SINAMICS G120 S7-300 PROFINET Speed Control Programming Guide

Overview: SINAMICS G120 and SIMATIC S7-300 Integration

The SINAMICS G120 is a modular low-voltage drive family from Siemens used for speed and torque control of asynchronous and synchronous three-phase motors. Each drive consists of a Power Module (PM) that handles the IGBT output stage and a Control Unit (CU) that provides the control logic, I/O, and fieldbus interface. For PROFINET-based control from a SIMATIC S7-300 CPU, the Control Unit must be a PROFINET-enabled variant such as the CU240E-2 PN (6SL3244-0BB12-1BA0) or CU240E-2 PN-F (6SL3244-0BB13-1FA0). The PN-F variant adds Safety Integrated with PROFIsafe for STO, SS1, and SLS functions.

The communication path between a SIMATIC S7-300 CPU (e.g., CPU 315-2 PN/DP, order number 6ES7315-2EH14-0AB0) and the SINAMICS G120 is cyclic PROFINET IO data exchange conforming to the PROFIdrive profile (referenced in IEC 61800-7-1 and IEC 61800-7-304). The PLC acts as the PROFINET IO Controller, and the G120 Control Unit is the PROFINET IO Device. Cyclic process data (PZD = Prozessdaten) is exchanged at the PROFINET send clock, typically 1 ms, 2 ms, or 4 ms, using a configured standard telegram.

System Architecture

Figure 1 — Reference topology: S7-300 CPU, managed PROFINET switch, SINAMICS G120 with CU240E-2 PN-F, PM240-2 power module, and the connected three-phase motor.

Prerequisites and Hardware

Before commissioning the drive, gather the following components:

• SIMATIC S7-300 CPU 315-2 PN/DP (6ES7315-2EH14-0AB0) with PROFINET interface on X1 P1R / P2R (RJ45)
• SINAMICS G120 Power Module (e.g., PM240-2 size A-C, 6SL3210-1PE..) selected for the motor kW rating
• SINAMICS G120 Control Unit CU240E-2 PN-F (6SL3244-0BB13-1FA0) — supports Safety Integrated
• STEP 7 V5.5 SP4 or higher with HW Config and NetPro
• STARTER V4.5 SP1 or higher (or SINAMICS Startdrive V15.1+ as alternative)
• GSDML file for the CU240E-2 PN-F V4.7 (or matching firmware version), installed via HW Config → Options → Install GSD File
• PROFINET patch cables (Cat 5e or higher), managed switch recommended (e.g., SCALANCE XC-100)
• Motor with complete nameplate data for p0304, p0305, p0307, p0310, p0311, p0314, cos φ

Firmware compatibility for the CU240E-2 PN-F: firmware V4.5 or higher is required for full Telegram 1-352 support. Firmware V4.7 SP3 is the current production release as of this writing. Firmware is updated via STARTER (online → accessible nodes → right-click → firmware update).

PROFINET Network Configuration and IP Addressing

Both the S7-300 CPU and the G120 Control Unit require static IPv4 addresses on the same subnet. PROFINET uses name-based addressing for device identification — the IP address alone is insufficient; the PROFINET device name must also match between HW Config and the physical device.

Use the Primary Setup Tool (PST) or PRONETA to assign the PROFINET device name and IP address to the G120 Control Unit before downloading the STEP 7 hardware configuration. The device name assigned by the tool must match the name configured in HW Config exactly (PROFINET is case-sensitive on device names).

Hardware Configuration in STEP 7 HW Config

1. Open the S7 project in STEP 7 → SIMATIC Manager → double-click HW Config for the S7-300 station.
2. From the hardware catalog, navigate to: PROFINET IO → Drives → SINAMICS → SINAMICS G120 → CU240E-2 PN-F → V4.7.
3. If the device is not in the catalog, install the GSDML file first: Options → Install GSD File → browse to the downloaded GSDML-V2.3xx-... file.
4. Drag the SINAMICS G120 onto the PROFINET IO system line. STEP 7 will automatically create a PROFINET IO system if one does not exist.
5. Right-click the G120 → Properties → Ethernet → assign a unique PROFINET device name (e.g., "g120-drv1") and IP address (e.g., 192.168.0.10).
6. In the device slot list (slot 0), select the standard telegram. For basic speed control, choose Standard Telegram 1.
7. STEP 7 will display the assigned I/O addresses (typically IW 256 / QW 256 for the first drive in the project). Record these addresses.
8. Save and compile (Station → Save and Compile), then download (PLC → Download to Target).

