Resolving W#16#8090 Error with SFC14/SFC15 on S7-1200 PROFINET

Overview

The Siemens DPRD_DAT (SFC14) and DPWR_DAT (SFC15) instructions are the standard mechanism for reading and writing consistent PROFINET or PROFIBUS I/O data larger than the 4-byte boundary the plain process image can guarantee atomically. On the S7-300 these blocks behave predictably: pass the slot I/O start address as LADDR, pass a ANY pointer in RECORD, and the read/write completes in a single PROFINET frame. Engineers migrating identical code to an S7-1200 or S7-1500 routinely hit RET_VAL = W#16#8090, which the system simply reports as "specified logical address is invalid." The cause is almost never a wiring or GSD issue — it is a misunderstanding of what LADDR represents on the newer controller families.

This reference consolidates the failure mode, the correct addressing model, the firmware-dependent RECORD syntax, and an alternative path that uses the S7-1200 process image directly when the I/O length permits.

Problem Details

Symptom signature reported in the field:

• Controller: S7-1214C DC/DC/DC (typical), firmware 2.x – 3.x; equivalent failure on S7-1500 with firmware < 1.1.
• Slave: PROFINET device (SEW PN drive, Lenze i500/i700, generic PN head module) on the distributed I/O network.
• Slave input slot: 6 bytes (a recurring case with drives that publish control + status words in a single submodule).
• Code copied from a working S7-300 project with LADDR := 256 (the I/O start address of the slave).
• On first execution: RET_VAL = W#16#8090, no data returned; output area remains at its previous value.

The error does not indicate length, alignment, or GSD problems. The diagnostic buffer entry on the S7-1200 typically reads "DPRD_DAT: address LADDR invalid" with no associated PROFINET alarm — a strong signal that the call never reached the IO controller stack.

Root Cause Analysis

Two distinct defects account for nearly every W#16#8090 in this context. Both must be checked before assuming a hardware fault.

1. LADDR Is a Hardware Identifier, Not a Process Image Address

On S7-300/400, the LADDR input of SFC14/SFC15 historically accepted the logical base address of the slot as it appears in HW Config — the same number the engineer typed when wiring the device to PIB/PIW/PID. On S7-1200 and S7-1500, TIA Portal assigns an internal Hardware Identifier (HW-ID) to each submodule for symbolic access. The LADDR parameter expects this system constant, not the I or Q start address.

The S7-1200 System Manual explains on page 269 that the block reads or writes the data of a consistently-transmitted I/O area; a footnote on page 72 of the same manual clarifies that the LADDR is "the identifier of the hardware object," which is generated automatically when the device is added in the device configuration. The two numbers are not interchangeable.

2. RECORD Parameter Syntax Differs by Firmware

For S7-1200 firmware below V3.0 and S7-1500 firmware below V1.1, the RECORD parameter of DPRD_DAT/DPWR_DAT requires an explicit POINTER or ANY literal such as P#DB10.DBX0.0 BYTE 4. Passing a structured tag (e.g., "IO_Lenze".H1.H.In) produces a compile error or, in some tool versions, a runtime W#16#8090. From S7-1200 V4.0 / S7-1500 V1.6 onward, the block accepts the tag name directly because the compiler infers the address and length.

Error Code Reference

See the S7-1200 Programmable Controller System Manual (entry ID 109751826) for the complete RET_VAL table on page 269 onward.

Locating the Correct LADDR in TIA Portal

1. Open the S7-1200 project in TIA Portal (V15 or later recommended; the procedure in Delta Motion's TIA V15 S7-1200 PROFINET guide shows the same workflow for RMC motion controllers).
2. Expand PLC tags in the project tree and double-click Default tag table.
3. Click the System constants tab at the top of the tag table editor.
4. Locate the row for the target PROFINET submodule (e.g., H1_AxisH_Status_Control[AI/AO]). The Value column holds the HW-ID, typically a number in the 256 – 65 535 range that does not match the I/Q start address.
5. Drag the row from the System Constants tab directly onto the LADDR input pin of the SFC. TIA Portal will fill the symbolic operand and resolve to the numeric HW-ID at compile time.

The dragged reference appears in the STL/SCL source as a quoted name (e.g., LADDR := "H1_AxisH_Status_Control[AI/AO]"), which is the recommended form: it is portable across project re-numbering and self-documents in the network.

Firmware-Specific RECORD Syntax

S7-1200 Firmware < V3.0 / S7-1500 Firmware < V1.1

Use an explicit POINTER literal in RECORD. The block reads exactly the number of bytes declared by the pointer; the data DB must be large enough to hold the record.

