Configuring SFB 52 RDREC and SFB 53 WRREC for Acyclic HART Communication in SIMATIC S7-400

In SIMATIC S7-400 and PCS 7 systems, executing acyclic data record communication to read or write HART parameters and diagnostic structures using system function blocks SFB 52 (RDREC) and SFB 53 (WRREC) frequently triggers parameter errors (such as STATUS 16#8090 or 16#80B0) due to incorrectly formatted ID and INDEX inputs. In S7-400 architectures, the 'ID' parameter must be configured with the logical diagnostic base address (LADDR) of the HART analog input module in hexadecimal, while the 'INDEX' parameter must specify the channel-specific data record number (records 140 to 147 for Channels 0 to 7 on ET 200M HART modules).

Acyclic Data Record Routing via SFB 52 and SFB 53

In SIMATIC automation systems, reading digital HART instrument variables (such as Secondary Variable SV, Tertiary Variable TV, Quaternary Variable QV, manufacturer device IDs, and sensor serial numbers) requires acyclic communication. Unlike cyclic process image updates (PIW), acyclic communication uses non-real-time data record routing:
- SFB 52 (RDREC / Read Data Record): Asynchronously reads a specified data record from a peripheral module into an S7 data buffer.
- SFB 53 (WRREC / Write Data Record): Asynchronously writes a formatted HART request telegram (e.g. HART Command 0 or Command 3) to the field instrument.

Both blocks operate across multiple controller scan cycles and report progress via boolean flags (REQ, BUSY, DONE, ERROR) and a 32-bit status word (STATUS).

Parameterizing the Logical Diagnostic Address (ID)

The parameter ID identifies the target peripheral hardware module:

Hardware Diagnostic Base Address:
- In STEP 7 HW Config, select the HART analog input module (e.g. 6ES7331-7TF01-0AB0).
- Open module properties; inspect the Addresses tab. Note the module's start address (e.g., input address 512 or diagnostic address 512).
Hexadecimal Conversion:
- The ID parameter requires data type DWORD. The numerical address must be converted to hexadecimal:
$$512_{\text{dec}} = 16#0200 \rightarrow \text{ID} := \text{DW}#16#00000200$$
- In S7-400 systems, if referencing an I/O module rather than a sub-module, bit 15 is typically set (DW#16#00008200 or the explicit diagnostic address). An incorrect ID generates error STATUS = 16#8090 (Module address invalid).

HART Channel Data Record Numbering (INDEX)

The parameter INDEX specifies the internal data structure within the module:

ET 200M HART Module Record Numbers:
On the standard ET 200M HART module (6ES7331-7TF01-0AB0), acyclic HART communication is assigned to dedicated data record numbers per physical channel:
Channel 0: INDEX = 140 (or 60 depending on operating mode)
Channel 1: INDEX = 141
Channel 2: INDEX = 142
Channel 3: INDEX = 143
Channel 4: INDEX = 144
Channel 5: INDEX = 145
Channel 6: INDEX = 146
Channel 7: INDEX = 147
Parameterizing an invalid index (e.g. Index 1 or Index 50) causes the module to reject the transfer with error STATUS = 16#80B0 (Record index not recognized).

SFB 52 / 53 Parameter Specification Matrix

The following table details parameters and error codes for acyclic HART communication:

ParameterTypeFormat / ValueDescriptionCommon Error CodesREQBOOLDynamic PulseTriggers data transfer jobSTATUS = 16#7001 (First call after REQ)IDDWORDDW#16#00000200Logical base address (LADDR) in Hex16#8090 (Module address invalid)INDEXINT140 to 147Target HART channel record number16#80B0 (Invalid record index)MLENINTBytes (e.g. 64)Maximum expected record length to read16#80B1 (Buffer length too short)RECORDANYP#DB10.DBX0.0 BYTE 64Target data destination buffer16#8092 (ANY pointer points to invalid memory)BUSYBOOLOutput FlagTrue while transfer is in progressNoneDONEBOOLOutput FlagTrue for 1 cycle when transfer succeedsNoneERRORBOOLOutput FlagTrue for 1 cycle if an error occurredInspect STATUS word

Note: Asynchronous SFB execution requires keeping REQ = 1 until either DONE = 1 or ERROR = 1.

Verification

Verify acyclic HART data reading in CFC test mode:
1. In SCL, parameterize SFB 52 with ID = DW#16#00000200 and INDEX = 140 (Channel 0).
2. Trigger REQ := True; monitor block outputs across cyclic scans.
3. Verify that BUSY cycles to True and returns to False, while DONE pulses True with STATUS = 16#00000000.
4. Inspect the target Data Block buffer; confirm that byte records match the HART response structure containing primary, secondary, and tertiary variables.
5. In WinCC, display the decoded digital variable; confirm dynamic synchronization with the field instrument.

Limitations and Operational Precautions

Essential rules for acyclic peripheral communication:
- Only one acyclic read/write job can execute per physical module channel at any given time; queuing overlapping requests causes job collision error 16#80C2.
- Acyclic data transfers have low priority on PROFIBUS DP and PROFINET; do not execute continuous cyclic polling with SFB 52, as this increases fieldbus cycle times.
- For high-speed applications requiring continuous auxiliary variables, use modern HART modules supporting cyclic HART variable mapping in HW Config rather than manual SFB 52 routines.

Engineer FAQ

Why is SFB 52 used instead of SFC 59 in newer systems?

SFB 52 (RDREC) and SFB 53 (WRREC) are standardized across both PROFIBUS DP and PROFINET IO architectures, whereas legacy SFC 59 (RD_REC) is limited to older PROFIBUS implementations.

Where is the returned data stored?

The returned telegram data is stored in the data structure referenced by the RECORD parameter, typically an ARRAY of bytes or structured UDT inside a dedicated global Data Block.

Can SFB 53 be used to write calibration setpoints to a transmitter?

Yes. By formatting the appropriate HART write command (e.g. Command 35 to write range values) into the send buffer, SFB 53 transmits the parameter directly to the instrument.