SFB52 RDREC for SCALANCE PROFINET Diagnostics: Parameter Guide

Overview

The system function block SFB52 "RDREC" (Read Record) is the standard Siemens mechanism for reading acyclic PROFINET IO records from any PROFINET device on the network, including the SCALANCE X family of managed switches. Because SCALANCE X-200, XB-200, XC-200, XR-200 and XM-400 switches expose their port, link, neighbor and diagnostic state through PROFINET records rather than cyclic I/O, RDREC is the only way to retrieve that data from an S7-300/400/1500 controller without third-party tools.

This guide covers the SFB52 interface, the correct population of the ID, INDEX, MLEN and RECORD parameters, the most useful record indices for SCALANCE diagnostics, how to read link/neighbor topology data, and the root-cause analysis of the typical BF (Bus Fault) LED symptom that appears immediately after a faulty RDREC call is downloaded to the CPU.

Prerequisites

• SIMATIC S7-300 (CPU 31x-2 PN/DP), S7-400 (CPU 41x-3 PN/DP), or S7-1200/1500 controller on the same PROFINET subnet as the SCALANCE device.
• SCALANCE X switch with PROFINET diagnostics enabled (X-200, XC-200, XB-200, XM-400, XR-500 families). The switch must appear as a PROFINET IO device in the STEP 7 / TIA Portal project.
• The GSDML file of the SCALANCE imported into the hardware catalog (e.g. GSDML-Vx.x-Siemens-SCALANCE-XC200-...xml).
• The diagnostic address assigned to the SCALANCE in HW Config / device configuration. This is the ID input for RDREC.
• STEP 7 V5.5 / TIA Portal V13+ with the SFB52 instance library (FB52 on S7-1500) installed.
• Familiarity with the Siemens support entry Reading out the topology data of a PROFINET IO system, which is the canonical SFB52-with-SCALANCE reference.

SFB52 Interface and Parameter Map

SFB52 RDREC reads an acyclic record from a PROFINET IO device. Its formal interface is identical for S7-300 and S7-1500 (where it is provided as FB52 RDREC in the "PROFINET IO" instructions library). The block has the following input and output parameters:

Step-by-Step: Implementing SFB52 in STEP 7

1. Open HW Config and assign a diagnostic address. Double-click the SCALANCE X device; in Properties > PROFINET interface > Diagnostics set a unique diagnostic address (e.g. 2042 decimal = 0x7FA). Note this number; it becomes your ID.
2. Create an instance DB. Insert SFB52 from the standard library and assign a new DB (e.g. DB52). This DB stores the RDREC instance data.
3. Create a destination DB. Build DB2 with at least 256 bytes reserved for the response. Larger values (512-2048) are needed for port-statistics records. Use the RECORD ANY pointer to mark the start.
4. Drive REQ from a clock or trigger. To prevent bus overload, pulse REQ from a 1-second timer or from OB82 (diagnostic interrupt) when the SCALANCE reports a state change.
5. Evaluate VALID and ERROR. On a rising edge of VALID, the data at RECORD is fresh. On ERROR = 1, read STATUS and branch to a fault handler.

Reference: SCALANCE Record Indices

The record indices listed below are the ones most often used for SCALANCE X diagnostics. All values are 0-based, decimal or hex as shown; pass them to RDREC as the INDEX input.

Sample Ladder Logic (S7-300, STEP 7 V5.5)

The snippet below reads the live link state of Port 5 on a SCALANCE X208. The pattern follows the Siemens reference PDF 38566021_NET_topology_SFB52_e.pdf.

