SIMOREG DC Master PPO3: Fixing PROFIBUS Control Word Failure on an S7-400

A SIMOREG DC Master (6RA70 series) drive wired to a SIMATIC S7-400 CPU 412-2DP over PROFIBUS DP with PPO3 occasionally shows a green, reachable DP slave in HW Config, healthy flashing LEDs on the CBP2 option board, and yet zero response from the drive to every control word the PLC sends. Status bits never propagate back, the fault bit stays at 0, and forcing 0xFFFF at the PQD has no effect. This reference walks through the three independent root causes that produce exactly this symptom, in the order they should be ruled out, and documents the least-known one: a load-order defect inside the Siemens-supplied MD_SIMPL (FC15) function block that ships with the SIMORECOMM library.

1. Hardware Identification: 6ES7090-0xx84-0FF0 / 6FF5

The MLFB printed on the option board nameplate decodes as follows. The exact order code reported in the field is 6ES7090-0xx84-0FF0 or 6ES7090-0xx84-0FF5. The trailing suffix (0FF0 vs. 0FF5) is the firmware / variant revision; the PROFIBUS behavior is identical for both. The 6ES7090 family is the SIMORECOMM option board that plugs onto the SIMOREG 6RA70 electronics box and carries the CBP2 PROFIBUS interface.

The CBP2 module implements PROFIdrive V2 (classic) PPO types 1 through 5. The DP slave address is set on the DIP switch block on the board, not in any drive parameter. The default PROFIBUS address is 3 unless the switches have been moved. Verify the address matches HW Config before any further diagnosis.

2. PPO3 Telegram Structure and PZD Mapping

PPO3 is a Parameter-Process-Data telegram with no PKW (no parameter channel) and exactly 4 words of PZD - 2 PZD-OUT (control word + main setpoint, PLC -> drive) and 2 PZD-IN (status word + main actual value, drive -> PLC). It is the smallest cyclic-only telegram and the one most often used for pure speed / torque control without parameter access over PROFIBUS.

HW Config fixes the I/O addressing. STEP 7 places 2 output words at the configured PZD start address (default depends on slot, e.g. PQD 256) and 2 input words at the input side (e.g. PIW 256). Word 1 is always STW1 / ZSW1; word 2 is always the setpoint / actual value. Reversing the order is a common source of confusion and is the first thing to verify when the drive ignores commands.

3. CBP2 Communication Board: LED Status Matrix

The CBP2 has three LEDs visible on the front edge of the module: red, yellow, and green. They are the single fastest field diagnostic because they tell you whether the DP link is established, whether the master is sending, and whether the slave has reached cyclic data exchange - independent of any PLC application code.

If the LEDs are not in the "all three flashing" row, the PROFIBUS physical layer is the problem, not the application. Re-check connectors, drop cable length, and the 220 ohm termination on both ends of the segment. If they are all flashing, the bus is healthy and the problem is in either the drive's parameter routing or the PLC's block sequence.

4. Control Word Architecture: Connectors and Binectors

Inside a SIMOREG 6RA70, the PROFIBUS PZD is not wired directly to the control logic. The DP slave deposits the control words into software connectors, and the application logic picks them up through parameter routing. Two connector types matter for PPO3:

K-prefixed signals are 16-bit word connectors; B-prefixed signals are single-bit binectors. The default SIMORECOMM parameter set wires P648 (control word source selector) to K3001 as a word, which means the entire 16-bit control word reaches the drive's state machine in one operation. An alternative is P648 = 9, which forces the drive to assemble the control word from individual bit-serial sources - this is the cause of the second variant of the symptom (drive ignores bits, but a subset of pre-wired bits still works).

5. Drive-Side Parameter Routing: n733, P648, P654-P675

The minimum set of drive parameters to inspect on the OP1S / OP1A / DriveMonitor commissioning tool is as follows. Use the parameter's display index (n) to see the live value and the parameter index (P) to change it.

