TP177B Sinamics CU320-2 P1001 Setpoint Resets to Zero on Enter

Problem Statement

A Simatic TP177B 6" touch panel is configured as a PROFIBUS DPV1 Class-2 master and writes the speed setpoint directly to a Sinamics S120 drive line-up via a CU320-2 Control Unit. The HMI project is built in WinCC Flexible 2008 SP5 and deployed with the panel image that ships with that service pack. The connection is healthy: the operator can read r1078 (smoothed actual speed setpoint) live, and the tag value updates on screen as the user types. The fault appears the instant the operator taps the on-screen ENTER key to confirm a new entry. The drive either

• stops abruptly and latches the setpoint to 0 RPM, or
• flashes to 0 RPM for one or two PROFIBUS cycles and then ramps to the requested value.

The fault is non-deterministic. Three of ten entries succeed, seven fail. No F-class fault is latched, no A-class warning is raised, the drive remains in Operation (ZSW1 bit 3 = 1), and the HMI does not report a connection error. The drive's local BOP20 keypad accepts the same setpoint without any drop, which proves the drive hardware is healthy.

Affected Hardware and Firmware

Confirm that the components in the cabinet match the matrix below before continuing. Earlier and later firmware revisions have different default values for the parameter access filter and the PKW response timing.

If the panel image is below V14.01.01, update first. Earlier images have a known bug where the parameter index (IND) field is transmitted as 0x00FF for non-indexed parameters, and the CU320-2 responds with PWE = 0 for one cycle before the actual value is read back. See the Siemens Industry Online Support entry for the Sinamics S120 CU320-2 operating instructions (entry ID 109744819) for the matrix of compatible HMI images and the recommended drive firmware for each panel image revision.

Communication Path: PROFIBUS DPV1 Class-2 Master

The TP177B communicates with the CU320-2 over PROFIBUS DP using the DPV1 extension. There are two distinct classes of PROFIBUS master:

For a stand-alone TP177B with no S7 between it and the drive, the panel is the only master on the segment and must be configured as Class-2. The Cyclic PZD channel is unused; every parameter exchange is a 16-byte PKW (also called PIV) telegram sent via the DPV1 acyclic read/write service.

PKW Request Layout

Each acyclic parameter access is a 16-byte (8-word) telegram with the following structure:

A typical write of p1001 = 777.0 RPM as a 32-bit IEEE 754 float looks like this on the wire:

Write request (master -> slave):
  PKE  = 0x63E9 | 0x2000 = 0x63E9   // bit 12 set = WRITE
  IND  = 0x0000
  PWE1 = 0x4442                     // 777.0f MSW
  PWE2 = 0x8000                     // 777.0f LSW

Write reply (slave -> master):
  PKE  = 0x23E9                     // 0x2000 = WRITE reply
  IND  = 0x0000
  PWE1 = 0x0000
  PWE2 = 0x0000

Notice the WRITE reply carries PWE1 = 0x0000 and PWE2 = 0x0000. This is the normal write acknowledgement in the Sinamics S120 — the response telegram does not echo the written value. If the WinCC Flexible tag acquisition mode is set to Two-stage, the panel reads the reply and, on the next cycle, sees PWE = 0. This is the moment the value visually "snaps to zero" on the field. Several of the fixes below work by preventing that secondary read from being interpreted as a new setpoint.

Function of Parameter p1001 in the Sinamics S120

Parameter p1001 in the Sinamics S120 is the first of 15 fixed speed setpoints. The active fixed setpoint is selected dynamically by the digital inputs or by BICO bits p1020 through p1023 (binary-coded 0–15), and the setpoint source is gated by p1000 (speed setpoint selection). The relevant parameters are:

Root Cause Analysis

Five independent causes have been observed on production systems. Work through each in the order presented; the first is the most common, the last is the rarest.

