Configuring S7-300 Profibus for Lenze 9300 Servo: Step-by-Step

Overview

This engineering reference documents a complete Profibus-DP integration between a SIMATIC S7-300 CPU 314-2DP and a Lenze 9300 series servo drive (EVS9328 fitted with the 2133 Profibus-DP communication module, also marketed as EMF 2133 IB). The CPU is the Profibus-DP master; the Lenze drive is a DP slave exchanging cyclic process data with the PLC through the standard system functions SFC14 (DPRD_DAT) and SFC15 (DPWR_DAT). The motion recipe (14 mm forward, 2 s dwell, 2 mm reverse, 0.2 s dwell, 0.1 mm reverse, then 14 mm forward again) is fully parameterised by a SIMATIC TP270 operator panel, so the recipe is editable in production without re-programming the PLC.

The same pattern applies to any S7-300 CPU in the 31x-2 DP family (CPU 312-2DP, 315-2DP, 315-2 PN/DP, 317-2DP, 319-3 PN/DP on the DP port) and to a wide range of Lenze 9300 line drives (EVS9326, EVS9327, EVS9328, EVS9329, 9371, 9381). For users with a CP 342-5 instead of the integrated DP port, swap SFC14/SFC15 for FC1 (DP_SEND) and FC2 (DP_RECV); the drive-side configuration does not change.

System Architecture and Components

The reference topology puts the S7-300 at the head of a single-master Profibus segment with the Lenze 9300 as the cyclic-position slave and the TP270 as a standard Profibus HMI slave.

Topology: single-master Profibus-DP segment. Termination ON at both physical ends only.

Prerequisites

• STEP 7 V5.5 (or later) installed with the S7-300 Hardware Support Package for the CPU 314-2DP.
• The Lenze GSD file for the 2133 Profibus module. The file ships with the Lenze Drive Solution Designer / Lenze EPM software install and is also downloadable from the official Lenze product page for the 9300 series. The GSD file is typically named LEN0E091.GSD (verify the version stamped on the file against the firmware of the 2133 module).
• Lenze Global Drive Control (GDC) or the X400 keypad module to set the fieldbus-related drive parameters before the Profibus master goes online.
• The Lenze 9300 Communication Manual (Profibus-DP volume, document HGB_Profibus series) for the parameter set, telegram definitions, and fault-code cross-reference.
• A working Profibus segment with termination, and a known baud rate (1.5 Mbaud or 12 Mbaud are typical for a single Lenze slave).
• Appropriate firmware on the 2133 module. The Profibus-DP slave card is identified to the drive through the fieldbus type; mismatch between the GSD revision and the card firmware will appear as a configuration error during DP start-up.
• If using a CP 342-5, the CP's hardware support package in STEP 7 and a CP 342-5 DP master configuration in HWConfig on the CP, not on the CPU.

Profibus PPO Types and Telegram Structure

Profibus-DP slaves to drives use the Parameter Process Data Object (PPO) convention to combine a parameter channel (PKW) and a process data channel (PZD) into a single cyclic telegram. The Lenze 2133 module supports the standard PPO types defined in the PROFIdrive profile (see PROFIBUS & PROFINET International for the full profile spec).

For positioning control on a 9300 Servo where the drive handles the entire position controller, the smallest fit is PPO3: 2 PZD words in each direction. The first word is the control word (PLC → drive) and status word (drive → PLC); the second word carries the main setpoint, which for the 9300 Servo position controller is the position setpoint (or, in velocity mode, the velocity setpoint). When the recipe also needs to write back discrete drive parameters (e.g., positioning window, acceleration ramps), move to PPO1 to add the 4-word PKW channel.

Recommended choice for this recipe: PPO3 (4 bytes input / 4 bytes output). The PLC writes the control word and the position setpoint; the drive replies with the status word and the actual position. All ramp, gain, and limit parameters are pre-loaded once via the keypad/GDC, or, optionally, acyclically through the PKW channel of a PPO1 telegram. The PPO type must be set both in HWConfig (for the master side) and in drive code C0140 (for the slave side); mismatch produces a configuration fault during DP start-up.

