Problem Definition
A SIMATIC S7-224XP CPU is configured as USS master for a bus of three MICROMASTER 420 (MM420) drives. The USS_INIT instruction reports a successful execution and the Active output reads 16#0E, but every cycle of the USS_CTRL instruction returns Error = 1. Three MM420 units are visible on the RS485 bus, all of them have been re-parameterised via the AOP with P0700=5, P1000=5, P2010=6, P2011=6, P2012=2, and P2013=3, and the bus is wired through a 6ES7972-0BA51-0XA0 PROFIBUS connector. The drive is never reported as Fault or Inhibit; the master simply cannot exchange a valid response frame with the slave.
The fault is therefore a protocol / parameter mismatch at the USS-PKW and PZD layer, not a hardware or wiring failure. The remainder of this article walks through every parameter, pin, and instruction flag that has to be aligned for the bus to return clean USS_CTRL cycles.
USS_INIT, USS_CTRL, USS_RPM_x and USS_WPM_x will not resolve. USS is supported on the two onboard RS485 ports (Port 0 and Port 1) of the S7-224XP; any EM 277 attached to PROFIBUS cannot be used as a USS master.USS Protocol Reference for S7-200 and MM420
USS (Universal Serial Interface protocol) is a single-master multi-slave bus originally defined for Siemens MICROMASTER 4, SINAMICS V20 and COMBIMASTER drives. Each telegram consists of a 14-byte header, an optional PKW area (parameter identifier value, used to read/write parameter numbers) and a PZD area (process data, used to write the control word and speed setpoint and read the status word and actual speed).
For the S7-200 library:
- The master polls a configured set of drives cyclically. The Active word selects which of the 16 possible nodes is enabled (bit 0 = node 1, bit 1 = node 2, and so on).
- The PZD length is fixed at 2 words for both directions, matching the S7-200 USS_CTRL data block (control word + speed setpoint, status word + actual speed).
- The PKW length can be 0 (PKW disabled) or 4 (PKW with one parameter per telegram, 4 words). Any other value forces the drive to wait for a variable PKW length that the S7-200 library never produces.
The drive side mirrors the same fields. The MM420 parameter P2012 sets the PZD length, P2013 sets the PKW length and P2010/P2011 set the baud rate and node address. The MM420 evaluates the same 2-word PZD area by default, which is what the S7-200 library emits.
S7-224XP Hardware and Port 0/1 Specifications
The S7-224XP (order number 6ES7214-2AD23-0XB0 or later) provides two electrically isolated RS485 ports with the following relevant characteristics for USS operation:
| Item | Value |
|---|---|
| Connector | 9-pin female D-sub, Port 0 and Port 1 |
| Maximum supported USS baud rate | 115.2 kbit/s (only Port 1 from CPU firmware 2.0 onwards; Port 0 to 38.4 kbit/s) |
| Maximum recommended USS baud rate (multi-drop MM420) | 9.6 kbit/s or 19.2 kbit/s |
| Mode selector switch | Position 0 = PPI/Freeport/USS, position 1/2 not used on S7-200 |
| Freeport ASCII/USS selection | Made by USS_INIT instruction, not by mode switch |
For a 3-drive MM420 network running at 9.6 kbit/s, either port is acceptable. With 19.2 kbit/s use Port 1 to leave more time per telegram. The USS_INIT call must be made exactly once on the chosen port, in the first scan, with a one-shot rising-edge trigger to avoid reinitialising the port on every cycle.
PROFIBUS Connector 6ES7972-0BA51-0XA0 Pinout
Order number 6ES7972-0BA51-0XA0 is the SIMATIC DP FastConnect bus connector with PG socket, 90 degree cable outlet, terminating resistor that can be switched in. The D-sub pinout used for USS on the S7-200 is identical to the PROFIBUS standard:
| D-sub pin | Signal | Use on USS |
|---|---|---|
| 3 | RxD/TxD+ (B line) | RS485 + to drive terminal 14 on MM420 |
| 8 | RxD/TxD- (A line) | RS485 - to drive terminal 15 on MM420 |
| 5 | DGND | Reference, tie to MM420 terminal 13 (0V) |
| 6 | VP (+5 V isolated) | Bus termination supply, leave floating if the drive supplies its own |
| 1, 2, 4, 7, 9 | n.c. / shield | Do not connect for USS |
The connector is electrically suitable. The two most common field failures on the 6ES7972-0BA51-0XA0 are (a) the on-board 220 ohm terminator left switched off at the physical end of the bus and (b) the on-board terminator left switched on in the middle of a multi-drop bus. Only the two extreme nodes of the bus must be terminated. The S7-224XP end of the cable is one extreme; the last MM420 is the other.
