Configuring HMI to Sinamics S120 CU320 via PROFIBUS Without PLC

Overview: Direct HMI-to-Sinamics PROFIBUS Communication

Connecting a Siemens HMI panel directly to a Sinamics S120 Control Unit 320 (CU320) over PROFIBUS DP without an intermediate SIMATIC PLC is an established integration path for machines that require drive visualization, jog/MDI operator control, and fault display from a single panel. The CU320 exposes its parameter space as PROFIBUS slots that the HMI treats like a SIMATIC S7-300/400 data block image, allowing WinCC flexible tags to read and write drive parameters through a deterministic addressing scheme.

This architecture removes the PLC from the control loop for HMI-only applications, reduces hardware cost, and shortens commissioning. The trade-off is that all logic normally written in ladder or SCL must either be embedded in the drive itself (via DCC, BICO, or free function blocks on the CU320) or replicated as HMI scripts in WinCC flexible.

Prerequisites and Compatible Hardware

Validate the hardware stack and software versions before wiring. The mapping rule depends on the panel correctly identifying the drive as a SIMATIC S7-300/400 station type.

Confirm the following firmware baseline:

• CU320 firmware V2.4 or higher (V4.4/V4.5/V4.6 SP3 recommended for current projects).
• WinCC flexible 2008 SP3 HF6 or later for the TP177B/M277 image.
• STARTER V4.4 SP1 or higher (matches drive firmware V4.x GSD/V5.1+).

PROFIBUS Network Architecture

The CU320 is a PROFIBUS DP-V1 slave by default. When the HMI is configured to address the drive as if it were a SIMATIC S7-300/400, the PROFIBUS master logic inside WinCC flexible exchanges data using the SINAMICS PPO (Parameter Process data Object) types 1, 2, 5, or the newer telegram types. The HMI does not need PPO awareness; it just addresses data block words through the S7 API.

PROFIBUS baud rate settings: the CU320 automatically detects and adapts to the master's baud rate (9.6 kbps to 12 Mbps). For new installations set the panel and the drive to 1.5 Mbps, which is the slowest rate commonly used with WinCC flexible panels to ensure reliable handshaking during startup.

WinCC Flexible Project Configuration

1. Open WinCC flexible, create a new project targeted at the TP177B or MP277, and select PROFIBUS as the HMI connection.
2. In Project → Communication → Connections, add a new connection of type SIMATIC S7 300/400. Do not select SIMATIC S7 200; the drive does not speak S7-200 I/O mapping.
3. Set the HMI PROFIBUS address (default 1) and the CPU/DP slave address of the CU320 (default 2).
4. Insert the Sinamics S120 GSD file (SIEM808F.GSD for firmware V4.x or SI8281F.GSD for legacy V2.x) into WinCC flexible's device catalog. The GSD provides the slot-based parameter channel.
5. Slot mapping: assign one PPO type per drive object. WinCC flexible interprets the parameter channel as DB offsets; choose PPO1 (4 PKW + 2 PZD words) for parameter-heavy screens, or PPO5 (no PKW + 10 PZD) when only process data is needed and parameter access will go through standard tags.

Parameter Addressing Formula

The Sinamics parameter channel maps each parameter onto a virtual SIMATIC data block word. The mapping rule is identical for every drive object on the CU320:

The base offset for drive object #1 (the CU320 control unit itself) is 1024. Each subsequent object shifts by an additional 1024 words:

• Drive Object #1 (CU320 control unit): DBW = 1024 + (parameter index)
• Drive Object #2 (first Motor Module / Drive): DBW = 2048 + (parameter index)
• Drive Object #3: DBW = 3072 + (parameter index)
• Drive Object #4: DBW = 4096 + (parameter index)
• ...
• Drive Object #N: DBW = N * 1024 + (parameter index)

The parameter index is simply the parameter number when the parameter has no sub-index. If the parameter has sub-indices, each sub-index toggles bit 0 of the DBW offset (i.e., adds 1 to the DBW). The pattern is:

DB number   = parameter number (pXXXX or rXXXX)
DBW offset  = (drive_object_number << 10) + (parameter_index_word_offset)

where parameter_index_word_offset is the internal 16-bit word index inside the object. The simplest encoding is the one used in WinCC flexible:

DBW = drive_object_number * 1024 + p_or_r_number_remainder

Drive Object to DBW Address Mapping Reference

The Control Unit itself can be confirmed as object #1 via parameter p0097 (drive object numbers in the actual topology). Always verify by reading r0002 on each object before binding an HMI tag — drive topology re-numbering after commissioning is a common cause of tags reading back zeros.

Worked Examples: Reading and Writing Tags

Each example below uses the canonical Sinamics parameter format pXXX[i] / rXXX[i] and translates it directly into a WinCC flexible Tag with address format DB<n> DBW<m>.

