Reading SINAMICS S120 r945 Fault Buffer to WinCC from S7-300

Overview

Reading the SINAMICS S120 fault buffer (parameter r945 / r949) from the drive and displaying it on a WinCC Flexible 2008 HMI requires three coordinated segments: PROFIBUS DP from the drive to the S7-300 CPU, an acyclic parameter-channel read implemented with the Toolbox SINAMICS S120 V1.3 HF1 function blocks (FBs) and data type UDT30002, and an Industrial Ethernet connection from the S7-300 to the HMI panel. The acyclic PKW read runs on top of PROFIBUS DP without consuming additional PZD slots, and the resulting fault data lands in a data block that WinCC tags can address directly.

The architecture below separates the three networks cleanly and matches the configuration most commonly used with a CPU 319F-3 PN/DP or CPU 319-3 PN/DP paired with a SINAMICS S120 CU320-2 DP control unit and a Multi Panel or Comfort Panel running WinCC Flexible 2008.

Prerequisites

• SINAMICS S120 drive system with CU320-2 DP control unit (or CU320-2 PN with PROFIBUS option module). All drives and Line Modules are visible in the drive CLiQ topology.
• CPU 319-3 PN/DP or CPU 319F-3 PN/DP with integrated PROFIBUS DP master and PROFINET interface. Firmware V3.3 or higher is recommended.
• STEP 7 V5.5 + SP4 or STEP 7 (TIA Portal) V13 SP1 or later for project engineering of the S7-300 station. The Toolbox V1.3 HF1 was developed for STEP 7 V5.x; for TIA Portal use the SINAMICS S120 S7-300/400 Function Blocks for TIA Portal equivalent (FB30202 etc., see Siemens KB entry 109480367).
• Toolbox SINAMICS S120 V1.3 HF1 (Siemens order number 6SL3070-0AA00-0AG0) installed. Contains FBs FB30100–FB30106 and UDTs UDT30001–UDT30004.
• WinCC Flexible 2008 SP5 or later with Hotfix 18 (KB entry 109482244) on the engineering station; WinCC Flexible Runtime on the target panel.
• STARTER V4.5 SP1 or SCOUT V5.4 for commissioning the drive and verifying PROFIBUS / PKW access on the bench.
• PROFIBUS DP cable (e.g. 6XV1830-0EH10) with PROFIBUS connectors (6GK1500-0FC10) and bus terminators switched on at both ends.
• Ethernet cable (Cat 5e or higher) for the HMI ↔ CPU link. If the panel is a non-PN model, the CPU's integrated PROFINET port serves as the gateway.

SINAMICS S120 Fault Buffer Structure

Every SINAMICS S120 Control Unit (CU320-2, CU310-2) and every active DRIVE-CLiQ component maintains its own fault buffer. The parameters used for read-out are documented in the SINAMICS S120/S150 List Manual.

r782[0]\code>

Reading r945 alone gives the numerical fault code; pairing it with r947/r949 yields a timestamped buffer that can be displayed in chronological order on the HMI.

PROFIBUS DP Network Configuration

1. In HW Config (STEP 7) insert the SINAMICS S120 CU320-2 DP from the catalog (path: PROFIBUS DP → SINAMICS → SINAMICS S120 → CU320-2 DP). Set the PROFIBUS address to match the rotary switches on the CU (default 3 for CU320-2 DP).
2. Configure the PZD telegram length. For cyclic motion control use the standard telegrams (e.g. Telegram 1, 2, 3, 102, 105, 106, 116–118). The PKW parameter channel requires an additional slot only on drives that do not support DP-V1; CU320-2 supports DP-V1 acyclic access natively and no extra PZD slot is needed.
3. Compile HW Config and download. Verify the drive goes to RUN with cyclic PZD exchange (check LED BF off, RDY green, DPR green).
4. In STARTER or SCOUT go online, right-click the drive → Properties → Bus Configuration and confirm the PROFIBUS node ID and baud rate (1.5 Mbit/s default, 12 Mbit/s supported by DP-V2).

STEP 7 Program: Reading the Fault Buffer

The Toolbox V1.3 HF1 ships FBs and UDTs that wrap the DP-V1 acyclic parameter access. The relevant pair for fault-buffer readout is:

Step 1 – Copy the Toolbox Blocks

Open the library supplied with Toolbox SINAMICS S120 V1.3 HF1 (SINAMICS_S120_V13_HF1) and drag UDT30002, UDT30003, FB30102, FC30100 into your S7 program.

Step 2 – Build the Target Data Block (DB200)

Create a data block that WinCC can address. Use the structure of UDT30003 plus a small request block of your own:

DATA_BLOCK "DB_FaultBuffer"
STRUCT
  Request : UDT30001;       // header for the next read request
  Response : UDT30002;      // latest response (raw, header + 16 words)
  Buffer : UDT30003;        // decoded fault buffer
  Trigger : BOOL;           // HMI button: read on rising edge
  Busy : BOOL;
  Done : BOOL;
  Error : BOOL;
  Status : WORD;
END_STRUCT;
END_DATA_BLOCK

Step 3 – Call FC30100 in OB1

The high-level wrapper accepts the PROFIBUS address of the drive, the parameter number (945 for fault codes, 947 for the day timestamp, 949 for the time-of-day timestamp), the index (always 0 for r945 in single-DO drives; for DCC or parallel drives the index may be 0–2) and writes the response into Buffer.

