Problem Statement: Standard Telegrams Do Not Carry Fault Codes
A SINAMICS G120C PN connected to a SIMATIC S7-1200 (CPU 1215C) is typically operated using one of the Siemens standard telegrams. Telegram 1 carries speed setpoint and actual value plus the standard control/status words. Telegram 350 adds a torque limit word and the actual current/torque feedback, which is attractive when a torque cap must be enforced from the PLC. Neither telegram, however, includes the drive's fault number (r0945) or warning number (r2122) in the cyclic process image. The PLC sees the bits in the status word that indicate "fault active" or "warning active," but it cannot read the actual numeric fault code without additional configuration.
This article documents three viable approaches to surface fault and warning codes from a G120C on an S7-1200 in TIA Portal V15.1 Update 3 with Startdrive V15.1 Update 2:
- Keep the standard telegram and add a free telegram (telegram 999) on slot 1 containing the relevant r-parameters mapped to PZDs.
- Use supplementary telegram data on the same slot to extend a standard telegram with additional words that the user tailors.
- Read fault and warning records acyclically with
WRRECandRDRECagainst the PROFIdrive parameter channel.
The first two options push the values into the cyclic I/O image and update every bus cycle. The third option is decoupled from the bus cycle and reads on demand, which is the technique used by the Siemens "S7-1200 with SINAMICS G120" application example (entry ID 70155469).
Telegram Selection Matrix for SINAMICS G120C PN
The following telegrams are selectable for the G120C PN. Only the words that matter for a typical speed-controlled application with torque limit are shown. PZD widths are fixed at 16 bits unless otherwise noted.
| Telegram | Direction | Word 1 | Word 2 | Word 3 | Word 4 | Word 5 | Typical Use |
|---|---|---|---|---|---|---|---|
| 1 | PLC → drive | STW1 | NSOLL | — | — | — | Speed control |
| 1 | Drive → PLC | ZSW1 | NIST | — | — | — | Speed feedback |
| 2 | PLC → drive | STW1 | NSOLL | — | — | — | Speed control with encoder feedback |
| 3 | PLC → drive | STW1 | NSOLL | — | — | — | Speed control with encoder + torque limit |
| 20 | PLC → drive | STW1 | NSOLL | — | — | — | Speed control, 16-bit I/O variant |
| 350 | PLC → drive | STW1 | NSOLL | M_LIM | Suppl_setp | — | Speed + torque limit + supplementary setpoint |
| 350 | Drive → PLC | ZSW1 | NIST | IA_IST | M_IST | Suppl_act | Speed + current + torque feedback |
| 352 | PLC → drive | STW1 | NSOLL | M_LIM | Suppl_setp | — | Like 350, encoder slot present |
| 999 | Both | User-tailored (free) | Custom mapping of any r-parameter to PZD | ||||
None of telegrams 1, 2, 3, 20, 350, or 352 contain r0945, r0947, r2122, or r2124. Telegram 999 is the only built-in way to get those values into the cyclic frame without changing the firmware or using an acyclic service.
Prerequisites
- SIMATIC S7-1200 CPU 1215C (DC/DC/DC or AC/DC/RLY) with PROFINET interface, firmware V4.4 or later (recommended for compatibility with TIA V15.1 UPD 3).
- Three SINAMICS G120C PN drives, each with a valid PROFINET device name and IP address assigned by the topology editor.
- SINAMICS G120C firmware V4.7 SP10 or later to match the Startdrive V15.1 UPD 2 device library.
- TIA Portal V15.1 Update 3, Startdrive V15.1 Update 2, Openness V15.1 installed on the engineering station.
- GSD file for the G120C PN imported if the project was migrated from an older TIA version.
- Functional PROFINET network with the PLC and all three drives reachable from the engineering station.
r0018 before commissioning acyclic services.Step 1 — Configure Telegram 1 for Speed Control
Telegram 1 is the lowest-complexity cyclic configuration and is the recommended base for any application that does not require encoder-based position control. To assign it:
- In the project tree, expand
SINAMICS_G120C_PN_1 > Device configurationand open the Properties inspector. - Select the PROFINET interface → Telegram configuration.
