Acyclic PROFINET Communication with Siemens PLC WRREC/RDREC Guide

Overview: Acyclic PROFINET Between Siemens S7 Controllers and PROFINET Devices

PROFINET IO defines two distinct data exchange paradigms: cyclic real-time (RT) IO and acyclic record services. Cyclic IO transfers process data at a configured send clock (typically 1 ms, 2 ms, or 4 ms) between the IO Controller and its assigned IO Devices. Acyclic services, by contrast, operate on a best-effort basis alongside cyclic traffic and are intended for parameterization, diagnostics, and non-time-critical record read/write operations.

For applications where a Siemens S7 PLC must exchange configuration data, diagnostics, batch records, or non-deterministic payload with an external PROFINET Device (such as a drive, I/O station, controller, or sensor head) on a 40-60 second polling cycle, acyclic PROFINET is the preferred mechanism. It removes the need to consume cyclic I/O slots for slow-changing data and avoids burdening the real-time scheduler with low-priority traffic.

This article documents the practical implementation of acyclic PROFINET read/write record services between a Siemens S7-1500 (or compatible S7 CPU with integrated PROFINET interface) and an external PROFINET Device, focusing on the WRREC and RDREC function blocks, the meaning of the ID hardware identifier and the INDEX record index, and the canonical slot / subslot / index addressing model used in PROFINET IO record CRs.

Cyclic vs Acyclic PROFINET: When to Use Each

Use acyclic services whenever the data is:

• Sampled or written at intervals > 100 ms (logging, batch records, parameter dumps).
• Larger than the cyclic slot envelope (e.g., recipe arrays, firmware parameters).
• Addressable through standardized PROFINET records (0xAFF0 module identification, 0xF80C IMEI, 0x802A PD Port, etc.) or manufacturer-specific records.
• Bound for a Siemens data block (DB) that is not replicated as cyclic IO.

PROFINET Record CR Addressing: Slot, Subslot, Index

Every PROFINET acyclic read/write record request uses the canonical tuple:

RDREC / WRREC inputs:
  LADDR      = HW identifier of the slot or subslot (the "ID")
  INDEX      = record index (0..65535)
  SLOT       = (encoded in LADDR)
  SUBSLOT    = (encoded in LADDR)
  LEN        = record length in bytes
  RECORD     = pointer to the user data area
  DONE / BUSY/ ERROR / STATUS = call result

The record service targeting in PROFINET is described as slot, subslot, index per the Siemens acyclic communication application note:

1. Slot selects the module (a logical slot number from 0 to the device's slot count).
2. Subslot selects the submodule within that slot. Subslot 0 of the slot is the slot itself; subslot 1 is typically the first submodule.
3. Index selects the record number within the selected subslot. Index 0xAFF0 is reserved by the PROFINET specification for IM (I&M) data; indexes in the 0x8000-0xFFFF range are typically manufacturer-specific.

WRREC and RDREC Function Blocks: Parameter Reference

Siemens provides the RDREC (Read Record) and WRREC (Write Record) function blocks for S7-300/400/1200/1500 in the "PROFINET IO" or "Communication / PROFINET IO" library. The signature for S7-1500 (FW >= V2.0) is:

On a Phoenix Contact PLCnext controller the equivalent blocks are also named WRREC and RDREC; they map 1:1 to the Siemens semantics because the PROFIdrive/PROFINET record services are identical at the wire level. The PLCnext Engineer help system documents the local instance DB layout and runtime behavior.

Where to Find the ID (HW Identifier / LADDR) Value

The ID parameter is the hardware identifier (HW-ID) that TIA Portal assigns to a slot or subslot when the PROFINET Device GSD is imported and instantiated. There is no global numbering scheme across vendors; the value is project-local.

To discover the correct ID in TIA Portal:

1. Open the device view of the S7-1500 CPU.
2. Click on the slot of the PROFINET Device (or on a specific submodule) you want to address acyclically.
3. Open Properties > System constants (or use PLC tags > Show all tags > System constants). The system constant name follows the pattern <DeviceName>~HW_ID or <SubmoduleName>~HW_ID.
4. Pass this constant directly to the ID input of RDREC/WRREC. Do not hard-code the numeric value; use the named constant so that renumbering during commissioning does not break the program.

Where to Find the INDEX Value

The INDEX is the record number defined in the device's PROFINET profile or GSD. Three sources are authoritative:

1. PROFINET standard records — reserved indexes per the PROFINET specification (e.g., 0xAFF0 I&M0, 0xAFF1 I&M1, 0xF80C PD Port, 0x802A Multiple Assignment). These are stable across vendors.
2. Device GSD (GSDML) — the manufacturer-specific record indexes are declared in the device's GSDML under the records for each submodule. Open the GSDML in TIA Portal via Options > Manage Generic Station Description Files (GSD), then drill into the submodule's record list.
3. Device manual / parameter list — drives and intelligent IO typically publish the parameter mapping in their parameter manual. Siemens SINAMICS drives, for example, map many PROFIdrive parameters to PROFINET indexes in the <Parameter Manual> chapter.

Reading a Siemens DB Over Acyclic PROFINET

Siemens S7 does not natively expose data blocks as acyclic PROFINET records from the CPU acting as IO Controller. The CPU exposes cyclic IO; acyclic records live on the device side. To publish DB content over acyclic PROFINET to an external client, you must either:

• Run a program on the S7 that serves RDREC requests on a free slot by implementing a custom PROFINET device (i.e., make the S7 act as an IO Device rather than IO Controller), or
• Use the S7 Communication server functions (PUT/GET) over ISO-on-TCP or S7 Communication on the same Ethernet interface — these coexist with PROFINET on the same physical port.

