Configuring MC_ReadPeriphery for SIMODRIVE 611U Telegram

Overview: Why Use Periphery Read for SIMODRIVE 611U on T-CPU 317T

The CPU 317T (catalog numbers 6ES7317-7TK10-0AB0 and 6ES7317-7UL10-0AB0) combines a standard SIMATIC S7-300 PLC runtime with an integrated Technology CPU channel set. The technology channels expose position, velocity, and torque paths of the closed-loop drive as if they were additional technology objects, but the speed/torque raw values and a number of additional drive words (A/D inputs, A/D outputs, encoder status bits, status word 2, etc.) are not part of the technology channels — they live in the PROFIBUS DP periphery image of the drive's PZD (Prozeßdaten) slots.

The standard PROFIdrive profile for the SIMODRIVE 611U uses telegram 102 as the base telegram. Telegram 102 is mapped into the T-CPU technology I/O image in addresses 0 to 63 of the slot; the technology functions (MC_MoveAbsolute, MC_MoveVelocity, MC_CamIn, MC_GearIn, MC_Halt, …) consume a defined subset of those words (NSOLL, NIST, Gx_STW, Gx_ZSW, MOMRED, …). Any word beyond the technology function's reserved range — and any word added by extending telegram 102 with user PZDs — can only be reached from the user PLC side through the MC_ReadPeriphery / MC_WritePeriphery function blocks (older names: MO_ReadPeriphery / MO_WritePeriphery). This is the only supported mechanism for the PLC partition of the T-CPU to observe or set free PZDs of the drive, including the A/D input/output word ranges that the question references.

The intent of this guide is to make the wiring complete: assign the expanded PZDs to a defined offset in HW Config, configure the same expansion in the drive commissioning tool SimoComU, and then read those words into a user DB using MC_ReadPeriphery with an ANY pointer of the form P#DB100.DBX 0.0 WORD n. Without the HW Config assignment, the technology bytes appear "grey" in STEP 7 monitoring because they are not declared as I/O symbols; without the SimoComU assignment, the drive reports the expanded words as zero because they were never placed in the cyclic frame.

Prerequisites and Reference Documentation

Before applying the configuration sequence, verify that the following hardware and software levels are present.

• CPU 317T with firmware V2.x or newer. The MC_* function family is available from the technology function library shipped with STEP 7 V5.4 + SPx and is integrated as a system library in STEP 7 (TIA Portal) from V13 onward. The older MO_* blocks survive for compatibility on the same T-CPU and call the same underlying runtime, so this guide applies to both spellings.
• SIMODRIVE 611U in the universal closed-loop control variant (modules 6SN11xx-1Ax0x-xHAxx with PROFIBUS option board). Firmware on the SIMODRIVE 611U should be at least V5.x. The drive configuration tool is SimoComU (catalog 6SN1197-0AA10-0BPx bundle), which is the only way to write the PZD list on the drive side.
• STEP 7 V5.4+ (or TIA Portal V13+) with the optional package S7 Technology for the technology FB/FC libraries. The technology library installs the FBs MC_ReadPeriphery, MC_WritePeriphery, MC_Power, MC_Home, etc.
• Manual: "S7-300 Connecting the SIMODRIVE 611U to the Technology CPU", order number 6SN1197-0AB10-0BP7. Chapter 5.4 "Adapting message frames individually" is the primary reference for the procedure described below. The manual is distributed with the SIMODRIVE 611U documentation DVD and is indexed on Siemens Industry Online Support by searching for the order number.
• PROFIdrive profile V4.0 or later for the definition of telegram types 1–103. The profile is published by PROFIBUS & PROFINET International and is available at www.profibus.com/pi/profidrive.

Telegram 102 Anatomy and the Expansion Strategy

Telegram 102 for the SIMODRIVE 611U is a Siemens-specific PROFIdrive mapping for closed-loop speed/torque control with one to three encoders. The standard PZD layout is symmetric: setpoint words from PLC to drive, actual-value words from drive to PLC, with encoder control/status word pairs. The Technology CPU's axis objects consume a fixed subset:

The expansion of telegram 102 means appending additional PZDs in HW Config AND in SimoComU, in matching count and matching order. If the two sides disagree the drive sets bit 7 of ZSW1 ("Control requested") but the PLC reports 0x0000 for the surplus words because the cyclic frame carries no payload for them. This is exactly the symptom described in the source: SimoComU's diagnostic view shows the additional words as empty, not because the drive rejects them, but because the PZD list on the drive side has not been extended in the same way as HW Config.

