Reading MM4 Fault Codes over Profibus-DP via DriveES FB38

Field engineers commissioning a Siemens MICROMASTER 4 (MM420 / MM430 / MM440) on Profibus-DP from an S7-300 (CPU315-2 PN/DP) frequently need to surface drive fault codes on an MP377 (or other WinCC flexible HMI) without sending an operator to the BOP/AOP on the drive cabinet. MM4 drives do not natively publish fault numbers in the PZD (process data) channel. Instead, fault information must be read out cyclically over the PKW (parameter channel) of the PPO structure, or acyclically through DriveES function blocks. This reference covers both methods and provides a working integration path to the HMI.

1. Problem Statement and Architecture

The reported configuration is:

• Controller: SIMATIC S7-300, CPU315-2 PN/DP (6ES7 315-2EH14-0AB0 and earlier -0AH/0AB versions behave identically for DP master operation).
• Drive: MICROMASTER 440 (MM440) with the Profibus-DP option module (6SE6400-1PB00-0AA0) - the same module fits MM420 and MM430.
• HMI: SIMATIC MP377 (Profinet variant, e.g. 6AV6 644-0AB01-2AX0) running WinCC flexible 2008 / WinCC (TIA Portal) with the runtime version matching the panel image.
• Bus topology: CPU315-2 PN/DP acting as DP master on the integrated MPI/DP interface; MP377 connected on the PN side of the CPU.

The fundamental constraint is that MM4 firmware does not place the active fault code (r0947 / r0948 / r0949 / r2109 etc. on SINAMICS) into the PZD words by default. Only status word 1 (r0052, ZSW1) and status word 2 (r0053, ZSW2) are broadcast cyclically. Any fault code, fault value, warning, or fault time must therefore be fetched explicitly by the PLC through either:

1. Cyclic PKW via PPO type 1 or PPO type 5 (8 PKW words + 2/6 PZD words), updated every DP cycle.
2. Acyclic PKW via DriveES Simatic function blocks FB36 / FB37 / FB38 (DEV_FLT3), which read the drive's internal fault buffer.

2. Profibus PPO Structure and PKW Channel

Every MM4 on Profibus exposes a PPO (Parameter Process data Object) selected in HW Config under the DP slave properties. The PPO type determines how many words of PZD and PKW are exchanged:

The PKW channel is 4 words. Each word has a fixed meaning:

• PKE (Word 1) - Parameter Keword. Bits 0-10 = parameter number, bits 11-15 = AK (Auftrags-Kennung / request/response ID).
• IND (Word 2) - Index. Bit 15 selects the parameter page (upper/lower 2000-parameter bank in MM4); bits 0-7 are parameter sub-index, used for MM4 to extend the address range.
• PWE1 / PWE2 (Words 3-4) - Parameter Value. For a 16-bit value only PWE2 is used; for 32-bit values both words carry low/high.

The MM4 Profibus module operating instructions document the AK codes. The most relevant ones are:

For MM4, parameter numbers above 2000 are addressed by setting bit 15 of the IND word (the "page bit"). Example: to read parameter r0947 (last fault code) you actually address parameter 947 with IND = 16#8000; to read r0948 you use parameter 948 with IND = 16#8000. The parameter page bit is essential on MM4 and is a frequent source of "illegal PKE" responses.

3. Method A - Cyclic Read of P947 through the PKW Channel

Configure the DP slave as PPO1 or PPO5. In HW Config, drag the MM4 GSD file (SIEM8170.GSD for the original DP option, or SIEM8180.GSD / SIEM8190.GSD depending on firmware) into DP master, choose the desired PPO type, and assign the I/O addresses (e.g., PIW 256-263 / PQW 256-263 for PPO1).

