Overview
The SINAMICS S110 with the CU305 PN Control Unit is a single-axis servo drive with a built-in PROFINET (PN) interface. Unlike a single-axis drive that exposes a single PROFINET slot, the S110 is a multi-Drive Object (multi-DO) device, meaning PROFINET slots are defined per Drive Object: one sub-slot for the Control Unit itself (CU telegrams) and a second sub-slot for the actual drive axis (DO telegrams). This is a frequent source of confusion in commissioning, because a project paper will sometimes list only one telegram line and the engineer expects a single slot in HW Config (TIA Portal / STEP 7).
This reference covers:
- The two-slot model of the S110 on PROFINET
- CU telegram 390 (2/2 PZD) versus drive telegrams 1 (2/2 PZD) and 111 (12/12 PZD)
- I/O address mapping on a SIMATIC S7-300/S7-400 controller (e.g., CPU 315-2 PN/DP)
- STARTER/TIA Portal configuration and the role of BICO
- Verification and troubleshooting for the most common commissioning pitfalls
The reference is consistent with the SINAMICS S110 Function Manual and the SINAMICS S110 List Manual (parameter list, telegram definitions). Always validate the installed firmware version against the relevant edition of the manuals (S110 firmware V4.x / V5.x differ in available telegrams and Epos behavior).
S110 CU305 PN Two-Slot Architecture
When the CU305 PN is inserted into the PROFINET topology of an S7-300 / S7-1500 controller, the device appears with the following internal structure (viewed in HW Config / TIA Portal device view):
| Slot | Sub-slot | Object | Default Telegram | Role |
|---|---|---|---|---|
| 0 | 0 | DAP (Device Access Point) | n/a | Identification, diagnostics |
| 1 | 1 | Control Unit (CU) | 390 (2/2 PZD) | Digital I/O of the CU, control/status words, optional time sync, drive-clocked I/O |
| 2 | 1 | Drive Object 1 (DO1) | 1, 111, 999, etc. | Closed-loop control of the motor (speed, position, torque) |
Only the CU slot carries telegram 390. The drive slot is where the engineer selects the application telegram. If the project documentation lists only one telegram, the engineer is almost always looking at the CU slot and has not yet exposed the DO sub-slot in the configuration tool.
Why two slots exist
The CU305 PN is the controller board. It contains the digital inputs/outputs, the PROFIdrive stack, and the cross-communication glue that connects PLC telegrams to the firmware objects of the drive. By separating the CU from the DO, the S110 can scale to multiple axes (a CU310-2 can host several DOs), and it allows the drive telegram and the CU telegram to be serviced by different PROFINET ARs and watchdog settings. For the single-axis CU305 this distinction is academic but still present: any code that uses Telegram 390 is talking to the CU, not to the motor.
CU Telegram 390 (Control Unit Slot)
Telegram 390 is a 2/2 PZD telegram used to access the digital inputs/outputs that are physically wired to the CU305 PN terminals. It is not used to command the motor.
| PZD # | Direction (PLC → Drive) | Name | Width | Note |
|---|---|---|---|---|
| PZD1 | Output | STW1_CU | 1 word | Control word for CU functions (e.g., terminal simulation, reserved bits) |
| PZD2 | Output | Free / reserved | 1 word | Often unused on CU305 |
| PZD # | Direction (Drive → PLC) | Name | Width | Note |
| PZD1 | Input | ZSW1_CU | 1 word | Status word for CU functions |
| PZD2 | Input | Free / reserved | 1 word | Often unused on CU305 |
Configure telegram 390 once in STARTER (or TIA Portal) on the Control Unit. STARTER automatically wires the BICO interconnections between the telegram PZD and the relevant CU parameters (e.g., r2050 indices for the receive words, p2051 indices for the transmit words). After loading, the CU's digital I/O becomes accessible to the PLC without further parameter manipulation. Other CU-only telegrams that may appear in GSD listings are 391, 392, 393, 394, 395, 396; they differ in width and bit assignments and are not interchangeable with telegram 390. Consult the List Manual table "Telegram selection" before substituting.