- In Add telegram, choose Standard telegram 1.
- Map the resulting I/O addresses into the PLC's process image (for example,
%IW64for ZSW1/NIST and%QW64for STW1/NSOLL). - Create a global DB, for example
DB_Drive1_Cyclic, with the structureSTW1 : WORD; NSOLL : INT; ZSW1 : WORD; NIST : INT;and assign it to the cyclic I/O using the PLC variable mapping table.
The STW1 control bits 0 (ON/OFF1), 1 (OFF2), 2 (OFF3), and 3 (enable pulse) must be set in the order required by the drive's ramp-up sequence. Bit 6 must be toggled to acknowledge faults. The ZSW1 status word reports drive state in bits 0–2, fault in bit 3, warning in bit 7, and speed deviation in bit 8.
Step 2 — Add Torque Limiting with Telegram 350
When the application must cap motor torque (for example, to protect a gearbox or to perform a soft start against a known load), telegram 350 is the correct choice. It adds the torque limit word M_LIM on the output side and the actual current (IA_IST) plus actual torque (M_IST) on the input side.
- Replace the telegram assignment from Step 1 with Standard telegram 350.
- Update the cyclic DB layout to:
STW1 : WORD; NSOLL : INT; M_LIM : INT; SupplSetp : INT;(output)
ZSW1 : WORD; NIST : INT; IA_IST : INT; M_IST : INT; SupplAct : INT;(input) - Scale
M_LIMas a signed 16-bit value where 16384 (0x4000) represents 100 percent of the rated motor torque (parameterp2003reference torque). - Scale
NSOLLas a signed 16-bit value where 16384 (0x4000) represents the reference speed (parameterp2000).
Step 3 — Extend the Telegram with Free Telegram 999
Free telegram 999 lets you map any read-only r-parameter to a PZD position in the cyclic frame. Telegram 999 can be used either as a standalone replacement for the standard telegram or as an additional slot attached to the drive's PROFINET interface.
For a configuration that keeps standard telegram 1 (speed control) and adds fault codes, add a second telegram slot with telegram 999 and map the following parameters to the PZDs in this order:
| PZD index (slot 2) | Drive parameter | Meaning | Data type |
|---|---|---|---|
| 1 | r0945[0] |
Fault number, most recent active | U16 (Unsigned16) |
| 2 | r0947[0] |
Fault time received (seconds as floating-point) | REAL (32-bit) |
| 3 | r2122[0] |
Warning number, most recent active | U16 |
| 4 | r2124[0] |
Warning time received | REAL |
| Byte | Field | Value | Notes |
|---|---|---|---|
| 0 | Function |
0x01 = read, 0x02 = write |
Always read for fault buffer |
| 1 | Number of parameters | 1–39 | Read one parameter per call |
| 2 | Attribute |
0x10 = value |
Use 0x10 for r0945, 0x20 for description |
| 3 | Number of elements | 1–65 | 1 for current fault, 8 for buffer |
| 4–5 | Parameter number | Little-endian U16 |
r0945 = 0xB1 0x03
|
| 6 | Subindex | 0–255 | Index 0 = index 0 of array |
| 7–8 | Reserved | 0 | Padding |
The response on a successful read contains: byte 0 = function echo (0x01), byte 1 = number of parameters echoed, byte 2–3 = format/type of the value, byte 4–5 = number of values returned, byte 6–7 = parameter value (U16) for r0945.
