard Ethernet (IEEE 802.3) and offers three performance levels: ordinary TCP/IP communication, Real-Time (RT) and Isochronous Real-Time (IRT). PROFINET is the Ethernet counterpart of Profibus and adopts the familiar PROFIBUS DP application model. With 89.2 million installed nodes at the end of 2025, it is one of the most widely used industrial networks in the world.
🧠 How does PROFINET work?
PROFINET IO follows a provider/consumer model: the controller and devices send their cyclic data on their own, without being polled each time. There are three device roles:
| Role | Typical device | Task |
|---|---|---|
| IO controller | PLC or soft PLC | Runs the control program, provides outputs and receives inputs |
| IO device | O, drive, valve terminal, sensor | Provides inputs and receives outputs from one or more controllers |
| IO supervisor | engineering station, laptop or HMI | Commissioning and diagnostics, usually connected temporarily |
At start-up the controller sets up an Application Relation (AR) with each device, with separate channels for cyclic data, acyclic parameters and alarms. Building blocks you will find in every PROFINET network:
- GSD file (GSDML) - an XML description of the device, supplied by the manufacturer and imported into the engineering tool, such as TIA Portal
- Device name and DCP - every device gets a name; the Discovery and basic Configuration Protocol binds that name to the MAC address and assigns the IP address
- LLDP - through IEEE 802.1AB every device knows its neighbours, so the controller knows the topology and a replaced device automatically gets its name back
- Layer 2 transport - cyclic data travels without an IP header directly in Ethernet frames with Ethertype 0x8892 and VLAN priority 6; parameters use UDP
- Diagnostics - standardised diagnostic alarms plus SNMP for port status and network statistics
⚙️ What is the difference between RT, IRT and TSN?
PROFINET runs several channels side by side on the same network. You set the update time per device, anywhere from 250 µs to 512 ms.
| Channel | Use | Typical cycle time | Hardware |
|---|---|---|---|
| TCP/IP and UDP | Engineering, web server, parameters, OPC UA | No guaranteed timing | Standard Ethernet |
| RT (Real-Time) | Cyclic I/O data between PLC and devices | 1–10 ms | Standard Ethernet chips, switches with 802.1Q priority |
| IRT (Isochronous Real-Time) | Motion control, servos, synchronised axes | 250 µs down to 31.25 µs, jitter < 1 µs | Dedicated ASICs and IRT switches |
| TSN (conformance class D) | The same functions as IRT, using IEEE 802.1 standards | Comparable to IRT | TSN-capable switches and devices |
IRT reserves a fixed time phase in every cycle for scheduled traffic and synchronises all clocks to within a microsecond. That requires dedicated hardware. With PROFINET over TSN, PI replaces this proprietary mechanism with open IEEE standards. The TSN specification (PROFINET V2.4) was completed in 2019. The industrial TSN profile IEC/IEEE 60802 was published in June 2026 and is supported in PROFINET V2.5.
🧱 Which conformance classes does PROFINET have?
A conformance class (CC) defines the minimum set of functions a device and the network must support. The classes build on one another.
| Class | Communication | Main functions | Typical application |
|---|---|---|---|
| CC-A | RT | Basic I/O, alarms, parameters; ordinary Ethernet infrastructure | Building automation, simple I/O |
| CC-B | RT | Adds SNMP diagnostics, topology detection and device replacement without an engineering tool; MRP optional | Factory and process automation |
| CC-C | IRT | Adds bandwidth reservation and clock synchronisation; bumpless media redundancy (MRPD) optional | Motion control, robots, presses |
| CC-D | TSN | CC-C functions over IEEE 802.1 TSN | Converged IT/OT networks |
Alongside the conformance classes there are application classes, such as CC-B(PA) for the process industry. A device may only carry the PROFINET name after certification by a PI-accredited test lab. Ask your suppliers for the PROFINET certificate matching the conformance class you need.
🔄 How does PROFINET differ from PROFIBUS and other protocols?
PROFINET is not PROFIBUS over Ethernet, but it does reuse the I/O model and the profiles. PROFIBUS is still being sold: around 1 million devices were added in 2025, on an installed base of 71 million.
| Characteristic | Profibus DP / PA | PROFINET |
|---|---|---|
| Physical layer | RS-485 or fibre (DP), two-wire MBP (PA) | Copper or fibre Ethernet, also Ethernet-APL |
| Speed | Max. 12 Mbit/s (DP), 31.25 kbit/s (PA) | 100 Mbit/s full duplex, Gigabit possible; APL 10 Mbit/s |
| Topology | Line with terminating resistors | Star, line, tree and ring via switches |
| Access | Master-slave, token passing | Provider/consumer, multiple controllers possible |
| IT integration | Via a gateway | Direct: TCP/IP, web server, SNMP, OPC UA alongside real-time data |
Compared with the other major industrial Ethernet protocols: IP (ODVA, strong in North America) uses UDP/IP for I/O, EtherCAT processes frames on the fly and is very fast for motion control, and Modbus TCP is simple but not deterministic. PROFINET is strongest in Europe and in Siemens environments, but it is an open standard supported by hundreds of manufacturers.
🛡️ How does PROFINET handle redundancy and functional safety?
For high availability PROFINET offers several levels of redundancy:
- MRP (Media Redundancy Protocol, IEC 62439-2) - switches and devices in a ring; a Media Redundancy Manager keeps one ring port blocked and, after a cable break, switches to the backup path within at most 200 ms (for a ring of 50 devices)
- MRPD - for IRT the controller sends every frame in both directions around the ring at once, so a fault is absorbed without any interruption
- S2 system redundancy - a redundant controller pair; each device keeps two connections, one of them active
- R1 system redundancy - two fully separate networks, with devices that have two interfaces
For functional safety, PROFIsafe (IEC 61784-3-3) runs on top of PROFINET. The profile treats the network as a black channel and protects the safety data itself with sequence numbers, watchdogs, CRCs and a unique address relationship. PROFIsafe reaches SIL 3 according to IEC 61508 and PL e according to ISO 13849, and is used between a safety PLC and emergency stops, light curtains and safe drives. By the end of 2025 there were 31.5 million PROFIsafe nodes installed.
