SINAMICS G120 PROFINET PZD Mapping on S7-300 in TIA Portal

Overview: How an S7-300 Talks to a SINAMICS G120 over PROFINET

The recurring question from first-time integrators is deceptively simple: "Why does the number 600 inside the drive subroutine correspond to the I/O area the drive actually uses?" The number is not a magic literal — it is the start address of the drive's PROFINET PZD telegram, bound to the S7-300 hardware configuration (HWCN). Every read/write at offsets +2, +4, +6, +8, +10 of that base address is just a PZD word offset inside the telegram. Once that mental model is in place, the entire drive ↔ PLC link becomes transparent.

This reference covers the full binding chain between a SINAMICS G120 CU240E-2 PN and an S7-300 PN CPU inside TIA Portal V13 (or newer). It includes telegram structure, hardware configuration, the role of FB283, SFC14/SFC15, Startdrive commissioning, and the most common fault patterns.

Hardware stack covered:

• SINAMICS G120 with CU240E-2 PN Control Unit (FW V4.4 minimum, V4.7 / V5.1 recommended)
• S7-300 CPU with on-board PROFINET port (e.g., CPU 315-2 PN/DP, CPU 317-2 PN/DP, CPU 319-3 PN/DP) — or CP 343-1 for older non-PN CPUs
• TIA Portal V13 SP1 minimum with the Startdrive add-on; TIA V15 / V16 / V17 recommended for new projects

Protocol stack covered:

• PROFINET IO RT (Real-Time, Class 1)
• PROFIdrive profile telegrams 1, 20, 350/352 and Free Telegram 999
• PROFIsafe Telegrams 30 / 31 (only when using F-CPU and integrated safety)

Prerequisites

Before opening TIA Portal, confirm the following items are on the bench.

Hardware Requirements

• Drive: SINAMICS G120 with CU240E-2 PN Control Unit. The CU240E-2 PN supports PROFINET RT, PROFIsafe over PROFINET, and shared device. Memory card (SD) recommended for parameter backup.
• Controller: S7-300 CPU with on-board PROFINET (CPU 31x-2 PN/DP) or any S7-300 with a CP 343-1 (6GK7343-1 series). The CP must support PROFINET IO Controller, not just PROFINET IO Device.
• Network: Cat 5e (or better) shielded Ethernet cable. Maximum segment length 100 m. Switch required for star topology; linear topology also permitted if the drive supports it (CU240E-2 PN does).
• Power: Drive line filter (if required for EMC), line reactor (for weak networks or large motors), braking resistor (for regenerative applications).

Software Requirements

• TIA Portal V13 SP1, V14, V15, V15.1, V16, or V17. Legacy projects from V13 remain editable in newer versions; reverse migration is not supported.
• Startdrive add-on matching the TIA Portal version. Without Startdrive, the CU240E-2 PN device will not appear in the hardware catalog and telegram parameters cannot be set from inside TIA.
• GSDML file for the CU240E-2 PN. Installed automatically with Startdrive; can also be downloaded from the Siemens Product Support server.
• Optional: Standalone STARTER or Startdrive Commissioning Tool for parameter dump / restore.

Engineering Data to Have Ready

• PROFINET device name for the drive (e.g., g120-m1)
• PROFINET IP address and subnet (e.g., 192.168.0.10 / 255.255.255.0)
• PROFINET IO update time — 1 ms minimum, 2–4 ms recommended for non-synchronous drives
• Telegram selection (Standard 1, Standard 20, Free 999, or PROFIsafe 30/31)
• PZD start address in PLC — must not overlap any other IO. Common conventions: 256, 500, 600, 1000. The legacy project described in the source uses 600.
• Motor nameplate data: voltage, current, power, cos φ, speed, connection (star / delta)

Telegram Architecture: How PZD Words Move Between Drive and PLC

Every PROFINET drive exchanges data through a fixed-length Process Data (PZD) container of 16-bit words. The drive transmits actual values to the PLC and receives setpoints from the PLC. The order, length, and meaning of the words are defined by a telegram. The G120 supports a fixed list of standard telegrams and a user-defined "free" telegram.

Standard Telegram 1 (Default for G120)

This is exactly the layout the source program exposes: input offsets +2, +4, +6, +8, +10 from base 600 (six words of 16-bit each) and output offsets +2, +4 (two words). The offsets correspond to the byte boundaries of the 16-bit words.