Example 1 — Control Unit parameter

Drive object = Control Unit (#1). Parameter p2098[1] (inverting connector for the CU's inverter output to the next higher-level controller):

DB number  = 2098
DBW offset = 1024 + 1     (sub-index [1] toggles the low bit)
          = 1025
Full tag:  DB 2098  DBW 1025

Example 2 — Drive power module parameter without sub-index

Parameter p898 on the AC-AC power module (object #2):

DB number  = 898
DBW offset = 2048 + 0     (no sub-index, no toggling)
          = 2048
Full tag:  DB 898  DBW 2048

Example 3 — Power module parameter with sub-index zero

Parameter p2098[0] on the power module (object #2):

DB number  = 2098
DBW offset = 2048 + 0     (sub-index [0] does not toggle the low bit on this object numbering)
          = 2048
Full tag:  DB 2098  DBW 2048

Sub-index [0] retains the base offset; sub-indexes [1], [2], ... add 1, 2, ... to the DBW offset respectively.

Example 4 — Drive 2 actual alarm code

Parameter r2132 on Drive 2 (object #3) without index = the currently active alarm code word:

DB number  = 2132
DBW offset = 3072 + 0
          = 3072
Full tag:  DB 2132  DBW 3072

Example 5 — Safe Limited Speed, positive direction

Parameter p9733[1] on Drive 2 (object #3):

DB number  = 9733
DBW offset = 3072 + 1
          = 3073
Full tag:  DB 9733  DBW 3073

Example 6 — TB30 digital output word

Parameter r4047 on the TB30 Terminal Board (object #4):

DB number  = 4047
DBW offset = 4096 + 0
          = 4096
Full tag:  DB 4047  DBW 4096

Bit extraction for sub-word parameters

For parameters that are stored as packed bit-fields such as control words (r0054) or status words (r0052, ZSW1, STW1), expose the entire DBW as a 16-bit Word tag and apply WinCC flexible Bit extraction on the I/O field or screen object:

r0052[0] of Drive 2 (status word 1, smooth):
  DB number  = 52
  DBW offset = 3072 + 0 = 3072
  Full tag:  DB 52  DBW 3072
  -> Extract bit 3 (operation enabled) via Bit selection 'Bit 3'

Implementing Jog and MDI Control from the HMI

For jog (JOG) and MDI (setpoint entry) operation without a PLC, the drive's control word 1 (STW1) and the matching setpoint (NSOLL) channels are written by HMI tags. Use drive object #2 (or whichever drive object carries the closed-loop control for the axis).

Wiring the control word bits in STARTER/SCOUT

1. Open the drive in STARTER and navigate to Commissioning → Control structure → Drive I/O.
2. Confirm the PROFIBUS telegram in use — standard telegram 2 (PZD 4/4) is the smallest telegram that carries STW1/ZSW1 + NSOLL/NIST.
3. For internal jog buttons driven by the HMI, route p1051/p1052 into the BICO source for STW1 bit 8/9 using p2050[8..9], so that toggling the HMI bit directly issues a jog command.
4. Set control word source: p0855 = 0 (drive-controlled) and p0922 = 999 (free telegram structure) if needed.

Reading Faults and Alarms on the Panel

Two parameter arrays are commonly placed on a fault screen:

• r2131 (oldest active fault code) — read at object #2 as DB 2131 DBW 2048.
• r945[i] (fault history, indexed) — full fault buffer; index i increments the DBW low bit per entry. For object #2: DB 945 DBW 2048 + i.
• r2132 (most recent alarm number) — see Example 4 above; configure as a Word tag and let the HMI display the numeric value alongside a lookup text list in WinCC flexible.
• r2120 (alarm history bits 0..15) and r2121 (bits 16..31) — for color-coded alarm banners.

The official enumeration of fault/alarm codes is published in the Sinamics S120 List Manual (function manual FH1).

Commissioning and Verification

1. Power up the CU320, wait until r0002 shows the expected drive-object count.
2. Compile and download the WinCC flexible project to the panel.
3. On the panel, enter the PROFIBUS diagnostics screen (Start → Settings → PROFIBUS) and confirm the configured partner is Online.
4. Open a temporary screen with one input field bound to DB 21 DBW 1024 (Control Unit, command parameter set selection). Write a value of 0 and confirm the tag echoes back 0 within 200 ms (one PROFIBUS poll cycle at 1.5 Mbps).
5. For every drive object used by the HMI, perform a single read of r0021 (actual speed smoothed) at the appropriate offset and confirm a non-zero, plausible rpm when the drive is enabled.
6. Trigger a known, non-damaging fault (e.g., open the encoder cable briefly) and verify the fault code displays on the panel via DB 2131 DBW 2048 within one cycle.
7. If a parameter reports 32767 (0x7FFF) on a status read, the panel is reading an unsupported slot — recheck p0922 and the telegram mapping.

Troubleshooting Matrix

Notes on PORT Swapping and TIA Portal Equivalents

The same addressing scheme carries directly into TIA Portal projects targeting Comfort Panels and WinCC Comfort/Advanced. In TIA Portal, the equivalent mapping is configured under Devices & Networks → HMI connection → Connection resources, where the CU320 is added as a SIMATIC S7-300/400 station with a PROFIBUS subnet. Reference documentation: Configuring an HMI Connection via PROFIBUS (Basic Panels / Comfort Panels) on the TIA Portal Help (V20).

In TIA Portal the tag address syntax becomes %DB<n>.DBW<m> with identical numeric values to those shown above. The drive-object-to-offset multiplier of 1024 per object is unchanged between WinCC flexible and TIA Portal.