Re-Programming a Siemens SIMOVERT Masterdrives VC Control Board via PROFIBUS SFC14/SFC15

This field reference covers the complete re-commissioning procedure for a Siemens SIMOVERT Masterdrives Vector Control drive that has lost its control board parameters and must be reloaded from a STEP 7 S7-300/S7-400 master using cyclic PROFIBUS DP communication. The drive model in scope is the compact unit 6SE7021-0EA61-Z (11.2 A, 480 V in / 480 V out), running software release V3.32. The same methodology applies to the wider 6SE70 series when the same control board (CUMC, CUVC) and PPO type are used.

The official Operating Instructions for the SIMOVERT MASTERDRIVES Vector Control (software release V3.32) is the primary documentation source for parameter numbers, ranges, and PPO types referenced throughout this article. SIMOVERT MASTERDRIVES Vector Control - Operating Instructions (V3.32).

1. Hardware Identification and Software Release

Before any parameter write is attempted, confirm the unit is the drive you think it is. The 6SE7021 ordering key decodes as follows:

Check the firmware version of the CUVC control board by reading parameter r060 (Software version) and r061 (Software generation) on the PMU panel or via DriveMonitor. The V3.32 release described in the official manual is the only release for which the parameter numbers and fieldbus mapping in this article are fully validated. Older V1.x, V2.x, or V3.1 firmware uses different parameter numbers and PPO types - do not cross-load a .dnl across major firmware boundaries without verifying each parameter.

The CUVC control board is the one that holds the PROFIBUS slave address, the PPO type, and the parameter set. The factory *.dnl file is normally written to non-volatile memory on this board. If the board was replaced, the file is lost. The rest of this article walks through the recovery path.

2. PROFIBUS PPO Architecture

SIMOVERT Masterdrives use the Variable-Speed Drive (VSD) profile and a fixed Parameter Process Data Object (PPO) telegram between the SIMATIC S7 master and the drive. There are five PPO types. The drive must be told which one to expect via parameter P091 (CB parameter, PPO type) on the PROFIBUS option board (CBP/CBP2).

The SFC15 call in the source uses LADDR = W#16#140 and a 20-byte record (P#DB16.DBX20.0 BYTE 20). 20 bytes = 10 words, which matches PPO Type 1 (4 PKW + 2 PZD each direction -> 12 words / 24 bytes total round-trip) ONLY if the SFC15 is writing only the PZD portion of a PPO1 frame; however, the byte count of 20 in the call corresponds more closely to a PPO1 PZD-only write (2 words = 4 bytes) being too small, so the layout is more consistent with the PZD portion of PPO 4 (6 PZD words = 12 bytes output, 12 bytes input -> 24 bytes). The most common configuration for the 6SE7021-0EA61 with a CBP2 board and S7-300 master is PPO 4, which provides 6 PZD words each direction and no PKW. Confirm by reading P091 via DriveMonitor or PMU. If P091 reports 4, you are using PPO 4; if it reports 1, the byte count in the SFC15 call must be re-examined because the SFC call length must exactly match the configured PPO word count.

3. SFC14 and SFC15 Configuration

The S7 master uses the standard PROFIBUS DP read/write system function blocks to exchange data with the drive's CBP2 module. The example in the source uses LADDR W#16#140 = 320 decimal, which is the diagnostic base address of the slave. The SFC call signatures are:

SFC14 - DPRAM Read (DP-Slave -> S7)

CALL  SFC 14   // "DPRD_DAT"
     LADDR := W#16#140                  // DP slave diagnostic address
     RET_VAL := MW100                   // SFC return code (0 = OK)
     RECORD := P#DB16.DBX 0.0 BYTE 12   // 12-byte target buffer (PPO4 input)

SFC15 - DPRAM Write (S7 -> DP-Slave)

CALL  SFC 15   // "DPWR_DAT"
     LADDR := W#16#140                  // DP slave diagnostic address
     RECORD := P#DB16.DBX20.0 BYTE 12   // 12-byte source buffer (PPO4 output)
     RET_VAL := MW102                   // SFC return code (0 = OK)

The SFC15 call in the source data uses P#DB16.DBX20.0 BYTE 20. This 20-byte length does not match any standard PPO exactly. Two interpretations are possible and must be resolved by inspecting the HW Config of the source project:

1. The HW Config slot is configured as a combined PZD area, and the 20-byte figure is a residual from a PPO 2 or PPO 5 setup that was simplified during rebuild. In that case, reset the SFC15 length to 12 (PPO 4) or 20 (PPO 2) and re-verify.
2. The SFC call originally wrote a 20-byte block that includes 4 PKW header words (8 bytes) plus 6 PZD words (12 bytes), matching PPO 2. In that case the PPO type is 2, not 4.

