SINAMICS S120: Save Servo Homing Position to ROM via PROFINET

1. Problem Definition

On a SINAMICS S120 drive with an absolute encoder, the operator can teach the home (reference) position in STARTER or Startdrive, the value then appears in the trace, and the process runs correctly. The fault appears at the next de-energize / re-energize cycle: the actual position value (r2521[0]) reverts to the encoder raw value that was stored in the Sensor Module flash at the last cold start, not to the position that was taught.

The root cause is not a hardware failure. The teach-in triggered from the engineering tool writes p2506 (target position) and updates p2505 (offset) in volatile RAM of the Control Unit only. When the 24 V is removed, the Control Unit loses the RAM copy. The only way to make the homing persistent is to copy the entire parameter image from RAM to the non-volatile memory of the Control Unit (and / or Motor Module) using parameter p0971[0] = 1, which can be triggered acyclically over PROFINET.

2. Encoder Class Pre-Check

Before you write a homing offset to ROM, confirm the measuring system. The SINAMICS S120 supports three encoder classes that have different power-loss behavior and therefore a different homing requirement:

Read the encoder configuration in STARTER / Startdrive under Configuration > Encoder and confirm p0400[0..n] (encoder type selection) and p0411[0..n] (measuring-system configuration). The encoder must be classified as an absolute encoder (p0400 = 9xxx absolute encoder family) for the home position to make physical sense after a power cycle.

3. Parameter p2507 — Encoder Adjustment Interface

p2507 is the command / status parameter for the SINAMICS encoder adjustment (the "teach home position" routine). It is the only parameter that triggers the drive to compute p2505 (the absolute encoder offset) from the live raw encoder value and the user-supplied target position p2506.

Procedure for a teach-in to a known mechanical position:

1. Jog the axis to the mechanical home (e.g., tool-change point, clamp position).
2. Stop the axis and clear any pending drive faults (acknowledge r2138).
3. Write the desired target position (e.g., 0 LU) to p2506[0] using WRREC.
4. Write the value 2 to p2507[0] using WRREC. This tells the drive: "use the absolute value of p2525 as the target, and write the offset into p2505".
5. Poll p2507[0] — the drive will return 3 when the adjustment has been committed to the encoder model.
6. Persist with p0971[0] = 1 (see §4).

4. Parameter p0971 — Save to Non-Volatile Memory (RAM to ROM)

p0971[0] is the standard SINAMICS "Copy RAM to ROM" parameter. Writing 1 to it instructs the drive to serialize the entire current RAM parameter image to the Control Unit flash, including p2507, p2505, p2506, and all closed-loop position control parameters.

5. PROFINET Acyclic Communication Mechanism

SINAMICS S120 parameters are mapped into the PROFINET slot / index model as follows:

• Slot 0 — Control Unit (CU320-2 / CU310-2 / CU305)
• Slot 1 — Motor Module
• Slot 2 — Sensor Module 1 (motor encoder)
• Slot 3 — Sensor Module 2 (load encoder, if present)
• Slot 4 — Terminal Module / expansion
• Index 0 … 65535 — Parameter number
• Subindex 0 … n — Parameter index (p2507[0] → subindex 0; p2507[1] → subindex 1)

The PROFINET record index for a given SINAMICS parameter number P is:

RECORD_INDEX = 0xB02E + (P - 1)

Examples:

The standard record data layout for a DPV1 write is the Siemens-specific 4-byte request header followed by the parameter data. The header contains the request ID, parameter number, and subindex:

Byte 0: Request reference (0x00 - 0xFF, returned in reply)
Byte 1: Request ID (0x01 = read, 0x02 = write request, 0x82 = write request with parity)
Byte 2: Drive object ID (DO-ID, typically 1 = Control Unit)
Byte 3: Number of parameters (0x01 for single-parameter access)
Byte 4: Attribute (0x10 = value, 0x20 = description, 0x30 = text)
Byte 5: Number of elements (0x01)
Byte 6: Parameter number (low byte)
Byte 7: Parameter number (high byte)
Byte 8: Subindex (0x00)
Byte 9: Subindex + Number of subindices (0x00)
Byte 10+: Data (4 bytes for U32, 8 bytes for U64, 4 bytes for Float)