Drive Telegrams for the DO1 Sub-Slot
The DO1 sub-slot is the slot that controls the motor. The available telegrams depend on the firmware and the licensed functionality (basic speed control vs. Epos basic positioner). The most common selections are summarized below.
| Telegram | PZD width (in / out) | Function | Typical Use |
|---|---|---|---|
| 1 | 2 / 2 | Standard speed setpoint | Simple V/Hz-like speed control with one control word and one setpoint |
| 2 | 4 / 4 | Speed setpoint with encoder | Speed control with actual value feedback via telegram |
| 3 | 2 / 2 | Position control (basic) | Basic positioning with limited PZD |
| 4 | 6 / 6 | Position control with encoder | Positioning with encoder actual value |
| 5 | 10 / 10 | Speed control with DSC | High-performance speed control (Dynamic Servo Control) |
| 6 | 10 / 10 | Torque control with DSC | High-performance torque control |
| 102 | 6 / 6 | Speed control (extended) | Speed control with torque limits, encoder |
| 103 | 10 / 10 | Position control (extended) | Positioning with DSC, encoder, and limits |
| 105 | 12 / 12 | Position control with DSC and Epos subset | High-end positioning |
| 110 | Free | Manufacturer-specific free BICO telegram | Custom configuration |
| 111 | 12 / 12 | Epos basic positioner (full) | BASIC POSITIONER (EPOS) with position, velocity, torque limits, modes |
| 999 | Free | Free interconnection | User-defined PZD list (BICO on receive and transmit words) |
The 12/12 telegram frequently seen with the S110 is almost always 111, used in conjunction with the licensed BASIC POSITIONER (Epos) functionality. The 2/2 telegram that occupies the DO slot in many retrofits is 1. They are not interchangeable: a drive configured for telegram 111 expects a 12-word receive frame and a 12-word transmit frame, and it will fault on a shortened or extended frame. See Fault F08501 / F08502 in the S110 Function Manual for the specific fault codes raised on length mismatch.
Telegram 1 vs. Telegram 111: Practical Differences
| Aspect | Telegram 1 | Telegram 111 |
|---|---|---|
| PZD count | 2/2 (4 bytes in + 4 bytes out per direction) | 12/12 (24 bytes in + 24 bytes out per direction) |
| Control granularity | STW1, NSOLL_A, ZSW1, NIST_A | STW1, STW2, NSOLL_B, position setpoint, override, position actual, NIST_A, ZSW1, ZSW2, MELDW, etc. |
| Profile | Speed setpoint interface (PROFIdrive profile Velocity Mode) | PROFIdrive profile Positioner Mode (Epos) |
| Function package required | None (always available) | BASIC POSITIONER license option |
| PLC logic complexity | Simple ramp/STOP logic in PLC | Trajectory generator + positioner state machine in PLC, drive accepts MDI / traversing blocks |
| Typical application | Conveyor, winder, fan with speed control | Pick-and-place, indexing tables, linear axes |
If a project paper lists both telegram 390 (on the CU) and telegram 1 (on DO1), the PLC will be in classic speed-control mode. If the paper lists both telegram 390 and telegram 111, the PLC is talking Epos. The two are not paired with the same application code; the control word semantics differ (e.g., bit 6 in STW1 has a different meaning under Epos).