Resolve this ambiguity by reading P091 on the drive with DriveMonitor. The PKW area can be left as zeros for PPO 2 if the master does not need parameter access at runtime.

4. Process Data (PZD) Layout in DB16

For PPO 4 with 6 PZD words each direction, the 12-byte input and 12-byte output records map into the STEP 7 data block as follows. The exact starting offset depends on whether PKW is present; the example below assumes PPO 4 (no PKW):

For PPO 1 (4 PKW + 2 PZD), the offset shifts: PKW occupies bytes 0..7, PZD OUT 1 starts at byte 8, PZD IN 1 starts at byte 8 of the read area. The 20-byte write of SFC15 in the source can be a PPO 1 PZD write (2 PZD words = 4 bytes output only, with 4 PKW words = 8 bytes in front) and a 12-byte read (2 PZD words = 4 bytes + 4 PKW words = 8 bytes), giving a 20/12 asymmetric SFC call - this is also a possibility and should be ruled out by reading P091.

5. Control Word 1 (STW1) Bit Assignments

STW1 is the primary on/off and operating-mode selector. The bit numbering below is the Siemens PNO profile (bit 0 = LSB). Default source is P554 (bit 0), P555 (bit 1), etc., when the control source is fieldbus.

The minimum STW1 sequence to run the drive from PLC is STW1 = 16#047E then transition bit 0 from 0 to 1: bit 10 = 1 (PLC control), bit 7 = 1 (no fault), bit 6 = 1 (setpoint enabled), bit 5 = 1 (ramp active), bit 4 = 1 (ramp enabled), bit 3 = 1 (pulse enable), bits 1, 2 = 1 (no OFF2/OFF3). That is decimal 1150 -> hex 0x047E. Setting bit 0 brings it to 0x047F = 1151 and the drive runs the setpoint sent in HSW.

6. Status Word 1 (ZSW1) Bit Assignments

ZSW1 is the drive's reply. The bit meanings in PPO word 1 are:

A drive that is healthy and idle reports ZSW1 = 0x0631 = 1585 (bits 0, 1, 4, 5, 8, 9 set, with the run bit 2 = 0 because it has not yet received the ON command). When the run bit is on, ZSW1 transitions to 0x0E37 = 3639. These are the expected baseline values for verification.

7. Setpoint and Actual Value Encoding (HSW / HIW)

HSW (Hauptsollwert, main setpoint) and HIW (Hauptistwert, main actual value) are normalized to 4000 hex = 100 % of the reference speed defined by P351 (reference speed) or P357 (reference frequency) depending on operating mode. The drive's PROFIBUS scaling must be matched to the S7 engineering:

• 4000 hex = 100 % of reference
• 7FFF hex = +199.99 % of reference
• 8000 hex = -200.00 % of reference (sign-magnitude: -100 % = C000 hex)
• Resolution: 0.0061 % per LSB

If the PLC sends raw RPM in 1/100 RPM units, you must add a scaling FC between DB16 and the SFC15 call:

// Example: convert RPM (REAL) to normalized HSW (INT)
// Reference speed P351 = 1500 RPM, scaling 4000h = 100 % = 1500 RPM
L  DB16.DBD 4                // raw setpoint as REAL, e.g. 750.0 RPM
L  1.6384e+04               // 4000h = 16384 decimal
/R                            // = 0.5
RND                          // 8192 = 2000h = 50 %
T  DB16.DBW 2                // write to HSW slot

8. Parameter Mapping From DB16 to Drive Pxxx

The 20-byte / 12-byte process image in DB16 carries the control path, not the parameter path. Drive parameters (P001..r398, U950..) are configured via DriveMonitor and persist on the CUVC. The PLC only writes the STW and HSW during operation. To recreate the parameter set, you must know the source values of every Pxxx the original commissioning engineer entered.

The most important parameters to recover, in the order the V3.32 manual recommends for a re-commissioning, are:

To make the STW bits sourced from the PROFIBUS PZD word, the parameters P554 through P567 must be set to the BICO connectors 2000 (STW1 bit 0) through 2015 (STW1 bit 15). The default factory value of these parameters is a terminal or PMU source, which is why a recovered drive with stock parameters will not respond to the PLC until the BICO connectors are re-routed.