🏭 Where is PROFINET used?
- Factory automation - production lines, packaging machines and robotics, often with TIA Portal as the engineering environment
- Motion control - servo axes and presses using IRT or TSN and the PROFIdrive profile
- Process automation - through proxies to PROFIBUS PA and increasingly directly via Ethernet-APL, two-wire Ethernet all the way into the hazardous area
- Sensors and actuators - IO-Link masters that sit in the network as PROFINET devices
- Infrastructure - tunnels, water treatment and buildings, linked to SCADA
In the Netherlands, PI Nederland, with its secretariat at the industry federation FHI in Leusden, supports users and suppliers with knowledge days and training. For installation and commissioning, work with PI’s PROFINET installation guidelines and certified engineers.
🔐 How do you secure a PROFINET network?
As PROFINET networks are increasingly linked to IT systems, cybersecurity and overall security become core concerns. Classic PROFINET was designed for an isolated cell and has no authentication or encryption. Anyone with layer 2 access can discover devices, rename or reset them using DCP, and eavesdrop on cyclic data. A well-known example is CVE-2017-2680: specially crafted DCP broadcasts put a wide range of Siemens components into a denial-of-service state that could only be recovered manually.
PI’s answer is PROFINET Security, defined in three classes that build on one another:
| Class | Goal | Measures | Status (2026) |
|---|---|---|---|
| Security Class 1 | Robustness | DCP read-only, SNMP off by default, digitally signed GSD files (GSDX) | Devices in use |
| Security Class 2 | Integrity and authenticity | Cryptographically protected messages, X.509 certificates for devices and controllers | Specified, being tested |
| Security Class 3 | Confidentiality | Authenticated encryption of all data, role-based access, logging | Specified, being tested |
Because most installations do not yet have Security Class 2 or 3, defence in depth remains the guiding principle. A practical approach:
- Map the network - build an asset inventory of controllers, devices, firmware versions and GSD files.
- Segment - put each PROFINET cell in its own zone following the zones and conduits model of IEC 62443 and the Purdue Model, with segmentation using VLANs and a firewall towards higher levels, preferably an industrial firewall that understands PROFINET traffic.
- Block layer 2 at the edge - do not let DCP, LLDP or RT frames (Ethertype 0x8892) leave the cell; RT and DCP are not routable and do not need to be.
- Hardening - disable unused switch ports, web servers and SNMP write access, set DCP to read-only where possible and use managed switches with port security.
- Monitor passively - an OT IDS on a mirror port spots new devices, DCP set commands and firmware downloads; analyse traffic with Wireshark, which fully decodes PROFINET.
- Control changes - restrict access to the engineering station, check GSD files for their origin and keep firmware patches up to date.
For organisations under NIS2 and the Dutch Cybersecurity Act, these measures are part of the duty of care. Manufacturers of PROFINET devices fall under the Cyber Resilience Act: the duty to report actively exploited vulnerabilities has applied since 11 September 2026, and the full requirements apply from 11 December 2027; certification against IEC 62443-4-2 helps demonstrate that.
❓ Frequently asked questions
What does PROFINET stand for?
PROFINET stands for Process Field Network. It is the industrial Ethernet standard of PROFIBUS & PROFINET International, defined in IEC 61158 and IEC 61784-2. The name reflects its origins in the PROFIBUS fieldbus world.
Is PROFINET only for Siemens equipment?
PROFINET is an open standard managed by PI and supported by hundreds of manufacturers, from controllers to drives and sensors. Siemens was a driving force behind its development and supplies many PROFINET controllers. Every device carrying the PROFINET name must be certified by an accredited PI test lab.
What is the difference between PROFINET RT and IRT?
PROFINET RT sends cyclic data with cycle times of roughly 1 to 10 ms over standard Ethernet hardware. PROFINET IRT reserves bandwidth and synchronises clocks, allowing cycle times down to 31.25 µs with jitter below 1 µs. IRT is intended for motion control and requires dedicated hardware.
Can I use ordinary Ethernet switches for PROFINET?
For PROFINET RT in conformance class A, switches that support IEEE 802.1Q priority will work. Conformance class B and higher require PROFINET-certified switches that provide topology and diagnostics through LLDP and SNMP. IRT requires switches with dedicated IRT hardware.
Is PROFINET secure?
Classic PROFINET has no authentication or encryption, so its security comes from segmentation, firewalls, hardening and monitoring. PROFINET Security Class 1 makes devices more robust, for example with DCP in read-only mode and signed GSD files. Security Classes 2 and 3 add certificates and encryption and have been specified, but are still being tested in 2026.
What is PROFINET over Ethernet-APL?
PROFINET over Ethernet-APL carries PROFINET at 10 Mbit/s over a single two-wire cable into the process field, including power and intrinsic safety for hazardous areas. This lets field instruments join a PROFINET network directly, without a gateway. It is intended as the successor to PROFIBUS PA and the 4-20 mA loop.
📌 In summary
PROFINET is PI’s open industrial Ethernet protocol that connects PLCs, I/O and drives in real time, from simple RT communication to microsecond-accurate IRT and TSN. With conformance classes A to D, MRP redundancy, PROFIsafe and Ethernet-APL, PROFINET covers both factory and process automation. Because classic PROFINET has no authentication, segmentation, hardening and monitoring remain essential until Security Classes 2 and 3 are widely available.