Configuring SINAMICS G120C Telegrams on S7-1200 for Fault Codes

David Krause17 min read
SiemensTutorial / How-toVFD / Drives
Licensed PE Working through this on a live machine? A Maine-licensed engineer can take it from here — included with IMD hardware, by the hour for everything else. Book an engineer

Problem Statement: Standard Telegrams Do Not Carry Fault Codes

A SINAMICS G120C PN connected to a SIMATIC S7-1200 (CPU 1215C) is typically operated using one of the Siemens standard telegrams. Telegram 1 carries speed setpoint and actual value plus the standard control/status words. Telegram 350 adds a torque limit word and the actual current/torque feedback, which is attractive when a torque cap must be enforced from the PLC. Neither telegram, however, includes the drive's fault number (r0945) or warning number (r2122) in the cyclic process image. The PLC sees the bits in the status word that indicate "fault active" or "warning active," but it cannot read the actual numeric fault code without additional configuration.

This article documents three viable approaches to surface fault and warning codes from a G120C on an S7-1200 in TIA Portal V15.1 Update 3 with Startdrive V15.1 Update 2:

  1. Keep the standard telegram and add a free telegram (telegram 999) on slot 1 containing the relevant r-parameters mapped to PZDs.
  2. Use supplementary telegram data on the same slot to extend a standard telegram with additional words that the user tailors.
  3. Read fault and warning records acyclically with WRREC and RDREC against the PROFIdrive parameter channel.

The first two options push the values into the cyclic I/O image and update every bus cycle. The third option is decoupled from the bus cycle and reads on demand, which is the technique used by the Siemens "S7-1200 with SINAMICS G120" application example (entry ID 70155469).

Telegram Selection Matrix for SINAMICS G120C PN

The following telegrams are selectable for the G120C PN. Only the words that matter for a typical speed-controlled application with torque limit are shown. PZD widths are fixed at 16 bits unless otherwise noted.

Telegram Direction Word 1 Word 2 Word 3 Word 4 Word 5 Typical Use
1 PLC → drive STW1 NSOLL — — — Speed control
1 Drive → PLC ZSW1 NIST — — — Speed feedback
2 PLC → drive STW1 NSOLL — — — Speed control with encoder feedback
3 PLC → drive STW1 NSOLL — — — Speed control with encoder + torque limit
20 PLC → drive STW1 NSOLL — — — Speed control, 16-bit I/O variant
350 PLC → drive STW1 NSOLL M_LIM Suppl_setp — Speed + torque limit + supplementary setpoint
350 Drive → PLC ZSW1 NIST IA_IST M_IST Suppl_act Speed + current + torque feedback
352 PLC → drive STW1 NSOLL M_LIM Suppl_setp — Like 350, encoder slot present
999 Both User-tailored (free) Custom mapping of any r-parameter to PZD

None of telegrams 1, 2, 3, 20, 350, or 352 contain r0945, r0947, r2122, or r2124. Telegram 999 is the only built-in way to get those values into the cyclic frame without changing the firmware or using an acyclic service.

Prerequisites

  • SIMATIC S7-1200 CPU 1215C (DC/DC/DC or AC/DC/RLY) with PROFINET interface, firmware V4.4 or later (recommended for compatibility with TIA V15.1 UPD 3).
  • Three SINAMICS G120C PN drives, each with a valid PROFINET device name and IP address assigned by the topology editor.
  • SINAMICS G120C firmware V4.7 SP10 or later to match the Startdrive V15.1 UPD 2 device library.
  • TIA Portal V15.1 Update 3, Startdrive V15.1 Update 2, Openness V15.1 installed on the engineering station.
  • GSD file for the G120C PN imported if the project was migrated from an older TIA version.
  • Functional PROFINET network with the PLC and all three drives reachable from the engineering station.
If the firmware on the G120C is older than V4.7, certain parameter channel responses may differ in length. Always verify the firmware level with parameter r0018 before commissioning acyclic services.

Step 1 — Configure Telegram 1 for Speed Control

Telegram 1 is the lowest-complexity cyclic configuration and is the recommended base for any application that does not require encoder-based position control. To assign it:

  1. In the project tree, expand SINAMICS_G120C_PN_1 > Device configuration and open the Properties inspector.
  2. Select the PROFINET interface → Telegram configuration.
  3. In Add telegram, choose Standard telegram 1.
  4. Map the resulting I/O addresses into the PLC's process image (for example, %IW64 for ZSW1/NIST and %QW64 for STW1/NSOLL).
  5. Create a global DB, for example DB_Drive1_Cyclic, with the structure STW1 : WORD; NSOLL : INT; ZSW1 : WORD; NIST : INT; and assign it to the cyclic I/O using the PLC variable mapping table.