Standard Telegram Selection

Standard telegrams are predefined PROFIdrive PZD structures that define the cyclic data layout between the PLC and the drive. Each telegram has a fixed number of words sent and received. The most commonly used telegrams for the SINAMICS G120:

For a PID-driven speed reference (the typical use case described in the field report), Standard Telegram 1 is the optimal choice. Each standard telegram occupies 4 bytes of input (drive → PLC) and 4 bytes of output (PLC → drive) on the PROFINET IO system.

Cyclic Telegram Data Structure (Standard Telegram 1)

PLC → Drive (Outputs at QW base address)

Drive → PLC (Inputs at IW base address)

Assume HW Config assigns base address 256. Then STW1 = QW 256, NSOLL_A = QW 258, ZSW1 = IW 256, NIST_A = IW 258.

PROFIdrive Control Word 1 (STW1) Bit Definitions

Control word 1 follows the PROFIdrive application class 1 (AC1) state machine. The bit assignments per PROFIdrive profile V4.2:

Key STW1 values used for the basic on/off sequence:

Per PROFIdrive, the proper command sequence for starting the drive is:

1. Apply 0x047E — drive powers up and enters "Ready to switch on" state (ZSW1 bit 0 = 1).
2. Apply 0x047F — drive transitions through "Switched on" to "Operation enabled" (ZSW1 bits 0, 1, 2 = 1).
3. Write the speed setpoint to NSOLL_A (QW 258). The drive ramps to the setpoint via p1120.
4. For controlled stop: remove bit 0 (OFF1 = 0). The drive ramps down via p1121 then inhibits pulses.
5. For coast stop: clear bit 1 (OFF2 = 0). Pulses are removed immediately.
6. For fast stop: clear bit 2 (OFF3 = 0). Drive ramps down via p1135.
7. For fault acknowledgement: generate a 0 → 1 transition on bit 7 while bits 0-3 are in their normal ON state.

Status Word 1 (ZSW1) Bit Definitions

Speed Setpoint Normalization and Scaling Formulas

NSOLL_A and NIST_A are 16-bit signed integers with a normalized range of -32768 to +32767 (0x8000 to 0x7FFF). The full-scale value 0x4000 (16384 decimal) corresponds to 100% of the reference speed p2000. The effective range is -200% to +200%, although the drive clamps the positive side at p1082 (maximum speed) and the negative side at -p1082.

The normalization formula (PLC side):

NSOLL_A = (n_setpoint_rpm / p2000) × 16384

Equivalently in hexadecimal scaling:

NSOLL_A_hex = (n_setpoint_rpm / p2000) × 0x4000

Example: if p2000 = 1500 rpm (default) and the desired speed is 750 rpm:

NSOLL_A = (750 / 1500) × 16384 = 8192 = 0x2000

For reverse rotation at the same magnitude:

NSOLL_A = (–750 / 1500) × 16384 = –8192 = 0xE000

Decoding NIST_A on the PLC side:

n_actual_rpm = (NIST_A / 16384) × p2000

If the PID controller output is a REAL value in the range -100.0% to +100.0%, the conversion is:

n_setpoint_rpm = (PID_LMN / 100.0) × p2000

Using the SINA_SPEED Function Block

Siemens provides the SINA_SPEED FB (function block 302, instance DB created per drive axis) as part of the SINAMICS standard block library. The FB is documented in Siemens Application Example 58820849. The library is included with STARTER and can also be downloaded free of charge from Siemens Support. SINA_SPEED handles the STW1 state machine transitions, the NSOLL_A scaling, and the fault acknowledgement pulse internally, removing the need for the application engineer to write the state machine manually.

Call interface (STEP 7 V5.5 / TIA Portal V13+):

CALL "SINA_SPEED" , DB302
  AxisNo       := 1              // INT: Drive axis number (from STARTER topology, typically 1 for first drive)
  EnableAxis   := TRUE           // BOOL: Master enable for the FB
  SpeedSp      := #n_setpoint    // REAL: Speed setpoint in rpm (engineering units)
  RefSpeed     := 1500.0         // REAL: p2000 reference speed value
  EnableSp     := TRUE           // BOOL: Enable speed setpoint (drives bit 6 of STW1)
  AckError     := #ack_fault     // BOOL: Pulse to acknowledge faults (rising edge)
  SpeedAct     := #n_actual      // REAL: Actual speed in rpm (engineering units)
  AxisEnabled  := #drv_ready     // BOOL: Drive is in Operation enabled state
  Lockout      := #drv_lockout   // BOOL: Drive is in switching-on inhibited state
  Error        := #fault         // BOOL: TRUE = error active
  ErrorCode    := #err_code      // INT: 0 = OK, 8xxx = drive fault, 8xxx = comm fault
END_CALL