For a 32-bit unsigned write of the value 2 to p2507[0] on the Control Unit, the 14-byte payload is:

00 02 01 01 10 01 FB 09 00 00 02 00 00 00
|  |  |  |  |  |  |   |  |  |  |  |  |  |
|  |  |  |  |  |  p#  |  |  |  |  |  p2507 value (2)
|  |  |  |  |  | 2507|  |  |  |  |
|  |  |  |  |  |     |  |  |  |  +-- data[3]
|  |  |  |  |  |     |  |  |  +----- data[2]
|  |  |  |  |  |     |  |  +-------- data[1]
|  |  |  |  |  |     |  +----------- data[0]
|  |  |  |  |  |     +-------------- subindex (0)
|  |  |  |  |  +-------------------- number of subindices (0)
|  |  |  |  +----------------------- number of elements (1)
|  |  |  +-------------------------- attribute (value)
|  |  +----------------------------- number of parameters (1)
|  +-------------------------------- DO-ID (Control Unit = 1)
+----------------------------------- request ID (write with parity)

6. TIA Portal SCL Implementation

The following SCL (Structured Control Language) function block wraps the DPV1 write of a single SINAMICS parameter and can be called from a STEP 7 program running on an S7-1500 / S7-1200 with PROFINET connectivity to the SINAMICS S120.

FUNCTION_BLOCK "FB_Sinamics_WriteParam"
{ S7_Optimized_Access := 'TRUE' }
VERSION : 0.1
   VAR_INPUT
      i_hwInterface  : HW_INTERFACE;        // PROFINET interface
      i_slot         : UINT  := 0;          // 0 = CU, 2 = Sensor 1, 3 = Sensor 2
      i_paramNumber  : UINT;                // e.g. 2507 for p2507
      i_subIndex     : UINT  := 0;
      i_valueDWord   : DWORD;               // 32-bit value to write
      i_doId         : BYTE  := 1;          // Drive Object ID
   END_VAR
   VAR_OUTPUT
      o_busy         : BOOL;
      o_error        : BOOL;
      o_status       : WORD;                // STATUS of WRREC
   END_VAR
   VAR
      s_wrrec        : WRREC;
      s_rdrec        : RDREC;
      s_recordData   : ARRAY[0..13] OF BYTE; // 14-byte DPV1 request
      s_recordRead   : ARRAY[0..13] OF BYTE; // 14-byte DPV1 reply
      s_state        : INT  := 0;
      s_recordIndex  : DWORD;               // 0xB02E + (param - 1)
   END_VAR

BEGIN
   // Compute PROFINET record index from parameter number
   s_recordIndex := 16#B02E + (DWORD_TO_DINT(i_paramNumber) - 1);

   CASE s_state OF
      0:  // Idle / start
         s_recordData[0]  := 16#00;              // request reference
         s_recordData[1]  := 16#82;              // write request with parity
         s_recordData[2]  := i_doId;             // DO-ID (Control Unit)
         s_recordData[3]  := 16#01;              // number of parameters
         s_recordData[4]  := 16#10;              // attribute = value
         s_recordData[5]  := 16#01;              // number of elements
         s_recordData[6]  := UINT_TO_BYTE(i_paramNumber AND 16#FF);                  // low byte
         s_recordData[7]  := UINT_TO_BYTE(SHR(IN:=i_paramNumber, N:=8) AND 16#FF);     // high byte
         s_recordData[8]  := UINT_TO_BYTE(i_subIndex);                                // subindex
         s_recordData[9]  := 16#00;                                                    // subindex ext.
         s_recordData[10] := DWORD_TO_BYTE(i_valueDWord AND 16#FF);
         s_recordData[11] := DWORD_TO_BYTE(SHR(IN:=DWORD_TO_DWORD(i_valueDWord), N:=8) AND 16#FF);
         s_recordData[12] := DWORD_TO_BYTE(SHR(IN:=DWORD_TO_DWORD(i_valueDWord), N:=16) AND 16#FF);
         s_recordData[13] := DWORD_TO_BYTE(SHR(IN:=DWORD_TO_DWORD(i_valueDWord), N:=24) AND 16#FF);