The STW1 control bits 0 (ON/OFF1), 1 (OFF2), 2 (OFF3), and 3 (enable pulse) must be set in the order required by the drive's ramp-up sequence. Bit 6 must be toggled to acknowledge faults. The ZSW1 status word reports drive state in bits 0–2, fault in bit 3, warning in bit 7, and speed deviation in bit 8.

Step 2 — Add Torque Limiting with Telegram 350

When the application must cap motor torque (for example, to protect a gearbox or to perform a soft start against a known load), telegram 350 is the correct choice. It adds the torque limit word M_LIM on the output side and the actual current (IA_IST) plus actual torque (M_IST) on the input side.

  1. Replace the telegram assignment from Step 1 with Standard telegram 350.
  2. Update the cyclic DB layout to:
    STW1 : WORD; NSOLL : INT; M_LIM : INT; SupplSetp : INT; (output)
    ZSW1 : WORD; NIST : INT; IA_IST : INT; M_IST : INT; SupplAct : INT; (input)
  3. Scale M_LIM as a signed 16-bit value where 16384 (0x4000) represents 100 percent of the rated motor torque (parameter p2003 reference torque).
  4. Scale NSOLL as a signed 16-bit value where 16384 (0x4000) represents the reference speed (parameter p2000).
If you change from telegram 1 to telegram 350 at runtime (online), the PLC must re-initialize the slot. With PROFINET this is a stop/start of the drive's cyclic AR. Always perform telegram changes with the drive in Ready to switch on state, not while running.

Step 3 — Extend the Telegram with Free Telegram 999

Free telegram 999 lets you map any read-only r-parameter to a PZD position in the cyclic frame. Telegram 999 can be used either as a standalone replacement for the standard telegram or as an additional slot attached to the drive's PROFINET interface.

For a configuration that keeps standard telegram 1 (speed control) and adds fault codes, add a second telegram slot with telegram 999 and map the following parameters to the PZDs in this order:

Configuring the mapping in Startdrive:

  1. In the device view, open Telegram configuration on the PROFINET interface.
  2. Add a second telegram and select Free telegram (999).
  3. For each PZD slot, click Insert signal and select the parameter number (e.g., 945) and the array index 0.
  4. Set the signal type to Input (drive → PLC) for the fault/warning values.
  5. Compile the project and download the drive configuration. The cyclic I/O addresses of slot 2 will appear in the device view next to the standard telegram.

Free telegram 999 is also useful when the application needs additional process values such as r0021 (smoothed actual speed), r0031 (actual torque), or r0080 (torque-generating current Iq) without burning an extra acyclic service.

Step 4 — Use Supplementary Telegram Data (Option B)

Where Startdrive permits it, the standard telegram can be extended with supplementary data that appends additional PZDs directly to the same telegram rather than creating a second slot. The exact mechanics differ slightly between firmware versions, but the effect is the same: a single AR carries both the standard telegram and the user-defined words.

To add fault/warning numbers using supplementary data:

  1. Open the telegram configuration and switch from "Fixed telegram" to "User-defined / extended".
  2. After the standard telegram words (STW1/NSOLL), append two extra output words and four extra input words.
  3. Bind the appended input words to parameters r0945[0], r0947[0], r2122[0], and r2124[0].
  4. Reserve the appended output words for future writes (e.g., p0840 as ON/OFF1) if needed.

This approach has the advantage of a single PROFINET AR, a single configuration in the topology editor, and one set of I/O addresses for the PLC. The disadvantage is loss of strict conformance with the PROFIdrive profile; some third-party controllers may not accept the extended layout.

Step 5 — Acyclic Parameter Access with WRREC and RDREC

If you cannot or do not want to consume cyclic bandwidth for fault and warning codes, the acyclic route is the right choice. The drive exposes its parameter list over PROFINET record read/write services. The S7-1200 provides two system function blocks for this: RDREC (read record) and WRREC (write record). The Siemens application example cited above wraps these in an FB (FB20) that orchestrates the request/response handshake.