MM420 Parameter Map for USS Operation
The parameter set published in the original request is close to working but contains two errors: P2011 is set to 6 on all three drives, and P2013 is set to 3 (variable PKW length) which the S7-200 library does not support. The validated parameter map for a 3-drive MM420 network is given below. Each drive must be given a unique address and an identical PZD/PKW configuration.
| Parameter | Name | Drive 1 | Drive 2 | Drive 3 | Comment |
|---|---|---|---|---|---|
| P0003 | User access level | 3 | 3 | 3 | Expert access for parameter write |
| P0010 | Commissioning parameter filter | 0 | 0 | 0 | 1 to run quick commissioning, 0 to exit |
| P0700 | Selection of command source | 5 | 5 | 5 | 5 = USS on RS485 |
| P1000 | Selection of frequency setpoint | 5 | 5 | 5 | 5 = USS on RS485 |
| P2010 | USS baud rate | 6 | 6 | 6 | 6 = 9 600 bit/s, matches the S7-200 USS_INIT Baud = 3 selection |
| P2011 | USS node address | 1 | 2 | 3 | Must be unique, range 1…31; 0 is reserved for broadcast |
| P2012 | USS PZD length | 2 | 2 | 2 | 2 words = control word + NSET, status word + NACT (matches S7-200) |
| P2013 | USS PKW length | 0 | 0 | 0 | 0 = PKW disabled (recommended with S7-200). Use 4 only if USS_RPM_x/USS_WPM_x is required. |
| P2014 | USS telegram off time | 2000 | 2000 | 2000 | 0…65 535 ms; default 0 disables the watchdog. Set to 2000 ms to detect a broken link. |
| P2024 | USS PZD write (received from master) | 52 100 | 52 100 | 52 100 | Word 1 (control word) = parameter 52, Word 2 (NSET) = parameter 100 |
| P2025 | USS PZD read (sent to master) | 53 200 | 53 200 | 53 200 | Word 1 (status word) = parameter 53, Word 2 (NACT) = parameter 200 |
| P2027 | USS PKW write | 0 | 0 | 0 | Only required if PKW is enabled. Leave at 0 for S7-200 USS_RPM_x to function. |
Notes on the parameter values:
-
P2011 must be unique. Three MM420 units all on P2011 = 6 will collide and the S7-200 master will never receive a clean response, so
USS_CTRLlatches Error = 1. - P2013 = 0 disables PKW. A value of 3 or 127 tells the drive to expect a variable-length PKW, but the S7-200 library only produces 0 (none) or 4 (4-word) PKW. Variable lengths are not implemented in the S7-200 library and the drive will time out waiting for the remaining PKW words.
- P0700 = 5 and P1000 = 5 must both be set. Either one alone leaves the drive ignoring USS, even if RS485 is wired correctly.
- P0010 = 0. Many parameters cannot be written while P0010 = 1 (quick commissioning) is active. Always leave P0010 = 0 before any USS parameter change.
USS_INIT and USS_CTRL Subroutine Reference
The S7-200 USS library exposes two subroutines that are mandatory on the master side. Their data block layout is given below.
USS_INIT
USS_INIT(MODE, BAUD, ACTIVE, DONE, ERROR, STATUS)
| Operand | Type | Meaning |
|---|---|---|
| MODE | BYTE / BOOL | 0 = PPI mode (USS off), 1 = USS protocol active on the port |
| BAUD | BYTE / INT | 3 = 9 600, 4 = 19 200, 5 = 38 400, 6 = 57 600, 7 = 115 200 |
| ACTIVE | WORD | Bit n selects node n+1. 16#0001 = node 1, 16#000E = nodes 2, 3 and 4. 16#0E in the original fault is the bit pattern for nodes 2, 3, 4. |
| DONE | BOOL | 1 = initialisation completed |
| ERROR | BOOL | 1 = initialisation error (see STATUS) |
| STATUS | BYTE | Error class if ERROR = 1 |
A successful USS_INIT returns DONE = 1, ERROR = 0, STATUS = 0, regardless of whether any drive is connected. Active = 16#0E is valid and tells the master to poll nodes 2, 3 and 4 only. If the user intends to use nodes 1, 2 and 3, Active should be 16#07.