Sample ST code to issue a read for the current fault number on drive 1:
// DB_Acyclic parameter request record for r0945, single value
DATA_BLOCK DB_G120C_ReadFault
STRUCT
Request : ARRAY[0..15] OF BYTE := 8(#0);
Response : ARRAY[0..31] OF BYTE := 32(#0);
State : INT := 0;
Done : BOOL := FALSE;
Busy : BOOL := FALSE;
Error : BOOL := FALSE;
Status : WORD := 16#0000;
END_STRUCT;
END_DATA_BLOCK
// OB1 cyclic call
// Pre-fill request:
DB_G120C_ReadFault.Request[0] := 16#01; // Function: read parameter
DB_G120C_ReadFault.Request[1] := 16#01; // Number of parameters
DB_G120C_ReadFault.Request[2] := 16#10; // Attribute: value
DB_G120C_ReadFault.Request[3] := 16#01; // Number of elements
DB_G120C_ReadFault.Request[4] := 16#B1; // Parameter number low byte
DB_G120C_ReadFault.Request[5] := 16#03; // Parameter number high byte (= 945)
DB_G120C_ReadFault.Request[6] := 16#00; // Subindex 0
DB_G120C_ReadFault.Request[7] := 16#00; // Reserved
// Trigger RDREC
RDREC_DB(REQ := TRUE,
ID := "G120C_1_Interface".HwId, // HW ID of PROFINET slot
INDEX := 16#B02E, // PROFIdrive parameter channel
MLEN := 32, // Max response length
VALID => DB_G120C_ReadFault.Done,
BUSY => DB_G120C_ReadFault.Busy,
ERROR => DB_G120C_ReadFault.Error,
STATUS => DB_G120C_ReadFault.Status,
RECORD := DB_G120C_ReadFault.Response);
The current fault number (drive-side index 0) appears at byte 6–7 of the response. To read the full buffer, change byte 3 to the desired count (e.g., 8) and increase MLEN accordingly; each fault occupies 8 bytes (U16 number, U16 reserved, REAL time received, REAL time resolved).
Step 6 — Reading the Fault Buffer (r0945, r0947, r0949)
SINAMICS G120C exposes the fault buffer as a circular array of 8 entries. After a fault occurs, the drive moves the new entry to index 0 and shifts older entries up. The relevant parameters are:
| Parameter | Meaning | Format |
|---|---|---|
r0945[0..7] |
Fault number | Unsigned16 |
r0947[0..7] |
Fault time received, drive uptime in seconds | Floating-point 32 |
r0948[0..7] |
Fault time removed | Floating-point 32 |
r0949[0..7] |
Fault value (manufacturer-specific) | Unsigned32 |
r2131 |
Current fault code (most recent, only present while fault is active) | Unsigned16 |
r2133[0..7] |
Fault value, floating-point form | Floating-point 32 |
Reading the full buffer with one acyclic call is not possible because each parameter has a different data type and width. A practical strategy is to issue one read per index (0..7) using RDREC, with each call returning one fault number (2 bytes) plus its time received (4 bytes). On the PLC, store the values in a ring buffer DB keyed by drive number and slot index.
A complete index sweep from index 0 to index 7 fits in 8 sequential RDREC calls. Each call can be 200 ms apart on a stable PROFINET network, which keeps the bus load negligible. On a 1 ms PROFINET update time, the RDREC completes typically within 10–30 ms.
Step 7 — Reading the Warning Buffer (r2122, r2124)
Warnings follow the same circular scheme but live in a separate array. The parameter map is:
| Parameter | Meaning | Format |
|---|---|---|
r2122[0..63] |
Warning number | Unsigned16 |
r2124[0..63] |
Warning time received | Floating-point 32 |
r2132 |
Current active alarm/warning number | Unsigned16 |
r2109 |
Count of active warnings | Unsigned16 |
Note that the warning buffer is larger (64 entries) than the fault buffer (8 entries). When sweeping via RDREC, plan accordingly. A common simplification is to read only index 0 plus the count parameter r2109; if the count is non-zero, escalate the polling frequency or read the additional indices.
r2122 via free telegram 999 will only deliver the value at index 0 unless the array index is configured separately for each PZD slot. The free telegram maps one parameter per PZD, not the entire array.Step 8 — PROFINET Diagnostics Channel and FB20 Reference
Beyond the parameter channel, PROFINET offers a diagnostics channel that emits asynchronous alarm telegrams when the drive enters a fault state. The relevant alarm indices on a SINAMICS G120C are summarized below:
| Alarm index (hex) | Meaning |
|---|---|
| 0x00A0–0x00AF | Diagnostic alarms (channel-based, used for fault/warning events) |
| 0x0080–0x008F | Process alarms |
| 0x00FE | Status alarm (PRM_End, AR state changes) |
| 0x00C0 | Extended diagnostic (multi-byte vendor-specific data) |
Siemens ships a freely-available example project that demonstrates the diagnostics channel in combination with WRREC/RDREC for fault and warning reads. The example is published under entry ID 70155469. Inside the example, FB20 wraps the parameter channel handshake and exposes typed outputs such as FaultNumber, FaultTime, WarningNumber, and WarningTime for each of the three drives.
