Programming SIMODRIVE 611U on S7-315 PROFIBUS DP with SFC14 and SFC15
This field-procedure reference covers the full commissioning path for a Siemens SIMODRIVE 611 universal (611U) inverter controlled by a SIMATIC S7-315 (CPU 315-2 DP, order code 6ES7 315-2AFxx-0AB0) over PROFIBUS DP using the standard SFCs 14 (DPRD_DAT) and 15 (DPWR_DAT). The intended mode is positioning. Sample FBD and LAD code is provided with full LADDR, RECORD, and RET_VAL parameterization, plus the SIMOCOMU parameterization steps required to bring the drive online. All control word transitions (047Eh reset, 047Fh enable) are mapped, and a fault code matrix is included for commissioning troubleshooting.
1. Reference Architecture and Signal Topology
The S7-315-2 DP master communicates with the SIMODRIVE 611U control unit (typically a 6SN1118-x-x-x-x-x) over a PROFIBUS DP cable terminated per EN 50170. The 611U exposes a PROFIdrive-compliant slave interface and supports PPO types 1, 2, 3, 4, and 5. For positioning, PPO4 is the standard selection because it provides 6 process data words (PZD) in both directions plus the 4-word PKW parameter channel.
1.1 Hardware Bill of Materials
| Item | Order code / part | Function |
|---|---|---|
| CPU 315-2 DP | 6ES7 315-2AFxx-0AB0 | DP master, runs SFC14/15 |
| SIMODRIVE 611U control unit | 6SN1118-0AA00-0AA1 (or 6SN1118-0DMxx) | PROFIdrive slave |
| SIMODRIVE 611 power module | 6SN1123-x-x-x | Line / axis power stage |
| PROFIBUS connector | 6GK1 500-0FC10 or 6ES7 972-0BA12 | DP cable termination |
| PROFIBUS cable | 6XV1 830-0EH10 (purple) | DP segment |
| SIMOCOMU | Commissioning software | Drive parameterization |
| SIMATIC Manager | STEP 7 V5.5+ | PLC project engineering |
2. Prerequisites
- STEP 7 V5.5 (or higher) with S7-300 component support installed.
- SIMOCOMU commissioning software matching the 611U firmware (check Help > About for the supported GSD-compatible parameter set).
- PROFIBUS cable pre-wired, shields grounded at both ends, terminator ON at the two end nodes only.
- 611U control unit node address set on the rotary DIP switch (DIP switch S1 / address 0...127; standard for 611U is 4).
- 24 V control section powered (X124 connector) and pre-charge/line contactor hardware interlock wired per the manual.
- GSD file for the 611U installed in STEP 7 (the file is shipped with SIMOCOMU and is named
SIEM8110.GSDor similar, depending on firmware release).
3. SIMOCOMU Drive Configuration
Open SIMOCOMU, establish a serial or PROFIBUS connection to the 611U, and configure the drive for positioning mode. The 611U exposes hundreds of parameters; the minimum set required for a positioning application is shown below.
3.1 Minimum Parameter Set for Positioning
| Parameter | Typical value | Description |
|---|---|---|
| P1000 | 6 (PROFIBUS, 611U profile) | Setpoint source |
| P1010 | 0 | PROFIdrive conformance bit |
| P1011 | PPO4 | PPO type selected for PROFIBUS |
| P1012 | 4 | PROFIBUS node address (must match DIP) |
| P1100 | 1 | PROFIdrive profile selected (1 = standard) |
| P1240 | 0 (continuous, no inhibit) | Function inhibit configuration |
| P1250 | 1 | Activates traversing block mode (positioning) |
| P1260 | as required | Reference point coordinate (after homing) |
| P1261 | 0 | Absolute/relative encoding of blocks |
| P1310 to P1360+ | block data | Up to 64 traversing blocks (target, vel, accel) |
| P1400 | 1 | Homing / referencing mode select |
| P1790 | as required | Mechanical ratios / load gearing |
Save the parameter set to the EEPROM (P999 = 1 in SIMOCOMU to commit non-volatile). Cycle 24 V control power to activate.