Installing the Lenze GSD File and Configuring the Profibus Node

1. Copy the Lenze GSD file (e.g., LEN0E091.GSD) and the associated bitmap (LEN0E091.BMP) to the STEP 7 GSD directory: C:\Program Files\Siemens\Automation\SIMATIC Manager\S7DATA\GSD (the exact path depends on the STEP 7 install). Restart HWConfig so it re-scans the device catalog.
2. Open the S7-300 station in HWConfig. Drag the CPU 314-2DP from the catalog. On the X2 (MPI/DP) interface, set the interface type to Profibus-DP master and assign a Profibus subnet with a master address (default 2) and the desired baud rate. Siemens recommends 1.5 Mbaud for a single Lenze 9300 slave; 12 Mbaud is supported but cable quality becomes critical.
3. From the Profibus-DP catalog, expand Additional Field Devices → Drives → Lenze → 9300 Servo → EMF 2133 IB. Drag the appropriate PPO3 (or PPO1) entry to the Profibus subnet. Set the slave address to match the address you set on the 2133 module (rotary switches on the module, or C0135 in the drive parameter list).
4. Double-click the slave to open its properties. On the Parameter Assignment tab, confirm that the configured I/O addresses do not collide with the CPU 314-2DP's I/O. The default is PE 256..259 / PA 256..259 for PPO3. Change them to a free area such as PE 300..303 / PA 300..303 and note the values for the LADDR parameter of SFC14/SFC15.
5. Save and compile the station. Download the HWConfig to the CPU. The CPU 314-2DP will go into RUN; the slave should appear in the DP diagnostics as OK. If the BF LED on the CPU flashes, revisit the slave address and the GSD file version.

Lenze 9300 Drive Parameters for Profibus

Before the drive will accept a Profibus setpoint, the fieldbus source for control word, setpoint, and feedback must be selected in the drive. The relevant codes are documented in the Lenze 9300 Communication Manual; the values below are the typical settings for a position-controlled servo over Profibus.

Control Word and Status Word (ACDS / PROFIdrive Profile)

When configured for Profibus, the Lenze 9300 Servo drive accepts a 16-bit control word that follows the ACDS bit assignments inherited from the DRIVECOM profile. Most bits map 1:1 to PROFIdrive state transitions, so the same word layout used on Siemens MASTERDRIVES / SINAMICS drives applies here.

The standard switch-on sequence for a Profibus-controlled Lenze 9300 is:

1. Apply 0x0006 (binary 0000 0110): coast stop and quick stop cleared, drive waits for "Enable operation".
2. Apply 0x0007 (binary 0000 0111): add "Enable operation", drive powers the output stage.
3. Apply 0x000F (binary 0000 1111): add "Enable ramp generator" and "Enable setpoint", drive begins following the position setpoint.
4. To stop under controlled deceleration, drop bit 2 to 0 (quick stop).
5. To coast, drop bit 1 to 0.
6. To clear a fault, pulse bit 7 from 0 → 1 on a new control word write.

State transitions for the ACDS control word. Each transition is gated by reading the status word back before proceeding.

SFC14 / SFC15 Programming for Cyclic Data Exchange

For the integrated DP port of the CPU 314-2DP, the data from a DP slave is not in the process image. You must use SFC14 (DPRD_DAT) to copy consistent data from the slave to a DB, and SFC15 (DPWR_DAT) to write consistent data from a DB back to the slave. Both SFCs move a complete PPO as one consistent block; partial reads or writes are not possible.