If n733.01 is stuck at 0 while the PLC clearly sends a non-zero value, the chain is broken between the CBP2 board and the drive's parameter pool. The most common reason is that the SIMORECOMM firmware on the option board is not at a version compatible with the drive's main firmware. Check r060.00 (option board firmware) against the compatibility matrix in the 6RA70 commissioning manual.

6. Control Word Bit 10 and the 9C7E Default

The SIMOREG control word follows the PROFIdrive V2 state machine. The bits that matter for the basic on / off sequencing are:

The default value W#16#9C7E decomposes as follows:

9    C    7    E
1001 1100 0111 1110   (binary, MSB left)

Bit 15 14 13 12 11 10  9  8  7  6  5  4  3  2  1  0
      1  0  0  1  1  1  0  0  0  1  1  1  1  1  1  0

Meaning at default:
  Bit 0  = 0  (OFF1 not yet issued, drive idle)
  Bit 1  = 1  (OFF2 released)
  Bit 2  = 1  (OFF3 released)
  Bit 3  = 1  (Inverter enable)
  Bit 4  = 1  (Ramp enable)
  Bit 5  = 1  (Ramp not frozen)
  Bit 6  = 1  (Setpoint enable)
  Bit 7  = 0  (No fault ack)
  Bit 8  = 0  (No jog 1)
  Bit 9  = 0  (No jog 2)
  Bit 10 = 1  (Control by PLC - REQUIRED)
  Bit 11 = 1  (Reverse direction allowed)
  Bit 15 = 1  (Vendor-specific or reserved-as-1 by default)

Bit 10 is the master enable: if the PLC ever clears it (sends a word with bit 10 = 0), the drive silently drops into a "control by terminal" state regardless of P648. This is the most common cause of the "drive ignored my bits" symptom on a freshly configured PZD link. Always confirm that bit 10 is set in every STW1 word the PLC sends. Forcing 0xFFFF at the PQD is a useful diagnostic, but it is also unsafe - it forces the drive to energize; use it only with the line contactor open or with the EP terminal disabled.

7. MD_SIMPL (FC15) Function Block Layout

MD_SIMPL is the ready-made STL source block that Siemens ships in the SIMORECOMM example project for SIMATIC S7-300 / S7-400. It is meant to be called once per cycle from OB1 to package a tag-based control word into the PZD-OUT area and unpack the PZD-IN area back into status tags. The minimum signal list is:

EA_Adress is a pointer base. Inside the block, the STL uses indirect addressing to write to the PZD-OUT area and read from the PZD-IN area, typically with the pattern T PQD [AR1,P#0.0] and L PIW [AR1,P#0.0]. The block is called from OB1 once per scan, and the order of statements within the block determines which value reaches the drive in a given cycle.

8. STL Code Analysis: Load-Order Defect and the Fix

The defect reported in the field is in the order of two operations inside the block's output section: a constant load (9C7E or any default initialization) and the transfer to the peripheral output word. Compare the two sequences below.

8.1 Sequence A - correct (user's first attempt)

      L  W#16#9C7E    // 1. Load the control word default into ACCU1
      T  STW1          // 2. Park it in the STW1 tag
      L  STW1          // 3. Reload the tag
      T  PQD [AR1,P#0.0] // 4. Write to the PZD-OUT area

// Effect on cycle N:
//   PQD[0] = 0x9C7E  (current cycle)
//   STW1   = 0x9C7E

Sequence A is what any hand-written STL example looks like. The constant is committed to the tag, the tag is reloaded, and the value reaches the PQD in the same cycle. The drive sees 9C7E on the very first scan after the block is called.