4. SIMATIC Manager Hardware Configuration
- Open STEP 7 / SIMATIC Manager and create a new project with the S7-315-2 DP as the station.
- Open HW Config and place the S7-315-2 DP on rail 0.
- Open the DP master system properties. Set baud rate (1.5 Mbps recommended) and the master address (default 1).
- From the PROFIBUS DP catalog, open SIMODRIVE → SIMODRIVE 611 universal → drag the 611U to the master system.
- Assign DP slave address 4 (or whatever matches the DIP switch on the control unit).
- Open the 611U slot properties and select PPO type 4. PPO4 occupies 10 input words (4 PKW + 6 PZD) and 10 output words (4 PKW + 6 PZD) of the I/O image.
- STEP 7 proposes a starting I/O address. The convention is to use multiples of 16. For this article, the inputs start at
IW 280(10 words: 280..289) and the outputs start atQW 280(10 words: 280..289). This is theLADDRyou pass to SFC14 and SFC15. - Compile and download the HW Config to the CPU. The CPU will perform a DP reconfiguration and the 611U will appear in the online DP slave list.
LADDR. The actual process image is automatically filled/emptied by STEP 7. You can read IW280..IW299 directly if you do not need consistency across the PPO, but the moment a single position value spans words you must use SFC14 to obtain a consistent (gasket-free) read.5. PPO4 Frame Structure
PPO4 is a 20-byte (10-word) telegram in each direction, divided into the parameter channel (PKW) and the process data (PZD).
6. Control Word (STW1) and Status Word (ZSW1) Map
The control word and status word definitions below are the standard PROFIdrive v2 values that the SIMODRIVE 611U publishes. Cross-check against the manual that ships with your specific 611U firmware (the original Configuration Manual is part number PJU_0613_en.pdf, "Configuration Manual SIMODRIVE 611 digital").
6.1 STW1 Bit Map (Master → 611U, PZD word 1 = QW288)
| Bit | Name | Meaning |
|---|---|---|
| 0 | ON / OFF1 | 1 = controller enabled, 0 = ramp stop, pulse inhibit at end of ramp |
| 1 | OFF2 | 0 = coast to stop (voltage removed, pulse inhibit). 1 = no OFF2 |
| 2 | OFF3 | 0 = fast stop with max current. 1 = no OFF3 |
| 3 | Inverter enable | 1 = enable pulse, 0 = inhibit pulse |
| 4 | Ramp generator enable | 1 = release ramp generator output |
| 5 | Ramp freeze / start | 0 = freeze ramp setpoint, 1 = continue |
| 6 | Setpoint enable | 1 = release setpoint to drive ramp input |
| 7 | Acknowledge fault | 0→1 edge resets pending fault (ZSW1 bit 3) |
| 8 | Reserved / jogging 1 | 611U profile dependent |
| 9 | Reserved / jogging 2 | 611U profile dependent |
| 10 | Control by PLC | 1 = automation system owns control, 0 = manual |
| 11 | Reserved | |
| 12 | Reserved | |
| 13 | Reserved | |
| 14 | Reserved | |
| 15 | Reserved |
6.2 Reset / Enable Control Word Values
Per the source documentation, the two control word values used to start the 611U from cold are:
-
QW288 = W#16#047E (binary
0000 0100 0111 1110): drive in a defined reset / not-enabled state. Bit 10 = 1 (PLC control), bit 1 = 1 (no OFF2), but bit 0 = 0 (no ON), so the drive is parked. -
QW288 = W#16#047F (binary
0000 0100 0111 1111): bit 0 = 1 → ON, bit 1,2,3,4,6,7,10 = 1 → drive enabled and pulses released (subject to hardware enable on terminal X121).
