Configuring G120C PROFINET Telegram 999 with S7-1200 in TIA V12

David Krause17 min read
Industrial NetworkingSiemensTutorial / How-to
Licensed PE Working through this on a live machine? A Maine-licensed engineer can take it from here — included with IMD hardware, by the hour for everything else. Book an engineer

Configuring G120C PROFINET Telegram 999 with S7-1200 in TIA Portal V12

When a SINAMICS G120C PN drive is coupled to a SIMATIC S7-1200 over PROFINET using TIA Portal V12 and STARTER V12, the control engineer is forced to deal with the PROFIdrive telegram model. The drive will not accept any setpoints, run commands, or ramp time modifications from the PLC until the cyclic PZD data has been mapped on both sides and the Control by PLC bit is set in the first control word. This reference walks through the complete commissioning path: telegram selection, hardware configuration, PLC programming, the critical control word bit, and the firmware-dependent handling of ramp-up / ramp-down times.

Scope: The article targets the G120C PN family with firmware V4.6 and TIA Portal V12 SP1 / STARTER V12. Earlier firmware (V4.4 and below) does not expose ramp times as cyclic PZD words. The hardware project files referenced use the CPU 1214C and a 6SL3210-0KE1x-xUxx G120C PN, but the procedure applies to all S7-1200 CPUs and all G120C PN power ratings on PROFINET.

1. Prerequisites

Before starting, confirm the following software and hardware are installed and visible in the engineering environment:

  • TIA Portal V12 SP1 (or later in the V12 line) with the SINAMICS support package installed so that the G120C PN GSD file is available in the hardware catalog.
  • STARTER V12 (or Startdrive in TIA V13+) for the off-line drive parameterization and online commissioning.
  • SINAMICS G120C PN with firmware V4.6 (or V4.4 with the limitations noted in Section 9).
  • SIMATIC S7-1200 CPU with PROFINET interface (CPU 1211C, 1212C, 1214C, 1215C, 1217C, or 1212FC/1214FC/1215FC fail-safe variants are all compatible).
  • PROFINET patch cables, switch (or direct device-to-device cabling), and G120C Control Unit with PROFINET connectors.
  • Device name assignment mechanism: PRONETA, TIA Topology editor, or the G120C BOP-2 / IOP.

2. PROFIdrive Telegram Model in 90 Seconds

PROFIdrive defines a fixed set of telegrams that determine the order and meaning of the PZD (Process Data) words exchanged cyclically between controller and drive. A telegram contains:

  • PZD1 (output, PLC → drive): Control word 1 (STW1).
  • PZD2 (output, PLC → drive): Speed setpoint (NSOLL_A), 16-bit normalized value.
  • PZD1 (input, drive → PLC): Status word 1 (ZSW1).
  • PZD2 (input, drive → PLC): Actual speed value (NIST_A), 16-bit normalized value.

Standard telegrams 1, 2, 3, 4, 20, 352, 354 and the Free Telegram 999 are supported by the G120C. Standard telegrams have fixed content. Telegram 999 is fully user-definable - the engineer maps any available PZD signal to PZD1, PZD2, PZD3, etc.

Telegram Length Use Case Direction Reversal Internal Ramp Times
1 2/2 PZD Standard speed control with NSOLL_A Yes (STW1 bit 11) No (drive-internal)
2 4/4 PZD Speed control with torque limit Yes No
3 2/2 PZD Like telegram 1 with additional bits Yes No
352 6/6 PZD Speed control with extended setpoints Yes No (acyclic only)
354 4/4 PZD Speed control with ramp time word Yes Yes (FW V4.6+)
999 User-defined (max 16/16 PZD) Free configuration of all PZD slots User-mapped User-mapped
Telegram 999 is the recommended path when the application requires direction of rotation, acceleration time, and deceleration time to be writable from the PLC. With a fixed standard telegram such as 1 or 3, only the speed setpoint is exposed in the cyclic PZD; the ramp times are written acyclically via WRREC/RDREC, which is significantly slower (typically 30-100 ms per parameter).

