Resolving SFC59 RD_REC Error 8093 on SM 336F HART Modules

Problem Summary

An SFC59 (RD_REC) call issued by a CPU 417-5H against the fail-safe analog input module SM 336F (Siemens 6ES7336-4GE00-0AB0, 6 AI, 15-bit, HART) returns RET_VAL = W#16#8093, "module does not support this record". The block is invoked from SCL inside a CFC chart on a station equipped with S7 F Systems, and the module sits on an ET 200M behind an IM 153-4 PN connected by PROFINET IO. The same 8093 is observed on SFB52 (RDREC), SFC13 (DPNRM_DG), and the F-channel driver blocks of the F-library. The issue is not the module firmware or wiring; it is the way standard diagnostic records are addressed on F-modules on PROFINET IO. This reference explains the data structure, the role of the F-runtime, and the proper SFB and record numbers to use.

Hardware Identification and System Topology

The component 6ES7336-4GE00-0AB0 is the SM 336F, 6 AI, 15-bit, HART, fail-safe analog input module of the SIMATIC S7-300 / ET 200M family. It carries the following physical and electrical characteristics that matter for diagnostic record interpretation:

SM 336F (6ES7336-4GE00-0AB0) Key Hardware Parameters

Parameter	Value
Order number (MLFB)	6ES7336-4GE00-0AB0
Module family	SM 336F, F-AI 6 x 0/4…20 mA HART
Resolution	15 bits plus sign
Number of channels	6 (single-ended, isolated in groups of 1)
Input ranges	0…20 mA, 4…20 mA, 4-wire transducer
HART revision	Rev. 5 / Rev. 6 compatible
Safety integrity	SIL 2 / SIL 3 (Cat. 3 / Cat. 4)
PROFINET IO / PROFIBUS DP	Both (via IM 153 / IM 153-4 PN)
Module diagnostic length	up to 34 bytes (DS1)
Channel diagnostic per channel	up to 8 bytes (DS1 channel block)
Update time, typical	20 ms / channel, 120 ms for 6 channels
Substitute value (passive)	0 mA (current source disabled)

The station in the source is wired as follows:

• CPU: 417-5H (rack 0, slots 1–3 redundant pair, SIMATIC S7-400H with S7 F Systems)
• CPU order number: 6ES7417-5HT06-0AB0 (firmware V6.0 or later)
• PROFINET IO controller port: integrated PN interface of the 417-5H, configured as IO controller
• IM 153-4 PN: order number 6ES7153-4BA00-0XB0 (or 6ES7153-4DA02-0XB0), ET 200M PN head module
• Slot configuration: SM 336F in slot 4 of the ET 200M, base logical address e.g. PIW 512…PIW 523
• PROFINET device name: configured in HW Config / TIA Portal topology editor, e.g. et200m_aihart1
• Fail-safe blocks: F-runtime library V6.x, F-CPU firmware from V6.0
• CFC environment: PCS 7 V9.0 SP2 or later, SCL source blocks compiled into the CFC chart

The path between the CPU and the module traverses a PROFINET IO link. The IM 153-4 PN terminates the IO device side; the SM 336F is a slot of that device. From the controller's point of view the module is reached through an IOID = 54 (input, read), LADDR = base address of the input area. The base address is the same as the I/O address configured in the device list. The PROFINET AR (Application Relationship) is owned by the active CPU of the 417-5H pair; the standby CPU has no PN stack and cannot issue record-read RPCs against the IM 153-4 PN station.

SFC59 RD_REC – Interface and RET_VAL Reference

SFC59 (RD_REC) reads a data record from a module using the standard PROFINET / PROFIBUS DP record-read service. The block is declared as follows in the S7-300/400 system library:

FUNCTION_BLOCK RD_REC
VAR_INPUT
    REQ    : BOOL;     // Edge-triggered read request
    IOID   : BYTE;     // B#16#54 = inputs (read), B#16#55 = outputs (write)
    LADDR  : WORD;     // Logical base address of the module
    RECNUM : BYTE;     // Data record number 0…255
END_VAR
VAR_OUTPUT
    BUSY   : BOOL;     // 1 while read is in progress
    ERROR  : BOOL;     // 1 if error during read
    STATUS : WORD;     // RET_VAL – same as STATUS of SFB52
END_VAR
VAR_IN_OUT
    RECORD : ANY;      // Destination buffer (must be large enough)
END_VAR
END_FUNCTION_BLOCK

