Resolving CU305DP Telegram 111 with S7-300 CPU 315-2DP

1. Problem Summary

An S7-300 CPU 315-2DP (order number 6ES7 315-2AF02-0AB0, firmware V1.1) is wired by PROFIBUS DP to a SINAMICS CU305DP control unit on firmware V04.40.45, using GSD file revision V4.4.3. Telegram 111 (PZD-2/2) is configured identically on the S7-300 and on the drive, the peripheral addresses match slot for slot, and HW Config in SIMATIC Manager opens the CU305DP online with no station or diagnostic fault. Despite that, neither the control word (STW1) sent from the PLC nor the status word (ZSW1) returned from the drive changes — both remain at zero. The PLC finally writes W#16#47E then W#16#47F to STW1 with no status back from the drive.

Recovery requires two distinct fixes applied in sequence, not one:

1. Program fix: the LADDR input on SFC14/SFC15 is the PROFIBUS diagnostic address (W#16#3FE, decimal 1022) instead of the cyclic PZD base address of telegram 111 (W#16#A0, decimal 160). The SFCs never touch the telegram area, so the drive receives no cyclic output and returns nothing.
2. Hardware fix: a separate physical fault is found in the PROFIBUS segment (cable, connector, termination, or a damaged DP port). With the segment repaired, the same program starts working with no parameter change.

This article documents the layered diagnosis that surfaces both causes, the control word bit discipline that would have been a third trap, and the verification sequence that confirms the segment is healthy.

2. Hardware Identification and Compatibility

Before chasing bit-level symptoms, capture the exact order numbers and firmware states. Old CPU + new drive combinations are the most common cause of "nothing works at all" complaints, and most of them turn out to be a version mismatch you can rule out in five minutes.

Reference the S7-300 CPU 31xC and CPU 31x manual for the AF02 variant's two-port behavior on the Siemens support portal and the SINAMICS S110 Control Units manual for the CU305DP slot map on the SINAMICS S110 documentation.

3. Telegram 111 PZD Layout for CU305DP

Telegram 111 on SINAMICS S110 is the standard 2-PZD/2-PZD telegram for the EPOS (basic positioner) function. Both directions are 2 words, so the cyclic I/O image is 4 bytes each way.

Total cyclic payload is 4 words input + 4 words output. The PLC must reserve a contiguous peripheral area of at least 4 bytes for SFC14 and 4 bytes for SFC15. STEP 7 assigns the base addresses in HW Config under the CU305DP slot properties; note both the input start and the output start — they are usually equal for symmetric telegrams like 111 but can differ if the master/slave modules are not aligned.

4. Diagnostic Address vs. PZD I/O Base Address (LADDR)

The single most common mistake in this scenario is feeding SFC14/SFC15 the wrong LADDR. The PROFIBUS slave has two address areas in HW Config:

Symptom of using the wrong LADDR: SIMATIC Manager HW Config opens the slave online with no error, the SFC returns RETVAL = 0 (no access error), and the RECORD buffer never changes. Because the diagnostic area is readable, SFC13-based diagnostics still work — masking the mistake.

Fix the program so that:

• SFC15 LADDR = W#16#A0 (output side of telegram 111, PLC → drive).
• SFC14 LADDR = W#16#A0 (input side of telegram 111, drive → PLC). For symmetric telegrams the base is the same number; for asymmetric telegrams check the input start address separately.
• RECORD points to a DB or Merker area of at least 4 bytes (one double word) for PZD-2/2.

5. SFC14 / SFC15 Consistent Data Access

PROFIBUS DP transports PZD as a consistent block. If the PLC reads or writes the I/O area with plain L PEW / T PAW instructions, the four bytes can be torn across two PLC scan cycles and you see half-old / half-new data. For drives, that manifests as STW1 bits flickering and ZSW1 latching nonsense. Use SFC14/SFC15 to read and write the entire 4-byte PZD window atomically.