Cause 1: Two-stage value entry in WinCC Flexible

The default Value input/output field in WinCC Flexible 2008 uses a two-stage acquisition mode. The panel first issues a PKW READ against p1001, displays the returned value in the field, and only writes the operator's new value when ENTER is pressed. Because the WRITE reply from the CU320-2 contains PWE = 0 (per the telegram layout above), the panel's post-write refresh reads back p1001 = 0 and latches that into the tag. On a 12 Mbit/s PROFIBUS segment the read-modify-write-read sequence takes 4–6 DP cycles (≈ 6–10 ms), which is faster than the Sinamics' parameter-update cycle (typically 16 ms on a CU320-2). Intermittence comes from the read-modify-write and the parameter-store timing racing each other.

Cause 2: Parameter access level (p0003) too low

The Sinamics access filter is set by p0003:

If p0003 = 0, an acyclic write to p1001 is rejected with a negative PKW response. The HMI is not informed of the rejection in any way that affects the displayed field, and the drive's setpoint remains at whatever it was previously — which is the previous fixed setpoint or, if no selection bits are asserted, the ramped value of 0. The intermittent "sometimes it ramps" behaviour is explained by the operator occasionally pressing ENTER while p0003 is momentarily at 1 (for example, while the drive is in commissioning mode).

Cause 3: Tag data type mismatch

p1001 is a 32-bit IEEE 754 floating-point parameter. If the WinCC Flexible tag is configured with Data type = Int or Word, the panel truncates the value to 16 bits. For small values (0–32 767) this works, but the WRITE reply (always zero) is interpreted as a 16-bit 0 and latched. For values above 32 767 the truncation introduces a 0x8000 high bit, which the drive's BICO chain reads back as 0 after the integer-to-float conversion in the parameter store.

Cause 4: Drive state transition during the write

If the drive is in Switch-on inhibited (ZSW1 bit 0 = 0) or in a fast-stop ramp (OFF3 active), the ramp-function generator input is forced to 0. The PKW write succeeds and the new value is stored, but the displayed actual setpoint drops to 0 because the RFG is held at the OFF3 target. The drive then re-enters Operation and ramps to the new value, producing the "flashes to 0 and recovers" symptom. Check the state word in ZSW1:

Cause 5: Setpoint source (p1000) is not fixed setpoint

If p1000 ≠ 3, the active setpoint is sourced from analog input 1 (p1000 = 2), motor potentiometer (p1000 = 1), or a free BICO interconnection (p1000 = 0 or 6). Writing to p1001 is harmless but has no effect. The drive idles at 0 RPM because no selection bits are asserted and the fixed setpoint is the only thing the operator believes they are driving. This is the silent failure mode — no error, no warning, just zero.

Step-by-Step Diagnostic Procedure

Run this checklist before applying any of the fixes below. It localises the failure to one of the five causes and prevents wasted configuration effort.

1. Confirm the drive state. Open STARTER online and read r0002 (drive state) and ZSW1. If the drive is not in Operation (r0002 = 8), the RFG input is forced to 0 — go to Cause 4.
2. Confirm the setpoint source. Read p1000. If it is not 3, go to Cause 5 and either change the HMI strategy to write to the correct parameter or rewire the setpoint source.
3. Confirm the access level. Read p0003. If it is 0, the HMI is writing to a parameter that the drive will not accept — go to Cause 2 and raise the level on a temporary basis (set p0003 = 3, attempt the write, then restore).
4. Confirm the tag data type. In WinCC Flexible, open the tag properties of the tag bound to p1001. Verify Data type = Real (32-bit). If it is Int, Word, or DInt, go to Cause 3.
5. Confirm the tag acquisition mode. In WinCC Flexible, open the Value input/output field properties. Verify Acquisition mode = Continuous or On command (one-stage), not Two-stage. If two-stage, go to Cause 1.
6. Capture a PROFIBUS trace. Use a PROFIBUS analyser (for example, Softing PROFIbus Diagnoser or Inatech) on the segment. Look for PKW telegrams with IND = 0x00FF, missing toggle bits, or duplicate WRITE requests within one bus cycle. These are panel-image firmware defects; the cure is an image update (see Affected Hardware and Firmware above).
7. Bypass the HMI. From STARTER, write a new value to p1001 directly using the Write parameter button. If the drive responds correctly, the HMI write path is the only fault. If the drive also drops to 0, the fault is drive-side and the TP177B is innocent — suspect p1000 / p1020…p1023 misconfiguration or a BICO loop.