Standard Telegram 20

Same direction count (2 setpoints / 6 actuals) but signals are 32-bit. NSOLL_b (DWORD) at QD 602, NACT_b (DWORD) at ID 602. Use this when the controller expects 32-bit process variables or when speed resolution above 16-bit is needed. The address map expands from 4 output bytes to 8 output bytes; re-check for IO overlap.

Free Telegram 999

User-defined layout of up to 8 PZD words per direction. The user wires PZD slots to specific drive parameters via p2051 (output direction from the drive) and p2050 (input direction to the drive). Use this when the standard telegrams do not match the application — e.g., when you want to read r0021 (smoothed speed) instead of NIST, or write to a free setpoint channel.

PROFIsafe Telegrams 30 / 31

Required only when the drive is wired to a fail-safe PLC (S7-300F, ET 200S F-DI/DO) and an SS1, STO, or SLS safety function is commanded over PROFINET. Telegram 30 = 2/2 with PROFIsafe PZD, Telegram 31 = 2/6 with PROFIsafe. If you do not need safety but accidentally select these, the drive will refuse to run because it expects an F-host signature.

Signal Bit Layout — STW1 and ZSW1

STW1 (Control Word 1, PROFIdrive profile) bit assignments:

Standard run sequence: STW1 = 047E (off, no coast, no fast stop, ready) → STW1 = 047F (pulses enabled, ramp released, setpoint active). Skipping the intermediate state 047E is the most common reason for "drive will not run despite correct setpoint."

ZSW1 (Status Word 1) bit assignments:

The Core Question: How Does the Number 600 Become an I/O Address?

This is the binding that confuses most first-time integrators. The number 600 in your FB is not a symbolic tag — it is an input parameter pointing to a hardware address. The connection is realized in three layers.

Layer 1 — Hardware Configuration (HWCN): The Address Lives Here

When you insert the CU240E-2 PN from the hardware catalog into the S7-300 device view, TIA Portal creates a PROFINET IO device entry on the CPU's PROFINET subnet. You then drop the telegram module into a slot of that device. Each telegram slot exposes a configurable "I/O start address" field.

The address you enter here is what the PLC CPU uses as the base for all PZD I/O reads and writes for that drive. Configuring the drive with Standard Telegram 1 and start address 600 yields:

• Input range: IB 600 to IB 611 (six words = 12 bytes)
• Output range: QB 600 to QB 603 (two words = 4 bytes)

These byte ranges are registered in the system data blocks (SDB) of the PLC during compile and download. After download, the PLC operating system knows that whenever it needs to update the drive, it reads/writes from those bytes.

Layer 2 — Function Block Input Parameter

The FB that wraps the drive (e.g., FB283 from the Standard Drive Library, or a custom block from the legacy project) accepts the start address as one of these input types:

• LADDR — symbolic hardware identifier (newer blocks)
• IO_ADDRESS — integer start address (legacy blocks)
• PEW_START, PAW_START — separate input and output bases

When the FB reads the input value 600, it does not treat it as a number for arithmetic. It treats it as a pointer into the I/O address image. Internally the FB then calls SFC14 (DPRD_DAT) and SFC15 (DPWR_DAT) with the address 600 plus the appropriate word offsets.

Layer 3 — Direct Access with PEW / PAW

To read the drive status word directly without any FB wrapper, write PEW 600 (Peripheral-Input-Word) or PAW 600 (Peripheral-Output-Word) in the program. This is the only place where the literal number 600 is interpreted as an address:

• PEW 600 → reads the word at peripheral input address 600 → ZSW1 status from drive
• PAW 600 → writes the word at peripheral output address 600 → STW1 control to drive
• L 600 (in STL) or arithmetic on the literal 600 in the program → treats it as the integer 600, not as an address

Data Flow Topology

Hardware Configuration in TIA Portal

Step 1 — Add the Drive to the Project

1. Open the S7-300 project in TIA Portal.
2. Open the device view of the CPU.
3. In the hardware catalog, navigate to: Other field devices → PROFINET IO → Drives → Siemens AG → SINAMICS → SINAMICS G120 → CU240E-2 PN. If this entry is missing, install the Startdrive add-on and update the hardware catalog.
4. Drag the device into the PROFINET subnet connected to the CPU's PN port. TIA assigns a default PROFINET device name and IP address that you will overwrite.