Then in OB1 (or a dedicated cyclic OB) build the request once per DP cycle:

// Read r0947 (last fault code) from MM4 station 1
L W#16#1200         // AK = 1 (read word), parameter 947 in bits 0-10
T PQW 256           // PKE

L W#16#8000         // IND high = page bit, sub-index = 0
T PQW 258           // IND

L 0                 // PWE1 = 0 for 16-bit read
T PQW 260

L 0                 // PWE2 = 0 for 16-bit read
T PQW 262

After one DP cycle, the drive returns its response in PIW 256-263. Decode it:

L PIW 256           // PKE response
L W#16#0FFF         // mask parameter number
T "PKW.ParamNo"     // ignore on response

L PIW 256           // AK response
L W#16#F000         // mask AK bits
SRW 12
T "PKW.AK_resp"     // expect 1=ok, 7=drive busy, 8=illegal PKE, 9=illegal IND

L PIW 262           // PWE2 = fault code value (e.g. F0001 = 1, F0002 = 2)
T "MM4.FaultNumber"

Important caveats when using cyclic PKW:

• The drive returns an AK code; only AK = 1 or AK = 8-9 need a sanity check.
• You cannot change parameters on every cycle - PKW requests must alternate read/write to avoid EEPROM wear. Writes use AK = 3 (RAM only) when the value is transient.
• You only see the currently pending fault in r0947. To get the full history you need the fault buffer - use Method B.

4. Method B - DriveES Function Blocks (FB38 DEV_FLT3)

DriveES Simatic is a Siemens function block library (article ID 23322610 in the Siemens Industry Online Support, formerly known as DriveES DriveMon / DriveES PCS7) that wraps the acyclic DP-V1 read/write services for SIMATIC and SINAMICS / MICROMASTER. The relevant blocks for MM4 fault buffer access are:

4.1 Installing DriveES Blocks

1. Download "DriveES SIMATIC" or the successor package from Siemens support entry 23322610.
2. Unzip into a Step7 V5.x S7-Library folder; integrate the .s7l file into your project (Options → Standard Library / DriveES_Lib).
3. Copy the required FBs into your project's blocks directory and copy the supplied UDTs (UDT_FLT3, UDT_DIAG, UDT_PARAM) into the S7 program.
4. If using TIA Portal, the equivalent library is "SINAMICS DriveLib" - the FB equivalents are present but renamed; verify block version compatibility against the panel/MP377 firmware.

4.2 FB38 DEV_FLT3 Block Interface

The block interface in the DriveES documentation is as follows (verify against your specific library version):

4.3 UDT_FLT3 Structure

The supplied UDT_FLT3 is an array of fault entries. A typical DriveES instance exposes eight fault records. Each record contains:

4.4 Calling FB38 in OB1

// One-shot trigger on rising edge of fault detected
A     "MM4.StatusWord1".Fault        // ZSW1 bit 3 = fault active
FP    M 100.0                         // edge memory
=     DB20.DBX0.0                     // REQ input to FB38 instance

CALL FB38, DB38                        // FB38 instance DB38
  REQ       := DB20.DBX0.0
  DRIVE_NO  := 1                       // first MM4 on DP
  ADDR_DIAG := W#16#0FFF               // use HW Config diagnostic address
  ENABLE    := TRUE
  FLT3_DATA := "MM4.FltBuffer"         // UDT_FLT3, e.g. DB100
  BUSY      := DB20.DBX2.0
  DONE      := DB20.DBX2.1
  ERROR     := DB20.DBX2.2
  STATUS    := DB20.DBW4

5. Driver Control with FC14 (Legacy) / FB36 DEV_PAR

To complement the fault read, the drive must be controllable from the PLC (On/Off/Reset/Setpoint). The legacy path uses FC14 (article in the field report); the modern equivalent is FB36 DEV_PAR. FC14 expects:

Once FC14 is instantiated, the same DIAG address feeds FB38. Avoid mixing FC14 with FB36 on the same DP slave - both blocks will try to claim ownership of the parameter channel.

