CPU314C-2PN PROFINET to SINAMICS G120 CU250S-2: PIO & Telegram

Problem Overview

A very common commissioning scenario on a Siemens PROFINET network is a SIMATIC S7-300 CPU 314C-2PN/DP that downloads and runs its program correctly, has a valid link to a SINAMICS G120 CU250S-2 PN, reports no PROFINET diagnostic or station failure on either device, but still cannot exchange useful cyclic process data with the drive. The control word sent by the PLC never appears in the drive's r2050 / r2090, and the status word read back by the PLC never updates. This article documents the three root causes that account for roughly 95 % of these no-data-but-no-fault cases on S7-300 / G120 PROFINET links:

• The I/O address the user is moving to lies outside the configured process image of the CPU 314C-2PN/DP, so the cyclic frame never updates the symbolic operand the program is reading.
• The I/O direction is reversed in the user's mind (a QW on the PLC is an IW on the drive, and vice versa), so the program is writing the control word into the status-word slot or reading the control word slot as input.
• The telegram selected in the G120 and the device configuration in TIA Portal do not match the actual I/O length the program is moving, so the slots are offset by one or more words.

Each is addressed with concrete parameter numbers, register addresses, and a verification procedure that any field engineer can apply without an oscilloscope or PROFINET analyzer.

Hardware Topology

The reference installation is a line topology with no external switch. The integrated 2-port switch of the CPU 314C-2PN/DP is used as the PROFINET backbone.

Network addresses used throughout this reference:

Root Cause 1: Process Image versus Peripheral I/O

On an S7-300, the integrated PROFINET interface (X1 / X2) maps the cyclic I/O of every configured IO Device into the CPU's process image if the I/O address falls inside the configured process image range, or into the peripheral I/O area if it falls outside that range. The CPU 314C-2PN/DP ships with a default process image of 256 bytes for inputs and 256 bytes for outputs, which means only addresses IB 0 ... IB 255 and QB 0 ... QB 255 (or word-level IW 0 ... IW 254 and QW 0 ... QW 254) are accessible by the bit/byte/word process image instructions. A value moved into a symbolic operand backed by, for example, QW 256 will not actually reach the PROFINET frame because QW 256 is outside the process image.

On S7-1200 and S7-1500 this distinction does not exist in user code: every I/O is automatically in the process image and the peripheral prefix P is not normally required. Engineers who move from TIA Portal with an S7-1200 to an S7-300 keep writing IW 256 / QW 256 and get silent failures. There are two correct fixes:

1. Use the peripheral prefix: address the slot as PIW 256 (read directly from the peripheral input area) and PQW 256 (write directly to the peripheral output area). This works for any address in the peripheral I/O area and does not require any change in the CPU configuration.
2. Extend the process image: in TIA Portal open the CPU properties, select Process image, and increase the process image size for inputs and outputs to at least the highest I/O address used by the drive (for example, 512 bytes if the last slot ends at 300). After this, IW 256 and QW 256 resolve as normal process-image accesses and can be used freely in OB1.

Root Cause 2: Direction Mapping (PLC Output equals Drive Input)

The second source of confusion is the direction of the data word. In TIA Portal, the user looks at the device view of the G120, sees two slots (one input slot, one output slot) and assigns addresses in the CPU address space. The mapping rules are:

• What the CPU writes (its outputs, QW / PQW) is what the drive receives as an input (its IW, parameter r2050[0]). The control word and speed setpoint go from the PLC to the drive, so they live at QW / PQW addresses in the CPU program.
• What the CPU reads (its inputs, IW / PIW) is what the drive transmits as an output (its QW, parameter r2051[0]). The status word and actual speed come from the drive to the PLC, so they live at IW / PIW addresses in the CPU program.

It is impossible to write to a PLC IW from the user program. The MOVE instruction that loads the control word into an IW address either does nothing, raises a peripheral-access error, or compiles to a no-op depending on the firmware version. The user must always write the control word to a QW / PQW address and read the status word from an IW / PIW address. This is the same rule on every Siemens PLC, including S7-1200 and S7-1500; what changes is only the addressing notation.

Process Image Configuration on CPU 314C-2PN/DP

The default process image of the CPU 314C-2PN/DP is 256 bytes for inputs and 256 bytes for outputs. Telegram 1 of the SINAMICS G120 occupies 2 PZD words in each direction (4 bytes input + 4 bytes output), which means the drive's I/O always sits inside the default 256-byte process image. If TIA Portal has shifted the drive's address range to byte 256 or higher (for example, when additional IO Devices occupy the lower range), the drive falls outside the process image and the P-prefix becomes mandatory.