A complementary reference that shows the speed-control path on the S7-300/400 platform (still valid as a logic pattern for the parameter channel and telegram layout) is the application document at entry 58820849 (PDF).
Step 9 — Commissioning Procedure
- Download the PLC hardware configuration with all three G120C PN devices in the topology. Confirm that the PROFINET device names resolve from the engineering station.
- In Startdrive, open each drive's online portal and verify the firmware version with parameter
r0018. Accept if the version is V4.7 SP10 or later. - Restore the drive factory settings if commissioning for the first time (parameter
p0010 = 30, thenp0970 = 1). Wait for the drive to complete the ramp-down; the process can take up to 30 seconds. - Run basic commissioning: enter motor data from the nameplate into
p0300..p0311, setp0010 = 0to exit commissioning, thenp0971 = 1to save. - Configure the telegram (standard 1 or 350) on the PROFINET slot. Download the drive configuration from Startdrive.
- If using telegram 999 or supplementary data, add the parameter mappings and download again.
- Compile and download the PLC program. Place the CPU in Run.
- Send a single ON command (set STW1 = 0x047E, then 0x047F) and verify that the motor turns and that NIST follows NSOLL.
- Trigger the acyclic reads one drive at a time and confirm that RDREC returns VALID = TRUE and STATUS = 16#0000.
Step 10 — Verification Checklist
| Check | Expected | How to verify |
|---|---|---|
| PROFINET AR is up | Status word bit 2 (Ready to switch on) transitions | Online → Drive diagnostics → Communication status |
| STW1 bits toggle correctly | Drive follows ON/OFF1/OFF2/OFF3 | Force STW1 from watch table, observe ZSW1
|
| Speed setpoint tracks NIST | Within 2–5 % of NSOLL after ramp | Trace NSOLL and NIST in Startdrive |
| Torque limit honored | Motor torque saturates at M_LIM
|
Set M_LIM = 100 (≈6 %), drive a stalled condition, watch M_IST
|
| Fault number visible |
r0945[0] non-zero after a forced fault |
Trigger F30002 (DC bus undervoltage) by removing mains, observe cyclic PZD or RDREC result |
| Warning number visible |
r2122[0] non-zero after a forced warning |
Set motor identification pending, observe A07991
|
| RDREC returns valid data | VALID = TRUE, STATUS = 16#0000 | Monitor in HMI tag or watch table |
| Diagnostics alarm received | FB receives at least one alarm per fault event | Enable diagnostics in PLC online diagnostics |
Troubleshooting Matrix
| Symptom | RDREC STATUS | Root cause | Remediation |
|---|---|---|---|
| RDREC returns STATUS = 16#80B1 | 16#80B1 | Length of RECORD variable too short for response | Increase MLEN to ≥32 bytes; verify Response array size |
| RDREC returns STATUS = 16#80A1 | 16#80A1 | Wrong hardware ID; slot not assigned to this drive | Re-check HwId in system constants for the drive's PROFINET interface |
| RDREC returns STATUS = 16#80C3 | 16#80C3 | Access to parameter denied (drive in commissioning state) | Set p0010 = 0 on the drive, then re-issue RDREC |
| RDREC returns STATUS = 16#80B6 | 16#80B6 | PROFINET AR lost; drive not reachable | Check cabling and device name; reset AR from the PLC online view |
| Cyclic fault code reads 0 even when drive is faulted | N/A | Wrong PZD slot configured; default telegram sends ZSW1 only | Re-map PZD to r0945[0] in telegram 999 or supplementary data |
| Warning number freezes at first value | N/A | Cyclic update rate too low relative to warning buffer refresh | Use acyclic RDREC with polling, or set PROFINET update time to 1 ms |
| Telegram 350 download fails | N/A | Drive firmware does not support telegram 350 | Update G120C firmware to V4.7 SP10 or later |
| Free telegram 999 rejected | N/A | Parameter is read-only but mapped as output | Set signal direction to Input (drive → PLC) for r-parameters |
| Fault number jumps to 0 immediately after read | N/A | Application issued an acknowledge (p3981 or STW1.7) before buffer capture |
Capture buffer before issuing the acknowledge |
| Only the first drive responds to RDREC | 16#80A1 on drives 2–3 | Same hardware ID used for all three drives | Verify system constants — each drive must have a unique HwId |
Performance and Bandwidth Considerations
Each free telegram 999 PZD consumes 2 bytes of cyclic payload. The standard PROFINET frame on the S7-1215C has a maximum of 256 bytes input plus 256 bytes output per device, so a 5-word free telegram leaves ample headroom. The cyclic update time can stay at the default 1 ms without bus saturation even with all three drives each carrying a 5-word telegram 999.