Step 2 — Assign PROFINET Identity

1. Right-click the drive → Properties → PROFINET interface → Ethernet addresses.
2. Set the device name (e.g., g120-m1) and IP (e.g., 192.168.0.10 / 255.255.255.0).
3. Assign the device name to the physical drive using "Assign PROFINET device name" from the online menu. Without this step the IO controller cannot establish the AR (Application Relationship) and the drive's BF LED will be solid red.

Step 3 — Insert the Telegram

1. In the device view of the drive, expand "Module" → "Drive" → "Standard Telegram 1" (or your selection). Drag it into Slot 0.
2. Click the slot, then look at Properties → "IO addresses".
3. Uncheck "Apply default address" and enter 600 as the start address for both input and output (or split them — e.g., input 600, output 700). The source project uses 600 for both.
4. Confirm "System selection" is unchecked; otherwise TIA may re-assign the address on the next compile and break the FB binding.

Step 4 — Compile and Download

1. Right-click the CPU → Compile → Hardware (rebuilds all SDBs).
2. Download the hardware configuration to the PLC. The download writes the new process image map.
3. Power-cycle the drive if the telegram slot changes from a previous commissioning; the drive must re-initialize the IO AR to match the new telegram length.

Symbolic vs. Absolute Addressing

Once the start address is fixed, you can assign symbolic names so the program reads more cleanly:

In the source project, the FB input is the literal 600; inside the FB, offsets +2, +4, +6, +8, +10 are added to that base and resolved through PEW/PAW accesses. If you instead use symbolic tags, you bypass the FB offset logic and access each PZD word directly.

Reading and Writing the PZD Directly with SFC14 / SFC15

For projects that do not want to use FB283, the raw read/write mechanism is SFC14 (DPRD_DAT) for consistent reads and SFC15 (DPWR_DAT) for consistent writes. Both require a hardware identifier (LADDR), which is the start address of the telegram slot.

ST Sample — Reading Status Word and Speed Actual

DATA_BLOCK DB100 "Drive1_PZD_In"
  STRUCT
    StatusWord    : WORD;   // IW 600 — ZSW1
    SpeedActual   : WORD;   // IW 602 — NIST
    CurrentActual : WORD;   // IW 604 — IAIST
    TorqueActual  : WORD;   // IW 606 — MIST
    PowerActual   : WORD;   // IW 608 — PIST
    Reserve1      : WORD;   // IW 610 — slip / free
  END_STRUCT
END_DATA_BLOCK

CALL SFC 14                          // Consistent read
  LADDR   := 600
  RET_VAL := MW200
  RECORD  := P#DB100.DBX0.0 BYTE 12  // 6 words = 12 bytes

ST Sample — Writing Control Word and Speed Setpoint

DATA_BLOCK DB101 "Drive1_PZD_Out"
  STRUCT
    ControlWord   : WORD;   // QW 600 — STW1
    SpeedSetpoint : WORD;   // QW 602 — NSOLL
  END_STRUCT
END_DATA_BLOCK

CALL SFC 15                          // Consistent write
  LADDR   := 600
  RECORD  := P#DB101.DBX0.0 BYTE 4
  RET_VAL := MW210

SFC14 / SFC15 guarantee that all words of one PZD group are read/written in a single, consistent PN cycle. Direct PEW/PAW accesses are byte-wise and can tear during fast scans — avoid them for control/status words that need atomicity, especially when the IO update time is faster than the OB1 scan time.

Ladder Sample — Run Command Sequence

// Network 1: Build STW1 word from bits
A   "M10.0"      // Run request
=   "DB101".ControlWord.%X0    // Bit 0 — ON / OFF1

A   "M10.1"      // Fault acknowledge
S   "DB101".ControlWord.%X7    // Bit 7 — Acknowledge (set on rising edge)

A   "M10.0"
=   "DB101".ControlWord.%X3    // Bit 3 — Enable Operation

A   "M10.0"
=   "DB101".ControlWord.%X10   // Bit 10 — Control by PLC

// Build NSOLL — 16384 dec = 4000 hex = 100% reference speed
L   16384
T   "DB101".SpeedSetpoint

// Network 2: Write PZD
CALL "DPWR_DAT"
  LADDR  := 600
  RECORD := P#DB101.DBX0.0 BYTE 4
  RET_VAL := MW210

Commissioning with Startdrive

Startdrive adds an "Online & Diagnostics" view to the drive that lets you open the parameter list, edit any parameter, trace actual signals, run the commissioning wizard, and read/clear the fault buffer.