USS_CTRL
USS_CTRL(RUN, OFF2, OFF3, F_ACK, DIR, DRIVE, SPEED_SP, RESP_R, DONE, ERROR, STATUS, SPEED, RUN_EN, D_DIR, INHIBIT, FAULT)
| Operand | Type | Meaning |
|---|---|---|
| RUN | BOOL | 0 = stop, 1 = run (mapped to control word bit 0) |
| OFF2 / OFF3 | BOOL | Coast to stop / quick ramp stop (control word bits 1, 2) |
| F_ACK | BOOL | Acknowledge fault (control word bit 7) |
| DIR | BOOL | 0 = reverse, 1 = forward |
| DRIVE | BYTE | Node address 1…16 of the drive to control |
| SPEED_SP | REAL | Speed setpoint as a fraction (-200.0…+200.0 %) of P2000 reference |
| RESP_R | BOOL | 0 = read response, 1 = no read, only write |
| ERROR | BOOL | 1 = last USS_CTRL cycle failed (see STATUS) |
| SPEED | REAL | Actual speed returned by the drive |
| INHIBIT | BOOL | 1 = drive is in inhibit state (n_actual = 0 and power stage disabled) |
| FAULT | BOOL | 1 = drive has latched a fault |
The original configuration calls USS_CTRL with DRIVE = 6. Combined with the P2011 = 6 set on every drive, this means the master is trying to talk to a node that does not exist (the master never enabled drive 6 in Active = 16#0E). The library returns Error = 1 because the request is queued but no response frame is received within the telegram off time.
USS Error Code Reference Table
| STATUS | Source | Meaning | Typical cause |
|---|---|---|---|
| 0 | USS_INIT / USS_CTRL | No error | - |
| 1 | USS_CTRL | Drive did not respond | Wrong DRIVE value, no drive on that address, or address collision |
| 2 | USS_CTRL | Checksum (BCC) error in response | EMC noise, missing shield, mixed baud rate, broken termination |
| 3 | USS_CTRL | Parity error | P2013 / P2010 mismatch between master and drive |
| 4 | USS_CTRL | Framing error | Baud rate mismatch, e.g. P2010 = 5 on drive and Baud = 3 on USS_INIT |
| 5 | USS_CTRL | Overrun | CPU scan time longer than USS cycle, reduce SM0.0-driven USS_CTRL calls |
| 6 | USS_CTRL | Telegram off time exceeded | Drive not enabled in Active, or P2014 too low |
| 7 | USS_INIT | Mode invalid | MODE not 0 or 1 |
| 8 | USS_INIT | Baud rate code invalid | BAUD not 3…7 |
| 9 | USS_INIT | Invalid Active word | Active > 16#FFFF (CPU-level limit) |
| 10 | USS_CTRL | PKW length mismatch | P2013 set to variable length on drive while S7-200 expects 0 or 4 |
| 11 | USS_CTRL | PZD length mismatch | P2012 not equal to 2 |
| 12 | USS_CTRL | BCC error on receive | See code 2 |
| 13 | USS_CTRL | Invalid character in telegram | Noise, missing shield, broken cable |
The original report (USS_CTRL Error = 1, no STATUS value exposed in the snippet) is the most common USS fault and is almost always caused by either an address mismatch or a missing drive on the bus.