1. In the TIA Portal project tree, select the CPU 314C-2PN/DP.
2. Open Properties → General → Process image.
3. Confirm the size of the process image. Increase it if the drive's start address is at or above the current boundary.
4. Verify the size of the process image of the integrated PROFINET interface (under PROFINET interface → Properties → Process image). Both halves are sized independently.
5. After changing the size, recompile and download the hardware configuration. The CPU goes into STOP during the download of the hardware.

Address conflicts are reported by TIA Portal as a red border in the device view. A red border on the G120 device icon in Devices & Networks indicates that the chosen start address is either already in use by another slot or falls outside the maximum I/O range of the CPU. The CPU 314C-2PN/DP supports up to 8192 bytes of input and 8192 bytes of output peripheral I/O; the process image is a subset of that range.

Telegram 1 Configuration on the SINAMICS G120

Standard Telegram 1 (sometimes called "PZD 2/2" or "Speed control, 2 words") is the simplest useful telegram for a SINAMICS G120 PROFINET drive. It carries two PZD words in each direction. The assignment is fixed by the PROFIdrive profile and is the same on every SINAMICS G / S / V series drive that supports PROFINET.

To select this telegram on the G120 with a CU250S-2 PN:

1. Open the STARTER / Startdrive / IOP project for the drive.
2. Navigate to Communication → PROFINET → Telegram configuration.
3. Set P922 = 1 (Standard Telegram 1, PZD 2/2).
4. Do not change the BICO defaults of P2050[0], P2050[1], P2051[0], P2051[1] unless a non-default routing is required. The defaults route STW1 to the control-word BICO sink and ZSW1 from the standard status-word BICO source.
5. Copy RAM to ROM and, if a BOP/IOP is fitted, perform a power cycle to activate the change.

Address Map Reference

The table below is the most useful single page to print and bring to the panel. It ties the symbolic operand visible in TIA Portal, the absolute address used in the user program, the direction, and the drive parameter together. The example assumes the G120 occupies input address 256 ... 259 and output address 256 ... 259, which is the typical assignment when the lower 256 bytes are reserved for central I/O and the second PROFINET slot starts the drive at byte 256.

Sample OB1 code (SCL or LAD) for the CPU 314C-2PN/DP using direct peripheral access so that no process-image extension is required:

// OB1 - cyclic PROFINET exchange with G120 CU250S-2 PN
// Telegram 1, PZD 2/2, drive start address 256

// --- Send: PLC output area (PLC -> drive) ---
// Control word 1 = 16#047E (OFF1, no OFF2/OFF3, enable, control from PLC)
// To run the drive, set bit 0 (ON) -> 16#047F
#CtrlWord := 16#047F;            // 0x047F = ready to operate, setpoint enabled
#SpeedSet  := 16#1000;            // 0x1000 = 25 % of p2000 (100 % = 0x4000)

// Write to the drive via peripheral output area
MOVE_BLK(VARIANT:=#CtrlWord,  COUNT:=1,  OUT  => PQW256);
MOVE_BLK(VARIANT:=#SpeedSet,  COUNT:=1,  OUT  => PQW258);

// --- Receive: PLC input area (drive -> PLC) ---
// Read status word and actual speed from peripheral input area
MOVE_BLK(IN :=PIW256,  COUNT:=1, OUT => #StatusWord);
MOVE_BLK(IN :=PIW258,  COUNT:=1, OUT => #ActualSpeed);

For the equivalent LAD/ST approach inside STEP 7 V5.x or TIA Portal using the symbolic names assigned in the device view:

// LAD: place a MOVE box with IN = 16#047F and OUT = "G120_ControlWord"
//      place a MOVE box with IN = PIW256 and OUT to a data word (e.g. DB42.DBW0)
// ST:  "G120_StatusWord" := PIW256;
//      PQW256 := 16#047F;

TIA Portal Device and Telegram Setup Procedure

The procedure below assumes the SINAMICS G120 GSDML-G120-X.xml has been installed under Options → Manage general station description files (GSD) and that the device name has been assigned to the drive using the topology editor or the online "Assign PROFINET device name" function.