The SINA_SPEED FB internally performs the following operations:

1. Scales the REAL SpeedSp value to the 16-bit integer NSOLL_A using the formula above and RefSpeed as the reference.
2. Generates the STW1 state machine based on EnableAxis, EnableSp, and AckError inputs (transitioning 0x047E → 0x047F on rising edges of EnableAxis).
3. Generates the fault acknowledge pulse on bit 7 of STW1 when AckError has a rising edge.
4. Decodes ZSW1 bits to produce AxisEnabled, Lockout, and Error outputs.
5. Scales NIST_A back to REAL engineering units using RefSpeed.

Recommended call location: place SINA_SPEED in a cyclic interrupt OB (OB30-OB38). OB35 at 100 ms is typical for pump, fan, and conveyor applications. OB32 at 10 ms is suitable for higher-bandwidth speed loops. OB1 is acceptable for non-time-critical applications but produces non-deterministic update timing.

Manual Programming without SINA_SPEED

For installations that cannot use the SINA_SPEED library (legacy S7-300F with restricted library, custom state machine requirements, or educational purposes), the drive can be controlled manually by direct PQD/PIW access. The following example assumes DB100 as the data interface block and base address 256 for the drive.

DB100 layout (one drive):

• DB100.DBX0.0 — Run request (BOOL)
• DB100.DBX0.1 — Coast stop (OFF2)
• DB100.DBX0.2 — Emergency stop (OFF3)
• DB100.DBX0.3 — Fault acknowledge pulse (BOOL)
• DB100.DBD2 — Speed setpoint (REAL, rpm)
• DB100.DBD6 — Actual speed (REAL, rpm, feedback)
• DB100.DBX10.0 — Drive ready (Operation enabled)
• DB100.DBX10.1 — Drive faulted
• DB100.DBW12 — Fault code (INT)

OB35 cyclic interrupt code (100 ms execution):

// ====== BUILD STW1 ======
      U     "DB100".DBX0.0           // Run request
      =     "STW1".Bit0             // ON/OFF1
      U     "DB100".DBX0.1           // Coast stop (OFF2)
      SPBN  OFF2_OFF
      R     "STW1".Bit1             // Bit 1 = 0 → OFF2 active
      SPA   OFF2_DONE
OFF2_OFF: S     "STW1".Bit1             // Bit 1 = 1 → OFF2 cleared
OFF2_DONE:
      U     "DB100".DBX0.2           // E-stop (OFF3)
      SPBN  OFF3_OFF
      R     "STW1".Bit2             // Bit 2 = 0 → OFF3 active
      SPA   OFF3_DONE
OFF3_OFF: S     "STW1".Bit2
OFF3_DONE:
      U     "DB100".DBX0.0
      S     "STW1".Bit3             // Enable operation
      S     "STW1".Bit4             // Enable ramp generator
      S     "STW1".Bit5             // Unfreeze ramp generator
      S     "STW1".Bit6             // Enable setpoint
      U     "DB100".DBX0.3
      FP    "ack_edge_mem"          // Positive edge detect
      S     "STW1".Bit7             // Fault acknowledge pulse
      S     "STW1".Bit10            // Control by PLC
      T     "STW1" 
      T     PQD 256                 // Write STW1 to QW 256

// ====== SCALE NSOLL_A ======
      L     "DB100".DBD2            // Load REAL setpoint (rpm)
      L     1500.0                  // Load p2000
      /R
      L     16384.0                 // Load 0x4000
      *R
      RND                           // Round to integer
      T     "NSOLL_A"
      T     PQD 258                 // Write NSOLL_A to QW 258

// ====== READ NIST_A and decode ======
      L     PIW 258                 // Load NIST_A (INT)
      ITD                           // Convert to DINT
      DTR                           // Convert to REAL
      L     16384.0                 
      /R                            // Scale to 1.0 = 100%
      L     1500.0                  // p2000
      *R
      T     "DB100".DBD6            // Save actual speed (rpm)