Per chapter 5.4 of the 6SN1197-0AB10-0BP7 manual, the expansion must be configured in the following order:

1. Drive side: append PZDs to the PZD list in SimoComU under Configure PROFIBUS → Process data.
2. Controller side: append matching PZDs in HW Config under the drive slave's slot configuration, mapping each new word to a defined I-address offset within the technology I/O area (0–63).
3. Application: read those addresses through MC_ReadPeriphery / write through MC_WritePeriphery.

HW Config: Mapping Expanded PZDs to the Technology I/O Area (0–63)

The HW Config integration is the step that binds drive-side PZDs to symbolic I-addresses inside the 64-byte technology image. Open the S7 project in STEP 7 (or TIA Portal), open the HW Config editor, locate the SIMODRIVE 611U DP slave, and double-click the slot "SIMODRIVE 611U universal".

The dialog has two tabs: Standard and Technology. The Technology tab exposes the I-address and Q-address offsets assigned by the technology channels. These offsets are not freely chosen: the technology object consumes a contiguous block beginning at offset 0. If you are using one axis, the default layout typically occupies offsets 0–31 (32 bytes input, 32 bytes output, i.e. 16 PZDs each way). The remaining offsets up to 63 are available for the user to map additional PZDs.

1. In the dialog, switch to the Configuration tab. The list shows the PZD list of the current telegram (the standard 102). To extend, click Insert PZD and select the new word type (e.g. AIN1 (analog input 1), AOUT1 (analog output 1), or a user-defined word). Do this for every word you intend to read or write.
2. After inserting, set the I Address (for input words) and Q Address (for output words) offsets explicitly. The T-CPU enforces offsets inside the technology I/O area only. A typical expansion might be:
   • PZD 17 (I 16/Q 16) — A/D input 1
   • PZD 18 (I 18/Q 18) — A/D input 2
   • PZD 19 (I 20/Q 20) — A/D output 1
   • PZD 20 (I 22/Q 22) — A/D output 2
   The byte addresses here are local technology offsets, not the absolute I/Q addresses of the S7-300 process image. The T-CPU gateway remaps these into the technology I/O slot.
3. Compile and download HW Config. After the download, the technology I/O symbols I 0.0..I 63.7 and Q 0.0..Q 63.7 exist in the symbol table.

SimoComU: Configuring the Drive-Side Telegram

The SimoComU commissioning tool writes the drive's PZD list, encoder configuration, and PROFIBUS node parameters. The PZD list must match the HW Config insertion list byte for byte, otherwise the cyclic frame is asymmetric and one side reports zeros.

1. Establish an online connection to the SIMODRIVE 611U (RS232 commissioning cable or PROFIBUS DP-V1 master).
2. Navigate to Configure PROFIBUS → Process data (PZD). The current telegram type is shown; confirm that it is set to 102 as the base.
3. Append the additional PZDs in the same order as in HW Config. For each new word, select the source or sink inside the drive (e.g. for an analog input word, choose AIN1; for a torque actual value, choose MIST). The drive's user manual "SIMODRIVE 611U universal / universal E", order 6SN1197-0AA10-0BP1, lists every signal that can be mapped to a PZD slot.
4. Save to EEPROM on the drive. SimoComU flashes the configuration into the 611U; without this step, the drive still uses its last commissioning PZD list.
5. Cycle the PROFIBUS node or the drive (24 V reset is usually enough) so the new PZD list becomes active.

The diagnostic window inside SimoComU only shows the standard PZDs by default. To see additional words, open the Signal monitor (oscilloscope) and select the PZD from the signal list, or use the Control/status words dialog and tick "Show user-defined PZDs". The "empty" appearance in the diagnostic view mentioned in the source is a SimoComU display filtering feature, not a sign that the drive is sending zeros.

MC_ReadPeriphery and MC_WritePeriphery Function Blocks

The function blocks live in the technology library under Motion Control → Periphery. The full call interface is:

The instance DB is automatically assigned by STEP 7 (typically DB100 if the first technology FB is MC_ReadPeriphery — this matches the DB100 referenced in the source question). Inside the instance DB the Data parameter is an ANY pointer, which is why it appears grey in the standard variable view: the ANY contains a typed pointer to user data plus length and DB number, not the user data itself. To observe the actual values, watch the destination DB (DB100 in the example) rather than the ANY at the FB input.

Status word semantics for both blocks:

• 0x0000 — Busy / operation in progress
• 0x0001 — Done, data successfully transferred
• 0x8001 — Error: PeripheryAddress out of range (must be 0–63)
• 0x8002 — Error: Length out of range (must be 1–64)
• 0x8004 — Error: Any pointer invalid (DB number = 0 with offset > 0, or length = 0)
• 0x8010 — Error: Drive not configured or PROFIBUS connection down

STEP 7 Programming: Sample ST Block for Reading Expanded PZDs

The following Structured Text snippet shows a single-axis read of four expanded PZDs into DB100 beginning at byte 0, with rising-edge-triggered execution and a status/error split. It is written for STEP 7 V5.x but the same logic runs in TIA Portal V13+ using the same FB symbols.

