Resolving SFC 14/15 Error 8090 on S7-400 Profibus DP Systems

SFC 14 (DPRD_DAT) and SFC 15 (DPWR_DAT) are the canonical Siemens system function blocks for transferring consistent process data between an S7-400 CPU and a Profibus DP slave. Both blocks surface a 16-bit RET_VAL that uses a hex-coded error taxonomy. A return value of -32624 on a step 7 S7-414-3DP CPU, communicating with a third-party DP slave (in this case a Thermo Scientific Micro-Tech 9000 belt scale via its GSD file), is the signed representation of W#16#8090. The error is an LADDR-class fault, not a Profibus diagnostic fault, which is why the DP slave can be reported as healthy on the bus while data exchange still fails.

This reference describes the decoding path, enumerates every documented W#16#80xx cause for SFC 14/15, walks through the diagnostic logic for an S7-414-3XM05-0AB0 running firmware V5.3, and provides a step-by-step recovery procedure including GSD adjustments, LADDR hex conversion, consistent-length verification, and the move-out-of-process-image pattern that breaks persistent 8090 faults.

1. Symptom Summary

The reported failure mode is reproducible and consistent across both SFCs:

• CPU: Siemens SIMATIC S7-414-3DP, order number 6ES7 414-3XM05-0AB0, firmware V5.3.
• DP master interface: Integrated Profibus DP interface of the 414-3DP (IF1), operating as a DP Class 1 master.
• DP slave: Thermo Scientific Micro-Tech 9000 belt scale integrator, configured through its vendor GSD file.
• Cycle: SFC 14 reads 48 words, SFC 15 writes 48 words. Lengths match on both sides (HW Config and PLC program).
• LADDR input: 1500 decimal (intended as W#16#5DC).
• Bus diagnostics: The DP slave shows no diagnostic interrupt; it is visible online and reports its diagnostic state as healthy.
• Failure surface: RET_VAL of SFC 14 and SFC 15 returns the signed integer -32624.

The healthy bus state with simultaneously failing consistent-data read/write is the diagnostic fingerprint of an LADDR-class error. The S7-400 resolves the slave's logical base address from HW Config and the GSD slot map; if the LADDR in the call does not point at the configured slot, or if the consistent-length restriction is violated, the SFC returns W#16#8090 without ever raising a Profibus diagnostic interrupt.

2. Decoding -32624 to W#16#8090

The RET_VAL of SFC 14 and SFC 15 is defined as a 16-bit signed integer. The signed value is the two's-complement interpretation of the unsigned error word defined by Siemens. To decode any negative RET_VAL reported by these SFCs, apply the following conversion:

unsigned_word = 65536 + signed_RET_VAL

Applying the formula to the reported value:

unsigned_word = 65536 + (-32624) = 32912 = 0x8090

Cross-check by direct hex expansion: 0x8090 = (8 × 4096) + (0 × 256) + (9 × 16) + 0 = 32768 + 144 = 32912. The two values agree, confirming that the return is W#16#8090. From this point forward the error should be read as W#16#8090, the canonical Siemens error code.

3. Root Cause Catalogue for W#16#8090 on SFC 14/15

Per the Siemens online help for SFC 14 (DPRD_DAT) and SFC 15 (DPWR_DAT), the W#16#8090 cause is multi-branched. The three branches that map to this code are summarized below.

For a 48-word / 48-word symmetrical slot on a Profibus DP slave with a vendor-supplied GSD, the dominant root cause of 0x8090 in field reports is branch 1 — the slot-to-LADDR mismatch produced by an incorrectly generated or incorrectly imported GSD module map.

4. Affected Hardware and Firmware Context

Specifics of the installation drive both the symptom and the resolution path. The values below were extracted from the original field report and from the corresponding Siemens product catalog.

For the Siemens S7-400 product family, refer to the S7-400 Automation System, Module Data manual for the integrated Profibus DP interface capabilities and to the SFC manual for S7-300/400 for the canonical DPRD_DAT and DPWR_DAT error tables.

5. SFC 14 (DPRD_DAT) and SFC 15 (DPWR_DAT) Full Error Reference

Although the active fault is W#16#8090, the surrounding error codes are commonly encountered during the same diagnostic session. The complete SFC 14/15 return-value catalogue is reproduced below for reference.

For an installation where the bus is healthy and the slave is in data exchange, only the W#16#8090 / 8091 / 8092 / 8093 cluster is realistic. Codes in the W#16#80A0 / 80B0 / 80C0 / 80FF range indicate a hardware, firmware, or wiring fault that would also surface in the slave's diagnostic buffer.