6.3 ZSW1 Bit Map (611U → Master, PZD word 1 = IW288)
| Bit | Name | Meaning |
|---|---|---|
| 0 | Ready to switch on | 1 = electronics OK, main contactor can close |
| 1 | Ready to operate | 1 = pulse enable possible |
| 2 | Operation enabled | 1 = drive running, pulses active |
| 3 | Fault present | 1 = active fault, drive is not in operation |
| 4 | OFF2 active | 0 = OFF2 is currently applied |
| 5 | OFF3 active | 0 = OFF3 is currently applied |
| 6 | Switch-on inhibit | 1 = cannot switch on until STW1 bits 0→1 cycle |
| 7 | Warning present | 1 = non-fatal warning active |
| 8 | Speed set/actual in tolerance | 1 = |n_set - n_act| < threshold |
| 9 | Control requested | 1 = drive requests PLC control (handshake) |
| 10 | Reference point reached | 1 = homing complete |
| 11 | Reserved | |
| 12 | Reserved | |
| 13 | Reserved | |
| 14 | Reserved | |
| 15 | Reserved |
7. SFC14 and SFC15 Programming (LAD and FBD)
SFC14 (DPRD_DAT) reads a consistent block of data from a DP slave. SFC15 (DPWR_DAT) writes a consistent block of data to a DP slave. The 20-byte PPO4 must be transferred atomically (i.e. all 10 words in a single DP cycle) to avoid a torn read on multi-word values such as the 32-bit actual position Xist.
7.1 Data Block Layout (DB100)
Reserve a 40-byte data block for the cyclic image:
DATA_BLOCK DB100
STRUCT
RX_PPO : ARRAY[0..19] OF BYTE; // Inputs (611U -> Master), filled by SFC14
TX_PPO : ARRAY[0..19] OF BYTE; // Outputs (Master -> 611U), source for SFC15
END_STRUCT
END_DATA_BLOCK
Symbolic names simplify FBD and LAD coding. Define the following in the symbol table:
| Symbol | Address | Type | Comment |
|---|---|---|---|
| PPO4_RX | DB100.DBB0 | ARRAY[0..19] OF BYTE | Receive PZD (SFC14 destination) |
| PPO4_TX | DB100.DBB20 | ARRAY[0..19] OF BYTE | Transmit PZD (SFC15 source) |
| PPO4_RX.ZSW1 | DB100.DBW28 | WORD | Status word 1 (offset 8 into RX) |
| PPO4_RX.Xist | DB100.DBD34 | DWORD | Actual position 32-bit (offset 12) |
| PPO4_TX.STW1 | DB100.DBW38 | WORD | Control word 1 (offset 8 into TX) |
| PPO4_TX.NSollB | DB100.DBD40 | DWORD | Setpoint speed (offset 10) |
7.2 LAD Network — Read PPO4 from 611U
Network 1: Read PPO4 from slave 611U (LADDR 280) into DB100.PPO4_RX
CALL "DPRD_DAT" // SFC14
LADDR := W#16#0280 // configured I/O start address of the 611U
RET_VAL := MW100 // 0 = OK, see fault code table
RECORD := P#DB100.DBX0.0 BYTE 20
Equivalent graphic in LAD: a single SFC14 box with the three terminals connected as shown. LADDR is fixed at W#16#280; RET_VAL feeds a status word that OB1 can evaluate; RECORD is the symbolic pointer P#DB100.DBX0.0 BYTE 20.
7.3 LAD Network — Write PPO4 to 611U
Network 2: Write DB100.PPO4_TX to slave 611U (LADDR 280)
CALL "DPWR_DAT" // SFC15
LADDR := W#16#0280
RECORD := P#DB100.DBX20.0 BYTE 20
RET_VAL := MW102 // 0 = OK, see fault code table
7.4 FBD Variant (same logic, graphical form)
In FBD the two boxes appear as standard function blocks. The RECORD inputs accept the pointer P#DB100.DBX0.0 BYTE 20 and P#DB100.DBX20.0 BYTE 20 respectively. RET_VAL is a WORD output that should be tied to a status flag and ideally also passed to SF (set fault) for OB82-driven diagnostics.