5.1 Write (PLC → Drive) with SFC15 DPWR_DAT

// STW1 in DB100.DB0 (WORD)
// POS_STW in DB100.DB2 (WORD)
CALL  "DPWR_DAT"
     LADDR  := W#16#A0          // PZD output base address
     RECORD := P#DB100.DBX0 BYTE 4   // 4-byte record
     RETVAL := MW200            // 0 = OK, see error table below
END_CALL

5.2 Read (Drive → PLC) with SFC14 DPRD_DAT

// ZSW1 in DB101.DB0 (WORD)
// POS_ZSW in DB101.DB2 (WORD)
CALL  "DPRD_DAT"
     LADDR  := W#16#A0          // PZD input base address
     RETVAL := MW202            // 0 = OK
     RECORD := P#DB101.DBX0 BYTE 4
END_CALL

5.3 RETVAL error codes (most common)

If RETVAL = 0 but the buffer still reads zero, the program is writing to the wrong LADDR. Cross-check by going online with the drive and reading parameter r2050[0..1] (PZD receive from master) — if the values are zero, the master is the problem; if the values are correct, the drive is the problem.

6. Control Word 1 - The Bit 10 Rule

Even with the correct LADDR, telegram 111 will not respond to commands if STW1 bit 10 is not set. Bit 10 is the control requested bit (also called "master control by PLC" or "BicoCtrl"): until the drive sees it, the drive ignores all other command bits and never advances the state machine. ZSW1 then sits at zero and looks like the drive is dead.

The two control word values from the failing program — W#16#47E and W#16#47F — decode as follows:

0x47E = 0000 0100 0111 1110
        bit10=1, ON=1, OFF2=1, OFF3=1, EnablePulse=0 (transitioning)

0x47F = 0000 0100 0111 1111
        bit10=1, ON=1, OFF2=1, OFF3=1, EnablePulse=1 (running)

Both values set bit 10 correctly, so the "missing bit 10" hypothesis is not the cause of the symptom in this case — but it is the most common reason for the same symptom on a fresh installation. Always confirm bit 10 in your outgoing STW1 before chasing the LADDR or the cable.

7. Byte Order Between the PLC and the Drive

Siemens S7 stores words in big-endian at the byte level: in DB100.DB0 (a 16-bit word), bits 15..8 are at DBX1 and bits 7..0 are at DBX0. SINAMICS drive-side parameters (r2050, p2051, r2060) also use big-endian, so for symmetric PZD-2/2 there is normally no byte swap needed — but if the project copies PZD into a byte array and rearranges it for some legacy reason, you will see the high and low bytes flipped in the drive.

How to check:

1. Read the drive's r2050[0] (PZD1 from master). If the value matches the outgoing STW1 exactly, byte order is correct.
2. Read r2050[1] for PZD2 (POS_STW).
3. If r2050 reports 0x7E47 instead of 0x47E, the buffer passed to SFC15 is byte-swapped. Reverse the byte order in the DB before calling SFC15.

8. Online Diagnostics and the Slave Diagnostic Frame

When PZD is silent, the next step is the slave diagnostic frame. It distinguishes "the slave never received the PZD" from "the slave received PZD but did not process it".

8.1 Reading the diagnostic frame with SFC13 DPNRM_DG

CALL  "DPNRM_DG"
     LADDR  := W#16#3FE       // diagnostic address of the CU305DP
     RETVAL := MW204
     RECORD := P#DB110.DBX0 BYTE 32   // at least 6 bytes, 32 is safe
END_CALL

The first 6 bytes are the standard DP diagnostic header; bytes 6+ are device-specific and, for SINAMICS, follow the PROFIdrive profile diagnostic layout. Look for:

• Byte 5 bit 7 = 1 → "PZD fault", drive rejected the telegram.
• Byte 5 bit 6 = 1 → "PZD update", drive sees incoming data.
• Status byte 0x1C or higher → drive is in fault state and the state machine cannot move.

8.2 HMI Web server of the CU305DP

The CU305DP ships with a web server on default IP 169.254.11.22 (subnet 255.255.0.0) that exposes the live r2050 / r2053 values without any STEP 7 traffic. If the live r2050 is non-zero but the PLC reads zero, the issue is the receive side. If the live r2050 is zero, the issue is the send side. This is the fastest single instrument for fault isolation.