3. Selecting Free Telegram 999 in TIA Portal V12

  1. Open the TIA Portal project and the device configuration of the S7-1200.
  2. Locate the G120C PN in the network view and open the device properties.
  3. Switch to Device View > Properties > PROFINET interface > Telegram configuration.
  4. From the dropdown, change the default telegram to Standard telegram 999 (extended).
  5. The slot list becomes editable. The default TIA Portal V12 configuration for G120C populates a 6/6 PZD layout:
Slot Direction Default Signal Signal Number
PZD1 PLC → Drive STW1 0x0100 (256)
PZD2 PLC → Drive NSOLL_A 0x0101 (257)
PZD3 PLC → Drive Free 0x0000
PZD4 PLC → Drive Free 0x0000
PZD5 PLC → Drive Free 0x0000
PZD6 PLC → Drive Free 0x0000
PZD1 Drive → PLC ZSW1 0x0200 (512)
PZD2 Drive → PLC NIST_A 0x0201 (513)
PZD3 Drive → PLC Free 0x0000
PZD4 Drive → PLC Free 0x0000
PZD5 Drive → PLC Free 0x0000
PZD6 Drive → PLC Free 0x0000

To make the additional parameters (direction, ramp times) available cyclically, populate the free slots with the relevant signal numbers. The Siemens application example 68034568 documents the full signal list. Typical mapping for a four-word cyclic frame:

  • PLC → Drive PZD3: Ramp-up time (signal 0x0144 / p1138)
  • PLC → Drive PZD4: Ramp-down time (signal 0x0145 / p1139)

The signal numbers are the parameter index in the lower byte and the WORD marker (0x01) in the upper byte. After editing the slot list, compile the project so that the I/O addresses are recomputed and displayed in the device view.

4. Reading the I/O Address Map

After the compile step, TIA Portal assigns an I/O address range. The example used here produces:

PZD PLC Address (Output) PLC Address (Input) Default Length
1 %QW68 %IW76 WORD
2 %QW70 %IW78 WORD
3 %QW72 %IW80 WORD
4 %QW74 %IW82 WORD
5 %QW76 %IW84 WORD
6 %QW78 %IW86 WORD
Address ranges are project-specific. The actual offsets depend on the S7-1200 hardware configuration and on whether any other PROFINET devices share the same I/O area. Always read the addresses from the Device view > I/O addresses tab and not from any pre-existing example.

5. Configuring the G120C in STARTER V12

  1. Open STARTER V12 and connect online to the G120C over PROFINET (TCP port 2407 default, or via the routing table once the device name is assigned).
  2. Open the project that was created when the drive was inserted into the TIA Portal network view. The Insert SINAMICS drive wizard automatically creates a STARTER-compatible archive.
  3. Navigate to Configuration > Telegram configuration and confirm the same telegram 999 layout that was defined in TIA Portal. STARTER will re-read the slot list from the drive's parameter p922.
  4. Verify the PROFIdrive parameters:
    • p922 = 999 (telegram selection)
    • p2051[0..15] (PZD output signals to the drive)
    • p2050[0..15] (PZD input signals from the drive)
    • p0922 = ... IF1 PROFIdrive PZD telegram selection
  5. Save and download to the Control Unit, then perform a power-cycle or a warm restart if STARTER prompts for one.

6. Control Word 1 and the Bit 10 Permissive

The single most common reason that writes from the PLC appear to have no effect on the drive is that STW1 bit 10 is not set. The G120C, like every SINAMICS drive implementing PROFIdrive profile 3 (Velocity Mode), requires this bit to confirm that the controller is the active master.

Bit Name Required Value for Run
0 ON / OFF1 1 to energize, 0 to coast stop
1 OFF2 1 (0 = immediate pulse disable)
2 OFF3 1 (0 = quick stop)
3 Enable Pulse / Inhibit Operation 1 to enable
4 Enable Ramp Generator 1 to enable
5 Unfreeze / Freeze Ramp Generator 1 to start ramp
6 Enable Setpoint 1 to accept NSOLL_A
7 Acknowledge Fault 0→1 edge to clear a fault
8 Reserved 0
9 Reserved 0
10 Control by PLC 1 mandatory
11 Direction of Rotation (1 = reverse) 0 for forward, 1 for reverse
12-15 Reserved 0

A typical run word to start the drive in the forward direction at the speed setpoint is 16#047F (binary 0000 0100 0111 1111). For reverse operation use 16#0C7F (bit 11 set) or 16#087F if the application uses an inverted bit-11 polarity.