I/O Address Mapping on a SIMATIC CPU 315-2 PN/DP
The classic S7-300 project paper format shows telegram ranges in raw byte addresses. For a CU305 PN configured with telegram 390 (CU) + telegram 1 (DO1), the typical mapping on a CPU 315-2 PN/DP is:
| PLC address range | Direction | Telegram | Width | Function |
|---|---|---|---|---|
| PIW 900 / IB 900–903 (I) | Drive → PLC | 390 | 2 words | ZSW1_CU + reserved (CU status) |
| PQW 900 / QB 900–903 (Q) | PLC → Drive | 390 | 2 words | STW1_CU + reserved (CU control) |
| PIW 908 / IB 908–911 (I) | Drive → PLC | 1 | 2 words | ZSW1 + NIST_A (drive status + actual speed) |
| PQW 908 / QB 908–911 (Q) | PLC → Drive | 1 | 2 words | STW1 + NSOLL_A (drive control + speed setpoint) |
The paper notation "900..903 I/O Siemens Telegram 390" and "908..911 I/O Standard Telegram 1" corresponds to the input and output halves of those byte ranges. The PLC programmer must use PIW/PQW (word) access for the two PZD of each telegram; using PIB/PQB byte access is technically valid but error-prone for cross-word setpoints such as NSOLL_B in telegram 111.
Mapping for Telegram 111 (Epos, 12/12 PZD)
If telegram 111 is selected on DO1, the same project layout can grow as follows (addresses shown as one of several valid placements; the actual slot start is configurable in HW Config):
| PLC address range | Direction | Telegram | Width | Notes |
|---|---|---|---|---|
| PIW 900 / IB 900–903 | Drive → PLC | 390 | 2 words | CU status (unchanged) |
| PQW 900 / QB 900–903 | PLC → Drive | 390 | 2 words | CU control (unchanged) |
| PIW 912 / IB 912–935 | Drive → PLC | 111 | 12 words | ZSW1, ZSW2, NIST_A, NIST_B, MELDW, position actual, etc. |
| PQW 912 / QB 912–935 | PLC → Drive | 111 | 12 words | STW1, STW2, NSOLL_B, position setpoint, override, etc. |
The byte layout, order, and width of the 12 PZD in telegram 111 is fixed by the PROFIdrive profile and the Epos application. Refer to the S110 Function Manual section "Epos / Telegram 111" for the bit-by-bit mapping before writing any PLC code. The PLC must place the entire 24-byte range contiguously in I and Q areas.
STARTER Configuration Procedure
The recommended order is: configure the drive in STARTER first, then load to the PLC. STARTER is the tool of record for telegram selection and BICO interconnections; the PLC side only needs the matching slot configuration.
- Create the project and insert the CU305 PN. Use the exact article number (e.g., 6SL3040-1LA01-0AA0) and the firmware version installed on the device. Mismatches will reject the download.
- Open the message frame configuration. In the project tree, right-click Drive_1 → Properties → Message frame configuration. Add telegram 1, 111, 999, or another appropriate DO telegram. The dropdown is filtered by the currently licensed functionality (Epos is only listed if licensed).
- Configure the CU slot. Right-click Control Unit → Properties → Message frame configuration. Add telegram 390 (or 391–396) to the CU sub-slot. The "Insert after" control lets you place additional CU telegrams if needed; for a CPU 315-2 PN/DP retrofit, only one CU telegram is typical.
-
Verify BICO auto-interconnections. STARTER automatically writes the receive-word (p2051) and transmit-word (r2050) sources/destinations for the selected telegram. To inspect, expand Drive_1 / Communication / Message frame configuration and open the IF1 or IF2 detail view. Do not manually edit
p2051unless using telegram 999/110 or a custom extension; manual edits can break profile compatibility. -
Set PROFIdrive device properties. Confirm
p922= CU slot,p2038= PROFINET station name, and the I/O device identifier inp8940 / p8941if NAMUR/PN devices are involved. - Save and download to the drive. Use Target system → Download → Drive unit / Target device. Wait for the green "Download successful" status. The drive will only update telegram assignments on a power-up (Control Unit warm restart); cycle the 24 V supply if the previous telegram and the new one are different.
- Save the project offline for archiving. The PLC side will need the same telegram selection to assign slot addresses.