// ---- DB2 layout: target buffer for the SCALANCE record ----
// DB2.DBX0.0  DWORD  : Port selector (1-based) – loaded before CALL
// DB2.DBX4.0  BYTE x : Record response from device
//
// ---- Marker area (MW100, M110, MD112, MW116) ----

NETWORK 1   // load record index 0x802A (32810 dec)
L  32810
T  MW 100

NETWORK 2   // prepare port selector (Port 5)
L  5
T  DB2.DBD 0

NETWORK 3   // call RDREC
CALL  "RDREC" , DB52
REQ    := M0.5          // 1-second pulse from timer
ID     := DW#16#7FA     // diagnostic address of SCALANCE
INDEX  := MW100         // 0x802A = 32810
MLEN   := 128           // large enough for one LLDP neighbor
VALID  := M110.0
BUSY   := M110.1
ERROR  := M110.2
STATUS := MD112
LEN    := MW116
RECORD := P#DB2.DBX4.0 BYTE 128

STATUS Code Decoding

RDREC returns a four-byte STATUS word whose upper two bytes (DWORD bits 16-31) identify the source (PROFINET IO stack = 0x80) and whose lower two bytes are the actual code. Use the table below as a first triage before consulting the S7 system manual.

Root Cause: BF LED After Download

The symptom reported in the field — "the BF LED turns on when the program is downloaded, but goes away when the program is removed" — almost always traces to one of three causes:

1. Wrong ID value. The ID must be the diagnostic address, not the PROFINET device number and not the cyclic IO address base. In the sample above, DW#16#7FA is the diagnostic address assigned in HW Config. Using a value from the process-image range will return STATUS = 0x80F0 and the CPU flags the device as not reachable, lighting the BF LED.
2. Bad RECORD ANY pointer. A malformed ANY such as P#DB2.DBX0.0 BYTE 0 or one whose DB number does not exist at runtime produces an internal RDREC error. STEP 7's online block-consistency check normally catches this, but a DB downloaded in a later change can mask the fault until RDREC actually executes.
3. Truncated MLEN combined with a long record. If the chosen INDEX returns, say, 220 bytes but MLEN = 2, the device treats the request as ill-formed (STATUS = 0x80B1) and may momentarily mark the slot as disturbed. The BF LED will blink rather than stay on, but many SCALANCE firmware revisions also surface a transient PROFINET alarm that the CPU records as a bus fault.

Reading Topology Data from a SCALANCE X208 (Worked Example)

This is the canonical use case from Siemens FAQ 38566021. Goal: discover which PROFINET neighbor is connected to Port 5 of a SCALANCE X208.

1. In HW Config, the SCALANCE X208 is at diagnostic address 2046 (0x7FE).
2. DB100 contains 256 bytes of buffer; DB100.DBD0 = port selector (1-based); the response starts at DB100.DBD4.
3. Set DB100.DBD0 = 5 (Port 5).
4. Call RDREC with INDEX = 32810 (0x802A), MLEN = 128, ID = DW#16#7FE.
5. When VALID = 1, decode the response:
   • Bytes 0-1: port number echo.
   • Bytes 2-3: chassis-id length.
   • Bytes 4-9: chassis-id (MAC of neighbor).
   • Bytes 10+: port-id of the neighbor's perspective and LLDP TLV list.

The same procedure with INDEX = 32811 (0x802B) and a 512-byte buffer returns all neighbor records in a single call, which is the pattern used by STEP 7's own topology scanner.

Verification and Commissioning

1. Open STEP 7 online > Monitor/Modify. Force REQ and watch VALID rise within 1-2 PROFINET update cycles (default 1 ms).
2. In the Diagnostic Buffer of the CPU, confirm no entry with ID 80F0 (device unreachable) or 80A0 (negative ack) appears after the call.
3. On the SCALANCE WBM (Web Based Management), open Information > PROFINET Diagnostics and compare the port status reported there with the data returned in RECORD. Any divergence points to a buffer-size mismatch.
4. If a topology viewer is open in STEP 7 (Target topology / Actual topology), the scanned neighbors should match the LLDP entries decoded from 0x802B.

Troubleshooting Matrix

Notes on S7-1500 and TIA Portal

On S7-1500, drop the equivalent RDREC instruction from Instructions > Communication > PROFINET IO. The interface is identical, but two practical changes apply:

• ID is supplied as a system constant of type HW_Interface or HW_Device. Right-click the SCALANCE in the device tree and select PROFINET IO diagnostics address to bind it.
• The RECORD input expects a tag of the same data type as the record. For SCALANCE port records, declare a Byte array (e.g. Array[0..255] of Byte) and use a slice for the port-selector header.

FAQ