7.5 STL Variant (compact, for reference)
// --- Read ---
CALL "DPRD_DAT"
LADDR :=W#16#280
RET_VAL:=MW100
RECORD :=P#DB100.DBX0.0 BYTE 20
// --- Write ---
CALL "DPWR_DAT"
LADDR :=W#16#280
RECORD :=P#DB100.DBX20.0 BYTE 20
RET_VAL:=MW102
7.6 SFC14 / SFC15 Return Code (RET_VAL) Matrix
| RET_VAL hex | Meaning (general) | Recommended action |
|---|---|---|
| 0000 | No error | Continue |
| 8090 | Address not configured / length too long | Verify LADDR and the configured PPO length in HW Config |
| 8092 | Data type of RECORD inconsistent with configured length | Confirm BYTE 20 and the destination DB exists |
| 8093 | LADDR is at a word boundary, but the configured length is in bytes (or vice versa) | Check the PPO slot in HW Config |
| 80A0 | Negative acknowledgement from DP slave | Inspect the 611U diagnostics buffer; check GSD |
| 80A1 | DP slave failure / loss of connection | Check PROFIBUS cable, address, terminating resistors |
| 80A2 | DP slave diagnostic data inconsistent | Read DP diagnostic frame; cross-check against 611U fault LEDs |
| 80B0 | DP error (general) | Check bus parameters, slave address, repeat the call |
| 80B1 | Different lengths in source / destination | Verify RECORD length matches HW Config |
| 80B2 | System error / DP master fault | Cycle 24 V to the S7-315 if it persists |
| 80B3 | DP bus access error / bus short | Inspect connectors, terminators, EMI |
| 80C0 | Data has not yet been read (internal) | Skip the read in the current OB1 cycle; retry next cycle |
| 80C1 | Result of the previous read still being processed | Insert a wait / use a one-cycle delay |
| 80C2 | Result of the previous write still being processed | Insert a wait / use a one-cycle delay |
8. State Machine for the 611U Control Word
Below is the recommended state sequence implemented in OB1. The transitions and the corresponding STW1 values are standard PROFIdrive v2 timing.
8.1 Sample FBD — Control Word Sequencer (Network 3)
// Step S0: STW1 := W#16#0 when start = FALSE
// Step S1: STW1 := W#16#047E when start = TRUE AND ZSW1.0 = TRUE
// Step S2: STW1 := W#16#047F when ZSW1.1 = TRUE
// Step S3: STW1 := W#16#047E when ZSW1.3 = TRUE (fault), keep STW1.7 toggled
9. Traversing Blocks (Positioning Mode)
Once the drive is enabled, positioning is achieved by selecting a traversing block number in STW2 (PZD word 6, QW298). The 611U supports 64 traversing blocks in absolute or relative mode.
9.1 Traversing Block Header (in PPO4, written via PKW)
| PKW word | Content | Example |
|---|---|---|
| QW280 (PKW-ID) | Function / ID | W#16#0001 (read single parameter) |
| QW282 (Index) | Parameter number * 1 | W#16#0150 (P1500 = block select) |
| QW284 (Value1) | Block number (1..64) | W#16#0003 = block 3 |
| QW286 (Value2) | Spare | W#16#0 |
For continuous block streaming, write the block number into P1500 using the PKW channel while the 611U is in Block selection mode (P1250 = 1).
9.2 Override and Function Inhibit
- Override is written into PZD3 (QW292). The 611U scales the velocity in PZD2 by this factor; valid range is 0..16384 with 16384 = 100 %.
- Function inhibit (P1240) is a hardware-equivalent safety: when the corresponding bit in STW2 is set, the drive refuses new traversing tasks and decelerates the axis to standstill with the configured emergency ramp.
