Configuring USS_RPM on S7-1200 to Read SINAMICS V20 r-Parameters

Configuring USS_RPM on S7-1200 to Read SINAMICS V20 r-Parameters

The USS_RPM (Read Parameter from Drive) instruction on the SIMATIC S7-1200 normally returns drive parameters without issue, but a recurring field problem appears when reading read-only display parameters from a SINAMICS V20: the block successfully reads system parameters such as P0003 (Access Level), P2010 (USS baudrate) or P2023 (USS protocol selection), yet it never returns the values of r0025 (output voltage) or r0027 (output current). The drive is on the bus, the CM 1241 RS485 is wired correctly, USS_PORT runs without error — the user simply cannot get a current/voltage readout into the PLC.

This article explains the underlying cause, the exact input values to load into USS_RPM for any V20 r parameter, and a complete commissioning workflow that includes TIA Portal configuration, status-code diagnostics, and a verification routine.

1. Problem Description

When the USS_RPM block is called with a parameter number that matches a writable Pxxxx parameter on the V20, the DONE output pulses and the VALUE output is populated correctly. When the same block is called with the numeric value that the drive's BOP shows as r0025 or r0027, the response is either:

• A non-zero ERROR bit with STATUS = 16#001F ("drive returns parameter access error"), or
• A successful read returning 0 with no error reported, or
• A timeout with STATUS = 16#0008 ("USS protocol violation, drive did not respond") because the request telegram's Parameter Identifier Value (PKE) is interpreted by the V20 as an unsupported parameter index.

The symptom is identical regardless of firmware version: only "configuration" parameters come back — never the live process values. The root cause lies in how the V20 interprets the 16-bit PKE field of the USS telegram, which is different from how the S7-1200 USS_RPM block sources its inputs.

2. USS_RPM Instruction Architecture

The USS_RPM instruction is part of the legacy USS library for the S7-1200 and is documented in the SIMATIC S7-1200 Programmable Controller System Manual and the dedicated USS instruction reference. The block reads a single parameter from a drive on the USS network and writes the result to a tag of the user-defined type USS_RPM_STRUCT inside the assigned USS data block.

Block call signature:

// Multi-instance DB or standalone FB call
USS_RPM(
    REQ        := bReadRequest,           // BOOL — start the read on rising edge
    DRIVE      := 1,                      // INT  — drive address (1..32)
    PARAM      := 25,                     // INT  — parameter number (PNU)
    INDEX      := 0,                      // INT  — parameter sub-index (normally 0)
    USS_DB     := "USS_Instance_DB",      // BLOCK_DB — shared USS configuration DB
    DONE       => bReadDone,             // BOOL
    ERROR      => bReadError,            // BOOL
    STATUS     => wReadStatus,           // WORD
    VALUE      => rDriveValue            // REAL or INT depending on parameter
);

Per Siemens documentation, all USS functions associated with one USS network and one PtP communication port must use the same instance data block (e.g. USS_Instance_DB). The block must be called from a main program cycle OB so that the internal state machine advances; calls inside startup OBs or interrupt OBs are not permitted.

The four inputs that determine what the V20 sees on the wire are DRIVE, PARAM, INDEX, and the configuration already loaded into the shared USS_DB by USS_PORT.

2.1 Required USS_DB fields

Before USS_RPM can complete a successful read, USS_PORT must have populated the shared data block. The minimum fields the application code must configure before USS_PORT is first called are:

The CM 1241 RS485 must be configured in TIA Portal with the same baud rate, 8 data bits, even parity, and 1 stop bit that the V20 expects when P2010 and P2023 are set.

3. SINAMICS V20 USS Parameter Model

The SINAMICS V20 exposes its parameter set through USS as a 16-bit Parameter Number (PNU) inside the PKE word of every request and response telegram. The 'P' or 'r' prefix that the V20's BOP shows is purely a user-interface convention and is not transmitted on the wire. The drive distinguishes read-only from read/write parameters internally and refuses write attempts to r parameters with status 0x01 (parameter read-only).

For the V20, the numeric portion of the parameter number is the PNU used by USS. The mapping is direct:

The values r0025 and r0027 are returned by the V20 as 32-bit floating-point values in the PWE (Parameter Value) field of the USS response telegram. The USS_RPM block extracts this value and exposes it as a 32-bit REAL at the VALUE output when the underlying VALUE member of USS_RPM_STRUCT is configured as REAL.