The RET_VAL field is identical in meaning to the STATUS output of SFB52 (RDREC). The codes that occur on the SM 336F path are:

SFC59 / SFB52 RET_VAL Codes Relevant to the SM 336F

RET_VAL (hex)	Meaning	Typical cause on F-module
0000	No error	—
7000	No job active, BUSY = 0	First call or job complete
7001	First call, BUSY = 1	—
7002	Subsequent call, BUSY = 1	—
8090	Logical base address invalid	Slot not configured, or address typo
8091	Module does not recognize RECNUM	Wrong record number in IO context
8092	RECORD is not of type BYTE	Wrong ANY pointer in SCL
8093	Record not supported by module	F-channel wrapper, or wrong RECNUM
80A0	Module NACK at start of read	F-signature mismatch, F-CPU in PASSIVATED state
80A1	Module NACK during read	F-runtime fault
80A2	DP/PN slave fault	IM 153-4 PN station failure
80A3	PROFIBUS DP / PN protocol error	Watchdog, name assignment, port fault
80A4	CI (communication interface) fault	Internal CPU ↔ PN stack error
80B0	Module not available / not configured	Slot empty in HW Config
80B1	Module type mismatch	Slot populated with wrong MLFB
80B2	Channel does not exist	Channel index out of range
80C0	No diagnostic data available	Diagnostics disabled in HW Config
80C1	Channel has no diagnostic data	Channel OK or channel not used

The 8093 is unambiguous: the addressed slot has received a record-read request, but it cannot satisfy it. The CPU never has to forward the record to the station when the record number is reserved or unknown. The decision whether to support the record is made inside the module firmware, so the user program receives the error in the very first call. The IOID value of B#16#54 is correct for input-direction modules: it tells the IO controller that the request is a "read from the input area of the addressed slot". An IOID of B#16#55 is reserved for output-direction reads and returns 8091 on a SM 336F.

Root Cause Analysis

The SM 336F is a fail-safe I/O module. From the S7 F Systems architecture, every read or write of a fail-safe channel is wrapped by an F-channel driver that maintains:

• The F-source address (CRC-protected signature block)
• The F-monitoring time for the channel
• The passivation state of the channel
• The discrepancy check between redundant channels
• The F-sil level and the F-CPU signature

The standard PROFIBUS DP / PROFINET IO record number scheme used for SIMATIC standard I/O does not map 1:1 to the F-channel driver. Records 0…31 are reserved for standard module identification, channel diagnostics, and HART data; records 100…199 are reserved for F-specific data. SFC59 with IOID = 54 and RECNUM = 1 (DS1) is interpreted by the F-head as a standard channel diagnostic request. The SM 336F F-firmware reports 8093 because the F-channel driver is the actual source of the diagnostic information, and the standard record-read RPC has no path into it. This is documented in the Siemens manual Structure and Content of Diagnostic Data for SIMATIC S7-300 / ET 200M Distributed I/O Device Fail-safe Signal Modules.

Three other reasons can produce the same 8093 and must be ruled out before assuming the F-channel driver is the cause:

1. Diagnostics disabled in HW Config. If "Channel diagnostics" and "HART diagnostics" are unchecked in the module properties, the F-channel driver still reports no data when standard records are polled. The remedy is to enable diagnostics in HW Config and re-download the configuration.
2. Wrong logical base address. The PROFINET device allocates slot addresses. The LADDR passed to SFC59 must be the start address of the F-input area (e.g. PIW 512). A LADDR pointing to a status byte, a value status, or a PII byte offset can return 8093 because the record-read RPC is sent to a different sub-slot. The base address of the slot is shown in HW Config / TIA Portal under the device list; it is not the address of the first value byte of the input word.
3. Module not in RUN. If the SM 336F is in PASSIVATED state because of a discrepancy, the F-CPU marks the channel as bad. Standard record reads during this state return 8093 instead of the live channel data. The remedy is to clear the discrepancy and re-integrate the channel through the F-block F_AI_PASS_ON.

