6ES7531-7TF00-0AB0 HART Read/Write via WRREC RDREC in TIA Portal

6ES7531-7TF00-0AB0 HART Read/Write via WRREC/RDREC in TIA Portal V17

The Siemens SIMATIC S7-1500 module 6ES7531-7TF00-0AB0 (SM 531 AI 8xTC/RTD/R HART) is the only AI card in the S7-1500 family that integrates HART v7 communication natively on every channel, allowing a TIA Portal V17 program to pull PV/SV/TV/QV data from field devices such as the Endress+Hauser TMT142 temperature transmitter and PMP71B-1Q689/0 pressure transmitter without a handheld or third-party tool. This reference details the exact procedure for using WRREC and RDREC system functions to perform acyclic HART reads and writes from a TIA Portal project.

1. Hardware Architecture and Channel Topology

The 6ES7531-7TF00-0AB0 occupies one slot on the S7-1500 backplane and provides eight isolated differential inputs. Each input is configurable for thermocouples (types B, E, J, K, N, R, S, T, U, C, L, TXK, GOST), RTDs (Pt100, Pt200, Pt500, Pt1000, Ni100, Ni1000, Cu10, Cu50, Cu100, LG-Ni1000), or resistance measurement (0–300/600/6000 Ω). Channels 0–1 and 2–3 are paired for HART modulation; an internal HART modem per pair decodes the FSK signal riding on the 4–20 mA loop generated by the field device.

2. Prerequisites

• CPU: S7-1500 with FW ≥ 2.0 (1511/1513/1515/1516/1517/1518; ET200MP CPUs also supported).
• Module: 6ES7531-7TF00-0AB0 firmware ≥ V1.0. Confirm FW with HW identifier via online diagnostics.
• Engineering: TIA Portal V17 Update 4 or later, with HSP (Hardware Support Package) for the module installed. S7-PCT is not required for this workflow.
• Field devices: HART v5/v6/v7 sensor. The TMT142 ships HART v7 by default; the PMP71B is field-selectable to HART v6 or v7.
• Wiring: Loop supply 24 V DC, polarity-correct twisted pair, HART 250 Ω minimum at the receiver side.
• Reference numbers: Each HART device must have a unique Long Tag (32 chars, HART v6+) or Tag (8 chars, legacy).

3. Configuring the Module in TIA Portal V17

1. Open the project, drag the 6ES7531-7TF00-0AB0 into a free slot of the S7-1500 rack.
2. In Properties > Module parameters, set each used channel:
   • Measurement type: TC, RTD-3 wire, RTD-4 wire, Resistance, or Disabled.
   • Smoothing: default "None"; use "Weak/Medium/Strong" if process is noisy.
   • Interference frequency suppression: 50 Hz / 60 Hz / None.
3. In Properties > HART:
   • Enable the channel for HART.
   • Assign the HART short address (0 for point-to-point, 1–15 for multidrop).
   • Set the number of dynamic variables to acquire (4 = PV/SV/TV/QV, 8, 16).
4. Compile hardware (Ctrl+F3) and download to the CPU. Confirm green module LED before continuing.

4. HART Variable Model (PV, SV, TV, QV)

All four variables are returned as IEEE-754 floats with a status byte (per HART v7 spec, command 9 returns variable code + EU units + time stamp + status). The TMT142 and PMP71B units are configurable from the device menu via HART command 11/12/13/14 or via Simatic PDM; WRREC can drive the same commands if writes are required.

5. WRREC and RDREC Function Blocks

Both functions live in the TIA Portal Standard Library under "Communication" and conform to IEC 61131-3. They implement acyclic record read/write services via PROFINET slot/index addressing.

6. HART Record Index Map for the 6ES7531-7TF00-0AB0

The SM 531 exposes HART data through PROFINET record indexes on the HART submodule. The table below summarizes the indexes most commonly used in TIA Portal V17 with this module. Values are documented in the Siemens Function Manual "Analog Input Module AI 8xTC/RTD/R HART" (entry ID 109773780) and are confirmed against TIA V17.

7. Step-by-Step: Reading PV/SV/TV/QV via SCL

7.1 Declare data types

// UDT_HART_CMD3
TYPE UDT_HART_CMD3 :
  STRUCT
    PV       : REAL;      // engineering units
    SV       : REAL;
    TV       : REAL;
    QV       : REAL;
    Loop_mA  : REAL;      // loop current
    Percent  : REAL;      // % of range
    Status   : BYTE;      // HART variable status
    Code     : BYTE;      // variable code for QV
  END_STRUCT;
END_TYPE

7.2 FB instance for cyclic read

FUNCTION_BLOCK FB_HART_ReadCmd3
VAR
  HART_ID : HW_IO;            // IO handle from PLC tags (HART submodule)
  RTrigger: BOOL;
  RDREC_1 : RDREC;
  Buf     : ARRAY[0..25] OF BYTE;
  RData   : UDT_HART_CMD3;
  Busy    : BOOL;
  Done    : BOOL;
  Err     : BOOL;
  Status  : WORD;
END_VAR