10. Homing and Referencing
Before any absolute positioning, the axis must be homed. The 611U supports multiple homing modes (P1400):
| P1400 | Mode | Description |
|---|---|---|
| 0 | No homing required | Only valid for purely relative positioning |
| 1 | Direct setpoint (P1260) | Software reference; no axis motion |
| 2 | BERO + encoder zero | Approach cam, then encoder zero pulse |
| 3 | BERO only | Approach cam, stop, take cam position as reference |
| 4 | Limit switch + encoder zero | Backup to hardware limit, then encoder zero |
| 5 | Hardware limit only | Emergency homing, no encoder zero |
Confirm ZSW1 bit 10 (Reference point reached) is 1 before issuing any absolute traversing task.
11. Commissioning and Verification
- Bring the system to a safe state. Open line contactor, ensure emergency stop chain is closed.
- Connect STEP 7 to the S7-315 and go online. In HW Config right-click the 611U and select PROFIBUS diagnostics to confirm the slave is in cyclic data exchange (no red X).
- Open a VAT table in STEP 7. Force
DB100.DBW38 = W#16#047Eand observeDB100.DBW28for ZSW1.0 = 1. - Force
DB100.DBW38 = W#16#047F. Check ZSW1.1 = 1 and ZSW1.2 = 1; the 611U should now be running. With the line contactor still open, no motion occurs but the drives internal state is armed. - Close the line contactor (in controlled order). Issue a small relative move via traversing block 1 (e.g. 1.0 mm at 1 mm/s) and monitor
DB100.DBD34for the actual position advancing toward the target. - Inspect the PROFIBUS diagnostics page periodically; it shows the last error counters, retry count, and bus statistics for the 611U segment.
- Use the SIMOCOMU trace function to record the internal state machine, current, and speed for the next positioning run. Cross-check against the S7 VAT.
12. Troubleshooting Matrix
| Symptom | Likely cause | First check |
|---|---|---|
| RET_VAL = 80A1 from SFC14 | PROFIBUS cable break or terminator missing | Resistance between pins 3 and 8 with terminators ON: 220 Ω at each end; ∞ at the middle. Also check the LED on the 611U PROFIBUS jack. |
| ZSW1.0 stays 0 after writing 047E | 24 V control section not present, or X124 missing | Measure 24 V on X124 pins 7 and 8. Check status LEDs on the 611U front panel. |
| ZSW1.1 stays 0 after writing 047F | Hardware enable on X121 missing, or pulse enable wiring open | Check terminal X121 enable input, hardware enable jumper, and the BERO / hardware limit switch chain. |
| ZSW1.3 = 1 (fault) | 611U in fault state | Read fault via PKW (read P947 / P953) or use SIMOCOMU to view the active fault buffer; the LED is on the front panel. |
| Drive enables but does not move on a block select | Reference not set, or override = 0 | Check ZSW1.10 (reference point reached) and QW292 (override) — must be > 0 for motion. |
| Position overshoots / oscillates | Kv (P gain) too high, or PKW write to P1500 racing with cyclic PZD | Reduce P2010 Kv value, add a 1-cycle interlock to ensure SFC15 completes before next PKW write. |
| Process data inconsistent (torn read of Xist) | SFC14 not used; reading IW directly | Replace direct I/O access with SFC14 into a DB; the 4-byte Xist must be read in a single DP cycle. |
| RET_VAL = 80B3 on power up | Slave not yet at the same baud rate, address conflict | Wait 3 s after CPU start-up; verify address 4 (or whatever) on both 611U DIP and HW Config. |
| Block select accepted but ignored | Function inhibit active, or the 611U is in Jog mode | Read P1240 (function inhibit) and P1250 (mode); set to 0 and 1 respectively. |
13. Common 611U Fault Codes (Subset)
The 611U has an eight-digit fault number space. The table below lists the most common ones encountered during PROFIBUS-driven commissioning; refer to the Configuration Manual for the full list.