6. Diagnostic Workflow

The order in which checks are executed matters: it is most efficient to verify the LADDR slot map (which is the most common cause) before descending into bus-level diagnostics. The recommended sequence is:

1. Capture the unsigned RET_VAL. Add a temporary WORD tag, copy the RET_VAL of SFC 14 into it, and force a monitor session. The hex value must be 0x8090 for the rest of this article to apply.
2. Open the slave in HW Config. Locate the Thermo Scientific Micro-Tech 9000 in the Profibus DP subnet. Expand the slot list and identify the module(s) producing the 48-word I/O. Write down the start address of the input module and the start address of the output module, both in decimal and in hex.
3. Compare LADDR to the slot's start address. The SFC 14 LADDR must equal the input-module start address; SFC 15 LADDR must equal the output-module start address. If the GSD imported both as a single combined module with separate input and output halves, the SFCs can call the same slot with separate LADDR tags for each direction.
4. Convert the decimal address to a hex WORD. The reported LADDR is 1500 decimal = 0x5DC. Confirm that the SFC call uses the literal W#16#5DC (or a WORD tag loaded with the same value). Avoid using INT tags that may be displayed as decimal and lead to off-by-one entry errors.
5. Confirm the consistent-length boundary. The S7-414-3DP supports a maximum consistent-data area of 32 bytes (16 words) per slot in the standard process image. To transfer 48 words = 96 bytes, the slot must be configured outside the process image and the data must be transferred with SFC 14/15. Verify that the slot is not mapped to the process image and that the RECORD/SD length matches the configured length in bytes.
6. Verify the GSD-derived module layout. Open the GSD file in a text editor and search for the module names with 48-word (96-byte) input/output lengths. Confirm that the GSD Module record declares the unit as 0x96 (hex) for the total length. A common error is that the GSD declares the unit as 48 words (decimal) but the slot consumes the length as words not bytes, leading to a 96-byte expected length against a 48-byte actual length.
7. Online test the call. With a single SFC 14 call in OB1 (or a low-priority cyclic OB) and the LADDR corrected, monitor RET_VAL and the first few bytes of the RECORD buffer. If RET_VAL returns 0, the LADDR-class fault is resolved. If it persists, branch to W#16#8091 / 8092 / 8093 diagnosis.

7. Resolving the LADDR Parameter

The LADDR parameter of SFC 14/15 is a 16-bit logical address of the slot, not the diagnostic address of the slave. The conversion from the slot's HW Config start address to the LADDR literal is mechanical but easy to get wrong.

For an input module whose start address is 1500 in HW Config:

1500 (decimal) = 5DC (hex) = W#16#5DC

The SFC call should be written as:

CALL "DPRD_DAT"     // SFC 14, read consistent data
LADDR  := W#16#5DC   // input-module start address, hex WORD
RET_VAL := MW100     // signed RET_VAL, also view as W#16# in monitor
RECORD  := P#DB20.DBX0.0 BYTE 96   // 48 words = 96 bytes

For an output module whose start address is 1534 (a typical 48-word gap):

1534 (decimal) = 5FE (hex) = W#16#5FE

CALL "DPWR_DAT"     // SFC 15, write consistent data
LADDR  := W#16#5FE   // output-module start address, hex WORD
RET_VAL := MW102     // signed RET_VAL
SD      := P#DB21.DBX0.0 BYTE 96   // 48 words = 96 bytes

To make the LADDR more legible in the program, define two WORD constants in a data block and use them by name:

DATA_BLOCK "DP_ADDR"
  STRUCT
    INPUT_LADDR  : WORD := W#16#5DC;   // 1500 dec, input slot
    OUTPUT_LADDR : WORD := W#16#5FE;   // 1534 dec, output slot
  END_STRUCT
END_DATA_BLOCK

Then call the SFCs with LADDR := "DP_ADDR".INPUT_LADDR and LADDR := "DP_ADDR".OUTPUT_LADDR. The symbol table binds the hex value to a meaningful name and prevents accidental decimal/hex swaps.

8. Consistent Data Length and Process Image Considerations

The S7-400 default consistent-data region is small. The integrated Profibus DP interface of the 414-3XM05-0AB0 places the I/O of each slot into the process image in 1-word or 1-byte chunks by default. A 48-word (= 96-byte) consistent read or write exceeds the default consistent region, which is why the slot must be configured outside the process image and accessed only through SFC 14/15.

The relevant rules are summarized below.

To remove a slot from the process image, open the slot properties in HW Config, uncheck Process Image (German: Prozessabbild) or set the Update attribute to none. The slot's start address remains valid, but the process image no longer references it. SFC 14/15 then becomes the only legal means of access.

The 96-byte (= 48-word) consistent length is supported on the S7-414 integrated DP interface. The maximum consistent-data area on the 414 integrated DP master is 128 bytes per slot for SFC 14/15 transfers; the project is well within this envelope.

9. GSD File and Slot Configuration

The Thermo Scientific Micro-Tech 9000 GSD file is the authoritative description of the slave's module map. The GSD text contains a list of Module records, each with a name, an input-byte count, an output-byte count, and an optional consistency specification.