For PROFIdrive parameter access, the data record index is typically 0xB02E (decimal 45102) on the drive's PROFINET slot. The request payload follows the PROFIdrive parameter channel specification:

PZD index (slot 2) Drive parameter Meaning Data type
1 r0945[0] Fault number, most recent active U16 (Unsigned16)
2 r0947[0] Fault time received (seconds as floating-point) REAL (32-bit)
3 r2122[0] Warning number, most recent active U16
4 r2124[0] Warning time received REAL
Byte Field Value Notes
0 Function 0x01 = read, 0x02 = write Always read for fault buffer
1 Number of parameters 1–39 Read one parameter per call
2 Attribute 0x10 = value Use 0x10 for r0945, 0x20 for description
3 Number of elements 1–65 1 for current fault, 8 for buffer
4–5 Parameter number Little-endian U16 r0945 = 0xB1 0x03
6 Subindex 0–255 Index 0 = index 0 of array
7–8 Reserved 0 Padding

The response on a successful read contains: byte 0 = function echo (0x01), byte 1 = number of parameters echoed, byte 2–3 = format/type of the value, byte 4–5 = number of values returned, byte 6–7 = parameter value (U16) for r0945.

Sample ST code to issue a read for the current fault number on drive 1:

// DB_Acyclic parameter request record for r0945, single value
DATA_BLOCK DB_G120C_ReadFault
  STRUCT
    Request  : ARRAY[0..15] OF BYTE := 8(#0);
    Response : ARRAY[0..31] OF BYTE := 32(#0);
    State    : INT  := 0;
    Done     : BOOL := FALSE;
    Busy     : BOOL := FALSE;
    Error    : BOOL := FALSE;
    Status   : WORD := 16#0000;
  END_STRUCT;
END_DATA_BLOCK

// OB1 cyclic call
// Pre-fill request:
DB_G120C_ReadFault.Request[0] := 16#01;    // Function: read parameter
DB_G120C_ReadFault.Request[1] := 16#01;    // Number of parameters
DB_G120C_ReadFault.Request[2] := 16#10;    // Attribute: value
DB_G120C_ReadFault.Request[3] := 16#01;    // Number of elements
DB_G120C_ReadFault.Request[4] := 16#B1;    // Parameter number low byte
DB_G120C_ReadFault.Request[5] := 16#03;    // Parameter number high byte (= 945)
DB_G120C_ReadFault.Request[6] := 16#00;    // Subindex 0
DB_G120C_ReadFault.Request[7] := 16#00;    // Reserved

// Trigger RDREC
RDREC_DB(REQ := TRUE,
         ID  := "G120C_1_Interface".HwId,    // HW ID of PROFINET slot
         INDEX := 16#B02E,                  // PROFIdrive parameter channel
         MLEN := 32,                        // Max response length
         VALID => DB_G120C_ReadFault.Done,
         BUSY  => DB_G120C_ReadFault.Busy,
         ERROR => DB_G120C_ReadFault.Error,
         STATUS => DB_G120C_ReadFault.Status,
         RECORD := DB_G120C_ReadFault.Response);

The current fault number (drive-side index 0) appears at byte 6–7 of the response. To read the full buffer, change byte 3 to the desired count (e.g., 8) and increase MLEN accordingly; each fault occupies 8 bytes (U16 number, U16 reserved, REAL time received, REAL time resolved).

Step 6 — Reading the Fault Buffer (r0945, r0947, r0949)

SINAMICS G120C exposes the fault buffer as a circular array of 8 entries. After a fault occurs, the drive moves the new entry to index 0 and shifts older entries up. The relevant parameters are:

Parameter Meaning Format
r0945[0..7] Fault number Unsigned16
r0947[0..7] Fault time received, drive uptime in seconds Floating-point 32
r0948[0..7] Fault time removed Floating-point 32
r0949[0..7] Fault value (manufacturer-specific) Unsigned32
r2131 Current fault code (most recent, only present while fault is active) Unsigned16
r2133[0..7] Fault value, floating-point form Floating-point 32

Reading the full buffer with one acyclic call is not possible because each parameter has a different data type and width. A practical strategy is to issue one read per index (0..7) using RDREC, with each call returning one fault number (2 bytes) plus its time received (4 bytes). On the PLC, store the values in a ring buffer DB keyed by drive number and slot index.

A complete index sweep from index 0 to index 7 fits in 8 sequential RDREC calls. Each call can be 200 ms apart on a stable PROFINET network, which keeps the bus load negligible. On a 1 ms PROFINET update time, the RDREC completes typically within 10–30 ms.

Step 7 — Reading the Warning Buffer (r2122, r2124)

Warnings follow the same circular scheme but live in a separate array. The parameter map is:

Parameter Meaning Format
r2122[0..63] Warning number Unsigned16
r2124[0..63] Warning time received Floating-point 32
r2132 Current active alarm/warning number Unsigned16
r2109 Count of active warnings Unsigned16

Note that the warning buffer is larger (64 entries) than the fault buffer (8 entries). When sweeping via RDREC, plan accordingly. A common simplification is to read only index 0 plus the count parameter r2109; if the count is non-zero, escalate the polling frequency or read the additional indices.