CALL "FC FaultRead" , "DB_FaultBuffer"
  I_Ctrl_Adr := 2048        // logical address of CU320-2 DP (slot 0 / diagnostic address)
  I_Para_Nr  := 945         // r945 = fault code buffer
  I_Para_Idx := 0
  I_ReadN    := 8           // 8 entries
  I_Trigger  := "DB_FaultBuffer".Trigger
  O_Busy     := "DB_FaultBuffer".Busy
  O_Done     := "DB_FaultBuffer".Done
  O_Error    := "DB_FaultBuffer".Error
  O_Status   := "DB_FaultBuffer".Status
  IO_Buffer  := "DB_FaultBuffer".Buffer

For a complete timestamped buffer, call FC30100 three times in OB1 — once each for r945, r947, r949 — or call FB30102 in sequence from a sequencer FB.

Step 4 – Acknowledge Faults from the HMI (Optional)

To acknowledge faults from the HMI, write p3981 = 1 or use the standard STW1.7 bit in the cyclic telegram. Acyclic write: parameter 2103 with value 1 triggers a fault acknowledge on the drive object.

CALL "FC ParaWrite" , "DB200"
  I_Ctrl_Adr := 2048
  I_Para_Nr  := 2103
  I_Para_Idx := 0
  I_Value    := 1
  I_Trigger  := "HMI_Ack_Button"

WinCC Flexible 2008 Configuration

Step 1 – Add the Connection

1. In the WinCC Flexible project tree, right-click Connections → New Connection.
2. Select driver SIMATIC S7 300/400.
3. Set HMI device address to the panel's IP (e.g. 192.168.0.10), PLC address to the CPU's PROFINET IP (e.g. 192.168.0.1), subnet mask 255.255.255.0.
4. Select ISO-on-TCP transport. Rack 0, Slot 2 (CPU 319). Enable Access point 2 if the CPU is configured as a PN station with PN-IO mode.

Step 2 – Create Tags

WinCC Flexible cannot import a STEP 7 DB structure directly; either export DB_FaultBuffer via STEP 7 → Options → Symbol Table Export and import into WinCC, or create the tags manually as area pointers on the configured connection.

Step 3 – Build the Fault View Screen

1. Insert an I/O field or text list bound to Fault_1. Map numerical fault codes to descriptive text using a text list imported from the SINAMICS S120 fault list (column "Number" → "Reaction" → "Cause").
2. Insert a button labelled Read faults with event Press → SetBit → FaultReadTrigger. Add a one-shot reset after 1 s with an invert + delay.
3. Insert an output field bound to FaultReadBusy showing a progress bar.
4. Insert a button Acknowledge bound to FaultAck.

Step 4 – Recipe / Alarm Logging (Optional)

Add an alarm log to record every fault transition. WinCC Flexible can store up to 2,000 alarm entries on a Comfort Panel and 1,000 on a 270 Multi Panel. Configure alarms with the same text list used on the fault view.

Verification

1. In STARTER go online → right-click drive → Commissioning → Diagnostics → Fault buffer. Trigger a controlled fault: in Diagnostics → Inputs/Outputs force signal loss on one encoder, or set p2102 = 1 to enable a fault test.
2. On the HMI press Read faults. Within 1–2 s the fault code number and the descriptive text should appear.
3. Compare the WinCC display with STARTER's fault buffer; codes, count, and timestamps must match.
4. Acknowledge the fault from the HMI. The Busy bit shall clear, and the entry should disappear from Fault_1 while remaining visible in STARTER's history (per S120 acknowledgement logic).

Troubleshooting Matrix

Performance and Timing

An acyclic DP-V1 read of 8 words typically completes in 80–150 ms at 1.5 Mbit/s and 30–60 ms at 12 Mbit/s. A full timestamped fault-buffer read (r945 + r947 + r949) therefore takes ~250–450 ms at 1.5 Mbit/s. Avoid polling the read trigger faster than 1 s; DP-V1 acyclic bandwidth is limited and excess requests will be queued and eventually rejected by the drive.

Edge Cases and Field-Proven Caveats

• Drive CLiQ topology: r945 on a Line Module or Terminal Module is read from the DO number assigned by STARTER. Failing to address the right DO returns 80C0.
• Faults from Safety Integrated: Safety faults (F016xx, F306xx) sit in a separate buffer (r975 / r977). If the HMI shall show safety faults too, add a second FC30100 call with I_Para_Nr := 975.
• Hot restart: A warm restart of the CPU clears DB_FaultBuffer. If persistence is required, copy the buffer to a non-retentive area or to a recipe on the panel.
• Panel change mid-read: If the operator changes screen during a read, WinCC keeps the tags updated; the read is initiated by the button, not by the screen change. No special handling required.
• Firmware compatibility: Toolbox V1.3 HF1 was tested against S120 firmware V4.x and V5.x. On V6.x (CU320-2 PN with SINAMICS V6) prefer the TIA Portal successor library.

Related HMI Error Code Reference

For general patterns of mapping numerical fault codes to descriptive HMI text lists, see the AutomationDirect HMI and PLC Error Code Tables reference (panel-agnostic template, applies to any alphanumeric panel that consumes a tag with discrete codes): HMI and PLC Error Code Tables (EA9-RHMI appendix A).

FAQ