Resolving Sinamics S120 Standard Telegram 5 Status Word Endian

Problem Overview

Engineers commissioning a SINAMICS S120 CU310-2PN connected to a SIMATIC S7-1500 via PROFINET frequently encounter a byte-order confusion when reading Standard Telegram 5's first Status Word (ZSW1). The typical symptom: the watch table in TIA Portal V15.1 shows the ZSW1 value (for example 0xEF37) at input address IW17, but the bit symbol "ControlRequested" (ZSW1.9 - the SS1/STO/Stop-C control-request flag defined in the PROFIdrive profile) is generated at I18.1, not I17.1. Reading I17.1 yields "Ready To Operate" (ZSW1.1 in PROFIdrive terms) rather than the expected control-request flag.

When the start address is changed to an even value (IW18), the symbol still maps the bit to I18.1, and the engineer's expectation that the bit should now be at I19.1 is not met. The drive is communicating correctly; the apparent conflict is the combination of little-endian storage in the S7-1500 I/O area and the 16-bit word alignment rules for PROFINET slots. This article consolidates the root cause and walks through a verified configuration that exposes ZSW1.9 at the symbolic address expected by the technology object and by STARTER trace.

System Topology

The reference configuration validated against this article:

• SINAMICS S120 with Control Unit CU310-2 PN, firmware 5.2 SP3 (or newer in the 5.2 line)
• SIMATIC S7-1500 CPU 1515-2 PN, firmware V2.6 (or 1516T/1517T when PROFIsafe is in scope)
• TIA Portal V15.1 with SINAMICS S120 GSDML V2.35
• STARTER V5.4 SP1 (or Startdrive in TIA) for drive-side parameterization
• Telegram 5 mapped to PROFINET slot 0, subslot 1
• SLS (Safely Limited Speed) configured with Stop C as the active stop response

The PROFINET IO device appears in the TIA device view as "SINAMICS S120 CU310-2 PN" with the I/O addresses assigned by TIA's slot model. The S120 supports a wide set of Standard Telegrams (1, 2, 3, 4, 5, 6, 9, 20, 81-86, 102-106, 116, 118, 125-132, 136, 138, 139, 166, 220, 352, 370, 371, 390-396, 999). Telegram 5 is the appropriate choice when the application requires one control word plus one setpoint (NSOLL) and one status word plus one actual value (NIST) with a single encoder, which is the canonical case for a Safety Integrated SLS test.

Understanding Standard Telegram 5

Standard Telegram 5 is a PROFIdrive profile telegram standardized by PROFIBUS & PROFINET International. It is structured on the cyclic PZD channel as four 16-bit words. See the S120 Commissioning Manual (entry 99472695) for the PZD mapping of all supported standard telegrams.

PZD3 is the ZSW1 word of interest for the Stop C / control-request question. The drive transmits 16 bits of status information every PROFINET cycle, and the S7-1500 places them into a contiguous 16-bit input area starting at the configured input address. The mapping from the cyclic PZD receive word to the internal status image can be observed on the drive side via parameter r2050[0] (raw receive word) and r2089[0] (ZSW1 image after BICO interleaving).

ZSW1 Bit Map (PROFIdrive Profile V4.2)

The bit numbers below are 1-based in the PROFIdrive convention (Bit 0 = LSB of the low byte in big-endian order). This is the same convention used in the S120 List Manual under r2089[0] (ZSW1 mapping) and the Safety Integrated Function Manual.

For the SLS Stop C case in the field scenario, the engineer monitors ZSW1.9 ("Control Requested") to determine whether the drive has handed control of the ramp-down to the safety function and the PLC should freeze further setpoint changes. The bit toggles to 1 in the safety reaction window and back to 0 once the drive enters STO, reaches n=0 via SS1, or returns to normal closed-loop control.

Byte Order, Word Alignment, and Endianness on the S7-1500

The S7-1500 stores multi-byte process values in little-endian order. When a 16-bit word received in network/big-endian order (most significant byte first) is placed in the I/O area, the S7-1500 reverses the byte order so that the least significant byte occupies the lower memory address. The same convention applies at the bit level for the first eight bits in a byte:

• Byte n: low byte of the 16-bit word, holds bits 0-7 of the word in PROFIdrive order
• Byte n+1: high byte of the 16-bit word, holds bits 8-15 of the word

For PROFINET, the fieldbus convention is:

• Words are transmitted high-byte first (big-endian / network order) on the wire.
• Words must start on an even byte boundary (i.e., an even input-word address such as IW18, IW20, IW22). Telegrams cannot legally start at an odd byte offset because PROFIdrive telegrams are word-structured, and the GSD enforces the slot start alignment.