Define a data block (e.g., DB100) that mirrors the PPO layout. For PPO3:

DATA_BLOCK DB100
TITLE = 'Lenze 9300 PPO3 image'
STRUCT
  ControlWord  : WORD;   // output word 0 - PZD1 to drive
  Setpoint     : WORD;   // output word 1 - PZD2 to drive (position)
  StatusWord   : WORD;   // input  word 0 - PZD1 from drive
  ActualValue  : WORD;   // input  word 1 - PZD2 from drive (actual pos.)
END_STRUCT
END_DATA_BLOCK

Call the read in OB1 (or OB35 for a fixed cycle) and the write right after. The RET_VAL of both SFCs returns W#16#0000 on success; non-zero values are described in the STEP 7 Online Help.

// Read inputs from drive (4 bytes for PPO3)
CALL "DPRD_DAT" (
  LADDR   := W#16#12C,                    // 300 decimal = W#16#012C
  RET_VAL := MW100,                       // 0 = OK; non-zero = error
  RECORD  := P#DB100.DBX 4 BYTE 4         // StatusWord + ActualValue
);

// Write outputs to drive (4 bytes for PPO3)
CALL "DPWR_DAT" (
  LADDR   := W#16#12C,
  RET_VAL := MW102,
  RECORD  := P#DB100.DBX 0 BYTE 4         // ControlWord + Setpoint
);

Common RET_VAL values from SFC14/SFC15:

Length rules. For PPO3, SFC15 writes 4 bytes (2 PZD words) and SFC14 reads 4 bytes. For PPO1, both move 12 bytes; PPO2 = 20 bytes; PPO4 = 12 bytes; PPO5 = 28 bytes. The RECORD parameter must match the configured slot length exactly. SFC15 returns W#16#8090 if it does not.

For an OB35 (cyclic interrupt) implementation, place the calls in OB35 at, e.g., 100 ms, and have the HMI read recipe data from a separate recipe DB rather than from DB100. The drive-side cycle is independent of OB35; the drive latches the latest setpoint and status on each telegram.

Implementing the Positioning Sequence with TP270 Recipe

The motion recipe is built from the TP270-supplied parameters. The PLC's job is to (a) check the drive state, (b) write a target position, (c) wait for "position reached" in the status word, (d) dwell for the supplied time, and (e) repeat. The drive handles the motion profile (ramp, position controller, following-error window) internally, so the PLC never needs to interpolate the move.

Positioning sequence state machine. Each transition is gated by the drive status word and the local TON timer.

Recipe variables (loaded from the TP270 into DB200):

Position values from the TP270 are real-world millimetres. The drive expects a Lenze-internal position value (increments) on PZD2. Two options exist:

1. Use the drive's scaling. Configure C0885 (position scaling factor) so that the integer fed in PZD2 maps directly to the recipe. With the default 100 incr/mm, 14 mm = 1400 increments. The PLC rounds rForward * 100 and writes the integer.
2. Convert in the PLC. The PLC multiplies the real value by the scale and writes the integer. Advantage: the recipe is portable across drives with different scaling.

An STL outline of the sequence control in OB1 follows. It uses an internal state word (MW200) to track the current step and runs the cycle indefinitely until bStart is reset.

// Step 0: Wait for run request
      A   DB200.DBX0.0        // bStart
      JC  ST10
      L   0
      T   MW200
      BEA

// Step 10: Drive ON sequence
ST10: L   W#16#6
      T   DB100.DBW0         // ControlWord = 0x0006
      CALL "DPWR_DAT"        // write
      L   DB100.DBW4         // StatusWord
      L   W#16#31            // Ready + Run + Enabled
      AW
      L   W#16#31
      ==I
      JC  ST20
      BEA

// Step 20: Send forward setpoint
ST20: L   DB200.DBD2         // rForward
      L   1.0
      *R
      L   1.0e+2             // scale 100 incr/mm
      *R
      RND
      T   DB100.DBW2         // Setpoint (INT)
      L   W#16#F
      T   DB100.DBW0         // ControlWord = 0x000F
      CALL "DPWR_DAT"
      // wait for "position reached" in status word
      L   DB200.DBD2         // store target in DB210 for re-use
      T   DB210.DBD0
      L   21
      T   MW200
      BEA