3.1 Why "system" parameters return but readouts do not

When the application loads PARAM := 3, PARAM := 2010, or PARAM := 2023, the resulting PNU is a small integer that fits within the standard USS PKE field without modification. The V20 interprets the request correctly and returns a 16-bit integer payload.

When the application loads PARAM := 25 for r0025, the request is technically correct, but two common application mistakes prevent the value from appearing:

1. Index is left at the wrong value. The V20 uses INDEX in the request telegram to select between array elements or between the integer and floating-point view of the same parameter. r0025 is reported as a floating-point value with INDEX = 0. Leaving INDEX at a non-zero default (for example, copying a value from a USS_WPM call) makes the V20 respond with a parameter-not-found error.
2. No time is given between requests. USS_RPM completes on the first telegram exchange. If a new request is issued before the V20 has finished updating its internal measurement (r0025 and r0027 refresh at the current controller cycle, typically 4 ms), the drive will return the previous sample or reject the request. A minimum 50 ms inter-request gap is sufficient at 9600 baud; 20 ms at 19200 baud or higher.

4. Root Cause Analysis

The V20 reports an out-of-range PNU if the request asks for parameter 25 while the V20's "Access Level" (P0003) is set to 1 or 2, because read-only display parameters r0000–r0049 are gated behind access level 3 by default. The PLC sees STATUS = 16#001F and assumes the wiring is wrong, when in fact the V20 has deliberately refused the request.

The required drive-side access level is therefore P0003 = 3 for the duration of commissioning. For production, leave P0003 = 3 permanently or restrict the readout to those r parameters that are exposed at the standard level.

Additional root cause: the V20 firmware families handle parameter index 0 differently. On V20 firmware V15.0 and later (parameter r0018 reports the firmware version), parameter index 0 always returns the floating-point view of read-only parameters. On earlier firmware, INDEX = 0 returns the integer view, which appears to the user as VALUE = 0 even though DONE is TRUE.

5. Prerequisites and Hardware Setup

Before calling USS_RPM for r0025 and r0027, the following must be verified.

5.1 Hardware

• CPU: SIMATIC S7-1200, firmware V4.0 or later. USS instructions are available from STEP 7 V13 SP1 upward. CM 1241 RS485 (order number 6ES7241-1CH30-0XB0) is required; the onboard RS485 of the CPU is not supported.
• Drive: SINAMICS V20, any frame size. Recommended firmware V15.0 or later for stable floating-point readouts.
• Wiring: Two-wire RS485 from CM 1241 to V20 terminals P+ and N-. Install the terminating resistor at the drive end (DIP switch on V20, position ON when the drive is at the end of the segment). Cable: shielded twisted pair, maximum 1000 m at 9600 baud.

5.2 Drive-side configuration (V20 BOP or IOP)

6. Step-by-Step Configuration in TIA Portal

1. Add the CM 1241 RS485 to the device configuration. Drag the module from the hardware catalog into the signal board or communication slot. Open its properties and set baud rate, parity, and protocol to "USS". Match the baud rate to P2010 on the drive.
2. Create a global DB for the USS instance. Insert a new data block named USS_Instance_DB. The block must contain a tag of type USS_PRM_STRUCT, a tag of type USS_WPM_STRUCT for each write parameter, and at least one tag of type USS_RPM_STRUCT for each read parameter.
3. Call USS_PORT in OB1. Wire its PORT input to the configured CM 1241 hardware ID, its BAUD input to the baud rate code, and its USS_DB input to "USS_Instance_DB". Drive REQ TRUE cyclically. The block must run without raising ERROR.
4. Add the USS_RPM call. Drop the instruction into OB1. Wire USS_DB to the same shared instance DB. Set DRIVE := 1 for the V20 at address 1. Set PARAM := 25 for r0025 (output voltage) and a second instance with PARAM := 27 for r0027 (output current).
5. Set the INDEX input to 0. This selects the floating-point view of the read-only parameter. Do not omit the input; the default differs by firmware and will silently return an integer view or zero.
6. Generate a periodic request pulse. Wire REQ to a clock generator that produces a one-cycle pulse every 100 ms. Reading both voltage and current every 200 ms is sufficient for most HMI display refresh rates and does not starve the USS bus.
7. Capture VALUE to a tag of type REAL. Move the VALUE output of each USS_RPM call to a retentive REAL tag such as "Data".Voltage and "Data".Current. The block updates VALUE only on the cycle that DONE is TRUE.
8. Download and go online. Open the watch table for the instance DB. Force a manual REQ pulse and observe STATUS, ERROR, and VALUE.

