Implementing USS Communication: S7-400 CPU to MM4 Drives via CP441

The Siemens SIMATIC S7-400 family does not ship with pre-built USS function blocks designed for the CP441 point-to-point communication module. Engineers targeting the legacy MICROMASTER 4 (MM4) drive family must therefore construct the USS telegram inside STEP 7 manually, or substitute a Profibus DP option module on the drive to remove the manual encoding burden entirely. This reference documents the USS telegram structure, the MM4 parameter set required to expose the drive on an RS-485 multi-drop link, the CP441 hardware configuration, and a working S7-400 program skeleton for both control word and setpoint transmission.

USS Protocol Fundamentals

USS (Universal Serial Interface protocol) is Siemens' proprietary, RS-485-based, half-duplex master/slave protocol used predominantly with older drive families such as SIMOREG, SIMOVERT, MICROMASTER, and SINAMICS V20. The protocol uses 11-bit characters (1 start, 8 data, 1 even parity, 1 stop) and an asynchronous serial frame. A single master (the S7 PLC) polls up to 32 slaves on one bus segment, addressing each by a configurable node number.

USS Telegram Structure for MM4

The MM4 expects a 14-byte payload enclosed in a USS frame. The full transmission unit is: STX, LGE, ADR, payload, BCC. The field report lists the canonical layout; expanded with byte-level encoding below.

Control Word 1 (STW1) Bit Map

Main Setpoint (HSW) Encoding

The setpoint is normalized to 0x4000 (= 16384 decimal) representing 100% of the configured reference frequency. The actual motor frequency is computed by:

f_out [Hz] = HSW × P2000 × 2^-14 = HSW × P2000 / 16384

For example, with P2000 = 50 Hz and HSW = 0x2000 (8192 decimal), the drive runs at 25 Hz.

CP441 Hardware Configuration

The S7-400 PtP solution is the CP441-1 (6ES7441-1AA00-0AE0) or CP441-2 (6ES7441-2AA00-0AE0) module. CP441-2 supports two independent interfaces (X27 and X28) and provides a loadable protocol driver architecture; CP441-1 supports a single interface.

Hardware Setup Steps

1. Insert the CP441 in a free slot of the S7-400 rack. Slot allocation must match the configured slot in STEP 7 HW Config.
2. Wire the MM4 RJ-485 terminals (terminals 29 and 30 on MM440; 28 and 29 on MM420) to the CP441 RS-485 port. Use a shielded twisted pair, ground the shield at one end only.
3. Add a 120 Ω termination resistor across the bus at each physical end node. The MM4 does not include onboard termination; install a discrete resistor or fit the optional MM4 termination connector.
4. Set the CP441 interface to RS-485 half-duplex using the X27/X28 dip switch block on the rear of the module (4-wire / 2-wire selector).

STEP 7 Software Configuration

STEP 7 V5.5 (or STEP 7 Professional in the TIA Portal for S7-400 routing) is the standard engineering tool for S7-400. Although Siemens publishes USS example blocks aimed at the S7-300 / CP340 / CP341, the same protocol driver concept applies to the CP441 family once a loadable driver is assigned to the port.

Assigning the USS Driver to CP441

1. In HW Config, double-click the CP441 module and select the interface tab.
2. Open "Protocol" and assign the loadable driver. The USS driver for CP441 is supplied with STEP 7 and is selectable as "3964R / USS". If the driver is missing, it must be installed from the STEP 7 optional package "CP PtP Parameter Assignment".
3. Configure the baud rate to match the drive (default 9600 8E1 for MM4). Set parity to EVEN.
4. Enable RS-485 mode and set the bus termination inside the CP441 parameter dialog.
5. Save and download the hardware configuration to the CPU.

Manual USS Implementation in S7-400 (without loadable driver)

STEP 7 STL Send Block (FC100) Skeleton

FUNCTION FC100 : VOID
// FC100 — Build and send a 14-byte USS telegram to MM4
VAR_INPUT
  i_DriveAddr  : INT;   // 1..30, 31 = broadcast
  i_ControlWord : WORD; // STW1, e.g. W#16#047E
  i_Setpoint    : INT;   // 0..16384 normalized
END_VAR
VAR_TEMP
  t_BCC       : BYTE;
  t_Index     : INT;
END_VAR
VAR
  s_TxBuf     : ARRAY[0..15] OF BYTE; // STX, LGE, ADR, PKE..PZD2, BCC
END_VAR
BEGIN
  s_TxBuf[0]  := B#16#02;            // STX
  s_TxBuf[1]  := B#16#0C;            // LGE = 12
  s_TxBuf[2]  := INT_TO_BYTE(i_DriveAddr);
  s_TxBuf[3]  := B#16#00;            // PKE hi = no parameter access
  s_TxBuf[4]  := B#16#00;            // PKE lo
  s_TxBuf[5]  := B#16#00;            // IND hi
  s_TxBuf[6]  := B#16#00;            // IND lo
  s_TxBuf[7]  := B#16#00;            // PWE hi
  s_TxBuf[8]  := B#16#00;            // PWE lo
  s_TxBuf[9]  := B#16#00;            // PWE hi
  s_TxBuf[10] := B#16#00;            // PWE lo
  s_TxBuf[11] := WORD_LO_BYTE(i_ControlWord);  // STW1 lo
  s_TxBuf[12] := WORD_HI_BYTE(i_ControlWord);  // STW1 hi
  s_TxBuf[13] := WORD_LO_BYTE(INT_TO_WORD(i_Setpoint));
  s_TxBuf[14] := WORD_HI_BYTE(INT_TO_WORD(i_Setpoint));

