Displaying SINAMICS S120 Fault Codes in WinCC 7.0 SP2

Overview

SINAMICS S120 drives expose hundreds of fault and alarm numbers (F-coded faults, A-coded alarms) that the controller needs to surface to the operator. When the drive is connected to a SIMATIC station (S7-300/S7-400 with ET 200S Profibus slave) and the SCADA layer is WinCC 7.0 SP2 over TCP/IP, there is no automatic, plug-and-play import path the way WinCC Flexible 2008 SP2 provided for direct point-to-point Profibus. The integrator must therefore build the bridge manually: read the SINAMICS fault and alarm words out of the cyclic or acyclic parameter channel, transport them to WinCC tags, and map each numeric value to a description through a WinCC text list or text library.

This reference covers three engineering paths that work in production installations:

1. Method A – Cyclic fault/alarm word + manually built WinCC text list (lowest effort for small fault sets, most common field approach).
2. Method B – Siemens pre-built text library for SINAMICS error messages (fastest, requires internet access to Siemens Support and is documented in entry ID 47520881 and the successor entry 51679827).
3. Method C – Acyclic PKW/DPV1 parameter read of r0945, r0947, r2122, r2124 (used when the cyclic image does not contain the full fault buffer).

All three methods are valid; the choice depends on the number of drives, the desired granularity (current fault only vs. complete history), and the available engineering time.

Prerequisites

SINAMICS S120 Fault and Alarm Architecture

The S120 keeps a circular fault buffer and a separate alarm buffer. The most important parameters for SCADA visualisation are listed below. Knowing which parameter to read is half the job; the other half is mapping the 16-bit or 32-bit value back to a string the operator can read.

For a 1-line HMI message the typical minimum set is r2135.0 (fault present, bit 3) and r2130 (current alarm) plus r0945[0] (most recent fault code). The full list reference is in the SINAMICS S120/S150 List Manual.

Profibus Telegram and PPO Structure

The CU320-2 DP is configured with a standard telegram (1, 2, 3, 4, 5, 6, 7, 9, 110 or 111 are the most common). On a Profibus PPO (Parameter Process Object) the layout is:

Standard telegrams 1–7 do not transmit fault text; they only transmit status bits (ZSW1 bit 3 = "fault active", ZSW1 bit 6 = "switch-on inhibit", ZSW1 bit 7 = "alarm active") and the actual value. The numeric code itself (e.g. F07801) is read out acyclically through the PKW part of the PPO or via DPV1 read/write record.

If cyclic display of the current alarm number is required, the S120 supports the "Free telegram 999 / 9999" configuration where additional status words are mapped to PZD. A typical mapping is:

• PZD3 OUT = control word 2 (STW2) – not used for fault
• PZD3 IN = ZSW2 (status word 2)
• PZD4 IN = current alarm number r2130 (mapped via p2051[x])
• PZD5 IN = most recent fault number r0945[0] (mapped via p2051[x])

This gives WinCC a 16-bit integer that can be wired directly into a text list. The configuration is done in STARTER under Drive → Communication → Telegram configuration → Free telegram configuration, then assigning p2051[i] = r2130 and p2051[i+1] = r0945[0].

Method A – Cyclic Word plus Manually Built WinCC Text List

This is the most reproducible method because it depends only on the WinCC configuration, not on external downloads.

Step A1 – expose the current fault and alarm number on Profibus

In STARTER, on the CU320-2:

1. Open the drive object and switch to Communication → Telegram configuration.
2. Choose Free telegram (BICO interconnection).
3. Assign a free PZD input to parameter r2130 (current alarm) and another to r0945[0] (current fault) using the p2051[idx] and p2050[idx] parameters.
4. Save to ROM and download.

Step A2 – map the PZD words into STEP 7 I/O

In HW Config of the S7 station, install the SINAMICS S120 GSD file (Siemens device library) and place the drive on the Profibus subnet. Note the input addresses assigned (e.g. PEW 256 / PEW 258 for the PZD words you need).

Step A3 – WinCC tag configuration

1. In WinCC Explorer, open Tag Management and add two binary / unsigned-16 tags under the SIMATIC S7 PROTOCOL SUITE / Profibus DP / Tag or under TCP/IP if WinCC is talking to the CPU directly.
2. Point the tags to the input words selected above (e.g. "Drive1_CurrentAlarm" → DBW or PEW from the S7 program). Often the S7 program copies the PZD image into a DB so that the WinCC TCP/IP channel can read it without I/O access rights.

Step A4 – build the text list

1. In WinCC Explorer, right-click Text and Graphic Lists → Text Lists and create a new list, e.g. SINAMICS_FaultList.
2. For WinCC 7.0 SP2 the list is a flat list of Value / Text pairs. Add the standard S120 fault codes. A representative subset:

3. Repeat for alarms (Axxxx) and bind the text list to an I/O field in the desired screen.

Method B – Siemens Pre-Built Text Library (Entry 47520881 / 51679827)

Siemens ships a downloadable text library for WinCC and WinCC Flexible that contains the full SINAMICS error message catalogue. The original entry is 47520881; a successor that includes newer firmware is at 51679827.