8.3 STARTER / SINAMICS commissioning tool

STARTER (or the newer Startdrive) online view of the CU305DP shows the expert list. The minimum parameters to verify:

9. Hardware Fault Isolation

The original case ended with "We find a hardware problem." That is the correct final chapter of this story. The most common physical-layer faults in this combination, in order of frequency:

1. Termination missing or duplicated. A 220 Ω + 390 Ω termination is required at the start and end of the segment only. CPUs count as a node. The CU305DP must have its bus terminator ON (DIP switch on the CU305, or wired terminator on the SUB-D connector) only if it is at the end of the segment. DP repeaters (RS-485) re-isolate and re-terminate each segment.
2. Cable damage. Pinch points at cabinet entries, abrasion at drag chains, and crushed cable trays are the usual suspects. A 9-pin PROFIBUS cable must keep the two data lines (pin 3 = B, pin 8 = A) twisted at a lay of roughly 1 inch (25 mm) and shielded. Reading A-B with a multimeter should show ≈ 220 Ω with terminators in and ≈ 50..70 Ω between A and B without.
3. Connector wiring reversed. Pin 3 (B) on one end of the cable landing on pin 8 (A) on the other end is a classic field mistake. The bus scans as alive, but every frame is a one-bit error.
4. Damaged DP port. The CPU 315-2DP X1 and X2 interfaces each have their own physical transceiver. If a transient ESD or a wiring fault killed one port, swapping to the other interface (and updating HW Config to point at that port) is the fastest check.
5. Power supply sag on the drive. If the CU305DP sees 24 V below 20 V, it stays alive enough to scan on PROFIBUS but cannot actuate outputs. The BF LED will be off while the actual drive enable is rejected.

10. Step-by-Step Recovery Procedure

1. Verify the slave is reachable. Open HW Config online and read the CU305DP slot properties. Confirm the configured PZD output base address. Write it down; call it LADDR_OUT. Do the same for the input base address; call it LADDR_IN. The diagnostic address is separate.
2. Patch the LADDR in the program. In every CALL "DPWR_DAT" block, set LADDR = LADDR_OUT. In every CALL "DPRD_DAT" block, set LADDR = LADDR_IN. Leave the SFC13 LADDR at the diagnostic address.
3. Confirm RECORD length. For telegram 111 (PZD-2/2), RECORD must be BYTE 4. Mismatches yield RETVAL = 80B1 and a CPU diagnostic entry.
4. Set STW1 with bit 10. In the application, build STW1 as 0x47E → 0x47F on the rising edge of the start command, then hold 0x47F for steady run. Bit 10 = 0x400 must always be set once control is requested.
5. Download the project to the CPU and go online. Watch DB100.DBD0 in the live monitor. The first SFC15 call should now write a non-zero value to the drive's r2050[0].
6. Read back the drive with STARTER or the web server. r2050[0] should equal STW1, r2050[1] should equal POS_STW. ZSW1 (r0930 internal mapping) should show bit 0 ("Ready to switch on") toggle as STW1 changes.
7. Read the PLC side with SFC14. DB101.DBD0 should now change every PROFIBUS cycle. ZSW1 bit 10 ("control requested acknowledged") is the bit that proves the drive sees the master.
8. Physically inspect the segment. Check terminators, connectors, cable damage, shield bonding, and 24 V at the CU305DP. This step is what surfaced the final hardware fault in the original case.
9. Power-cycle the drive. After any hardware repair, repower the CU305DP and the line module so that the bus comes up in a known state.

11. Verification Checklist

When all eight items pass, telegram 111 is alive. A typical first time from a cold bus to operation enabled with this configuration is 80..150 ms (one PROFIBUS cycle plus the drive's internal ramp-up).

12. Common Variations on the Same Symptom

Three further cases that produce the same "STW1 = 0, ZSW1 = 0" picture and worth ruling out before going to the cable tray:

• Wrong telegram selected in p0922. If p0922 does not match the HW Config telegram, the drive maps the PZD differently. Forcing p0922 = 111 and re-powering the drive is the fast check.
• Drive in commissioning mode (p0010 ≠ 0). The drive will not act on cyclic PZD while commissioning is open. Reset p0010 = 0 and copy RAM to ROM.
• BICO interconnections overridden. Manual BICO changes to p0840, p0844, p0845, or p2103 (the standard control signal sources) route the enable logic away from STW1. Restore with p0010 = 30, p0970 = 1 factory reset, or re-load a saved project.