CALL  DPRD_DAT
LADDR   := "H1_AxisH_Status_Control[AI/AO]"   // symbolic HW-ID
RET_VAL := #_RetVal                            // INT; 0 = OK
RECORD  := P#DB10.DBX0.0 BYTE 4                // exact byte count

For 6-byte input slots seen on drives, use BYTE 6. For 4-byte words plus 2 bytes of status, size the pointer to the full submodule length to avoid silent truncation.

S7-1200 Firmware >= V4.0 / S7-1500 Firmware >= V1.6

The structured tag can be referenced directly. The compiler computes the address and length from the PLC tag declaration.

CALL  DPRD_DAT
LADDR   := "H1_AxisH_Status_Control[AI/AO]"
RET_VAL := #_RetVal
RECORD  := "IO_Lenze".H1.H.In

Pre-condition: RECORD must point to a byte-aligned DB or an IN/OUT/STAT block that is at least as long as the slot. The V4.0/V1.6 firmware block also accepts the legacy pointer form, so the older syntax continues to work after a firmware upgrade.

Alternative: Direct Process Image Access

If the PROFINET submodule is ≤ 4 bytes (the natural width of PIB/PIW/PID on the S7-1200), the process-image update is itself atomic. You can read or write the slot with the standard I/O area instructions and skip SFC14/SFC15 entirely:

// S7-1200: 6-byte drive status at input start 256
L     IB 256                       // byte 0
L     IB 257                       // byte 1
T     "Axis_Status".StatusWord1   // any DB tag, BYTE
L     IW 258                       // bytes 2..3
T     "Axis_Status".StatusWord2   // any DB tag, WORD
L     IW 260                       // bytes 4..5
T     "Axis_Status".StatusWord3   // any DB tag, WORD

For submodules > 4 bytes the S7-1200 system manual explicitly requires DPRD_DAT / DPWR_DAT (see page 269) and the process image alone is not sufficient for atomicity.

Step-by-Step Resolution Procedure

1. Confirm firmware. In TIA Portal: Online & diagnostics → Module information → Firmware. Required minimums: S7-1200 V3.0 for legacy pointer form with relaxed checks, V4.0 for direct struct RECORD; S7-1500 V1.1 / V1.6 respectively.
2. Identify the HW-ID. Open PLC tags → Default tag table → System constants. Filter by device name. Copy the value (or drag-drop the row onto the SFC pin).
3. Update LADDR. Replace the literal 256 (or any process-image address) with the symbolic HW-ID tag.
4. Update RECORD syntax. Match the syntax to your firmware per the section above.
5. Recompile and download. TIA Portal resolves the symbolic operand to the numeric HW-ID at compile time. A stale offline/online mismatch will reproduce W#16#8090 even with a correct symbolic reference.
6. Test the call. Set RET_VAL to a watch tag and force a one-shot trigger on a one-time OB or a rising-edge flag in OB1.

Verification

After the corrected SFC is downloaded, perform the following checks before declaring the fault closed:

1. RET_VAL == 0 on first execution. Anything non-zero is a regression — recheck the system constant mapping rather than adding retries.
2. Online & diagnostics → Diagnostics buffer on the S7-1200: no new entries with text "IO access error" or "DPRD_DAT" after the call.
3. Watch table on the destination DB: values update on each OB1 pass. For drive control words, toggle a bit in the DB and verify the drive accepts the command (refer to the drive parameter list — e.g., SEW MOVIPRO / Lenze i500 control-word bits).
4. Network load: DPRD_DAT adds 1 PROFINET read service per call. If the SFC is called inside a fast OB (< 4 ms), confirm cycle time impact via the Cycle time measurement in the online diagnostics.
5. Submodule substitution: if the GSD is later exchanged and the slot's HW-ID changes, the symbolic reference updates automatically; the literal numeric reference would have re-introduced the W#16#8090.

Specific Platform Notes

Common Field Pitfalls

• Stale hardware identifier after GSD update. Re-running the device configuration re-numbers HW-IDs in some TIA Portal releases. A symbolic reference survives; a hard-coded integer does not.
• Calling SFC14 from OB1 without edge. On S7-1200, each call triggers a PN read service. Use a one-shot (e.g., a rising edge of a 1-Hz clock) to avoid doubling bus load.
• RECORD length mismatch. The slot length is set in the GSD. If the configured submodule is 4 bytes and the code requests 6, expect W#16#8093; if the slot is 6 bytes and the code requests 4, the trailing 2 bytes are silently discarded on read.
• Optimized block access. S7-1200 / S7-1500 default to optimized access. The RECORD DB must have the "Optimized block access" attribute consistent with the SFC; mixed settings cause ANY pointer errors (W#16#8092).
• PROFINET update time too short. A send clock of 250 µs with 6-byte drive data can saturate the IO controller if multiple SFC14 calls run in parallel. Verify in the device properties → PROFINET interface → Real-time settings.