When TIA Portal places Telegram 5 at input address IW17, the I/O table is set up with the high byte of ZSW1 at the next higher address (IB18) and the low byte at the lower address (IB17). The TIA symbolic database, when it generates a tag for the ZSW1 bits, follows the S7-1500 convention: bit 0 of the word maps to bit 0 of the low byte (IB17.0), bit 1 to IB17.1, and so on. Bit 8 (the first bit of the high byte) maps to IB18.0, and bit 9 maps to IB18.1.

This explains the field observation: the symbolic tag "ZSW1.ControlRequested" (which is ZSW1.9 in the PROFIdrive profile) is generated at address IB18.1, not IB17.1. The bits are not mislabeled. The address 17 is the lower byte of the 16-bit word. TIA correctly placed ZSW1.9 at bit 1 of the high byte (bit 1 of IB18).

The recommended practice is to align the telegram start address to an even word address (IW18, IW20, IW22, ...) so that the I/O area displays a clean word-oriented map. Telegram 5's first 16-bit word (ZSW1) is then available at IW18 with bit 0 of the word at IB18.0 and bit 9 at IB19.1. Within TIA, the symbolic name "Axis1_Actor_Interface_AddressIn(1).ZSW1.ControlRequested" still resolves to the same physical bit whether the telegram is placed at IW17 or IW18 - it is generated relative to the slot offset, not the absolute start address, so swapping the start address does not change the bit number; it only changes which absolute IB address hosts the high byte.

Root Cause

The root cause of the byte-order confusion in this scenario is the combination of three factors:

1. The S7-1500 stores multi-byte process data in little-endian order at the byte/bit level. The lowest byte of a word is at the lowest address; the lowest bit (bit 0) of that byte is at the lowest absolute address.
2. The S120 transmits PROFIdrive telegrams in big-endian / network byte order on PROFINET. The first byte received in a telegram word is the high byte of the word as defined by the PROFIdrive profile.
3. PROFINET slot mapping is word-aligned: Telegram 5's first input word must start at an even input-word address. Placing it at IW17 violates the conventional alignment and creates an off-by-one view of the high-byte / low-byte structure when the input area is scanned in TIA's watch table byte-by-byte.

The original engineer's belief that the S7-1500 uses little-endian and the S120 transmits big-endian is correct. The TIA symbolic generator accounts for this: it places ZSW1.9 (which is bit 9 of the 16-bit word) at IB18.1 - bit 1 of the high byte, which in big-endian network order is the second least significant bit of the high byte, which is the ninth bit of the entire 16-bit word.

The "I17 vs I18" offset is a direct consequence of the IW17 base address: ZSW1 spans IB17 (low) and IB18 (high), so ZSW1.0 is at IB17.0, ZSW1.8 is at IB18.0, and ZSW1.9 is at IB18.1.

Resolution

Step 1 - Confirm Telegram 5 Selection on the Drive

In STARTER (or Startdrive) for the S120 CU310-2PN, open the configuration tree under Communication → PROFINET and verify that "Standard telegram 5" is the active PZD telegram. The drive-side parameter p922 must equal 5. When p922 is changed, perform a POWER ON or execute "Set p922 = 1, then 5" to activate the new mapping on the next PROFINET cycle.

Step 2 - Configure an Even Telegram Start Address in TIA

In the TIA Portal device view, select the SINAMICS S120 CU310-2PN IO device and open the device properties. Navigate to PROFINET interface → Telegram configuration. Set the I-address for Telegram 5 to an even value, e.g. IW18 ... IW21 (four 16-bit words = 8 bytes of input plus 8 bytes of output for the full two-word-per-direction mapping). The Siemens TIA documentation for telegram configuration across fail-safe and standard modules is in the TIA Portal F-Module Communication Telegrams reference; the selection mechanics (telegram drop-down, extension word, slot configuration) apply directly to the S120 PROFINET slot as well.

Step 3 - Verify the Technology Object Tag Generation

Compile the TIA project. After the build, the technology object (TO) for the positioning axis (Axis1) will generate the data block Axis1_Actor_Interface_AddressIn / AddressOut. Expand the structure and locate the ZSW1 substructure. Within ZSW1, the bit ControlRequested must be a Boolean and must reside at the offset corresponding to bit 9 of the 16-bit word. The symbolic address resolves as follows when the start address is IW18:

"Axis1_Actor_Interface_AddressIn(1)".ZSW1.ControlRequested   // Symbolic
P#I19.1                                                    // Absolute, pointer view
%I19.1                                                     // Direct I/O reference

Step 4 - Cross-Check with STARTER Trace

In STARTER, open the trace for r2050[0] (ZSW1 received from PROFINET) and r2089[0] (ZSW1 after BICO interleaving). Both must display the same bit pattern. Drive a Stop C via STARTER or via the safety logic, and confirm that r2050[0] bit 9 toggles. If the trace shows the bit toggle, the drive is transmitting the bit correctly. The PLC's interpretation is then a one-to-one match to the PROFIdrive specification.