  // BCC = XOR of ADR..last payload byte
  t_BCC := B#16#00;
  FOR t_Index := 2 TO 14 DO
    t_BCC := t_BCC XOR s_TxBuf[t_Index];
  END_FOR;
  s_TxBuf[15] := t_BCC;

  // Hand off to CP441 send FB (e.g. FB9 P_SEND or vendor wrapper)
  "CP441_DB".SENDLEN := 16;
  // Copy s_TxBuf into the send DB using BLKMOV / SFC83
END_FUNCTION

The receive path mirrors the structure: a 16-byte response contains STW1 status word (ZSW1) and the main actual value (HIW) in bytes 11–14, plus the BCC in byte 15. The receive FB (e.g. FB10 P_RCV) populates a structured DB that the application program scans for drive fault bits (ZSW1 bit 3 = fault, bit 6 = switch-on inhibit).

Driver ES Alternative

The source thread mentions that installing DRIVER ES (Siemens order 6SW1700-5NC00-0AA0) into STEP 7 provides tested function blocks (FCs) and example projects for driving SIMOREG DC-MASTER and MICROMASTER 4 via USS. These blocks abstract the raw byte transmission and present a structured parameter / process-data interface inside the S7 program. DRIVER ES supplies:

• Pre-tested FCs for parameter read / write (PKW channel)
• Pre-tested FCs for process data (PZD) cyclic exchange
• Watchdog and fault reaction handling
• Example S7-300 and S7-400 projects

If the project budget allows, DRIVER ES is the most reliable route for an S7-400 / MM4 USS application.

MM4 Drive Setup

Before any PLC-side telegram is sent, the MM4 must be configured to source its commands from the COM link rather than the terminal strip. The setup sequence is taken from the official Siemens USS setup guide:

1. Reset the drive to factory defaults with P0010 = 30, P0970 = 1.
2. Set quick commissioning P0010 = 1 and enter motor plate data (P0304–P0311).
3. Set command source P0700[0] = 5 (USS on COM link).
4. Set setpoint source P1000[0] = 5 (USS setpoint).
5. Set the USS address P2011[0] to the unique node number (1–30).
6. Set the USS baud rate P2010[0]. Common choices: 6 = 9600, 7 = 19200, 8 = 38400. All nodes on the bus must use the same baud rate.
7. Set process data length P2012[0] = 2 and parameter channel length P2013[0] = 127 (variable PKW).
8. Set telegram off time P2014[0] > 0 to enable USS watchdog. A typical value is 1000 ms; if no telegram arrives within this window the drive trips F0072.
9. Exit quick commissioning with P3900 = 3 to commit settings.

Commissioning Sequence

1. Connect a service PC with DriveMonitor or STARTER via the MM4 RS-485 service port or the optional OP panel. Verify parameters P0700, P1000, P2010, P2011, P2012, P2013, P2014 read back as expected.
2. Use a serial line analyzer (e.g. COM-bus monitor) tapped across the RS-485 bus to verify that the CP441 is emitting the expected STX / LGE / ADR sequence.
3. From the S7-400, send STW1 = 0x047E (Ready to switch on) and observe that the drive enters the "Ready" state. ZSW1 should read 0x0BB1.
4. Send STW1 = 0x047F (Operation enabled). The drive should now accept setpoints.
5. Apply HSW = 0x2000 (50%) and verify the motor accelerates to ~25 Hz on P2000 = 50 Hz.
6. Issue an OFF1 command (STW1 bit 0 = 0) and verify the drive ramps to zero following the configured ramp time in P1121.
7. Record the worst-case bus turnaround time. With 32 nodes polling in round-robin and 14-byte payload at 9600 baud, expect ~7 ms per slave and ~225 ms total cycle.

Common Faults and Diagnostics

Profibus Alternative

• Standard S7-400 DP master / slave FCs (SFC14 / SFC15 for consistent data) replace all custom USS encoding.
• Deterministic 12 Mbps cyclic exchange instead of polled 9.6 kbps.
• Standardized PPO telegram types (PPO1 / PPO3 / PPO5) supply pre-defined PKW and PZD structures.
• Diagnostic interrupts for drive faults are wired automatically through Profibus DP-V0 / DP-V1.

The Profibus module is the recommended path for new installations where the customer is open to a hardware upgrade. The MM4 Profibus module supports PPO type 1 (PKW + 2 PZD), which is the typical minimum required to read status and write speed reference.

Siemens Documentation References

• Overview of USS communication (S7-300, S7-400) — STEP 7
• General information on drive setup (S7-300, S7-400) — STEP 7

Frequently Asked Questions