TIA Portal / STEP 7 HW Config (CPU 315-2 PN/DP)
For the PLC side, the same telegrams must be selected on the same sub-slots. The order:
- Install the SINAMICS S110 CU305 PN GSD file (e.g.,
GSDML-Vx.x-Siemens-SINAMICS_S110_CU305_PN-yyyymmdd.xml) via Options → Manage general station description files (GSD) in TIA Portal, or via the HW Config menu in STEP 7 V5.5. - Drag the CU305 PN from the hardware catalog onto the PROFINET IO system of the CPU 315-2 PN/DP. Assign the same PROFINET device name (e.g.,
sn110-ax1) and the same IP address that STARTER wrote to the drive (p8940/p8941). - Open the device view of the CU305 PN. Two sub-slots are visible: Control Unit and Drive_1. For each sub-slot, open Properties → Telegram and select the same telegram as in STARTER (390 for CU, 1 or 111 for Drive_1).
- Open Properties → I/O addresses on the drive sub-slot and set the start address. The paper example (900 for CU, 908 for DO1 with telegram 1; 912 for DO1 with telegram 111) must be entered as the start address; the tool allocates the consecutive bytes automatically.
- Compile the hardware and download. Watch the diagnostic buffer for
IO device failureevents during the first download. A consistent configuration will produce a green check on the PROFINET IO system within a few seconds of the drive's CU booting.
BICO Interconnections: What STARTER Does for You
For the standard telegrams (1, 2, 3, 4, 5, 6, 102, 103, 105, 111, 390) the receive and transmit words are hard-mapped to specific parameters:
-
Receive words (PLC → drive): STW1 is wired to the relevant control word source (e.g.,
p0840ON/OFF1,p1140OFF2,p1141OFF3 for telegram 1; the Epos state machine for telegram 111). -
Transmit words (drive → PLC): ZSW1 and the application-specific actual values (e.g.,
r0021smoothed actual speed,r0027current absolute actual current) are routed tor2050indices for the selected telegram.
The mapping is bidirectional and is documented in the List Manual under the function block diagrams for "Message frame configuration." If a different default is required (e.g., you need a different ZSW bit assigned to bit 4 of ZSW1), use telegram 999 or 110 with explicit BICO wiring — never overwrite p2051 on a standard telegram, because the next STARTER download will revert your change.
Verification Checklist
- Drive-side: In STARTER, Online → Drive unit diagnostics → Communication. The "IF1 PROFIdrive PZD" and "IF1 PROFIdrive PKW" sections should show Operating state: Online and Telegram: 1 (or 111) on the drive, and Telegram: 390 on the CU. If the field is empty or shows 0, the telegram is not active on the drive — re-trigger the load and power-cycle.
-
Drive-side: On the drive's operator panel (BOP20 or IOP), navigate to
r2050[0]andr2050[1]. These are the receive words from the PLC. SetSTW1 = 0x047Efrom the PLC (do not energize the drive yet), and verify that the readback values match the expected bit pattern. If they do, PROFINET is exchanging frames. -
PLC-side: In the S7-300 / S7-400 program, force the receive word and observe the corresponding control word. For telegram 1:
PQW 908 = W#16#047Eshould set ZSW1's bit for "operation enabled" request in a non-faulted drive. Confirm the input word mirrors the expected status within one PROFINET update cycle (default 1 ms; 0.5 ms with isochronous mode). -
Epos side (telegram 111): Drive must be in Mode = Positioner (p0108 has the Epos license) and
r0108.13(or the equivalent functional setting) is active. Without the license, telegram 111 is not selectable. -
Time-sync (optional): If the CU slot uses telegram 390 to forward time sync via PROFINET, verify that the drive is
LLDP / IRTsynchronized with the controller (look forSYNCstatus in STARTER online diagnostics).