Acyclic reads do not consume cyclic bandwidth at all but are rate-limited to roughly 50–100 parameter requests per second per drive on a G120C. For fault and warning sweeps of 8 entries, the worst-case latency is 8 × 20 ms ≈ 160 ms. This is acceptable for HMI display but too slow for fast interlock logic. For interlocks, prefer the cyclic status word bit 3 (fault present) and bit 7 (warning present), and use the acyclic read only to populate the fault/warning number for the operator.
Safety and Operational Notes
r0945 via RDREC does not affect the drive state. Do not write to p3981 (acknowledge faults) from the PLC unless the application logic explicitly requires it; an inadvertent acknowledge during commissioning can mask intermittent faults.M_LIM alone for personnel protection.Frequently Asked Questions
Which telegram on a SINAMICS G120C PN carries the active fault number?
None of the standard telegrams (1, 2, 3, 20, 350, 352) include fault or warning numbers in the cyclic frame. Use free telegram 999 to map r0945[0] to a PZD, or read r0945 acyclically with RDREC against data record index 0xB02E.
Can I read the full 8-entry fault buffer in a single RDREC call?
No. Each parameter is read separately. Issue 8 RDREC calls, one per index, with number-of-elements set to 1 each. Combine this with 8 calls to r0947 if you also need the timestamps. With a 1 ms PROFINET update time, the complete sweep finishes in under 200 ms.
What is the data record index for PROFIdrive parameter access on the G120C?
The PROFIdrive parameter channel uses index 0xB02E (decimal 45102) on the drive's PROFINET slot. Startdrive's standard blocks (e.g., SINA_PARA) handle this index internally, but if you call RDREC/WRREC directly you must set INDEX = 16#B02E.
How do I scale NSOLL and M_LIM in telegram 350?
Both are signed 16-bit values where 16384 (0x4000) represents 100 percent of the reference value. NSOLL references parameter p2000 (reference speed). M_LIM references parameter p2003 (reference torque). Use the scaling tools in the PLC to convert RPM and Nm to integer values.
Can I use telegram 999 together with telegram 1?
Yes. Add telegram 999 as a second telegram on the same PROFINET slot. The PLC will see two separate I/O regions: one for the standard telegram 1 (speed control) and one for telegram 999 (fault/warning numbers). Both update every bus cycle without extra load on the parameter channel.
Why does my RDREC return STATUS 16#80C3?
STATUS 16#80C3 means the drive denied the parameter access, typically because the drive is in commissioning mode (p0010 ≠ 0). Set p0010 = 0 on the drive and re-issue the read. If the issue persists, verify that the parameter number in the request is correct and that the firmware supports the parameter.
Is FB20 from Siemens example 70155469 mandatory?
No. FB20 is a convenience wrapper that handles the request/response handshake for multiple drives. You can call RDREC and WRREC directly with the request structure shown in Step 5, but FB20 reduces programming effort when scaling to three or more drives.