Reading parameter r2122 via free telegram 999 will only deliver the value at index 0 unless the array index is configured separately for each PZD slot. The free telegram maps one parameter per PZD, not the entire array.

Step 8 — PROFINET Diagnostics Channel and FB20 Reference

Beyond the parameter channel, PROFINET offers a diagnostics channel that emits asynchronous alarm telegrams when the drive enters a fault state. The relevant alarm indices on a SINAMICS G120C are summarized below:

Alarm index (hex) Meaning
0x00A0–0x00AF Diagnostic alarms (channel-based, used for fault/warning events)
0x0080–0x008F Process alarms
0x00FE Status alarm (PRM_End, AR state changes)
0x00C0 Extended diagnostic (multi-byte vendor-specific data)

Siemens ships a freely-available example project that demonstrates the diagnostics channel in combination with WRREC/RDREC for fault and warning reads. The example is published under entry ID 70155469. Inside the example, FB20 wraps the parameter channel handshake and exposes typed outputs such as FaultNumber, FaultTime, WarningNumber, and WarningTime for each of the three drives.

A complementary reference that shows the speed-control path on the S7-300/400 platform (still valid as a logic pattern for the parameter channel and telegram layout) is the application document at entry 58820849 (PDF).

Step 9 — Commissioning Procedure

  1. Download the PLC hardware configuration with all three G120C PN devices in the topology. Confirm that the PROFINET device names resolve from the engineering station.
  2. In Startdrive, open each drive's online portal and verify the firmware version with parameter r0018. Accept if the version is V4.7 SP10 or later.
  3. Restore the drive factory settings if commissioning for the first time (parameter p0010 = 30, then p0970 = 1). Wait for the drive to complete the ramp-down; the process can take up to 30 seconds.
  4. Run basic commissioning: enter motor data from the nameplate into p0300..p0311, set p0010 = 0 to exit commissioning, then p0971 = 1 to save.
  5. Configure the telegram (standard 1 or 350) on the PROFINET slot. Download the drive configuration from Startdrive.
  6. If using telegram 999 or supplementary data, add the parameter mappings and download again.
  7. Compile and download the PLC program. Place the CPU in Run.
  8. Send a single ON command (set STW1 = 0x047E, then 0x047F) and verify that the motor turns and that NIST follows NSOLL.
  9. Trigger the acyclic reads one drive at a time and confirm that RDREC returns VALID = TRUE and STATUS = 16#0000.

Step 10 — Verification Checklist

Check Expected How to verify
PROFINET AR is up Status word bit 2 (Ready to switch on) transitions Online → Drive diagnostics → Communication status
STW1 bits toggle correctly Drive follows ON/OFF1/OFF2/OFF3 Force STW1 from watch table, observe ZSW1
Speed setpoint tracks NIST Within 2–5 % of NSOLL after ramp Trace NSOLL and NIST in Startdrive
Torque limit honored Motor torque saturates at M_LIM Set M_LIM = 100 (≈6 %), drive a stalled condition, watch M_IST
Fault number visible r0945[0] non-zero after a forced fault Trigger F30002 (DC bus undervoltage) by removing mains, observe cyclic PZD or RDREC result
Warning number visible r2122[0] non-zero after a forced warning Set motor identification pending, observe A07991
RDREC returns valid data VALID = TRUE, STATUS = 16#0000 Monitor in HMI tag or watch table
Diagnostics alarm received FB receives at least one alarm per fault event Enable diagnostics in PLC online diagnostics