Troubleshooting Matrix
| Symptom | Likely Cause | Fix |
|---|---|---|
| Drive is online, but the PLC shows "IO device failure" on the CU305 | PROFINET device name or IP does not match the PLC project | Compare p8940 with TIA Portal device properties; assign via Topology Editor or STARTER |
| Drive F08501 "PZD configuration error" | Telegram length mismatch between drive and PLC | Select the same telegram on both sides; re-load drive, power-cycle, then PLC |
| Drive F08502 "PZD length fault" | PLC wrote too few or too many words to the DO slot | Verify PZD length = 2 (telegram 1) or 12 (telegram 111) and that the S7 program is using the full PQW range |
| Drive goes OFF2 immediately after ON1 | STW1 bits for OFF2/OFF3 are not set, or telegram bits are inverted | Set STW1 = 0x047E (OFF1 + OFF2 + OFF3 inactive) for the first motion test |
| HW Config shows only telegram 390 | Drive sub-slot is collapsed in the device view | Click the "+" to expand the CU305 PN; the DO1 sub-slot is a sibling of the CU sub-slot |
| PLC reads ZSW1 = 0 even with drive running | Telegram selected on PLC but not on drive, or the drive has just been re-loaded and has not re-initialized | Re-check STARTER online diagnostics; power-cycle the drive; wait 10 s for CU to finish boot |
| Epos telegram 111 not selectable in STARTER | Epos license missing (r0108 bit) | Enable licensing via Web License Manager or order the activation card; telegram 111 is hidden if unlicensed |
| Receive and transmit words appear swapped | Address range for the CU slot and the DO slot are interleaved | Set explicit start addresses in TIA Portal / HW Config; do not auto-compute |
Edge Cases and Field Caveats
- Project paper lists only one telegram. The paper is almost always quoting one slot. Confirm the existence of the second slot in the project archive (the .dpx / .zap or TIA Portal file) before assuming the drive uses only that one telegram.
- S7-300/400 with 16-bit PQW/PIW granularity. The CPU 315-2 PN/DP can read PZD only on word boundaries. Telegram 1 (2 PZD) is fine. Telegram 111 (12 PZD) is also fine, but the S7 program must use the full 12-word range — do not interleave other I/O into the address space or the PLC will lose frame consistency.
- PROFINET update time. The S110 supports 0.5 ms (IRT) and 1 ms (RT) update times. For Epos, the recommended value is 1 ms or 2 ms; sub-1 ms is generally not required and can cause over-sampling on a CPU 315. Configure Update time under the device's PROFINET port properties.
-
Mixing CU305 PN with CU305 DP. A common service-call error is loading the PROFINET GSD onto a PROFIBUS CU305 (or vice-versa). The article numbers are close; verify before downloading because a wrong GSD can brick the network configuration and force a manual reset of
p8940. - Crypto-aggressive sites. Some plants run PN-Security. The CU305 PN does not support PN-Security profiles; if the controller insists on SecureConnect, the S110 must be on a non-secured IO controller or the connection will be rejected.
- Firmware upgrades. Telegram 111 layout changed between early S110 V4.x firmware and later V4.7+/V5.x firmware. If the project paper was authored against an older firmware, do not blindly adopt the bit layout — verify against the current List Manual revision.
Sample ST Snippet for a CPU 315-2 PN/DP + Telegram 1
The following Structured Text block shows a minimum-viable S7-300 ST section that ramps NSOLL_A from 0 to 50 % of p2000 in 2 s. It assumes the drive is in telegram 1 on the DO slot starting at PQW 908, and the CU slot is at PQW 900.