// ====== DECODE ZSW1 ======
      L     PIW 256                 // ZSW1
      T     "ZSW1"
      U     "ZSW1".Bit2             // Operation enabled
      =     "DB100".DBX10.0
      U     "ZSW1".Bit3             // Fault present
      =     "DB100".DBX10.1
      L     0
      T     "DB100".DBW12           // Clear fault code (read from r0947 via acyclic)

Commissioning the G120 in STARTER

1. Open STARTER → Project → New → Online (accessible nodes via PROFINET).
2. Click "Accessible nodes" — STARTER will discover the G120 by its PROFINET device name.
3. Select the G120 and click "Accept" to add it to the project.
4. Double-click the drive → Configuration wizard launches.
5. Set the control structure: "Speed control" (V/f or vector control can be selected on the next screen).
6. Enter motor nameplate data: p0304 (rated voltage V), p0305 (rated current A), p0307 (rated power kW), p0310 (rated frequency Hz), p0311 (rated speed rpm), p0314 (motor pole pair number).
7. Set the command source: p0700 = 6 (PROFINET / PROFIdrive telegram).
8. Set the setpoint source: p1000 = 6 (PROFINET setpoint).
9. Set the standard telegram: p0922 = 1 (or whichever telegram was selected in HW Config).
10. Set the reference speed: p2000 = rated motor speed from p0311.
11. Set speed limits: p1080 (minimum speed) ≥ 0, p1082 (maximum speed) ≤ p2000 (typically).
12. Set ramp times: p1120 (ramp-up seconds), p1121 (ramp-down seconds).
13. Optional: set p1300 (control mode) = 0 for V/f open-loop or 21 for sensorless vector control.
14. Optional: motor identification p1900 = 2 (motor identification at standstill + rotating measurement).
15. Save the configuration to the drive RAM, then RAM → ROM (Copy RAM to ROM).

Integrating the PID Loop

The PID FB41 (CONT_C) from the STEP 7 Standard Library outputs a REAL value (LMN) in percent, typically scaled by the LMN_FAC (output factor) and LMN_OFF (output offset) parameters. The default LMN range is -100.0 to +100.0% for bipolar outputs or 0.0 to 100.0% for unipolar.

To connect the PID output to the drive setpoint:

n_setpoint_rpm = (PID_LMN / 100.0) × p2000

For unipolar control (PID output 0-100%):

n_setpoint_rpm = PID_LMN × (p2000 / 100.0)

Example FB41 configuration for a pump speed control loop:

• SP_INT (setpoint): REAL, 0.0 to 100.0 representing 0% to 100% of flow demand
• PV_IN (process value): REAL, scaled feedback from 4-20 mA pressure transmitter
• GAIN: e.g., 0.5 (proportional gain, tune empirically)
• TI: e.g., 5000 ms (integral time)
• TD: 0 ms (no derivative action for pump flow)
• LMN_FAC: 1.0
• LMN_OFF: 0.0
• LMN_HLM: 100.0 (output upper limit)
• LMN_LLM: 0.0 (output lower limit, for unidirectional pump)

Place FB41 and SINA_SPEED in the same cyclic interrupt OB (e.g., OB35 at 100 ms) to ensure consistent sample time. The OB35 cycle time = PID sampling time = drive setpoint update time.

Verification and Diagnostics

PROFINET Connection Verification

1. Open NetPro in STEP 7 → right-click PROFINET IO system → Target system → Ethernet → Verify. All devices should report OK.
2. Open HW Config online (PLC → Online View). The G120 should appear with a green check mark.
3. Physically inspect the G120 LEDs: RDY (green, steady = ready, flashing = startup), BF (bus fault, OFF = OK, red = no connection, red flashing = configuration error).

Drive State Verification via VAT

Open a Variable Table (VAT) in STEP 7 and monitor:

• QW 256 — STW1 output (control word being sent to drive)
• QW 258 — NSOLL_A output (speed setpoint being sent)
• IW 256 — ZSW1 input (drive status word)
• IW 258 — NIST_A input (actual speed from drive)

Test sequence:\p>

1. Power up the drive. Observe QW 256 = 0x047E and ZSW1 bit 0 = 1 (Ready to switch on).
2. Force QW 256 = 0x047F (or trigger Run in your FB). Observe ZSW1 bits 0, 1, 2 = 1 (Operation enabled).
3. Write NSOLL_A = 0x2000 (representing 750 rpm at p2000 = 1500). Monitor NIST_A as the drive ramps up via p1120.
4. Verify ZSW1 bit 10 (f or n reached) transitions to 1 when NIST_A ≈ NSOLL_A.
5. Force QW 256 bit 0 = 0 (OFF1). Observe the drive ramps down via p1121.