         s_wrrec(REQ := TRUE, ID := i_hwInterface,
                 INDEX := DWORD_TO_DINT(s_recordIndex),
                 LEN := 14,
                 RECORD := s_recordData);
         s_state := 1;

      1:  // Wait for WRREC done
         s_wrrec(REQ := FALSE);
         IF s_wrrec.DONE THEN
            s_state := 2;
            o_busy := FALSE;
            o_error := FALSE;
         ELSIF s_wrrec.ERROR THEN
            s_state := 99;
            o_busy := FALSE;
            o_error := TRUE;
            o_status := s_wrrec.STATUS;
         END_IF;

      99: // Error / done
         ;
   END_CASE;
END_FUNCTION_BLOCK

Call sequence for a complete teach-and-save cycle:

// 1. Write 0 (or desired home) to p2506[0]
FB_Write(hwIf, slot:=0, param:=2506, sub:=0, value:=0, doId:=1, error=>err1);
// 2. Write 2 to p2507[0] - trigger "use p2525 as target" teach-in
FB_Write(hwIf, slot:=0, param:=2507, sub:=0, value:=2, doId:=1, error=>err2);
// 3. Wait >= 50 ms, then read back p2507[0] - should be 3 (done)
FB_Read (hwIf, slot:=0, param:=2507, sub:=0, value=>status, error=>err3);
// 4. Persist by writing 1 to p0971[0]
FB_Write(hwIf, slot:=0, param:=971, sub:=0, value:=1, doId:=1, error=>err4);
// 5. Wait for p0971 to return to 0 (poll, ~2-5 s for CU320-2)

7. Use the Official Siemens Library FB

Siemens maintains a free Library of Basic Functions (LoBF) for SINAMICS that includes a ready-to-use FB called FB 286 "RAM_to_ROM" and a higher-level FB "Save_SINAMICS_to_NV". The library ships with the entry referenced below and is the field-proven way to perform the operation; the FB internally handles the DPV1 record, the request / response handshake, and the 1-second poll for completion.

The block can be instantiated in TIA Portal V15.1 (or later) on S7-1200 / S7-1500 CPUs that act as a PROFINET IO controller, and it accepts the following inputs:

Reference: SINAMICS Blocks for SIMATIC (Library LoBF for RAM-to-ROM and parameter backup) — Siemens Industry Online Support entry ID 109760317.

8. TIA Portal Commissioning Sequence (Step by Step)

8.1 Prerequisites

• SINAMICS S120 with CU320-2 DP / PN (or CU310-2 PN) running firmware ≥ 4.5 (required for unambiguous DPV1 record semantics on slot 0).
• SIMATIC S7-1200 / S7-1500 PLC with PROFINET IO controller functionality.
• Drive and PLC on the same PROFINET subnet with logical IO device configured (HW identifier of the SINAMICS IO device is required).
• STARTER / Startdrive project is loaded, the drive is in online mode, the encoder is configured as absolute (p0400, p0410, p0411, p0412 set correctly), and the mechanical home position is reachable via jogging.
• The drive must be in "commissioning" or "ready" state (r0002 = 0x31C or higher; check r0002 for "Operation enabled"). Homing in "S4 / S5 commissioning" is allowed; the adjustment routine does not require closed-loop position control to be active.