9. Step-by-Step Re-Commissioning Procedure

Prerequisites

• DriveMonitor V5.x installed on a Windows PC with an RS232 serial cable to the CUVC X500 service port (use a Siemens 6SE7090-0XX84 cable or pin-compatible null-modem cable; DriveMonitor baud default 9600 8N1 on CUVC, optionally switched to 19200 / 38400 via DriveMonitor settings).
• STEP 7 project with the original HW Config and the original DB16 layout loaded on the programming device.
• The V3.32 Operating Instructions open in parallel for parameter reference.
• Motor nameplate data available.
• PROFIBUS cable installed and terminated.

Step 1: Power up the drive and read identification

1. Apply 480 V three-phase to L1/L2/L3. The CUVC PMU should display 0.0 after the self-test. If it shows a fault, record F-code and consult the fault table in the V3.32 manual.
2. Connect DriveMonitor, go online, and read r060 (firmware), r061 (firmware generation), P091 (PPO type), P918 (PROFIBUS address).
3. Read all of the current Pxxx values and save them as factory_state.dnl to a known folder.

Step 2: Restore the drive parameters

1. If an OEM-supplied .dnl file is available, use DriveMonitor Restore -> Parameter Set to load it.
2. If no .dnl is available, enter the parameters from the table in section 8 and from any documentation on the motor and application. Always click Save to EEPROM after each parameter block in DriveMonitor, otherwise changes are lost on the next power-down.
3. Set P060 to 0 (basic parameters) first, then to 3 (functional parameters) when you are ready to write application-specific BICO and process data routing.

Step 3: Configure the BICO routing for STW and ZSW

1. Set P554..P567 to the STW1 connector range 2000..2015. This connects the first PZD word output from the CBP2 to the drive's control logic.
2. Set P590..P599 (where supported) to the ZSW1 connector range 5100..5115 to route the first PZD input word to the status feedback.
3. If the original code uses setpoint selection from PZD, set the setpoint source parameter (typically P443 or P444) to the HSW connector 2002 (PZD word 2).

Step 4: Match the PPO type to HW Config

1. Set P091 to the PPO type that matches the STEP 7 HW Config slot configuration. The HW Config slot's input/output length (configured bytes) must equal 4 * (PKW + PZD) per direction.
2. If P091 is changed, the drive must be power-cycled before the CBP2 will accept the new telegram length.

Step 5: Match the PROFIBUS address

1. Set P918 to the slave address configured in the STEP 7 hardware configuration (commonly 3, 4, or 5 on Masterdrives installations).
2. Cycle control power to the drive so the CBP2 adopts the new address.

Step 6: Run the SFC14/SFC15 cyclic exchange

1. Set DB16.DBW0 (STW1) to 0x047E (1150) initially - everything except bit 0 = ON.
2. Set DB16.DBW2 (HSW) to 0x0000 (zero setpoint).
3. Set DB16.DBW12 (ZSW1 readback) and DB16.DBW14 (HIW) will be updated by SFC14. Verify ZSW1 = 0x0631 (ready, not running).
4. Toggle bit 0 of STW1 from 0 to 1. ZSW1 should transition to 0x0E37 within a few PROFIBUS cycles. The drive is now in operation with zero setpoint.
5. Increment HSW to 0x2000 (50 % of reference). The motor should accelerate along the P462 ramp.

Step 7: Run an auto-tune pass

1. Trigger the motor identification routine from DriveMonitor (typically P115 = 1 to start stationary measurement, or P115 = 2 for rotating measurement). The motor must be free to rotate without load for the rotating pass.
2. Save the new parameters to EEPROM when the routine completes.

10. Verification Checklist

After the re-commissioning, verify each item before returning the line to production:

11. Common Errors and Recovery

12. When to Call the OEM

If the original .dnl cannot be reconstructed from project documentation and the motor/process parameters are unknown, the original machine builder should be the first call. Most OEMs retain a parameter backup for ten or more years. The CUVC control board's EEPROM is physically small; if the original board is still accessible, DriveMonitor can read it and produce a .dnl directly. This is the lowest-risk recovery path.

Re-creating the parameter file from a print-out, the S7 DB, and the motor nameplate is feasible but time-consuming. Allow half a day for a moderately complex BICO setup, plus a controlled ramp test before returning the line to production.

Frequently Asked Questions