Step 5 - Adjust Program Logic

The PLC code that previously used %I17.1 or a symbolic tag whose absolute address resolved into the IW17 base must be updated to the new base address IW18. The bit offset within the word does not change. Search for the symbol ZSW1.ControlRequested across all program blocks, F-blocks, and the technology DB, and confirm the new address. For an SCL bit extraction example:

// SCL: extract ZSW1.9 (ControlRequested) from a 16-bit word tag
wZSW1 AT %IW18 : WORD;
bControlRequested : BOOL;

bControlRequested := (wZSW1 AND 16#0200) <> 0;   // Mask 0x0200 = bit 9

Verification Procedure

Use the following TIA watch table procedure to validate the mapping end-to-end:

1. Open the watch table for the SINAMICS S120 drive.
2. Add tags: %IW18 (raw ZSW1), %IB18 (low byte), %IB19 (high byte), and the symbolic tag "Axis1_Actor_Interface_AddressIn(1)".ZSW1.ControlRequested.
3. Start the drive in open-loop speed control and ramp to a value within the SLS limit.
4. Exceed the SLS limit by ~10% in the test direction. Activate SLS via the safety input (PROFIsafe or TM54F).
5. Observe ZSW1.9 toggle to 1 within the safety reaction time. The watch table entry for the symbolic tag must switch to TRUE simultaneously with the STARTER trace on r2050[0] bit 9.
6. Read the high byte IB19. The decoded bit pattern with ZSW1.9 = 1 must match the PROFIdrive definition of Stop C ramp-down active.

If the drive-side trace and the PLC-side watch table both show the same bit transition, the byte-order issue is resolved. The "I18.1 vs I17.9" perception is a labeling artifact of the base address only.

Common Pitfalls and Field Notes

• The "ControlRequested" bit is ZSW1.9 in the PROFIdrive profile and is reproduced in the S120 List Manual as r2089[0].9 mapped from the source signal p2082[0] (default "Control Requested" for Telegram 5). The same bit position has a different significance depending on the telegram. In Telegram 1, the same physical bit may map to a different signal after BICO remapping via p2082[0] / p2091[0].
• When using SINAMICS Safety Integrated Extended Functions, the safety status bits (S_ZSW1, r9744) are a separate word from ZSW1. Stop C uses the standard ZSW1.ControlRequested bit; safety status from the drive is reported in S_ZSW1 at a different slot offset, e.g. the safety telegram 30 if PROFIsafe is in use, or r9744 if accessed via a non-PROFIsafe path.
• If the technology object was created before the I/O address change, the Axis1_Actor_Interface_AddressIn DB is regenerated on compile. Run a "Compile → Software (rebuild all)" and check the DB for the new address offsets. A residual stale offset will be flagged in the TIA consistency check.
• STARTER (legacy) and Startdrive (TIA-integrated) display telegram mapping in different orderings. STARTER lists the PROFINET word sequence; Startdrive shows the PZD list with directional icons. Both display the same underlying r2050 / r2099 image.
• For projects on an S7-1500T (fail-safe CPU) with PROFIsafe in parallel, the safety slot is mapped separately (typically at a higher address, e.g. IW50). Telegram 5 remains the standard process data slot. The S7-1500T safety program uses the F-DB to monitor ZSW1.ControlRequested via the technology object's safety status word, not via direct I/O access. Mixing the two is a frequent commissioning error.
• The ZSW1 bit numbering in TIA's symbolic generator and in the S120 List Manual is consistent, but the display order is reversed in some trace viewers. Trust the symbolic address over the visual display.
• When the drive is in a free-wheeling or coast-down state (ZSW1.4 = 1), the ControlRequested bit can still toggle briefly during state transitions. To avoid false triggers, qualify the ZSW1.9 evaluation with ZSW1.2 = 1 (Operation Enabled) or use a rising-edge trigger with a 1-cycle filter.

Cross-Reference to S120 Safety Documentation

The Stop C reaction is described in the SINAMICS S120 Safety Integrated Function Manual (entry 51677403) under section 6.13 (Safety faults). The behavior is: SLS active + speed > SLS limit → drive sets ZSW1 bit 9 = 1 (Control Requested) → drive executes the stop ramp defined in p9556 / p9586 (or the Safety Integrated Extended stop ramp) → drive clears ZSW1.9 and enters a safe state. The PLC must not issue additional ON commands while ZSW1.9 = 1.

Bit 9 in the S120 List Manual corresponds to r2089[0].9 mapped from the source signal p2082[0] (default "Control Requested" from the PROFIdrive profile for Telegram 5). The same bit is accessible via the STARTER expert list under r2050[0] and r2094[0] depending on BICO configuration.

The SLS limit definition (p9531[0]) and the SLS stop response (p9563, p9583) determine the transition timing. The actual ramp-down is performed by the drive's safety processor, not by the S7-1500. The PLC observes the event via ZSW1.9 and must stop issuing further setpoint changes until the safety condition clears and the safety function acknowledges.

Frequently Asked Questions