Without bit 10 the drive will not enter Operation enabled state (ZSW1 bit 2 = 0), and the cyclic PZD writes are silently ignored. STARTER's online watch table will show STW1 with bit 10 = 0 even when the PLC is moving a value to %QW68; the diagnostic is unambiguous when you add the control word to the expert list and read p2051[0].

7. PLC Programming: Reading and Writing PZD in SCL or LAD

For the simple case of writing a fixed control word to PZD1, the standard MOVE instruction is sufficient. The MOVE instruction performs a direct load from a tag to the assigned output address, and the PROFINET stack on the S7-1200 takes care of the cyclic transmission. Example in LAD:

// Data block "DriveControl"
// Tag:    stw1 : WORD    // Control word 1
// Tag:    nsoll : INT    // Speed setpoint (-32768 .. +32767 => -100% .. +100%)

// Network 1 - Build STW1
// Bits: ON(0) | OFF2(1) | OFF3(2) | Enable(3) | RG-EN(4) | RG-Start(5) | SP-EN(6) | Ack(7) | 0(8) | 0(9) | PLC-Ctrl(10) | Dir(11) | 0(12..15)
// Forward run with PLC control: 16#047F
// Reverse run with PLC control: 16#0C7F
L 16#047F            // hard-coded forward run
T "DriveControl".stw1

// Network 2 - Build NSOLL_A (normalized)
L 10000              // 10000 decimal = ~30.5% of p2000 reference speed
T "DriveControl".nsoll

// Network 3 - Write to PZD output words
MOVE   "DriveControl".stw1  -> %QW68
MOVE   "DriveControl".nsoll -> %QW70

// Network 4 - Read PZD input words into tags
MOVE   %IW76 -> "DriveControl".zsw1
MOVE   %IW78 -> "DriveControl".nist

For higher-integrity applications, or when the S7-1200 has the PROFINET IRT option, prefer the system function blocks DPRD_DAT (read) and DPWR_DAT (write). These blocks provide consistent data transfer and status information. The application example at Siemens Entry ID 68034568 includes a fully-tested SCL library that wraps these blocks for SINAMICS drives.

For parameters that are not part of the cyclic telegram (any parameter not mapped to a PZD slot), use the acyclic mechanism with RDREC and WRREC. The G120C parameter index is constructed as (parameter number * 0x10000) + (sub-index * 0x100) + data_length_in_bits. The slot is the PROFINET slot of the drive submodule; for the G120C this is typically slot 1.

8. Direction of Rotation Handling

The direction of rotation is controlled by STW1 bit 11. For a single-bit interpretation:

  • 0 = positive direction of rotation (forward, per p1113 setting)
  • 1 = negative direction of rotation (reverse)

The reference direction is configured in p1113 in STARTER. If the application must block reverse operation, the corresponding interlock should be written into the PLC logic before STW1 is assembled; the drive itself does not enforce direction by default.

When both direction reversal and an analog setpoint polarity inversion are required, the simplest path is to leave NSOLL_A as a signed integer and combine the direction with the sign of the setpoint. A negative NSOLL_A in conjunction with bit 11 = 0 is treated as a positive setpoint by the drive, so the sign of the setpoint is overridden by the bit-11 value.

9. Ramp Time Handling on Firmware V4.6 and Later

With SINAMICS G120C firmware V4.6 the ramp times can be adapted cyclically as PZD words. The signals are exposed in the parameter list as:

Signal Number Parameter Description Unit Range
0x0144 / 324 p1138 Ramp-up time 0.01 s (1 = 10 ms) 0.00 ... 650.00
0x0145 / 325 p1139 Ramp-down time 0.01 s (1 = 10 ms) 0.00 ... 650.00

When the application requires continuous adjustment of the ramp time, map the signal to an output PZD slot. The S7-1200 then writes a WORD value where 1 corresponds to 10 ms. A value of 100 yields a 1.00 s ramp. Note that the drive interprets a value of 0 as the minimum ramp (typically 0.01 s), so the PLC must clamp the value to a sensible lower bound.

Firmware V4.4 and earlier: The cyclic ramp time words are not available. Use acyclic WRREC calls to write p1138 and p1139. The acyclic call typically takes 30-100 ms round-trip on a 12 ms PROFINET update, so do not call these in a fast control loop. The recommended pattern is to refresh the ramp times on operator request only.