| Fault no. | Plain text | Cause / remedy |
|---|---|---|
| 500 | Hardware enable missing | Check X121 enable input and the safety relay chain. |
| 501 | Motor overtemperature | Check motor fan, encoder wiring, P0601 motor model. |
| 504 | Speed controller output limited | Tune P2010 / P2011 or reduce load inertia. |
| 507 | Position controller at limit | Reduce Kv or check mechanical binding. |
| 600 | PROFIBUS failure | Check cable, terminators, baud rate, and GSD revision. |
| 602 | PROFIBUS timeout | Increase DP watchdog time in HW Config or check cyclic OB1 overrun. |
| 610 | Setpoint timeout | The 611U expected a new setpoint within the configured time; check master cycle. |
| 801 | Power section overcurrent | Inspect the IGBT module, the DC bus, and the motor insulation. |
| 805 | DC bus overvoltage | Check line voltage, line filter, and the braking resistor. |
14. Best Practices
- Always place the SFC14/15 calls in OB1 (or a single consistent-time OB such as OB35 if you need fixed 100 ms scheduling). Calling them from multiple OBs at different priorities leads to torn writes and bus collisions.
- For 32-bit values (
Xist,NIST_B), never use direct I/O access. Go through SFC14/15 into a DB to guarantee consistency. - Program the state machine in a separate FB (e.g. FB611) so the same block can be reused for multiple 611U axes. Pass
LADDR,STW1,NIST, and theXistactual position asVAR_IN_OUTof typeSTRUCT. - Monitor the PROFIBUS diagnostics page after every parameter change in SIMOCOMU. The 611U sometimes re-initialises the DP interface after a non-volatile commit, which can cause a momentary 80A1 return code.
- Where possible, use a higher-priority OB (OB35) for the cyclic PZD write and a lower-priority OB (OB1) for the acyclic PKW writes. Insert a bit interlock to prevent a PKW write and a PZD write from clashing in the same cycle.
15. References to Official Documentation
The Configuration Manual for SIMODRIVE 611 digital (PJU_0613_en.pdf) is the master document for parameter numbers, telegram structures, and fault codes used in this article. The SFC14 / SFC15 semantics are documented in the SIMATIC S7-300/400 system and standard functions reference manual.
What is the difference between SFC14 and SFC15 for a SIMODRIVE 611U?
SFC14 (DPRD_DAT) reads a consistent block of data from a DP slave into a destination area. SFC15 (DPWR_DAT) writes a consistent block of data from a source area to a DP slave. For the 611U PPO4 telegram, you call SFC14 once per cycle into DB100 starting at offset 0 and SFC15 once per cycle from offset 20, both with LADDR = W#16#0280.
Which PPO type should I select in HW Config for positioning on a 611U?
Use PPO4. It gives you the 4-word PKW parameter channel for acyclic access to P1500, P1240, P1250, and the like, plus 6 PZD words in each direction for STW1/ZSW1, setpoint, actual position, override, and STW2. PPO1 lacks the parameter channel; PPO2/PPO3 have different PZD counts that do not match the 611U positioning layout.
Why does my 611U not enable when I write 047F to STW1?
ZSW1 bit 1 (Ready to operate) only goes high when the hardware enable at terminal X121 is present. Check X121 wiring and the safety chain (emergency stop, line contactor). It is also worth confirming that ZSW1.0 (Ready to switch on) was high first; if you skipped the 047E reset step, the 611U will remain in switch-on inhibit.
How do I read the actual position of the 611U over PROFIBUS?
The actual position is the 32-bit value Xist at PZD word 3 of the input PPO4. In this article it is located at DB100.DBD34 (offset 12 from the start of the 20-byte RX block). Always read it through SFC14 to avoid a torn read across the two words.
Can I use SFC14 and SFC15 from a non-DP S7-300 CPU to talk to the 611U?
No. SFC14 and SFC15 require an active PROFIBUS DP master interface. Use a CPU with a DP port (such as 6ES7 315-2xxx) or add a CP 342-5 master module. The CP 343-5 is a different family and uses its own FB packages, not SFC14/15.