FUNCTION_BLOCK FB_RD_PERI
VAR
    fbRead      : MC_ReadPeriphery;   // instance lives in DB100
    bTrigger    : BOOL;               // call-once flag from cyclic OB1
    wStatus     : WORD;
    bDone       : BOOL;
    bError      : BOOL;
END_VAR

// one-shot trigger; rising edge keeps MC_ReadPeriphery from re-queuing
IF bTrigger = FALSE THEN
    bTrigger := TRUE;

    fbRead(
        AxisNo           := 1,                                 // first axis
        PeripheryAddress := 16,                                // tech byte 16 = first free word
        Length           := 4,                                 // read 4 PZDs
        Data             := P#DB100.DBX 0.0 WORD 4,            // destination
        Done             => bDone,
        Busy             => ,
        Error            => bError,
        Status           => wStatus);
END_IF;

IF bError THEN
    // log wStatus to a diagnostic ring buffer or set an operator panel flag
    // 0x8001 = bad offset, 0x8002 = bad length, 0x8010 = drive link down
END_IF;

After FB_RD_PERI returns Done=TRUE in the same OB1 scan, the four words are available in DB100:

• DB100.DBW 0 — word at technology I/O offset 16 (e.g. AIN1)
• DB100.DBW 2 — word at offset 17 (e.g. AIN2)
• DB100.DBW 4 — word at offset 18 (e.g. torque actual MIST)
• DB100.DBW 6 — word at offset 19 (e.g. ZSW2 bit field)

To write back free PZDs (analog outputs, torque feedforward, user status words), use the symmetric call with MC_WritePeriphery and the same offset/length, but with a source ANY pointing at a user DB. Writing outside the technology function's reserved range is permitted but must not collide with setpoint words that the technology channel itself writes. The T-CPU arbitrates writes so that the last writer in OB1 wins; place the MC_WritePeriphery call after the axis technology FB in the cycle.

Technology I/O Address Map and Assignment Rules

Rules that must be observed to avoid overlap and undefined behaviour:

1. The technology channel reserves the first N words, where N depends on the number of axes and encoders configured in the technology object. For a single-axis T-CPU with one encoder, the reservation is 16 words input / 16 words output starting at offset 0. With two axes it doubles.
2. User-defined PZDs must start at the next free offset after the reservation. With one axis the first legal user offset is 16; with two axes it is 32.
3. The offsets must be even (word alignment). Inserting a PZD at an odd byte offset triggers a compile error in HW Config.
4. The total PZD count (axis + user) must not exceed 32 words in / 32 words out, i.e. the technology I/O area is 64 bytes per direction. PROFIBUS telegram 102 supports a maximum of 16 PZDs each direction; if more is required, a user-defined telegram (type 999) must be configured in SimoComU.
5. If two axes share the T-CPU, assign a unique AxisNo (1..N) and use the corresponding offset range for each axis's user PZDs. The MC_ReadPeriphery call maps the byte offset inside the selected axis's technology I/O area, so the user code never needs to know the absolute I/Q address.

Verification and Commissioning Procedure

After the configuration and the user program are loaded, run the following commissioning sequence. Every step has a binary pass/fail so that a fault can be isolated quickly.

1. Drive availability. In HW Config, right-click the SIMODRIVE 611U slave and select PROFIBUS → Diagnosis. The slave should report Station OK. A Slave not reachable indicates a wiring/PROFIBUS address fault, not a PZD configuration fault.
2. PZD consistency. In SimoComU, open Configure PROFIBUS → Process data and compare the PZD count with the HW Config slot configuration. Mismatch is reported by STEP 7 as Config fault during download.
3. Online monitoring of the destination DB. In STEP 7, open DB100 in online view and observe DBW0, DBW2, DBW4, DBW6 while manually moving the axis. For a torque measurement, accelerate the drive with a small velocity setpoint; the NIST_B word in DB100 (mapped to its own PZD, not necessarily DBW0) should follow. Non-zero, changing values confirm the read path.
4. Function-block status. Watch MC_ReadPeriphery.Status in the instance DB. A persistent 0x0000 means Busy (acceptable), 0x0001 is Done (success), 0x8010 means the drive link is down. Other codes point to the parameter errors listed in section 6.
5. Cycle determinism. Place the FB call in OB35 or OB1 with a one-shot guard. Re-entrancy is permitted but consumes technology slot bandwidth; one call per cycle is sufficient for typical 100 ms control loops.

Troubleshooting Matrix

FAQ