1. Open the project in TIA Portal and select the CPU 314C-2PN/DP from the project tree.
2. Open Devices & Networks and drag the G120 CU250S-2 PN from the hardware catalog into the PROFINET subnet. Assign IP 192.168.0.2 and the previously assigned PROFINET device name.
3. Connect Port 1 of the CPU to Port 1 of the G120 in the topology view. Confirm Port 2 of the G120 is left disconnected.
4. Open the device view of the G120. Right-click on the PROFINET interface slot and confirm that the device is configured as an IO Device, not an IO Controller. The Operating mode field of the PROFINET interface must show IO Device.
5. In the device view, the Device overview shows the slot list. Slot 0 is the drive itself. Sub-slot 1 (telegram) contains the PZD configuration. Confirm the slot shows Standard Telegram 1 (PZD 2/2). If the slot is empty, add the standard telegram 1 by drag-and-drop from the catalog under PROFINET IO → Telegrams → Standard Telegram 1.
6. Open the slot properties and verify the input and output start addresses. The default depends on the slot order; for a clean project the drive occupies the first free area after the central I/O. With central I/O consuming bytes 0-15, the drive typically starts at byte 256 (QW 256 / IW 256). If the address is at byte 256 or higher, the process image must be enlarged or the P-prefix must be used.
7. Compile the project and download the hardware configuration to the CPU. The CPU performs an overall reset and goes through STOP → RUN during the download.
8. In the online view of the G120, monitor r2050[0], r2050[1], r2051[0], r2051[1] and r2090. With the example MOVE in OB1 active, r2050[0] must show 0x047F and r2051[0] must show 0x0C37 or similar (a healthy status word from the drive).

LED Diagnostics Interpretation

The PROFINET link is healthy when the port LEDs on the CPU and the G120 match the table below. Diagnose from the physical layer upwards: link first, then activity, then cyclic-data state on the drive.

The scenario "port 1 of the 314C green, port 2 of the 314C yellow" simply means "the PC link is up and the drive port is exchanging data". It is not an error condition. The bus is healthy. The drive is happily receiving and sending PROFINET frames. The reason the user cannot see the control word is purely an address-direction or process-image issue in the user program, not a PROFINET fault.

Control Word and Status Word Reference (PROFIdrive Profile)

The control and status words of Telegram 1 follow the PROFIdrive application class 1 profile. Only the bit combinations that matter during commissioning are listed below; the full bit map is in the SINAMICS G120 List Manual (LH1) – Communication section.

Useful hex values during commissioning:

• 0x047E = STW1 ready (no OFF2, no OFF3, enable operation, enable RFG, unfreeze RFG, enable setpoint, control by PLC). Bit 0 is OFF, so the drive sits in the "Ready to switch on" state. This is the safe state to apply during commissioning.
• 0x047F = same as 0x047E with bit 0 = 1 (ON). The drive leaves the "Switching on inhibited" state and enters "Operation enabled". From this point, the speed setpoint takes effect.
• 0x04FE = OFF2 active (bit 1 = 0). Use this for an emergency stop from the PLC.
• 0x04FA = OFF3 active (bit 2 = 0). Use this for a controlled fast stop.

Verification Procedure

After the hardware and program changes are downloaded, run the following verification sequence on the panel. Each step has a binary "pass / fail" outcome that does not require the motor to be turning.

1. Link LEDs: CPU Port 1 = green, CPU Port 2 = green or yellow, G120 Port 1 = green. If any link LED is off, the issue is cable / port / partner-device, not program addressing.
2. Bus-fault LEDs: BF LED on the CPU and on the G120 are both off. If BF is red on the G120, the device name or IP does not match the controller's configuration.
3. PROFINET state on the drive: connect STARTER or Startdrive to the G120, go online, and confirm the drive is reachable under IP 192.168.0.2.
4. Cyclic I/O on the drive: monitor r2050[0] (received control word) and r2051[0] (sent status word) in the parameter view. With the example OB1 active, r2050[0] must follow the value the PLC is writing to PQW 256. If r2050[0] stays at 0x0000, the slot is not being written; the I/O address or the process image is wrong.
5. Cyclic I/O on the PLC: in TIA Portal open Online & diagnostics → Monitor / modify on the G120 device. Confirm the input slot shows the drive's status word (typically 0x0C37 at standstill with command "ready to operate") and the output slot shows the controller's control word (0x047F when the example code is active). This view decouples the user program from the diagnostic and is the fastest way to confirm the slot is alive.
6. Direction test: force the control word to 0x04FE from the watch table and confirm the drive enters OFF2 and ramps out (or free-runs to stop). If OFF2 is not honoured, the IO Device is in local control (command source = manual / IOP) and not PROFINET control; set p700 / p1500[0] back to the BICO defaults so that the PROFINET control word reaches the control-word BICO sink.

Common Pitfalls and Troubleshooting Matrix