Reading Sinamics S120 Speed and Position from a Simatic S7-317T via FB455 MC_ReadDriveParameter

1. Problem Statement and Solution Path

A Simatic S7-317T (T-CPU) integrates technology functions for closed-loop motion control directly in the S7-300 CPU. Although the standard PROFIdrive telegrams (1, 2, 3, 5, 6, 102, 103, 105, 106) carry the cyclic speed setpoint, actual speed, controller enable, and status words, the technology object (TO) does not expose every drive parameter on the cyclic process data channel. To read the actual position and the actual speed in the user program—e.g., for an HMI panel, an external monitoring function, or a supervisory control loop—call FB455 MC_ReadDriveParameter from the S7-Technology library. The block triggers a non-cyclic parameter read over the PROFIdrive parameter channel (PKW) and returns a single parameter value per call.

2. Hardware and Software Prerequisites

The S7-Technology add-on package installs the technology blocks (FB401..FB490) into the program blocks of STEP 7 and supplies the DriveRef UDT used at the block interface. The same FB set is used for SIMOTION and for the T-CPU; only the project structure differs. For STEP 7 V5.4 and earlier, the package "S7-Technology V3.0" is the matching version, but it does not include FB455 in every release. Confirm the FB is present in the library: Standard Library > Motion Control > T-CPU > MC_ReadDriveParameter (FB455).

3. Sinamics S120 Drive Configuration

Configure the drive to expose a PROFIdrive telegram that the T-CPU recognizes. The S7-Technology configuration tool inserts the drive as a T-CPU axis and assigns the logical base addresses automatically. In the Sinamics S120 drive object, navigate to Communication > PROFIdrive and select one of the standard telegrams:

The choice of telegram is independent of the parameter channel used by FB455. The block always uses the non-cyclic PKW service on the same PROFIdrive connection. Telegram 105 is the recommended default for positioning axes on the S7-317T; it carries NSOLL, NISTGLATT, G1_STW, and G1_ZSW and provides full DSC bandwidth for high dynamic response.

4. T-CPU Configuration in HW Config

Open the S7 station in HW Config and insert the drive into the PROFIBUS or PROFINET subnet:

1. Drag the Sinamics S120 from the hardware catalog to the subnet. The HW Config tool resolves the GSD/GSDML file and shows the available submodules (telegram slots).
2. Open the drive object's property dialog and assign a slot to each standard telegram (1..n). At least one positioning telegram (103, 105, or 106) must be plugged to bring the technology object online.
3. Note the logical base address of the PZD submodule (input) and (output). The values appear under Addresses in the property dialog. The same numbers are written into the DriveRef UDT used by FB455.
4. Open the Technology object in the station, create an axis, and map the axis to the slot of the PZD submodule. The wizard exports a DriveRef UDT into the program blocks (default name: iTheAxis).
5. Compile the configuration (Station > Save and Compile) and download to the CPU.

The base address is the integer value required by the FB455 input, e.g., PIW 256 → integer 256, or PQW 256 → integer 256. The number is the start byte of the I/O area reserved for the drive's PZD; the actual PZD data begins at this offset.

5. FB455 MC_ReadDriveParameter — Block Interface

FB455 issues a non-cyclic parameter read over PROFIdrive and is non-blocking. The block can be called from any priority class that has access to the bus system (OB1, OB35, OB82, OB86, OB121). The interface:

The DriveRef parameter is a UDT that the S7-Technology axis configuration writes automatically. Its structure carries the slot, the I/O base addresses, and the diagnostic address of the drive object. The default UDT is UDT 30000 (or a project-specific UDT) and the symbol is usually iTheAxis.

6. Sinamics S120 Parameter Numbers for Position and Speed

FB455 returns raw drive values. The application must interpret the unit (LU, rpm, or 1000 LU/min for some velocity parameters). The table below lists the most relevant read-only parameters for position and speed on a positioning axis on the S120. The Index column is the array index to pass to FB455 (default 0).

Parameter numbers on the S120 follow the convention: rxxxx for read-only, pxxxx for read/write. FB455 issues a read request for either. Some parameters are access-protected; if the access level in the drive (p3950) does not include the parameter's level, the drive replies with PROFIdrive error code 0x0B (access denied), which FB455 surfaces as ErrorId 0x0007.