Minimum Commissioning Steps

1. Restore factory settings (only for new drives): Set p0010 = 30, then p970 = 1. Wait for the drive to reboot. Skipping this on a previously configured drive may leave conflicting parameter sets from the old application.
2. Enter motor nameplate data: p0304 (rated voltage), p0305 (rated current), p0307 (rated power), p0310 (rated frequency), p0311 (rated speed). Verify the motor connection type (star / delta) matches p0103.
3. Run motor identification: Set p0010 = 1, then p970 = 1. Apply ON command and let the drive measure stator resistance, leakage inductance, rotor time constant, and (optionally) moment of inertia via p1900.
4. Configure setpoint source: p1000 = 6 (PROFINET), p085 = 1 (fieldbus command source), p0922 = 1 (Standard Telegram 1).
5. Configure watchdog: p2040 = telegram failure time in ms. Default is 3 ms (3 × 1 ms IO cycle). For typical applications, set to 100 ms to ride through controller startup.
6. Save: p971 = 1 to copy RAM → ROM.

After these steps, sending STW1 = 047Eh then 047Fh from the PLC should run the drive at the requested speed setpoint.

Watchdog Timing Detail

The watchdog parameter p2040 defines the maximum allowed interval between consecutive PROFINET telegrams. If the drive does not receive a new telegram within this window, it issues F01910 (PROFINET communication failure). The default 3 ms is the IO cycle time × 3; for non-synchronous drives with IO update 4 ms, the default would be 12 ms. Setting p2040 to 100 ms (or higher) gives the controller startup grace period so F01910 does not fire during PLC RUN → STOP transitions.

Diagnostics and Verification

Online Diagnosis in TIA Portal

1. Go online with the CPU.
2. Open the device view of the drive → "Online & Diagnostics".
3. Check the PROFINET diagnostics for AR (Application Relationship) state. A green check means the IO controller and device are exchanging data.
4. Open "Watch table" and force the symbolic tags or PEW/PAW addresses. Drive should respond within one PN cycle (1–4 ms).

Drive-Side Diagnosis

Common Faults and Fixes

PROFINET Device Replacement Without Programming Device

For field service situations, configure the IO device with the "Device replacement without exchangeable drive" option:

1. Open the drive's PROFINET interface properties.
2. Enable "Device replacement without programming device".
3. The new CU240E-2 will inherit the previously assigned PROFINET name from its neighbor via LLDP.

If the legacy project shows a dead drive that no longer responds at the IP address, a hardware swap with this option enabled takes only seconds. Without it, you must bring a PG/PC to assign the PROFINET name to the new drive before the controller can find it.

Migration Path from Step 7 Classic to TIA Portal

Legacy projects built with Step 7 Classic and STARTER can be migrated to TIA Portal using the TIA migration tool. The drive parameters migrate automatically; the HWCN slot configuration for the CU240E-2 PN must be rebuilt because TIA Portal handles telegram slots differently from Step 7 Classic HW Config. The start address (600 in the source project) is preserved, but verify the slot ordering — TIA defaults to Telegram 1 in slot 0; Step 7 Classic with PROFIBUS historically used slot 4.

Verification Checklist

1. PROFINET device name matches between drive and TIA project — check online diagnostics AR state.
2. Telegram slot in HWCN matches p0922 on the drive — check "Compare offline / online" or read r2053.
3. Start address 600 (or whichever you chose) does not overlap with any other IO — view "IO address overview".
4. Watch table reads IW 600 = 0x0E31 or similar ZSW1 pattern with no error bits set — drive is alive but not enabled.
5. Force QW 600 = 0x047E then 0x047F in sequence — drive should accelerate to setpoint.
6. Monitor drive LEDs: RDY solid green, BF/PN solid off = healthy communication.

FAQ