If the goal is to log DB contents to a server every 40-60 seconds, the simpler and support-recommended path is to publish the relevant DB region through the cyclic IO of an attached PROFINET Device and let the server poll via PROFINET acyclic read. The Siemens application note 109743977 walks through the exact WRREC/RDREC pattern for an S7-1500 -> SINAMICS V90 PN link.

Step-by-Step Implementation on S7-1500 with TIA Portal

Prerequisites: TIA Portal V17 or later, S7-1500 CPU with PROFINET interface (any FW >= V2.0), GSDML installed for the target PROFINET Device, the device configured as an IO Device under the S7-1500 IO Controller.

1. Add the PROFINET Device. Drag the device from the hardware catalog onto the S7-1500 PROFINET subnet. Verify the device appears online and the cyclic IO exchange is green in the online diagnostics.
2. Open an OB for acyclic logic. Use OB1 (or a cyclic OB with longer runtime, e.g., OB30). Do not call RDREC/WRREC from an OB with a tighter send clock than the network can service; OB1 at 40-60 s polling is ideal.
3. Instantiate the block. Drop RDREC (FB52) from the Communication > PROFINET IO library. Configure its instance DB (e.g., iDB_RDREC).
4. Wire the inputs:
   • REQ — rising-edge tag pulsed by your 40-60 s timer (e.g., clock generator using TP or a self-resetting TON).
   • ID — the system constant from Properties > System constants of the target submodule.
   • INDEX — the manufacturer record index, e.g., W#16#002A.
   • MLEN — max record length; for parameter records 16-64 is typical; for image transfers up to the buffer size.
   • RECORD — pointer to a temp DB or static DB region sized to at least MLEN bytes.
5. Handle the outputs:
   • Poll BUSY; do not retrigger while busy.
   • On DONE = TRUE, capture LEN and copy the RECORD buffer to your logging DB.
   • On ERROR = TRUE, evaluate STATUS against the table below.
6. Repeat with WRREC if you need to write parameters back to the device.

Reference SCL Snippet (S7-1500)

// Trigger every 50 s via background OB
IF g_trigger_50s AND NOT iDB_RDREC.Busy THEN
    iDB_RDREC.Req := TRUE;
ELSE
    iDB_RDREC.Req := FALSE;
END_IF;

// Single-instance call
RDREC_DB(
    REQ   := g_trigger_50s,
    ID    := "PNDevice_Head"~HW_ID,     // system constant
    INDEX := 16#002A,                   // record index from GSD
    MLEN  := 32,
    VALID := ,                          // (S7-1200/1500 alias for DONE)
    BUSY  := iDB_RDREC.Busy,
    ERROR := iDB_RDREC.Error,
    STATUS:= iDB_RDREC.Status,
    LEN   := iDB_RDREC.Len,
    RECORD:= P#DB_LOG.buffer BYTE 32
);

STATUS / Error Code Reference for RDREC and WRREC

Verifying the Acyclic Exchange

1. Online watch on RDREC/WRREC: in TIA Portal, go Online > Monitor All. Watch REQ, BUSY, DONE, LEN, STATUS in the instance DB.
2. Check the record buffer: open the data block that contains the RECORD target and confirm bytes have updated.
3. Use PROFINET diagnostics: Online > Online & Diagnostics on the device, open Diagnostics buffer. Acyclic errors are reported here with timestamp and slot/subslot/index.
4. External capture: a Wireshark trace filtered to pn_io on UDP port 34964 will show RDREC/WRREC frames with the slot, subslot, and index fields decoded. This is the ground-truth verification when an in-PLC check is ambiguous.

Troubleshooting Matrix

Notes on Data Capacity and Forward Planning

If the user requirement may grow beyond 512 bytes per direction, evaluate the following scaling paths before commissioning:

• Submodule fragmentation: split the data set across multiple submodules, each with its own record index. The HW-ID resolves per submodule, so the user program iterates over an array of submodules.
• Cyclic + acyclic hybrid: keep the high-frequency process data in cyclic IO (typical 32-256 bytes per slot) and use acyclic records for bulk parameters, logs, and historical data.
• Index range planning: reserve a contiguous manufacturer index block in the GSDML (e.g., 0x4000-0x4FFF for application logs) so that adding records later does not require re-mapping the existing ones.
• Record size limits: although the PROFINET transport permits records up to ~64 KB, many IO Devices implement smaller caps (e.g., 240 bytes) to fit within a single UDP datagram without IP fragmentation. Always read the device's record maximum from its GSDML RecordLengthList.

Interoperability Notes: Phoenix Contact PLCnext, Third-Party Controllers, and SINAMICS Drives

The same acyclic record services are available on Phoenix Contact PLCnext controllers, Bosch Rexroth ctrlX, Beckhoff TwinCAT, and any PROFINET IO Controller that exposes the PROFINET RPC interface for record CRs. The block naming convention RDREC/WRREC follows the PROFIdrive convention, and the ID/INDEX/RECORD semantics are wire-compatible. When bridging S7-1500 acyclic services to a ctrlX Data Layer or PLCnext variable space, map the binary record payload byte-for-byte into the destination buffer and use the Bosch Rexroth acyclic PROFINET how-to as a wire-level reference.

For SINAMICS drives specifically, the parameter mapping from PROFIdrive parameter number (PNU) to PROFINET record index is documented in the SINAMICS parameter manuals. The Siemens application note 109743977 (PDF) provides a worked S7-1500 -> SINAMICS V90 PN example that can be adapted to any PN Device.

FAQ