Diagnostic Data Structure for the SM 336F

The complete diagnostic data layout for the SM 336F is given in the Siemens manual reference above. The data is organized in data records (DS) that are addressed by RECNUM in the standard SFC/SFB interface:

SM 336F Diagnostic and HART Data Records

RECNUM	DS name	Length (bytes)	Contents
0	DS0 – Module identification	16	Manufacturer, order number, serial, HW/FW version, profile
1	DS1 – Module diagnostics (channel group)	4 + 4·n	4-byte module status, n channel blocks of 4 bytes each
2…7	reserved	—	Not supported, return 8093
8…31	Channel-specific	varies	Range, scaling, substitute values, value status
64	HART mapping	68	Mapping of HART variables PV, SV, TV, QV to channels
65	HART feature list	21	List of supported HART commands, revisions
80	HART command response (read)	≤240	Response of an arbitrary HART command sent to the field device
96	Statistics	32	Counter of HART communication errors per channel
128	F-signature	36	F-source address, F-monitoring time, F-sil level
129	F-passivation state	8	Bit mask of passivated channels
130…139	F-channel user data	varies	User-level F records (read-only)
140…199	F-driver records	varies	Internal F-channel driver (not for direct user access)

Records 1 and 64…96 are addressable through SFC59 when the module is in standard (non-F) operation. Under F Systems, only the F-channel driver blocks of the F-library may retrieve these records, and only after the F-CPU has cleared the passivation state. The F-runtime uses record number 0x80 (128) to validate the F-source address on every safety message exchange; the 0x81 (129) record is the bit map of passivated channels that the safety program consults to detect safe-state behaviour. The HART-related structure of records 64, 65, 80 and 96 is functionally identical to the S7-1500/ET 200MP HART modules; a detailed description of the HART mapping layout can be found in the Siemens Analog Output Module AQ 4xI HART HF manual (applies to the output side but the HART record layout is shared across Siemens HART modules).

Solution 1: F-Library Record Read Block

The S7 F Systems library provides a dedicated record-read block, conventionally named F_AI_6x15Bit_RDREC (F-AI library V6.2 or later, ordered for the SM 336F HART module). The block wraps the SFB52 / SFC59 record read inside the F-signature check. The block signature for the SM 336F is loaded into the F-CPU during F-block compilation, and the block itself is certified for use up to SIL 3. The interface is:

FUNCTION_BLOCK F_AI_6x15Bit_RDREC
VAR_INPUT
    REQ    : BOOL;
    MODE   : BYTE;   // 0 = DS1, 1 = DS64, 2 = DS96, 3 = DS128
    CHAN   : BYTE;   // Channel index 0…5
    LADDR  : WORD;   // Same base address as the F-input
END_VAR
VAR_OUTPUT
    DONE   : BOOL;
    ERROR  : BOOL;
    STATUS : WORD;
    LEN    : INT;
    DATA   : ARRAY[0..239] OF BYTE;
END_VAR
END_FUNCTION_BLOCK

Calling sequence in SCL:

// F-IO area for the SM 336F
iStartAddr   : WORD := W#16#200;  // PIW 512, slot 4 of ET 200M
iMode        : BYTE := B#16#0;    // 0 = DS1 (channel diagnostics)
iChannel     : BYTE := B#16#2;    // channel 2 (0-based)

F_AI_6x15Bit_RDREC_DB(
    REQ    := bStart,
    MODE   := iMode,
    CHAN   := iChannel,
    LADDR  := iStartAddr,
    DONE   => bDone,
    ERROR  => bError,
    STATUS => wStatus,
    LEN    => iLen,
    DATA   => aDiagBuf
);

The F-block handles the CRC verification, the passivation check, and the record-RPC retry. If the underlying module is in a non-passivated state, the STATUS field returns 0 and the DATA array contains a fully populated DS1 / DS64 / DS96 / DS128 record. If the module is passivated, STATUS returns 0x80A0 and the block refuses to deliver data until the operator clears the passivation through the F-block F_AI_PASS_ON.