Cable Wiring to MM420 Terminal 14 / 15
The wiring example published in the Siemens S7-1200 USS example (and which is also valid for the S7-200, since both CPUs use the same RS485 electrical standard) is reproduced below:
Reference: SIMATIC S7-1200 Manual Collection - Example: USS general drive connection and setup
| Drive | RS485 + terminal | RS485 - terminal | 0 V reference |
|---|---|---|---|
| MICROMASTER 420 (MM420) | 14 | 15 | 13 |
| MICROMASTER 440 (MM440) | 29 | 30 | 28 |
| SINAMICS V20 | + | - | GND (terminal 11) |
Use shielded, twisted pair PROFIBUS cable (Siemens 6XV1830-0EH10 or equivalent, 150 ohm characteristic impedance). Connect the shield to earth at the cabinet entry gland on the S7-200 side; on the drive side the shield is normally connected to the drive PE terminal through the gland plate.
Bus Termination and Shielding
RS485 requires termination at both ends of the bus, typically 120 to 220 ohms between the + and - lines in series with a 1 nF capacitor to 0 V (the PROFIBUS standard 220 ohm / 1 nF). The 6ES7972-0BA51-0XA0 has a switchable 220 ohm termination; switch it on at the S7-224XP connector and at the connector wired to the last MM420. Switch it off on every intermediate node.
The MM420 has no internal RS485 terminator. There is no DIP switch on the MM420 for bus termination. External termination is mandatory.
Step-by-Step Reconfiguration Procedure
- Power off the S7-224XP and the three MM420 units.
- Connect the bus: S7-224XP Port 0 (or Port 1) → 6ES7972-0BA51-0XA0 → PROFIBUS cable → MM420 #1 terminal block (14, 15, 13) → MM420 #2 → MM420 #3. Switch the terminator on at the S7-224XP connector and at MM420 #3 only.
- Power on the MM420 units first. On each AOP, run quick commissioning (P0010 = 1, set motor data, P3900 = 1 to calculate). Exit commissioning with P0010 = 0.
- On each drive, set:
-P0003 = 3(expert access)
-P0700 = 5
-P1000 = 5
-P2010 = 6(9 600 bit/s)
-P2011 = 1on MM420 #1,2on MM420 #2,3on MM420 #3
-P2012 = 2
-P2013 = 0
-P2014 = 2000
-P2024 = 52100(control word + NSET)
-P2025 = 53200(status word + NACT)
-P2027 = 0 - Press the green OK button to save. P0002 must show the value just written. Repeat for every drive.
- In STEP 7 Micro/WIN, open Library → USS Protocol. Place
USS_INITandUSS_CTRLin the main program OB1. - Build a one-shot rising-edge of the first scan bit (SM0.1) to trigger
USS_INITexactly once. Set MODE = 1, BAUD = 3 (9 600 bit/s), ACTIVE = 16#07 (nodes 1, 2, 3). - Call
USS_CTRLthree times, one per drive, with DRIVE = 1, 2, 3 respectively. Drive 1 controls MM420 #1, and so on. - Download the project to the CPU. Switch the CPU to RUN.
- Toggle RUN = 1 on the
USS_CTRLfor drive 1. The MM420 #1 output frequency should ramp to SPEED_SP. STATUS should read 0, FAULT = 0, INHIBIT = 0.
Common Configuration Mistakes
| Symptom | Likely cause | Fix |
|---|---|---|
| USS_INIT DONE = 1, ACTIVE = 0x0E, USS_CTRL Error = 1 on every cycle | DRIVE input ≠ any address in ACTIVE | Set ACTIVE = 0x07 and DRIVE = 1, 2, 3 |
| USS_CTRL Error = 1 only on a single drive | Wrong P2011 on that drive, or two drives sharing the same P2011 | Verify P2011 with AOP, ensure each drive has a unique address |
| USS_CTRL Error = 1 with STATUS = 2 (BCC error) | Excess termination or missing shield | Switch off intermediate terminators, re-bond the cable shield at the cabinet entry |
| USS_CTRL Error = 1 with STATUS = 4 (framing error) | Baud rate mismatch | Match P2010 to USS_INIT BAUD (P2010 = 6 ↔ BAUD = 3) |
| USS_CTRL Error = 1 with STATUS = 10 (PKW length) | P2013 = 3 or 127 | Set P2013 = 0 (no PKW) or 4 (4-word PKW) |
| USS_CTRL Error = 1 with STATUS = 6 (telegram off time) | P2014 too low for the polling cycle | Raise P2014 to 2000 ms |