// Step 21: Hold 1 (2 s)
ST21: ...   // TON timer on DB200.DBD6
      // after timer done, set Setpoint = -rBack1 (positive magnitude, sign by recipe)
      L   22
      T   MW200

// Step 22: Move back 2 mm
// Step 23: Hold 2 (0.2 s)
// Step 24: Move back 0.1 mm
// Step 25: Loop back to Step 10

The exact implementation depends on whether the TP270 is sending values via a recipe or via simple tags. With a TP270 configured as a Profibus slave with its own GSD, the values land in the PLC's input process image and can be moved into DB200 with a few MOVE blocks.

Commissioning, Diagnostics, and Verification

1. Watch the LEDs. The CPU 314-2DP front panel has a "DP" LED (green) and a "BF" (bus fault) LED. After download, the DP LED should be solid green; the BF LED should be OFF. A steady BF indicates no Profibus activity; a flashing BF indicates a configuration or slave-address mismatch.
2. Use STEP 7's "DP Slave Diagnostics". In HWConfig, right-click the Lenze slave and select DP-Slave-Diagnose. The diagnostic buffer gives the slave's state and any Profibus layer-2 errors. A common reading is Station failure when the 2133 module is unpowered.
3. Monitor the PZD live. Open DB100 in the VAT table. After a successful SFC14 call, DB100.DBW4 (status word) should read 0x0531 on a healthy idle drive (Ready + Run + Enabled, plus "Operation enabled" and "DC bus charged"). On a fault, the high byte carries the Lenze fault code; the manual lists the cross-reference.
4. Force a small move. With the PLC in STOP, set DB100.DBW0 = W#16#6 and DB100.DBW2 = 0 in the VAT and trigger a single SFC15 via the VAT's "Modify" function. The drive should power up the output stage (you will hear the contactor close). Then write W#16#F with a small setpoint (e.g., 100 increments = 1 mm) and confirm the motor turns. Monitor the actual position in DB100.DBW6 to see the move complete.
5. Verify positioning accuracy. Measure the actual 14 mm / 2 mm / 0.1 mm with a dial indicator or a caliper. The drive's following error and positioning window (typically codes in the C090x range) determine the tolerance; tighter windows mean less margin for thermal drift.
6. Check the recipe round-trip. Edit rForward on the TP270 from 14 mm to, e.g., 10 mm. Verify the value arrives in DB200.DBD2 by toggling a VAT. Then start the cycle and confirm the drive moves 10 mm, not 14 mm. This validates the HMI-to-PLC segment of the chain.

Troubleshooting Matrix

CP 342-5 Alternative Path

If the application uses a CP 342-5 instead of the integrated DP port, the read/write path is different. The CP 342-5 is a Profibus-DP master that exposes its data through a configurable input/output area on the S7-300 backplane. The standard blocks for it are FC1 (DP_SEND) and FC2 (DP_RECV), both supplied with the CP. The CP also requires a separate DP master configuration in HWConfig that lives on the CP, not the CPU.

For each slave, allocate a length in the CP's input/output area (e.g., 4 bytes for PPO3). Then in the user program:

CALL "DP_RECV" (
  CPLADDR := W#16#150,                  // CP 342-5 base address from HWConfig
  RECV    := P#DB100.DBX 4 BYTE 4,
  DPSTAT  := MW110
);

CALL "DP_SEND" (
  CPLADDR := W#16#150,
  SEND    := P#DB100.DBX 0 BYTE 4,
  DPSTAT  := MW112
);

The drive-side configuration (C0086..C0089, C0120, C0135, C0140) is identical regardless of whether the master is the CPU 314-2DP's integrated port or a CP 342-5. DPSTAT non-zero indicates a CP-internal error (e.g., slave offline); the CP 342-5 manual maps the bits.

FAQ