Solution 2: SFB81 RDSYSST for Non-Safety Status

When the F-library block is not available, the standard SFB81 (RDSYSST) returns the diagnostic status of all slots of the IO device. SFB81 is part of the standard S7-300/400 system library and does not require F-signature checks. It is the correct interface for non-safety status displays (HMI, asset management, alarm log):

FUNCTION_BLOCK RDSYSST
VAR_INPUT
    REQ      : BOOL;
    SSL_ID   : WORD;   // System state list ID
    INDEX    : WORD;   // Sub-list index, e.g. logical base address
END_VAR
VAR_OUTPUT
    RET_VAL  : INT;    // 0 = OK, 80A0 = no diagnostic available
    BUSY     : BOOL;
    SSL_HEADER : STRUCT
        LENGTH  : WORD;
        NR      : WORD;
    END_STRUCT;
    DR       : ANY;    // Destination buffer
END_VAR
END_FUNCTION_BLOCK

The relevant SSL_ID values for the SM 336F on PROFINET IO are:

SSL_ID Values for Module Status on PROFINET IO

SSL_ID	Sub-list	Returned data
W#16#0A92	Module status of all modules (PROFINET IO)	Logical base address, slot, type, status
W#16#0A93	Module status of a specific module (PROFINET IO)	Same as 0A92, indexed by LADDR
W#16#0F31	Module identification (PROFINET IO)	Order number, HW/FW version, I&M0 record

Calling sequence in SCL:

DATA_BLOCK DB_RDSYSST
    STRUCT
        header : STRUCT
            LENGTH : WORD;
            NR     : WORD;
        END_STRUCT;
        slots  : ARRAY[0..63] OF WORD;
    END_STRUCT;
END_DATA_BLOCK

SFB81_DB(
    REQ      := TRUE,
    SSL_ID   := W#16#0A93,
    INDEX    := W#16#200,    // base address of the SM 336F slot
    RET_VAL  => iRet,
    BUSY     => bBusy,
    SSL_HEADER => DB_RDSYSST.header,
    DR       := DB_RDSYSST.slots
);
IF iRet = 0 AND NOT bBusy THEN
    // Examine slot status word
    wStatus := DB_RDSYSST.slots[0];
END_IF;

The slot status word layout is defined in the STEP 7 Online Help, keyword "System State List (SSL)". A returned value of W#16#0004 means "module OK", W#16#0101 means "module faulty", W#16#0102 means "module not available". The user program does not receive the HART-specific content of the SM 336F, but the slot-level state is sufficient to drive an HMI display and to drive a non-safety alarm. SFB81 does not require F-signature checks and does not consume F-monitoring time, so it is safe to call from non-F task classes (OB1, OB35, OB82) without disturbing the safety program.

Solution 3: SFC13 DPNRM_DG on the IM 153-4 PN

The IM 153-4 PN is the PROFINET device. SFC13 (DPNRM_DG) reads the diagnostic buffer of a DP / PN slave by sending a standard "Get-Slave-Diag" RPC. On PROFINET IO, this RPC is mapped to the AR (Application Relationship) diagnostic read. The SM 336F diagnostic data is encapsulated inside the IM 153-4 PN slot 0, and SFC13 returns the concatenation of all slot diagnoses. SFC13 is also a non-F call and does not require F-signature checks. It is the most efficient way to read the entire station's diagnostic data with a single RPC.

Important: the IM 153-4 PN must be configured as the LADDR target, not the SM 336F. The base address of the IM 153-4 PN head is configured in HW Config and is normally the smallest address in the device list (e.g. PIW 0…PIW 1 for status bytes). SFC13 ignores the slot address: it always returns the complete station diagnosis.

DATA_BLOCK DB_DPNRM
    STRUCT
        data : ARRAY[0..255] OF BYTE;
    END_STRUCT;
END_DATA_BLOCK

SFC13_DB(
    REQ      := bRead,
    LADDR    := W#16#0,        // IM 153-4 PN base address
    RET_VAL  => iRet,
    BUSY     => bBusy,
    RECORD   := DB_DPNRM.data
);
IF iRet = 0 AND NOT bBusy THEN
    // Bytes 0…5: device diagnostic header
    // Bytes 6…(6+2·n): slot diagnostic blocks
    nSlots := DB_DPNRM.data[5];
    FOR i := 0 TO nSlots - 1 DO
        wSlot   := WORD_OF_BYTE(DB_DPNRM.data[6 + 4*i], DB_DPNRM.data[7 + 4*i]);
        wStatus := WORD_OF_BYTE(DB_DPNRM.data[8 + 4*i], DB_DPNRM.data[9 + 4*i]);
        // Examine wStatus, see standard PROFINET slot status bits
    END_FOR;
END_IF;