10. Acyclic Parameter Access (WRREC / RDREC)

When a parameter is not part of the cyclic telegram 999, the PLC uses the PROFINET acyclic channel. The Siemens application example 68034568 provides ready-made function blocks Sinamics_Write and Sinamics_Read for the S7-1200 / S7-1500. The request structure for WRREC is:

// Data block of type "Sinamics_WRREC".req
//   Slot          := 1;            // PROFINET slot of the G120C
//   Index         := 16#0113;      // = (1138 * 0x10000) + (0 * 0x100) + 16 (16 bits)
//   DataLength    := 2;            // bytes (WORD)
//   Data          := 16#0064;      // 100 dec = 1.00 s ramp-up
//   Done          := ...;          // output
//   Busy          := ...;          // output
//   Error         := ...;          // output
//   Status        := ...;          // output

The standard Siemens request header for a parameter access is 4 bytes (R/W + parameter number + sub-index) and is followed by the data. The full index formula:

Index = (param_number << 8) | (sub_index << 0)        // for request header
       + (data_length_bits / 8) << 16                 // for the length field

When the field engineer writes a parameter with WRREC, STARTER will show the new value in the expert list almost immediately, confirming that the access succeeded.

11. Fault Code F08501 and Stop-Mode Behavior

When the S7-1200 is switched to STOP, the PROFINET cyclic frames cease. The G120C detects the loss of cyclic communication after a configurable watchdog interval (default 3 × PROFINET update time, e.g. 36 ms at 12 ms update rate) and raises the fault F08501 (PROFIdrive communication error) or F08502 (PROFINET sign-of-life failure), depending on the parameter setting p2048.

This is the expected response and is not a configuration error. To suppress a fault trip on PLC stop, the application has two paths:

  1. Set p2048 = 0 to disable the sign-of-life monitoring on the drive (not recommended for safety-related applications).
  2. Configure the S7-1200 OB1 / Startup so that the PZD output words continue to be written with safe values (e.g. STW1 = 16#047E to keep bit 0 OFF while bit 10 is still set) before the controller transitions to STOP. This is achieved with an OB100 / warm restart that pre-loads the output process image.

12. Common Pitfalls and Diagnostic Steps

Symptom Likely Cause Diagnostic Step Fix
Drive does not start, STW1 in expert list is all zeros PLC not writing to %QW68 Add a watch table on %QW68 in TIA Portal; force a value Verify MOVE source tags, address assignment after compile
Drive does not start, STW1 = 0x047E or similar but bit 10 = 0 Bit 10 not set in source tag Add the constant or tag in a watch table, check bit 10 Set bit 10 = 1 in the control word; re-evaluate
Drive accelerates then faults with F08501 Watchdog timeout - PROFINET update slower than expected Compare configured send clock with p2048 in STARTER Increase p2048 (e.g. 3 → 10) or shorten send clock to 1 ms
Ramp times not applied Telegram 999 does not include p1138 / p1139 Read p922 and p2051[2] / p2051[3] in STARTER Add the ramp time signal numbers to the free slots
Direction reversal not working STW1 bit 11 not toggled Add STW1 to a watch table, toggle bit 11 manually Map the direction tag in the PLC to bit 11 of STW1
Fault 8501 in STARTER even though PLC is in RUN Mismatch between PLC slot map and drive p2051 Compare TIA slot list with STARTER p2051/p2050 Re-download the drive configuration or re-compile TIA
Actual speed value returns 0x7FFF / -32768 Drive in fault state Check ZSW1 bit 3 (fault present) and r0947 Acknowledge the fault, then restart
Startdrive vs STARTER mismatch Configuration stored in TIA Portal project Open the drive from the TIA Portal project tree Use a single source of truth: TIA + Startdrive OR TIA + STARTER