6. Mapping the Fault Code to an Operator-Friendly Text

The integer in r0947 is the fault index, not the Fxxxx string the operator expects. The MM4 fault list (chapter 6 of the MM440 Parameter List) maps numeric values to fault text:

7. HMI Integration on MP377 (WinCC flexible)

1. In WinCC flexible (or TIA Portal HMI), create an HMI tag set of type WORD named MM4_FltCode bound to the PLC DB address that holds the PKW response (e.g., DB100.DBW0 = first fault code).
2. Insert an IO field with format string F0000 on the drive status screen. This pads the integer 1 → "F0001", matching the BOP display.
3. Use a text list for automatic plain-language description: assign text list entries 0..99 with the corresponding fault messages from the MM4 manual.
4. For the full history, create an array of 8 IO fields bound to DB100.DBW0 through DB100.DBW14 (one fault record per row). Show the timestamp as a separate field.
5. Place a single bit lamp bound to ZSW1 bit 3 (fault active) to give an operator a one-glance "drive faulted" indicator.
6. Use the MP377 function key to trigger Ack_Fault, wired to FC14.ACK so the operator can clear the fault from the panel without walking to the cabinet.

8. Step-by-Step Commissioning Procedure

1. Confirm MM4 Profibus option is installed - LED "Link" on the option module steady green; check P0922 = 1 (DP), P0014 = 4 (control source = Profibus).
2. Set DP address on MM4 (P0918 / DIP switches on the option module) - address 1..125, must match HW Config.
3. Import GSD into Step7 (Options → Install GSD); restart HW Config.
4. Insert MM4 DP slave in the S7-300 station and select PPO1 (or PPO3 if no PKW). Note the diagnostic address - e.g., 1023.
5. Compile and download HW Config. Verify "no diagnostics" on the DP slave in online view.
6. Call FC14 in OB1 with a 0 RPM setpoint and ON_OFF1 = TRUE; observe ZSW1 in the VAT.
7. Force a known fault (e.g., open the motor cable with the drive running) and check ZSW1 bit 3 transitions to 1.
8. Trigger FB38 on the rising edge; verify FLT3_DATA populates with F0003 (undervoltage) or the relevant fault.
9. Configure WinCC flexible tags to the FB38 output DB and download to MP377.
10. Validate on HMI that fault code and text match the BOP display.

9. Verification and Diagnostics

After commissioning, verify the following live on the VAT / Watch table:

• ZSW1 bit 3 (fault active) toggles when a real fault is forced.
• DB100.DBW0 contains a value matching Fxxxx after a fault.
• STATUS of FB38 returns 16#0000 on success; non-zero values indicate DP-V1 issue.
• PIW updates for the PZD area even when no PKW request is active - this confirms DP slave is in cyclic data exchange.

Use Status / Modify on the DB and run the "Read online / Monitor" function in Step7 to compare FB38's FLT3_DATA against the MM4 BOP display when a fault is present. They must agree. If FB38 shows 0 (no fault) but the BOP shows F0001, check the page-bit on IND and verify the DP slave diagnostic address is correct.

10. Troubleshooting Matrix

11. Field-Proven Caveats

• EEPROM wear: Do not write parameters (PKE AK = 2) on every cycle. MM4 EEPROM endurance is approximately 100,000 write cycles. Use AK = 3 (RAM-only) for transient setpoint writes.
• PKW PPO type consistency: If you select PPO3 / PPO4 (no PKW), FB38 still works because DriveES uses the acyclic DP-V1 read/write service over the same DP slave slot. PKW is only required if you want true cyclic parameter reads.
• Multiple drives: For more than one MM4 on the same DP segment, give each a unique diagnostic address and unique PPO slot. FB38 must be instantiated per drive.
• CPU load: Each FB38 instance consumes roughly 1 ms of CPU315-2 PN/DP time per call. Limit polling to OB35 (100 ms) if you have more than four drives.
• Firmware cross-reference: MM4 firmware V3.2 and below does not expose all parameters above 2000. Verify your parameter range with the connected BOP before scripting automatic parameter access.
• Profinet vs Profibus split: The CPU315-2 PN/DP can act simultaneously as Profinet controller and Profibus-DP master. The MP377 on PN and the MM4 on DP are independent subnets - do not try to bridge them at the panel level.

12. References to Official Documentation

• MM4 Profibus Module Operating Instructions - Section 3.4 covers PKW parameter access.
• DriveES SIMATIC Application - Contains FB38 (DEV_FLT3) and the example project.
• MICROMASTER 4 Parameter List - Full fault number / value mapping.
• MICROMASTER 4 & SINAMICS G Function block (FC14) to control an MM4 via Profibus-DP - Legacy control block documentation.

FAQ