The slot status bits returned by SFC13 are the PROFINET IO standard format. Bit 0 = "module fault", bit 1 = "channel fault", bit 2 = "external fault", bit 3 = "no parameter assignment", bit 4 = "no user data", bit 5 = "operator intervention required", bit 6 = "module is in standby", bit 7 = "module is in maintenance". The 8093 on SFC59 does not affect SFC13 because the two RPCs travel on different PROFINET services: SFC59 → record-read RPC; SFC13 → read-slave-diag RPC. SFC13 should be polled at low frequency (1 s to 5 s) because the diagnostic buffer is updated by the IM 153-4 PN after every AR state change, and high-frequency polling can saturate the PROFINET send queue.

Solution 4: HART Diagnostics Enablement in HW Config

If HART diagnostics is unchecked in the module properties, the SM 336F still functions, but all HART-specific records (64, 65, 80, 96) are clipped. The user program reading any of these records through SFC59 then receives 8093 because the record is technically supported by the module firmware but the module is told not to publish it. The fix is in HW Config (STEP 7 V5.5) or in the device configuration of TIA Portal:

1. Open the SM 336F slot in HW Config.
2. Open the module properties → tab "Inputs".
3. Click "HART" sub-tab.
4. Enable "HART diagnostics" – "HART frame specific monitoring" must be set to "Enabled".
5. Enable "Status information supplied by the connected field device in the HART frame" – see the TIA Portal reference for the exact wording of this option: HART diagnostics in TIA Portal.
6. Re-compile the HW configuration and download it to the CPU 417-5H.
7. Cold restart the IM 153-4 PN station (power off / on, or PN station restart through STEP 7).

After the restart, the SM 336F starts to populate DS64, DS65, DS80 and DS96. SFC59 with RECNUM = 64, 65, 80, 96 will return valid data. SFC59 with RECNUM = 1 returns the channel-diagnostic DS1 with HART bit set for every channel whose HART communication is healthy. The HART frame structure on the 4…20 mA loop uses Bell 202 frequency-shift keying at 1200 bit/s superimposed on the analog signal; the module acquires one HART frame per channel every 1 s under normal conditions, and faster under burst-mode devices.

Passivation Handling and OB82 Diagnostic Alarms

The SM 336F can be in one of three passivation states defined by the F-runtime:

• Non-passivated: the channel is delivering live process data; HART records are readable.
• Passivated: the F-CPU has marked the channel as not-safe; live process data is replaced by the substitute value; HART records return 8093 (or 0x80A0 on retry).
• Passivated with operator clear: the F-block F_AI_PASS_ON has acknowledged the passivation; the channel is being re-integrated; HART records are temporarily inaccessible until the F-monitoring time has elapsed.

The passivation bit for the SM 336F is held in DS129 (record 0x81). Reading it with SFB81 (RDSYSST) SSL_ID W#16#0F31 is the most direct method. The result is an 8-byte bit map in which bit n corresponds to channel n. A bit value of 1 means the channel is currently passivated. The HMI / asset-management layer can then display a clear "channel passivated" message and prevent the user from expecting valid HART data.

The SM 336F posts the following OBs to the CPU 417-5H when its diagnostic state changes:

SM 336F Diagnostic OB Mapping

OB	Triggered by	Information in OB start info
OB82	Module diagnostic interrupt (channel fault)	Logical base address, channel, error type (HART fail, overrange, wire break)
OB83	Module plug / unplug, parameter change	Logical base address, event code
OB85	Module fault on I/O update	Logical base address of input area
OB121	Programming error from F-block	Block number, address in OB priority class
OB122	I/O access error on F-block	Logical base address, slot

OB82 is the only OB that contains the channel-level error type. The user can install an OB82 handler that copies the channel error to a global data block, so that the same information is available to the HMI without polling the module through SFC59. The OB82 start info is 20 bytes long and is described in the STEP 7 Online Help under "Diagnostic interrupt OB (OB82)". The four channel-error-type codes that occur most often on the SM 336F are 0x01 (short-circuit), 0x02 (overrange), 0x03 (wire break), and 0x06 (HART communication error). OB83 is the only OB that fires when a configuration change is downloaded to the SM 336F. The 8093 on SFC59 during a download window is often caused by a coincident OB83 – the user program must tolerate a transient 8093 for the duration of the parameter download, typically 1 to 3 seconds.