7. DriveRef UDT Structure

The S7-Technology configuration tool emits a UDT for each configured axis. The default name in the symbol table is iTheAxis. The structure contains the slot, the I/O base addresses, and the diagnostic address. A representative excerpt of the UDT body:

DATA_BLOCK "iTheAxis"
UDT 30000
VERSION : 0.1
STRUCT
    HW_Submodule       : INT ;   // slot of the drive (0x00..0x1F)
    InputBaseAddress   : INT ;   // logical base address, PZD in
    OutputBaseAddress  : INT ;   // logical base address, PZD out
    DiagAddress        : INT ;   // diagnostic address (slot 0)
    DriveType          : BYTE ;  // PROFIdrive profile (3 = V3)
END_STRUCT ;
END_DATA_BLOCK

If the UDT is generated correctly, FB455 evaluates only the HW_Submodule and the I/O base addresses; the drive configuration is resolved via these references back into HW Config. The UDT is filled automatically by the S7-Technology axis configuration—do not edit it manually. Editing the UDT will invalidate the S7-Technology consistency check at download and can cause a technology fault on the next restart.

8. STEP 7 Implementation — Ladder Logic

Call FB455 in a cyclic OB (OB35) at a 100 ms interval. The pattern below reads r0021 (actual speed smoothed) into a global REAL ActSpeedRPM. A rising-edge generator on Trigger issues a new read when Busy goes low and no error is active.

NETWORK 1: Read actual speed (r0021) from Sinamics S120
   CALL FB 455 , DB 455
        Enable      := TRUE
        DriveRef    := "iTheAxis"
        ParameterNo := 21            // r0021 actual speed smoothed
        Index       := 0
        Execute     := "MC_ReadSpeed".Trigger
        Busy        := "MC_ReadSpeed".Busy
        Done        := "MC_ReadSpeed".Done
        Error       := "MC_ReadSpeed".Error
        ErrorId     := "MC_ReadSpeed".ErrorId
        Value       := "MC_ReadSpeed".ValueDINT

The sequencer below toggles Trigger when Busy goes low. The pattern is mandatory: FB455 must not be called with Execute := TRUE continuously; the rising edge on Execute starts a new request, and the block returns Busy = TRUE until the drive responds (typical latency 2..10 telegram cycles, i.e., 4..20 ms at 2 ms PROFIdrive cycle).

NETWORK 2: Edge generator for Execute
   A  "MC_ReadSpeed".Busy
   FN "MC_ReadSpeed".BusyOld
   O  "MC_ReadSpeed".StartCmd
   =  "MC_ReadSpeed".Trigger

NETWORK 3: Copy Value to HMI tag on Done
   A  "MC_ReadSpeed".Done
   JCN END
   L  "MC_ReadSpeed".ValueDINT
   DTR
   T  "ActSpeedRPM"
END: NOP 0

Once Done is set, copy Value into the HMI tag. The value of r0021 is in rpm and is a signed 32-bit integer; convert to REAL with DTR (STEP 7 STL) or DINT_TO_REAL (SCL) before display. r0021 is type I32 (signed integer); cast carefully when the value is negative (e.g., axis moving in negative direction).

9. STEP 7 Implementation — SCL (Structured Control Language)

For cleaner state handling, place the read in an SCL function block. The block is instantiated once per parameter and cyclically called from OB35. The block uses an instance DB to retain the trigger state.

FUNCTION_BLOCK FB_MC_ReadS120Position
VAR
    bExecute    : BOOL;     // internal trigger
    bBusy       : BOOL;     // FB455 busy
    bDone       : BOOL;     // FB455 done
    bError      : BOOL;     // FB455 error
    wErrorId    : WORD;     // FB455 error id
    diValue     : DINT;     // FB455 value
    bOldBusy    : BOOL;     // edge detection
END_VAR
BEGIN
    // Edge on Busy falling edge -> start next read
    IF bBusy = FALSE AND bOldBusy = TRUE THEN
        bExecute := TRUE;
    END_IF;
    bOldBusy := bBusy;