STARTER Trace for Dynamic Verification

1. Open STARTER → select the drive → Tools → Trace.
2. Add signals: r0021 (actual speed smoothed), r0063 (actual speed unsmoothed), r1114 (ramp-function generator setpoint after ramp), r0080 (torque actual).
3. Configure trigger: free run for 10 seconds.
4. Start the trace while commanding a step change in setpoint (e.g., 0 → 1500 rpm).
5. Verify: actual speed tracks the setpoint with no overshoot (or acceptable overshoot per process requirements); ramp time matches p1120.

Fault Code Reference Table

To read fault codes from the PLC, use SFB52 (RDREC) or SFB53 (WRREC) to read parameter r0947[0..7] (current fault codes) and r0949[0..7] (fault values). The acyclic PROFINET record is index 0x010A (parameter request). For bulk fault buffer reads, use the standard FB305 (SINA_DIAG) or equivalent acyclic functions.

Safety Integration with PROFIsafe

The CU240E-2 PN-F variant supports Safety Integrated with the following PROFIsafe-controlled safety functions:

• STO (Safe Torque Off) — PROFIsafe bit 0
• SS1 (Safe Stop 1, time-controlled) — PROFIsafe bit 1
• SLS (Safely-Limited Speed) — PROFIsafe bit 3 (requires encoder or sensorless safety via p9501)

To enable PROFIsafe safety, the following are required:

1. F-CPU in the S7-300 family (e.g., CPU 315F-2 PN/DP, 6ES7315-2FJ14-0AB0).
2. Safety program in the F-runtime group (F-CALL, F-DB with PROFIsafe telegram).
3. PROFIsafe slot configured in HW Config (slot 1 of the CU240E-2 PN-F) using PROFIsafe profile V2.6.1 or V2.4.
4. F-source address (PLC) and F-destination address (drive) configured identically on both sides.
5. PROFIsafe watchdog time F_WD_Time = 100 ms to 500 ms (typically).

For applications requiring only basic STO without PROFIsafe, use the on-board STO terminals on the CU240E-2 PN-F (terminals EP+1 / EP+2 / SH). A fail-safe signal applied to EP+1 and EP+2 activates STO. This configuration does not require an F-CPU and is sufficient for many machine safety applications per ISO 13849-1 PL d or SIL 2.

Performance Optimization

• PROFINET send clock: Default is 1 ms. Set via HW Config → PROFINET IO system properties → Real-time settings → Send clock. For pump/fan applications, 2 ms or 4 ms reduces network CPU load without significant control degradation.
• Cyclic OB interval: 100 ms (OB35) is typical. For higher dynamic response, use 10 ms (OB32) or 4 ms (OB30). Faster times require the CPU to have sufficient headroom (check OB1 cycle time remains well under 100 ms).
• Speed controller tuning: Default Kp (p1460) and Tn (p1462) are set for a Siemens 4-pole standard motor. For non-standard motors, run autotune (p1960 = 1 for rotating measurement). The PI speed controller output is the torque setpoint, which is limited by p1520 (torque lower limit) and p1521 (torque upper limit).
• Setpoint filter: For noisy PID outputs, enable the setpoint filter (p2261 = 1, PT1 low-pass) and tune p2262 (filter time constant) to a value 1/5 to 1/10 of the dominant process time constant.
• Actual speed smoothing: If using Standard Telegram 1, NIST_A is the unsmoothed actual speed. If the feedback is noisy, switch to Standard Telegram 3 which provides NIST_A_GLATT (smoothed via p0045 time constant).

Migration Path to TIA Portal and Startdrive

Siemens recommends TIA Portal V17 with Startdrive V17 as the modern engineering environment for new SINAMICS G120 projects. The migration benefits include:

• Integrated hardware catalog without separate GSD file management
• Graphical commissioning wizards for the drive and motor
• Axis technology object (TO_Speed) for S7-1500 motion control functions (MC_Power, MC_MoveVelocity, MC_Stop per PLCopen standard)
• Integrated safety engineering with Safety Integrated in the TIA Portal
• Web server on the S7-1500 CPU for remote drive diagnostics
• Automatic consistency check between PLC program and drive configuration

The S7-300 + STEP 7 V5.x + STARTER workflow documented in this article remains fully supported by Siemens and is appropriate for legacy projects or where S7-300 hardware is mandated. For new applications, the S7-1500 + Startdrive platform is recommended.

Troubleshooting Matrix

FAQ