Verification Procedure

After applying any of the solutions above, perform the following verification steps before the system is released to production:

1. Slot status verification. In STEP 7 / TIA Portal, open "Online → Accessible Nodes" and confirm that the SM 336F appears in the slot list of the IM 153-4 PN with status "OK" (green check) and not "Fault" (red cross). The corresponding HART icon in the module properties must be green.
2. DS0 verification. Issue SFB52 / SFC59 with RECNUM = 0 and confirm that the first 8 bytes contain "6ES7 336-4GE00-0AB0" as ASCII (read in little-endian: bytes 0…9 = ASCII characters of the order number).
3. DS1 verification. Issue SFC59 with RECNUM = 1. Confirm that the 4-byte module status is 0x00000000 and that no channel block is flagged. The first byte of the channel block is the channel number (0…5); the second byte is the channel error type (0x00 = no error).
4. DS64 verification. Issue SFC59 with RECNUM = 64. Confirm that the HART mapping table shows 4 variables per channel: PV, SV, TV, QV. If the device is a 4-wire pressure transmitter, PV should be pressure in engineering units, SV should be sensor temperature, TV and QV may be unused.
5. DS80 verification. Issue SFC59 with RECNUM = 80. Confirm that the HART command 0 (read unique identifier) returns a 14-byte response: manufacturer ID, device type, device ID, preambles, command rev, device rev, software rev, hardware rev, flags.
6. Passivation test. Force a discrepancy between the redundant channels (open one wire on channel 0). The DS129 record must show bit 0 set within 1 second. The OB82 handler must record a "discrepancy" error type for channel 0.
7. HART loop test. On a non-F channel of the same module, attach a HART handheld (475/375) and confirm that the primary variable is updated every 1 s. The DS96 record must show a monotonically increasing success counter for that channel.
8. S7-400H redundancy test. On a CPU 417-5H, switch the master role using SFC90 (H_STATUS) to confirm that the SFC59 calls continue to deliver data on the new master. The standby CPU has no PN stack; calling SFC59 from the standby returns 0x80A4 ("CI fault") and must be gated on the active CPU.

Troubleshooting Matrix

SM 336F / SFC59 Error Matrix

Symptom	Most likely cause	Confirm with	Remedy
SFC59 → 8093 for DS0	F-channel driver intercepting record read	SFB81 SSL_ID 0F31 returns valid module ID	Use F_AI_6x15Bit_RDREC or SFC13 for the head module
SFC59 → 8093 for DS64	HART diagnostics disabled in HW Config	Module properties → HART → "HART diagnostics" = unchecked	Enable HART diagnostics, recompile, download
SFC59 → 8093 for DS1	Channel in passivated state	DS129 bit set, OB82 fires	Acknowledge passivation with F_AI_PASS_ON, clear discrepancy
SFC59 → 8090	Wrong LADDR	Compare to HW Config I/O addresses	Use base address of slot 4, not the status byte offset
SFC59 → 80A0 on first call, then 0	Race condition with OB83 download	Check diagnostic buffer for "module parameter changed"	Add retry loop with 1 s wait, max 5 retries
SFC13 → 0 but no slot 4 data	Slot 4 not yet in AR (Application Relationship)	PROFINET topology editor: AR is green for slot 4	Power-cycle the IM 153-4 PN
OB82 does not fire	Diagnostic interrupt disabled in HW Config	Module properties → "Enable diagnostic interrupt"	Enable diagnostic interrupt, download
F_AI_6x15Bit_RDREC → 0x80A0 on every call	F-signature mismatch	S7 F Systems log: "F-source address differs"	Re-compile F-blocks, re-download with new signature
SFC59 → 80A4 on S7-400H	Call from standby CPU	SFC90 (H_STATUS) reports A-slot master	Gate SFC59 call on active CPU
SFC59 → 80B1 after MLFB change	Slot populated with wrong MLFB	Compare order number on module label to HW Config	Replace module with correct 6ES7336-4GE00-0AB0

Frequently Asked Questions