Step B1 – download and unzip

1. Log in to Siemens Industry Online Support.
2. Open the entry and download the attached ZIP file (typically named xxxxx_SINAMICS_ErrorMessages_WinCC_en.zip).
3. Extract to a working folder. The contents are usually:
   • A WinCC Flexible import file (*.xlsx or *.csv)
   • A WinCC v7 compatible import file (text library *.txt or *.xlsx)
   • A short README describing column layout

Step B2 – import into WinCC 7.0 SP2

1. Open WinCC Explorer and select Text and Graphic Lists → Text Lists.
2. Right-click the target text list and choose Import… (or use Text Library → Import from file, depending on the SP2 menu structure).
3. Point at the exported CSV/XLSX. The import wizard maps the first column to Value and the second to Text.
4. Verify with a few sample values (0, 7801, 30001, 50005) that the correct text appears in the preview column.

Method C – Acyclic PKW / DPV1 Read of the Fault Buffer

Use this method when the operator screen must show more than the latest fault. Acyclic communication is supported on the S7 side by SFB52 / SFB53 (RDREC / WRREC) or SFC58 / SFC59, and on the WinCC side through the S7 channel's Acyclic services.

PKW request structure for an S120 parameter read

A successful drive response returns 0x2000 + parameter number in PKE word 1 and the parameter value in PWE word 3 / 4. A complete WINCC-side script in C that polls the buffer looks like:

// Pseudocode for a WinCC C action polling r0945[n] from a SINAMICS
// 'hS7' is a previously opened channel handle
// 'nDrive' is the Profibus station number
for (int n=0; n<8; ++n)
{
    DWORD dwPNU = 945;        // r0945
    DWORD dwIdx = n;          // index
    DWORD dwVal = 0;
    // Issue DPV1 read of (945, n) on the SINAMICS slot
    HRESULT hr = S7AcyclicRead(hS7, nDrive, SLOT_PZD, dwPNU, dwIdx, &dwVal);
    if (SUCCEEDED(hr))
    {
        SetTagWord(MAKE_WORD(nDrive, n), (WORD)dwVal);
    }
    Sleep(20);                // do not overrun the bus
}

Bind each SetTagWord result to its own text list element. Because the fault buffer is 64 entries deep, the typical compromise is to display the first 8 entries (most recent) and provide a button that loads the next 8 on demand.

WinCC 7.0 SP2 Configuration Walkthrough

Connect the S7 station to WinCC

1. Open WinCC Explorer and start Tag Management.
2. Add a new driver of type SIMATIC S7 PROTOCOL SUITE.
3. Under TCP/IP, create a new connection. Point the IP address at the S7 CPU, the rack/slot to 0/2 (or the actual CPU slot).
4. Create internal tags of type Unsigned 16-bit to hold each PZD value that the S7 copies into a DB. Sample structure in the S7 DB:

DATA_BLOCK "DB_Drive1"
  STRUCT
    stDriveStatus : WORD;   // ZSW1 from PZD1
    nActSpeed     : INT;    // NIST from PZD2
    nCurrentAlarm : WORD;   // r2130 mapped to PZD3
    nCurrentFault : WORD;   // r0945[0] mapped to PZD4
    nFaultBuf1    : WORD;   // optional acyclic
    nFaultBuf2    : WORD;
  END_STRUCT;
END_DATA_BLOCK

Wire the I/O field to a text list

1. Open the screen (e.g. DriveOverview.pdl) in Graphics Designer.
2. Drop an I/O field on the page; in the configuration dialog select Output mode and bind it to tag Drive1_CurrentFault.
3. In the Output/Input tab, change field type to Text list and choose the imported list SINAMICS_FaultList.
4. Repeat for Drive1_CurrentAlarm and the corresponding SINAMICS_AlarmList.

Alarms via the WinCC Alarm Logging

For a real SCADA feel, the fault should appear in the message line at the bottom of the screen with an audible buzzer. The standard method is:

1. Create a numeric tag that mirrors a known fault bit (e.g. Drive1_ZSW1_Bit3).
2. Open Alarm Logging and create a new single message. Set Trigger tag to the bit and Status to Came In / Went Out.
3. In the message text use a placeholder for the dynamic text, for example: @(SINAMICS_FaultList%Drive1_CurrentFault%d). WinCC resolves the text list at runtime and prints "F07801 Motor overcurrent" instead of a raw number.
4. Configure a class with red background and the horn flag set so the operator gets an audible indication.

Verification Checklist

Troubleshooting Matrix

Edge Cases and Field-Proven Caveats

• Multiple drive objects on one CU320-2. A single CU hosts up to 6 servo / 6 vector drive objects. Each object has its own r2130/r0945 buffer. If the free telegram is configured only on the Control Unit, only the CU-level faults come through. To capture drive-object faults, configure the telegram on each DO.
• PROFIsafe on top of Profibus DP. When the S120 has a PROFIsafe channel (e.g. via ET 200S PM-D F module), the safety faults are signalled through the PROFIsafe status bits, not through F-numbers. Do not map safety-relevant messages to text lists that can be silenced.
• Text library localisation. The Siemens library at entry 47520881 ships in English; the German library is at 51679827. WinCC 7.0 SP2 supports text list runtime switching via the Text DLL, so both languages can co-exist.
• Time stamping. r2132 / r0949 are milliseconds since the drive powered on, not absolute time. Convert to absolute time in the S7 logic by adding the power-on time of the CU. WinCC Alarm Logging receives the absolute time correctly only if the S7 stamps the message.
• Legacy projects. Old S120 firmware < 2.6.2 indexes the alarm buffer at r2122[0…7] with a different mapping. Always cross-check the parameter list against the firmware version of the connected drive.