Open the GSD in a plain-text editor and locate the module that declares 48 words of input and 48 words of output. The relevant lines have the form:

; Vendor-specific module definition for 48-word / 48-word configuration
Module = "MT9000 48W/48W" 0x60, 0x60
0x96 Input   ; total input length 0x96 = 150 dec = 75 words
0x96 Output  ; total output length 0x96 = 150 dec = 75 words
EndModule

Three GSD pitfalls are commonly observed in field installations of the MT9000:

1. Length declared in words but consumed in bytes. A module declaration of 0x30 (48 dec) with the words qualifier yields only 48 bytes of I/O, not 96. If the PLC program transfers 96 bytes, the SFC will return W#16#8090 because the consistent-length restriction is violated.
2. Vendor-supplied GSD that places the I/O inside the process image by default. Some MT9000 GSD versions pre-set the Update attribute to process image. With 96 bytes, this leads to inconsistent updates. Set the Update attribute to none explicitly.
3. Module inserted in the wrong slot. Some GSDs allow multiple module instances; the wrong one can be selected from the catalog. Verify that the slot's Module name matches the one whose length matches 96 bytes.

If the GSD cannot be edited or if the vendor's tool does not expose the byte/word qualifier, an alternative is to insert the module with a Universal Module entry from the HW Config catalog (right-click the slot → Insert Object → Universal Module) and to enter the 96/96 length manually. The universal module is a GSD-language fallback for any DP slave, and it is interpreted as a consistent-data area of the specified length. The trade-off is that the diagnostic text in the slave's Module Information dialog is generic.

10. Step-by-Step Commissioning Procedure

The following procedure resolves the W#16#8090 fault on an S7-414-3DP with the Thermo Scientific MT9000 slave. The steps assume a live process; if the process cannot tolerate a brief PLC restart, transfer the project offline and download at the next scheduled stop.

1. Connect STEP 7 to the CPU. Open the project, go online, and place the CPU in STOP.
2. Open HW Config and select the MT9000 slave. Double-click the slave, navigate to the Configuration tab, and confirm the slot population. Replace the slot with a Universal Module if the vendor GSD is suspect, configured for 96 bytes input / 96 bytes output.
3. Uncheck the process-image update attribute for the slot. Save and recompile HW Config.
4. Note the start addresses of the input and output halves. The combined-module convention produces two addresses; the S7-400 places the input start at the lower address and the output start immediately after. Record the input start as W#16#5DC and the output start as W#16#5FE if the input starts at 1500.
5. Open the program editor and locate the SFC 14/15 calls. Replace any INT-typed LADDR with a WORD literal. Add the symbolic constants defined earlier.
6. Confirm the data block lengths. The RECORD (SFC 14) and the SD (SFC 15) ANY pointers must point to 96-byte arrays. The byte-count field of the ANY must be 96, not 48 and not 192.
7. Save, recompile, and download the program and the HW Config.
8. Restart the CPU. Place the CPU in RUN. Watch the DP slave's diagnostic state in the online view; it should transition from Not Ready → Ready → Data Exchange.
9. Monitor the SFC 14 RET_VAL. A return of 0 indicates success. A persistent W#16#8090 after the corrections indicates a residual GSD/LADDR mismatch that the slot inspection did not catch. Capture the module's slot number and start address and re-cross-check with the program.
10. Monitor the SFC 15 RET_VAL during a write test. The MT9000 echoes the write buffer for diagnostics; if the echoed length is wrong, the GSD is consuming the length in the wrong unit.

11. Verification and Online Testing

After applying the corrections, run a structured verification to confirm that the data exchange is consistent. The verification matrix below is suitable for the MT9000 application but applies to any 96/96 DP slot.

To confirm the consistent-length atomicity, the following sequence in OB1 is effective:

// Force a known pattern into the read buffer
L W#16#AA55
T DB20.DBW 0
T DB20.DBW 2
T DB20.DBW 4
... (repeat for all 48 words)

// Trigger SFC 14 to read the slave's echo back
CALL "DPRD_DAT"
LADDR  := "DP_ADDR".INPUT_LADDR
RET_VAL := MW100
RECORD  := P#DB20.DBX0.0 BYTE 96

// Compare the pattern
L DB20.DBW 0
L W#16#AA55
==I
= M 100.0   ; "pattern OK" flag

If RET_VAL is 0 and M 100.0 remains set, the consistent read is working. The same pattern can be applied in reverse with SFC 15 to verify the consistent write.

12. Cross-Platform Notes

Although this article focuses on the S7-400, the same SFC 14/15 error code is also valid for the S7-300 (CPU 31x with integrated DP) and for the ET 200S/IM 153 DP slave interface. The semantic is identical: W#16#8090 means an LADDR-class fault. The differences across platforms are:

• S7-300 integrated DP: maximum consistent data is 32 bytes per slot for the integrated interface. For 48-word (96-byte) slots, an external CP 342-5 or a CPU 31x with the 2-series integrated DP may be required to lift the limit.
• S7-400 external CP 443-5 Extended: maximum consistent data is 240 bytes per slot, more than enough for 96 bytes.
• ET 200S as a slave: the slot must be configured with the same length on both the master and the slave side; the same SFC 14/15 calls apply from the master CPU.

For DP/DP coupler links or for S7 routing, the same error semantics apply. The SFC 14/15 call is local to the local Profibus master interface; it does not route through a gateway.

13. Frequently Asked Questions