RTrigger := RTrigger;  // drive from cycle

// Trigger only when no other HART job is active
IF NOT Busy THEN
  RDREC_1(REQ := RTrigger,
          ID  := HART_ID,
          INDEX := 2,             // CMD 3 record
          MLEN := 26,
          VALID => ,
          BUSY => Busy,
          DONE => Done,
          ERROR => Err,
          STATUS => Status,
          RECORD := Buf);
END_IF;

IF Done AND NOT Err THEN
  RData.PV := REAL_OF_BYTES(Buf[0],Buf[1],Buf[2],Buf[3]);
  RData.SV := REAL_OF_BYTES(Buf[4],Buf[5],Buf[6],Buf[7]);
  RData.TV := REAL_OF_BYTES(Buf[8],Buf[9],Buf[10],Buf[11]);
  RData.QV := REAL_OF_BYTES(Buf[12],Buf[13],Buf[14],Buf[15]);
  RData.Loop_mA := WORD_TO_REAL(SHL(WORD_OF_BYTES(Buf[16],Buf[17]),0)) / 1000.0;
  RData.Status := Buf[24];
END_IF;

7.3 Cycle handling

Trigger reads at 1–2 s intervals to avoid HART bus contention; the SM 531 internally buffers the response so acyclic calls from user code do not block PROFINET cyclic traffic. For time-critical loops trigger on a TON with 1500 ms pulse.

8. Step-by-Step: Writing a Tag via WRREC (HART CMD 18)

FUNCTION_BLOCK FB_HART_WriteTag
VAR
  WBuf  : ARRAY[0..31] OF BYTE;
  WRREC_1: WRREC;
  Busy  : BOOL;
  Done  : BOOL;
  Err   : BOOL;
  Sts   : WORD;
END_VAR

// Build HART CMD 18 (Write Tag Descriptor) byte stream
WBuf[0] := 16#82;            // HART preamble (preamble is sent automatically)
WBuf[1] := 16#86;            // delimiter
WBuf[2] := 18;               // CMD 18
WBuf[3] := 24;               // data length incl.
// ... pack tag descriptor (16 ASCII bytes) into WBuf[4..19]

WRREC_1(REQ := TRUE,
        ID  := HART_ID,
        INDEX := 17,
        LEN  := 26,
        DONE => Done,
        ERROR => Err,
        STATUS => Sts,
        RECORD := WBuf);

9. Verification Procedure

1. Place the CPU in RUN with the module synchronized. The DIAG LED on the SM 531 must be green.
2. Open an HMI WinCC Unified tag that points to RData.PV. The value must match the field transmitter display.
3. Cross-check with Endress+Hauser Fieldcare connected on the same loop via a HART USB modem: PV and SV must agree to 4 decimal places.
4. Force a HART burst (PMP71B supports burst mode) and verify the STATUS byte = 16#00 (good non-cascade).
5. In Online > Diagnostics, expand the SM 531 and read the channel-level "HART status". Acceptable values: 0 (OK), 1 (Var Not Found), 2 (Cmd Not Implemented), 5 (Communication Error).
6. Log the STATUS word from RDREC; hex 0000 means success, 80A1 / 80C3 indicate record index errors, 80B1 protocol issues.

10. RDREC / WRREC STATUS Codes

11. Troubleshooting Matrix

12. Field-Proven Practices

• One acyclic job per HART channel at a time. The SM 531 internally serialises HART requests; overlapping RDREC calls on the same channel cause 80C4.
• Never burst-mode + heavy acyclic traffic on the same channel. The burst stream and acyclic CMD share the HART bus and will collide.
• Use Fieldcare or PDM for initial commissioning (range, units, write-protection) and reserve WRREC for runtime tag/message writes only. This matches the recommended workflow from E+H technical support.
• Track the device revision. HART CMD 0 returns the device revision (7 for TMT142, 7 for PMP71B). Some commands differ between revision 5 and 7.
• Loop current reading. Always read loop current from CMD 2 or CMD 3; reading it as an analog mA from the same channel is redundant and halves update rate.
• Retain long tags across firmware updates by exporting the project; the long tag is part of the sensor NVM, not the PLC.

13. Alternate Platform Notes

• ET200MP / SIMATIC ET200SP: The 6ES7531-7TF00-0AB0 is also usable in an ET200MP rack behind an IM 155-5 PN HF or higher. The procedure is identical.
• S7-1200: There is no equivalent module. Use ET200MP remote IO, or migrate to S7-1500.
• PROFINET vs PROFIBUS: The 6ES7531-7TF00-0AB0 is PROFINET only. For PROFIBUS DP, the legacy 6ES7331-7TF01-0AB0 (S7-300) follows the same WRREC/RDREC scheme but with PROFIBUS slot/index translation.
• TIA Portal V16 vs V17: V17 added the HSP for module FW V2.0 and the channel-level HART diagnostics. Older projects will compile but show "unknown submodule" without the V17 HSP.

14. Cross-References

• Siemens Function Manual "SM 531 AI 8xTC/RTD/R HART (6ES7531-7TF00-0AB0)", entry ID 109773780.
• TIA Portal V17 System Manual "RDREC / WRREC", 109773506.
• Endress+Hauser Operating Instructions for TMT142.
• Endress+Hauser Operating Instructions for Cerabar PMP71B.
• HART Universal Command Specification, FieldComm Group.

FAQ