13. Commissioning Procedure - Field-Tested Sequence

  1. Wire the G120C PN to the S7-1200 PROFINET port. Assign a unique device name with PRONETA, the TIA Topology editor, or the BOP-2.
  2. In TIA Portal, insert the G120C PN from the hardware catalog. Configure the PROFINET interface with the assigned device name and IP address.
  3. Set the telegram to Standard telegram 999 (extended). Populate PZD3 and PZD4 with the ramp time signal numbers (0x0144 and 0x0145) if FW V4.6 is in use.
  4. Compile the project and download the hardware configuration to the S7-1200.
  5. Open STARTER V12 (or Startdrive from TIA Portal). Connect online to the G120C, verify p922 = 999, p2051[0..5] and p2050[0..5] match the TIA configuration.
  6. Download the drive parameters. Power cycle the Control Unit if requested.
  7. Go online with the S7-1200. Add a watch table on the PZD output and input addresses. Force STW1 = 16#047F and NSOLL_A = 0.
  8. Confirm the drive responds: ZSW1 bit 2 (Operation enabled) should go to 1 and ZSW1 bit 0 (Ready to switch on) should be 1. NIST_A should track NSOLL_A.
  9. Step the speed setpoint from 0 to a small positive value (e.g. 2000 decimal = ~6%). The motor should ramp up.
  10. Toggle bit 11 of STW1 to verify direction reversal. The motor should ramp down to 0 and then accelerate in the opposite direction.
  11. Write a new ramp time (PZD3 or PZD4) and verify the change in p1138 or p1139 in STARTER.

14. Verification Checklist

  • [ ] Device name and IP address are unique and reachable from the S7-1200.
  • [ ] Telegram 999 in TIA matches p922 in STARTER.
  • [ ] p2051[0] = 0x0100 (STW1) and p2050[0] = 0x0200 (ZSW1) on the drive.
  • [ ] I/O addresses (e.g. %QW68, %IW76) appear in the device view and match the PLC program.
  • [ ] STW1 bit 10 = 1 in every cycle (use a watch table cross-check).
  • [ ] ZSW1 bit 2 = 1 (Operation enabled) when ON is commanded.
  • [ ] ZSW1 bit 3 = 0 (No fault) before commanding a run.
  • [ ] NIST_A tracks NSOLL_A within the configured ramp time.
  • [ ] Direction reversal: STW1 bit 11 toggles NSOLL_A sign internally; motor ramps through zero.
  • [ ] Ramp time changes: PZD3/PZD4 writes show up in p1138 / p1139 within one PROFINET cycle.

15. Related Standards and Documentation

Engineers commissioning this configuration should consult:

  • PROFIdrive profile 3 (Velocity Mode) - the application class on which STW1 / ZSW1 is defined. Refer to the PROFIBUS Nutzerorganisation (PNO) profile document.
  • IEC 61800-7 - Adjustable speed electrical power drive systems, the umbrella standard that defines the cyclic data interface.
  • SINAMICS G120C Operating Instructions - the parameter list with all signal numbers referenced in telegram 999.
  • S7-1200 System Manual, Chapter on PROFINET - the I/O addressing model and the use of MOVE vs system function blocks.

What telegram should I select for cyclic control of speed, direction, and ramp times on a G120C PN?

Use Free Telegram 999 on both the TIA Portal side and the drive (p922 = 999). Populate the free PZD slots with STW1, NSOLL_A, and the ramp time signal numbers 0x0144 (p1138) and 0x0145 (p1139) when firmware V4.6 is installed. For older firmware, write p1138 / p1139 acyclically with WRREC.

Why does the drive ignore all my PROFINET writes?

STW1 bit 10 (Control by PLC) is almost certainly 0. Set the bit in your source tag and verify it with a watch table. Without bit 10 the drive stays in Not enabled state and all PZD output words are silently rejected. This is the single most common reason that an S7-1200 appears not to communicate with a SINAMICS drive.

Can I use a simple MOVE instruction to write the control word and speed setpoint?

Yes, for the S7-1200 the MOVE instruction copies a WORD/INT/DWORD into the assigned output address and the PROFINET stack handles the cyclic transmission. For diagnostics and consistent-data applications use DPRD_DAT / DPWR_DAT. For non-cyclic parameters use RDREC / WRREC as shown in Siemens application example 68034568.

What does fault F08501 mean on the G120C when the PLC goes to STOP?

F08501 is the PROFIdrive communication error, raised when the cyclic PROFINET frames are not received within the configured watchdog. This is expected on PLC STOP. To avoid a fault trip, pre-load safe PZD values in OB100 or extend p2048 (sign-of-life tolerance). The default behavior in safety-relevant applications is to leave F08501 active so that the drive shuts down on loss of communication.

Which firmware allows me to change ramp times cyclically on a G120C?

SINAMICS G120C PN firmware V4.6 and later expose the ramp-up time (p1138) and ramp-down time (p1139) as PZD signal numbers 0x0144 and 0x0145. With V4.4 and earlier, the same parameters can be written only acyclically, which is significantly slower than a 1-12 ms PROFINET update.

Back to blog