8.2 Sequence B - defective (Siemens MD_SIMPL delivery, the bug)

      L  STW1          // 1. Load whatever STW1 currently holds
      T  PQD [AR1,P#0.0] // 2. Write to the PZD-OUT area
      L  W#16#9C7E    // 3. Load the control word default
      T  STW1          // 4. Park it in STW1 (TOO LATE for this cycle)

// Effect on cycle N:
//   PQD[0] = STW1 (from end of cycle N-1)
//   STW1   = 0x9C7E
//
// Effect on cycle N+1:
//   PQD[0] = 0x9C7E
//   STW1   = 0x9C7E

Sequence B writes the PQD before the tag is updated. In any given cycle, the PQD sees the value from the previous cycle. At first glance this is benign - after one cycle the system converges to 9C7E and stays there. The reason it fails in practice is that MD_SIMPL also has upstream logic that, on certain conditions, zeroes STW1 (for example, on a lost handshake or a watchdog flip). That zeroing happens after the PQD transfer in some revisions of the block. The net effect is that the constant in line 3 of Sequence B is overwritten again before the next cycle, and the PQD never sees a stable 9C7E - it flickers between the drive's actual STW1 at the time of the PQD transfer and whatever the upstream logic overwrites it with.

The fix is to re-order the operations so the constant load happens before the PQD transfer:

      L  W#16#9C7E    // 1. Load default into ACCU1
      T  STW1          // 2. Commit to STW1
      L  STW1          // 3. Reload
      T  PQD [AR1,P#0.0] // 4. Write to PQD - value is now 0x9C7E this cycle

For real control, replace the constant with a tag driven by your application logic:

      L  "DB_Control".STW1_User   // application-built control word
      T  STW1                       // commit to MD_SIMPL's tag
      L  STW1
      T  PQD [AR1,P#0.0]            // write to the drive

9. SVG Timing Diagram: Load Order on Three Consecutive Cycles

The diagram below shows three consecutive OB1 scans with Sequence B and the resulting PQD value at the PROFIBUS slave's input latch. The drive's STW1 capture happens at the end of the cycle (PROFIBUS token pass), so the PQD value at that latch point is what the drive receives.

The cycle-to-cycle delay is the visible symptom: the drive's n733.01 display "tracks" the PLC's STW1 tag with a one-cycle lag, but more importantly any logic in MD_SIMPL that resets STW1 in the same scan (watchdog, handshake flip) prevents the tag from ever settling to a non-zero value, and the PQD stays at 0. The drive interprets 0 in STW1 as "no PLC control" and ignores every bit. The user-reported symptom - "I forced FFFF and the drive still ignored it" - matches exactly when the constant load is at the end of the cycle and a reset to 0 happens immediately after.

10. Step-by-Step Verification Procedure

Run this procedure in order. Each step has a clear pass criterion; if you do not pass it, stop and fix it before continuing.

1. Confirm slave is reachable. In STEP 7, open the DP master system, right-click the SIMOREG slave, choose Monitor/Modify. The status line should read "DP slave is in cyclic data exchange". If it reads "not reachable" or "diagnostic interrupt pending", fix the bus first.
2. Check CBP2 LEDs. All three (red, yellow, green) should be flashing continuously. If not, you have a physical-layer or slave-side problem, not an application problem.
3. Force a known PZD-OUT value. In a VAT or directly in OB1, write W#16#9C7E to the first PQD (the STW1 word). Watch n733.01 on the drive OP1S. The value must update to 0x9C7E within one PROFIBUS cycle (typically 4-10 ms at 1.5 Mbit/s). If it does not, the DP link is not writing to K3001 - check P648 and the CBP2 firmware version.
4. Check P648. Read n648. If it is anything other than K3001 or 9, change it to K3001 and try step 3 again.
5. Check bit 10 of the PLC's STW1. Open the MD_SIMPL block offline and view STL. Confirm that the constant or tag load happens before the T PQD. If it happens after, re-order the statements.
6. Check STW1 in the PLC program. Online -> monitor the STW1 tag. It must hold a value with bit 10 = 1 for the entire time the drive is expected to be in PLC control.
7. Check the bit-serial routing (if P648 = 9). Read n654 to n675 and verify each bit of the control word maps to a B3100-B3115 binector. A missing parameter (default = 0) means the bit is hardwired off.
8. Watch ZSW1 back in the PLC. Force a fault on the drive (e.g. by opening a digital input configured as external fault). The ZSW1 value at the first PIW should update within one cycle. If it does, the PROFIBUS PZD channel is healthy; the problem is purely in STW1 generation.
9. Confirm the drive state. On the OP1S, read r000 (operating state). It should report a state consistent with STW1 (e.g. r000 = 7 "ready to switch on" if STW1 = 0x4BE, or r000 = 1 "switch on inhibited" if STW1 = 0x47E). A stuck r000 = 0 with STW1 = 0x9C7E means bit 10 is not reaching the state machine - go back to step 5.