7. Working Code Sample (Structured Text)

The following ST snippet demonstrates a complete voltage and current readout loop. Adapt the global tags to your project's naming convention.

// Read r0025 (output voltage in V) into "Data".Voltage
IF "Read_Voltage" THEN
    "USS_RPM_Voltage"(
        REQ    := NOT "USS_RPM_Voltage".DONE AND NOT "USS_RPM_Voltage".ERROR,
        DRIVE  := 1,
        PARAM  := 25,
        INDEX  := 0,
        USS_DB := "USS_Instance_DB"
    );
    IF "USS_RPM_Voltage".DONE THEN
        "Data".Voltage := "USS_RPM_Voltage".VALUE;
        "Read_Voltage" := FALSE;
        "Read_Current" := TRUE;
    ELSIF "USS_RPM_Voltage".ERROR THEN
        "Data".LastError := "USS_RPM_Voltage".STATUS;
        "Read_Voltage" := FALSE;
    END_IF;
END_IF;

// Read r0027 (output current in A) into "Data".Current
IF "Read_Current" THEN
    "USS_RPM_Current"(
        REQ    := NOT "USS_RPM_Current".DONE AND NOT "USS_RPM_Current".ERROR,
        DRIVE  := 1,
        PARAM  := 27,
        INDEX  := 0,
        USS_DB := "USS_Instance_DB"
    );
    IF "USS_RPM_Current".DONE THEN
        "Data".Current := "USS_RPM_Current".VALUE;
        "Read_Current" := FALSE;
    ELSIF "USS_RPM_Current".ERROR THEN
        "Data".LastError := "USS_RPM_Current".STATUS;
        "Read_Current" := FALSE;
    END_IF;
END_IF;

This pattern ensures that REQ is pulsed on a rising edge only after the previous read has terminated, which is the recommended edge-triggered use of the instruction.

8. Status Codes and Error Handling

The STATUS output of USS_RPM reports either a USS-protocol-level error or the drive's response-status word from the PKE field. The most relevant values are listed below.

9. Verification Procedure

1. Watch table check. Add the instance DB to a watch table. Force REQ on the voltage read. Confirm DONE = TRUE, ERROR = FALSE, and VALUE reads approximately the drive's bus voltage multiplied by sqrt(3) (e.g. 400 V class drive at 400 V mains returns r0025 ≈ 400).
2. Current check under load. Drive the motor from a known setpoint, for example 50% speed with a balanced mechanical load. Confirm that r0027 settles to a current value consistent with the motor's nameplate full-load current and the load.
3. Confirm refresh rate. Trigger an HMI tag update every 250 ms. The displayed values should update visibly without lag. A 200 ms scan budget per parameter is recommended; faster rates risk overlapping the drive's response window at 9600 baud.
4. Cross-check with BOP. Switch the drive to display r0025 and r0027 on the BOP. Compare the PLC tag against the BOP reading; the values should match within the drive's display rounding (±0.1 V or ±0.01 A).
5. Confirm no USS_PORT errors. Observe USS_PORT.ERROR and USS_PORT.STATUS. Any non-zero status sustained for more than five cycles indicates a bus health issue and will degrade USS_RPM reliability.

10. Field-Commissioning Checklist

• CM 1241 RS485 hardware ID matches USS_PORT.PORT
• CM 1241 baud rate matches P2010
• CM 1241 parity matches P2023 (default even)
• V20 P0010 = 0 (commissioning complete) before live reads
• V20 P0003 = 3 (expert access)
• V20 P2013[0] = 4 (PKW = 4 words)
• V20 P2011[0] matches DRIVE input on the block
• Terminating resistor ON at both ends only if the drive sits at the bus end
• Shield grounded at one end only (typically the cabinet ground bar)
• Inter-request delay ≥ 50 ms at 9600 baud, ≥ 20 ms at ≥ 19200 baud
• USS_RPM called from OB1 only
• All USS instructions on this network share the same instance DB

11. Troubleshooting Matrix

12. Related Read-Only Parameters

Once r0025 and r0027 are confirmed working, the same pattern reads any V20 read-only parameter. Common additions for HMI dashboards:

Each parameter should have its own USS_RPM instance, its own edge-triggered REQ pulse, and its own destination tag. Sharing one instance across multiple parameters is not supported.