| USS_CTRL Error = 1, INHIBIT = 1 | Drive in inhibit state because OFF2 / OFF3 are off or no enable | Set OFF2 = 1, OFF3 = 1 in USS_CTRL |
| USS_CTRL Error = 1, FAULT = 1 | Drive has a real fault (F001, F002, F004, etc.) | Read r0947 on the AOP, clear with F_ACK = 1 |
| USS_INIT ERROR = 1, STATUS = 8 | USS_INIT BAUD value out of range | Use BAUD = 3, 4, 5, 6 or 7 only |
| USS_INIT ERROR = 1, STATUS = 9 | ACTIVE bit field contains bits above 16 | Limit ACTIVE to 16#FFFF maximum |
Verification and Diagnostics
After the parameter change and a CPU power cycle, the following signals confirm a healthy bus:
-
USS_INIT: DONE = 1, ERROR = 0, STATUS = 0, ACTIVE = 0x07 (or the bit pattern matching the enabled nodes). -
USS_CTRLfor each drive: ERROR = 0, STATUS = 0, RUN_EN follows RUN, INHIBIT = 0, FAULT = 0, SPEED tracks SPEED_SP within one telegram cycle. - On the MM420 AOP, r0000 displays the drive state (e.g. 7 = run), r0021 (output frequency) tracks the setpoint and r0052 (status word) bit 2 (operation enabled) is set.
If USS_CTRL still returns Error = 1, isolate the bus to a single drive and a single address. With only MM420 #1 connected and P2011 = 1, ACTIVE = 16#0001, DRIVE = 1, a clean response is expected within one cycle. If that succeeds, re-add MM420 #2 and #3 one at a time. The first drive that reintroduces Error = 1 is the offending node, typically because of a duplicate P2011 or a missing terminator on the segment between the two drives.
USS_CTRL Error = 1 on every node. Always re-power the bus after plugging or unplugging a connector. For commissioning on a live machine, parameterise the drives with the bus disconnected, then bring the bus up after every drive is verified.Frequently Asked Questions
Why does USS_INIT return ACTIVE = 16#0E if I only have three drives?
16#0E is the bit pattern for nodes 2, 3 and 4 (bit 1, 2, 3 set). It is valid for those node addresses, but it does not enable node 1. If your three MM420 units are on P2011 = 1, 2, 3, set ACTIVE = 16#07 to enable nodes 1, 2 and 3. The master only polls nodes whose bits are set in ACTIVE.
USS_CTRL always returns Error = 1 with no STATUS code. What does that mean?
Error = 1 from USS_CTRL is set whenever the request to the DRIVE did not receive a response that the library could decode. The most frequent cause is a DRIVE value that does not match any drive on the bus (e.g. DRIVE = 6 when the highest node is 3) or a duplicate P2011 on the drives. Use one of the STATUS code values below as a deeper diagnostic only when it is non-zero.
What is the correct P2013 value for an S7-200 USS master?
Use P2013 = 0 (PKW disabled) for the simplest setup. Set P2013 = 4 only if the STEP 7 Micro/WIN program must read or write parameters with USS_RPM_x / USS_WPM_x. The S7-200 library does not implement variable PKW lengths, so values of 3, 127 or any other non-zero, non-4 value will leave the drive waiting for a PKW that never arrives.
Is the 6ES7972-0BA51-0XA0 PROFIBUS connector suitable for USS on the S7-200?
Yes. The 6ES7972-0BA51-0XA0 is a SIMATIC DP FastConnect bus connector with PG socket, 90 degree cable outlet, and switchable 220 ohm termination. Pins 3, 5 and 8 of its D-sub carry the RS485 +, GND and - signals and are wired to MM420 terminals 14, 13 and 15 respectively. Switch the on-board terminator on only at the two physical ends of the bus.
What is the maximum USS baud rate between an S7-224XP and three MM420 drives?
9.6 kbit/s (P2010 = 6, USS_INIT BAUD = 3) is the conservative choice and is recommended for any multi-drop MM420 network. 19.2 kbit/s (P2010 = 7, BAUD = 4) is supported on Port 1 of the S7-224XP and works with three drives provided the cable is short and properly terminated. Above 38.4 kbit/s the MM420 starts to show telegram off time faults with more than one node on the bus.