11. Edge Case: When P648 = 9 (Bit-Serial) and the Block Sequence B Coexist

If the project uses P648 = 9 instead of K3001, the bug in MD_SIMPL becomes harder to detect because the bit-serial path applies its own gating. The drive expects each of the 16 bits of the control word to be sourced from a B3100-B3115 binector. The default mapping in a factory-fresh 6RA70 is:

If P655 and P656 are left at 0, OFF2 and OFF3 are permanently asserted (low-active), and the drive stays in "switch on inhibited" state (r000 = 1) no matter what the PLC sends. This produces an identical symptom to the load-order bug: the drive looks alive, it takes no action. The fix is to explicitly route P655 = B3101, P656 = B3102, and so on, or switch P648 back to K3001 and use the word-serial path.

12. Edge Case: PZD Word Order Reversed by a Third-Party GSD

If a non-Siemens GSD is loaded in HW Config (e.g. an integrator-supplied GSD for a custom CBP2 firmware), the PPO3 word order can be reversed: PZD-OUT word 1 becomes the setpoint, word 2 becomes the control word. The symptom is that n733.01 (which displays the control word) shows the speed setpoint value, and the actual control word is buried in n733.17 (the setpoint display). The drive appears to "not see" the control word because the value at K3001 is, in fact, the setpoint, not the STW1. The remedy is to either load the Siemens GSD SIMO80DC.GSD from the original SIMORECOMM disk, or to swap the two PQD words in the PLC program so that the control word sits in the second PQD and the setpoint in the first.

13. Edge Case: HW Config PZD Address Conflict with Another Slave

STEP 7 does not always warn when two slaves in the same DP master system have overlapping PZD address ranges. If the SIMOREG is configured at PQD 256..259 and another slave is also configured at PQD 256..259, the master writes to both on every cycle and the SIMOREG sees the wrong data. Verify with HW Config -> DP master system properties -> Address overview that no other slave occupies the same input or output range.

14. Field Commissioning Checklist

• DP slave address on CBP2 DIP switch matches HW Config.
• PROFIBUS segment terminated 220 ohm on both ends, no stubs beyond 0.3 m at 1.5 Mbit/s.
• CBP2 LEDs all flashing continuously before any PLC code runs.
• HW Config I/O addresses for the PZD match the EA_Adress in MD_SIMPL.
• GSD file version in HW Config matches the CBP2 firmware (r060.00).
• P648 = K3001 (or 9 with full B3100-B3115 mapping including P655 and P656).
• P626 = K3002 for PROFIBUS speed reference.
• P554, P555 reviewed - if either is hardwired to a terminal, that command ignores the PLC.
• Bit 10 of every STW1 value the PLC ever sends is 1.
• MD_SIMPL load order verified: constant load before PQD transfer.
• Line contactor open or EP terminal disabled during any test that energizes the drive.
• No PZD address conflict with other DP slaves in the same master system.

15. Extended Troubleshooting Matrix

16. Reference: Parameter Compatibility Between 6RA70 Firmware and CBP2 Firmware

The 6RA70 main firmware and the CBP2 option board firmware are released as a pair. Mismatched combinations cause n733.01 to read 0 even when the PQD is correct. The following table lists the most common pairings encountered in the field. Confirm by reading r060.00 on the OP1S for the option board firmware and r060.01 for the main firmware.

17. Frequently Asked Questions