Troubleshooting Matrix

Symptom RDREC STATUS Root cause Remediation
RDREC returns STATUS = 16#80B1 16#80B1 Length of RECORD variable too short for response Increase MLEN to ≥32 bytes; verify Response array size
RDREC returns STATUS = 16#80A1 16#80A1 Wrong hardware ID; slot not assigned to this drive Re-check HwId in system constants for the drive's PROFINET interface
RDREC returns STATUS = 16#80C3 16#80C3 Access to parameter denied (drive in commissioning state) Set p0010 = 0 on the drive, then re-issue RDREC
RDREC returns STATUS = 16#80B6 16#80B6 PROFINET AR lost; drive not reachable Check cabling and device name; reset AR from the PLC online view
Cyclic fault code reads 0 even when drive is faulted N/A Wrong PZD slot configured; default telegram sends ZSW1 only Re-map PZD to r0945[0] in telegram 999 or supplementary data
Warning number freezes at first value N/A Cyclic update rate too low relative to warning buffer refresh Use acyclic RDREC with polling, or set PROFINET update time to 1 ms
Telegram 350 download fails N/A Drive firmware does not support telegram 350 Update G120C firmware to V4.7 SP10 or later
Free telegram 999 rejected N/A Parameter is read-only but mapped as output Set signal direction to Input (drive → PLC) for r-parameters
Fault number jumps to 0 immediately after read N/A Application issued an acknowledge (p3981 or STW1.7) before buffer capture Capture buffer before issuing the acknowledge
Only the first drive responds to RDREC 16#80A1 on drives 2–3 Same hardware ID used for all three drives Verify system constants — each drive must have a unique HwId

Performance and Bandwidth Considerations

Each free telegram 999 PZD consumes 2 bytes of cyclic payload. The standard PROFINET frame on the S7-1215C has a maximum of 256 bytes input plus 256 bytes output per device, so a 5-word free telegram leaves ample headroom. The cyclic update time can stay at the default 1 ms without bus saturation even with all three drives each carrying a 5-word telegram 999.

Acyclic reads do not consume cyclic bandwidth at all but are rate-limited to roughly 50–100 parameter requests per second per drive on a G120C. For fault and warning sweeps of 8 entries, the worst-case latency is 8 × 20 ms ≈ 160 ms. This is acceptable for HMI display but too slow for fast interlock logic. For interlocks, prefer the cyclic status word bit 3 (fault present) and bit 7 (warning present), and use the acyclic read only to populate the fault/warning number for the operator.

Safety and Operational Notes

Reading r0945 via RDREC does not affect the drive state. Do not write to p3981 (acknowledge faults) from the PLC unless the application logic explicitly requires it; an inadvertent acknowledge during commissioning can mask intermittent faults.
The torque limit in telegram 350 is a soft limit. For functional safety stops, use STO (Safe Torque Off) via the drive's safety terminals or via PROFIsafe — never rely on M_LIM alone for personnel protection.
When migrating from TIA V15 to V15.1, Startdrive may rewrite the telegram configuration. After the migration, always re-download the device configuration to the drives before downloading the PLC program.

Frequently Asked Questions

Which telegram on a SINAMICS G120C PN carries the active fault number?

None of the standard telegrams (1, 2, 3, 20, 350, 352) include fault or warning numbers in the cyclic frame. Use free telegram 999 to map r0945[0] to a PZD, or read r0945 acyclically with RDREC against data record index 0xB02E.

Can I read the full 8-entry fault buffer in a single RDREC call?

No. Each parameter is read separately. Issue 8 RDREC calls, one per index, with number-of-elements set to 1 each. Combine this with 8 calls to r0947 if you also need the timestamps. With a 1 ms PROFINET update time, the complete sweep finishes in under 200 ms.

What is the data record index for PROFIdrive parameter access on the G120C?

The PROFIdrive parameter channel uses index 0xB02E (decimal 45102) on the drive's PROFINET slot. Startdrive's standard blocks (e.g., SINA_PARA) handle this index internally, but if you call RDREC/WRREC directly you must set INDEX = 16#B02E.

How do I scale NSOLL and M_LIM in telegram 350?

Both are signed 16-bit values where 16384 (0x4000) represents 100 percent of the reference value. NSOLL references parameter p2000 (reference speed). M_LIM references parameter p2003 (reference torque). Use the scaling tools in the PLC to convert RPM and Nm to integer values.

Can I use telegram 999 together with telegram 1?

Yes. Add telegram 999 as a second telegram on the same PROFINET slot. The PLC will see two separate I/O regions: one for the standard telegram 1 (speed control) and one for telegram 999 (fault/warning numbers). Both update every bus cycle without extra load on the parameter channel.

Why does my RDREC return STATUS 16#80C3?

STATUS 16#80C3 means the drive denied the parameter access, typically because the drive is in commissioning mode (p0010 ≠ 0). Set p0010 = 0 on the drive and re-issue the read. If the issue persists, verify that the parameter number in the request is correct and that the firmware supports the parameter.

Is FB20 from Siemens example 70155469 mandatory?

No. FB20 is a convenience wrapper that handles the request/response handshake for multiple drives. You can call RDREC and WRREC directly with the request structure shown in Step 5, but FB20 reduces programming effort when scaling to three or more drives.

Back to blog