8.2 Procedure

1. Jog to home: Move the axis with STARTER control panel (or via PLC jog bits) to the mechanical home. Stop the axis; clear any faults via acknowledge (r2138 / bit 3).
2. Open Online > Expert list in Startdrive. Note current r2521 (actual position) and r2520 (position setpoint).
3. Decide the home coordinate: Common choice is 0.0 LU. Write 0.0 to p2506[0] from the expert list — observe that r2521 does not change yet (p2506 is just a target value).
4. Trigger teach-in: Write 2 to p2507[0] from the expert list. Within 20 ms the drive will read the raw encoder, compute p2505 = raw - p2506, and update r2521 = 0.0 LU. p2507 returns to 3 automatically.
5. Verify in Startdrive: r2521 = 0.0 LU, p2505 = (old r2521) - 0.0, r2521 stable with no further changes when the axis is not moving.
6. Cycle power: Remove 24 V from the Control Unit, wait 10 s, restore 24 V. After the next power-up r2521 must still be 0.0 LU. If it reverts to the pre-teach value, p0971 was not run, or the save did not complete before the power was removed.
7. Repeat via PROFINET: Once STARTER-based teach + cycle-power test is good, replace steps 3–5 with the SCL call sequence in §6. Trigger the teach-and-save from a button on the HMI, or automatically after the first valid "Home position reached" condition of the load-side sensor.

8.3 Verification

After the PLC writes p0971 = 1, poll p0971 in a 250 ms loop with a 10 s timeout. Successful completion is indicated by p0971 = 0 (idle) and r3996 = 0 (no pending flash operation). On a CU320-2 the typical save time is 1.5 s; on a CU310-2 it can reach 4 s when the project is large.

Mechanical verification: With the drive in "Operation enabled" (r0002 = 0x31F), perform a controlled axis motion of known magnitude (e.g., 100 mm). Compare r2521 (actual position) to the PLC-side expected position. A discrepancy of more than 1 LU indicates either the gear ratio is wrong (p2503, p2504) or the teach-in was performed in the wrong gear stage.

9. Modulo Axis Considerations

For a modulo axis (p2573 = "Yes"), the teach-in works identically but p2506 must lie inside the modulo range, typically [0, p2577). If the target home is intended to be, for example, 30° on a 360° modulo axis, write p2506 = 30° / 360° × 2^p2576 (where p2576 is the modulo resolution) and then write p2507 = 2.

10. Common Fault Codes and Recovery

11. Edge Cases and Field-Proven Caveats

• Multiturn overflow: A multiturn encoder that physically moves more revolutions than the encoder can count (typically 4096) will wrap, and the value saved to ROM is the encoder's current count, not the original home. This is the most common source of "homing drift after long process runs". Use p0411 to set the multiturn range correctly, or restart the process from the home position periodically.
• Gear ratio changes: p2505 stores the offset in Length Units. If p2503 (load revolutions) or p2504 (motor revolutions) is changed after a teach-in, the home position in LU will still be valid; the underlying raw value is just scaled differently. You do not need to re-teach after a gear-ratio change, but you must re-validate the actual position against a known mechanical reference.
• Two encoders: SINAMICS S120 supports a motor-side and a load-side encoder. The home position is stored separately for each. Confirm p2502 (encoder assignment for position control) matches the encoder you want to teach.
• Save during active motion: p0971 = 1 is allowed while the axis is moving, but it freezes the RAM image of all parameters at the time the write begins. For reproducible homing, do not trigger a save while the drive is dynamically changing position-controller gains (e.g., during auto-tuning).
• CU320-2 DP/PN vs. CU320-2 PN-only: Both expose slot 0 with the same record index mapping. The CU305 (compact) uses a different slot layout — slot 0 is the embedded CU, and the Motor Module is on slot 1, but the record index for p2507 is identical.
• Firmware version compatibility: The DPV1 record structure described in §5 has been stable since firmware 4.5. Older firmware (≤ 4.4) on CU320-2 requires the request ID 0x02 (write without parity) and a slightly different header layout. Always cross-check the SINAMICS List Manual matching your firmware build.

12. Diagnostic State Diagram

13. Comparison: STARTER-based vs. PROFINET-based Homing Persist