// S7-300 ST, TIA Portal V16 / STEP 7 V5.5 compatible
// LADDR 288 = PQB 900 (W#16#120 in hex); the drive DO slot is LADDR 292 (W#16#124)
FUNCTION_BLOCK FB_S110_Telegram1
VAR
stw1 : WORD; // Output word to drive (control word 1)
zsw1 : WORD; // Input word from drive (status word 1)
nsoll_a : INT; // 0..100% normalised to -16384..16384 (PROFIdrive 16-bit setpoint)
nist_a : INT;
ramp : REAL;
t_start : TIME;
END_VAR
BEGIN
// --- Read inputs (IB 908, IB 909) ---
zsw1 := WORD_TO_INT(PIW_908); // PIW 908 (drive → PLC, status word 1)
nist_a := PIW_910; // PIW 910 (actual speed, NIST_A)
// --- Build STW1: bits 0,1,2 = ON (1,1,1), bit 3 = enable operation, bit 6 = enable setpoint ---
stw1 := W#16#047E; // 0000 0100 0111 1110
// --- Setpoint ramp 0 -> 16384 (50% of p2000 if p2000 is the rated speed) in 2 s ---
IF t_start = t#0s THEN
t_start := T_PLC_MS();
END_IF;
ramp := INT_TO_REAL(T_PLC_MS() - t_start) / 2000.0;
IF ramp > 1.0 THEN ramp := 1.0; END_IF;
nsoll_a := REAL_TO_INT(16384.0 * ramp);
// --- Write outputs (QB 908, QB 909) ---
PQW_908 := stw1;
PQW_910 := INT_TO_WORD(nsoll_a);
END_FUNCTION_BLOCK
Replace the implicit PIW_xxx/PQW_xxx with the S7-300 I/O symbols defined in the symbol table, or with direct PI/PQ addressing.
Standards and Profiles
All telegrams discussed follow the PROFIdrive application profile published by PI (PROFIBUS & PROFINET International). The S110 conforms to PROFIdrive profile V4.1 (for firmware V4.x) and V4.2 (for firmware V5.x) for telegrams 1, 2, 3, 4, 5, 6, 102, 103, 105. Telegram 111 follows the PROFIdrive Positioner Mode definition; the S110 implementation is fully described in the S110 Function Manual. Telegrams 390–396 are Siemens-specific extensions to expose the CU's digital I/O. The PROFINET conformance class is Class A (RT only) for CU305 PN; IRT is supported in firmware V4.6+. For deeper conformance claims, the PROFIdrive profile document (PI) is the authoritative source; do not assume compliance without checking the latest PI specification revision.
Why does the S110 CU305 PN need two PROFINET slots?
The S110 is a multi-Drive Object device. One sub-slot is the Control Unit (carries telegram 390 to access the CU's onboard digital I/O and synchronization) and the other sub-slot is Drive_1 (carries telegram 1, 111, 999, etc. for motor control). They are configured independently in STARTER and in TIA Portal/HW Config.
Is telegram 390 a motor-control telegram?
No. Telegram 390 only exposes the Control Unit's digital I/O, status, and a small control/status word. To command the motor (ON/OFF, setpoint, mode selection) you must configure a drive-control telegram (1, 2, 3, 4, 5, 6, 102, 103, 105, 111, 999, etc.) on the DO1 sub-slot.
Can I use telegram 111 without an Epos license?
No. Telegram 111 is the Epos basic positioner telegram and is only available if the BASIC POSITIONER (Epos) function is licensed on the drive (visible in r0108.13 or the corresponding licensing bit for your firmware). Without the license, the telegram is hidden in STARTER and will not be selectable.
The drive raises F08501 / F08502. What now?
The telegram length on the PLC side does not match the telegram length on the drive side. Confirm that the same telegram (e.g., 111 on both) is selected in both STARTER and TIA Portal/HW Config, re-download to the drive, power-cycle the CU, then re-download to the PLC. Verify the I/O address start is set such that the full 12 PZD of telegram 111 (or 2 PZD of telegram 1) are inside the same PQW/PIW range with no overlapping modules.
The PLC sees telegram 390 only, not the drive telegram. Is the configuration broken?
Not necessarily. In TIA Portal / HW Config the DO1 sub-slot can be collapsed under the CU305 PN node. Expand the device view, click on the Drive_1 sub-slot, and assign the same telegram as in STARTER. The address ranges in the project paper (e.g., 900..903 / 908..911) only become valid once the DO slot is fully configured.
Can I have telegram 1 on the CU slot and telegram 111 on the DO slot?
No. Telegram 1 is a drive-control telegram and belongs on the DO sub-slot, not on the CU. The CU slot accepts 390–396 only. If the project paper shows 1 on the CU, treat it as a documentation error and select 1 on DO1 in the configuration tool.