    FB455_DB.Enable       := TRUE;
    FB455_DB.DriveRef     := iTheAxis;
    FB455_DB.ParameterNo  := 2521;          // r2521 actual position
    FB455_DB.Index        := 0;
    FB455_DB.Execute      := bExecute;
    FB455_DB.Busy         => bBusy;
    FB455_DB.Done         => bDone;
    FB455_DB.Error        => bError;
    FB455_DB.ErrorId      => wErrorId;
    FB455_DB.Value        => diValue;

    bExecute := FALSE;                       // clear edge after start

    IF bDone THEN
        ActPositionLU := DINT_TO_LREAL(diValue);
    END_IF;
END_FUNCTION_BLOCK

For position parameters in LU, store the DINT in a global variable of type LREAL or DINT, depending on the application. For velocity parameters in 1000 LU/min (r2522, r2526), divide the result by 1000 to get LU/min before display. For parameters reported in the 32-bit IEEE-754 REAL format (some S120 parameters on PROFINET), apply DINT_TO_REALWORD or simply alias the Value output as a DWORD and re-interpret with a bit-cast to REAL.

10. Cyclic Integration Pattern

Non-cyclic parameter reads must be staggered. PROFIdrive allows at most one outstanding PKW request per drive; calling FB455 in a 100 ms OB and starting a new read every 10 ms on the same drive will keep the channel busy. The recommended pattern is to issue one read per OB35 cycle and rotate the parameter number across cycles:

A simple state machine that increments a step counter every 100 ms and issues a rising edge on the corresponding trigger line is sufficient. The block Busy/Done outputs then synchronize the cycle; do not advance the step until Done is set, to avoid overlapping requests on the same drive. If a read returns an error, retry on the next cycle (do not freeze the sequencer; some parameters are not available while the drive is in startup).

11. Diagnostics and Error Codes

FB455 surfaces error codes from the PROFIdrive parameter channel and from the S7-Technology runtime. Decode the ErrorId output using the following table:

All errors are stored in the instance DB. Inspect the diagnostic buffer of the T-CPU via STEP 7 > PLC > Module Information > Diagnostic Buffer. The diagnostic event references the drive's diagnostic address (set in HW Config) and often contains the PROFIdrive error code from the drive object (e.g., 0x0A = state conflict, 0x0B = access denied, 0x0E = value out of range).

12. Troubleshooting Matrix

13. Drive Object Selection Notes

The Sinamics S120 is a multi-axis system: each drive object (Servo_1, Servo_2, Vector_1) has its own parameter set. The parameter number r0021 on Servo_1 is not the same physical variable as r0021 on Servo_2. The DriveRef UDT must reference the slot and base address of the specific drive object being read. If multiple Servo objects share one Control Unit (CU320-2), each object has its own PZD slot, its own DriveRef instance, and its own PROFIdrive logical connection. The first slot (DI/DO) and the subsequent slot 1..n represent the drive objects in the order configured in STARTER or SIMOTION Scout.

14. Performance and Timing

A single FB455 read against a Sinamics S120 over PROFIBUS DP-V1 (PKW) takes 2..4 bus cycles at 2 ms cycle time, i.e., 4..8 ms wall time. Over PROFINET with IRT, the latency is 1..2 update cycles (1..2 ms). At 100 ms OB35, this is fully sufficient for HMI and supervisory tasks. For high-rate acquisition (e.g., 1 kHz scope traces), use the cyclic PZD of telegram 105 (NISTGLATT, NISTGLATTFEIN) instead of FB455. Telegram 105 carries the speed in 32-bit resolution with a 125 µs cycle on PROFINET IRT—about 1000× faster than the PKW channel.

15. Acceptance Test Procedure

To verify the implementation on a real machine:

1. Place the CPU in RUN, drive in Operation enabled (r0002 = 0x4xx).
2. Trigger a manual reference motion of 100 LU and observe r2521 change by exactly 100 LU.
3. Read r0021 at 0 rpm (standstill) and confirm Value = 0.
4. Drive at 1500 rpm, read r0021 and confirm Value ≈ 1500 (within ±2 rpm, smoothing time constant).
5. Force a drive fault via STARTER (e.g., set p0840 = 0 abruptly), confirm FB455 returns ErrorId = 0x0006.
6. Clear the fault, confirm next read returns Done = 1 with valid value within 100 ms.
7. Disconnect the PROFIBUS connector; confirm ErrorId = 0x0005 within 1 s.

16. Frequently Asked Questions