Fix A: Tag Acquisition Mode and Value Range

This is the highest-yield fix. In WinCC Flexible 2008 SP5:

1. Open the HMI project, navigate to the screen containing the setpoint field, and double-click the Value input/output field to open its properties.
2. On the General tab, set Mode = Input (not Input/Output — the Output half causes a cyclic readback that latches the WRITE-reply zero).
3. On the Limits tab, set the lower limit to the drive's minimum speed (for example, -21 000.0 RPM) and the upper limit to the drive's maximum (for example, 21 000.0 RPM). The default of 0 to 10 000 silently clamps negative or excessive values to 0.
4. On the Text / Format tab, set Display format = 999 999.9 and Data format = Real (32-bit IEEE 754).
5. For the underlying tag (Project → Tags → …), set Data type = Real, Length = 4 bytes, and Acquisition mode = On command. Acquire the value with a button that calls UpdateTag("HMI_Tag_p1001") immediately before the write, not cyclically.
6. Rebuild the project, transfer to the panel, and power-cycle the TP177B.

Fix B: Two-stage Write with Staging Word

For installations where the operator must explicitly confirm the new value (regulatory or process-safety reasons), the two-stage entry cannot be removed. In that case, route the write through a staging tag to absorb the WRITE-reply zero:

1. Create a new internal tag HMI_Staging_p1001 (Real, 4 bytes) in the HMI project.
2. Bind the on-screen Value input field to HMI_Staging_p1001. The field is read/write on the panel memory only; no PROFIBUS traffic is generated.
3. Place a separate Button on the screen labelled Send. The Press event uses the function SetValue("Drive_p1001", HMI_Staging_p1001).
4. Use SetValue with the On change acquisition mode on the destination tag so that the WRITE is dispatched exactly once. The function is in the WinCC Flexible function library at System Functions → Tags → SetValue.
5. Optional: add a second Output field bound to Drive_p1001 (read with Cyclic continuous acquisition at 2 s) so the operator can see the actual drive value without contaminating the input field.

The staging tag decouples the on-panel memory from the PROFIBUS round trip. The WRITE reply (PWE = 0) is consumed by the staging function and never written back to the displayed field.

Fix C: Raise the Parameter Access Level (p0003)

1. Connect to the CU320-2 with STARTER / Scout.
2. Read p0003. If it is 0, change to 3 (Expert) for the duration of the commissioning session.
3. Attempt the HMI write. If it succeeds, the access level was the issue.
4. Permanently raise the level by either (a) writing p0003 = 3 from the project / HMI and saving with STARTER ("Copy RAM to ROM"), or (b) moving the write to a parameter that is exposed at user level (for example, the analog-input-scaled value at p0750…p0757).

Fix D: Switch from Acyclic PKW to Cyclic PZD

If the panel is the only master on the segment and no Class-1 PZD traffic exists, it is wasteful to use the slow acyclic PKW path for the setpoint. The clean engineering solution is to dedicate a PZD word to the setpoint and write it cyclically from the panel. This requires WinCC Flexible 2008 SP3 or later and a panel image that supports the PZD area on the connection:

1. In the HMI connection (Connection → Properties), confirm that the Area pointer for PZD checkbox is set and that the default PZD length is 2 PZDs in / 2 PZDs out (matches the standard Sinamics S120 default mapping for STW1/NSOLL/ZSW1/NIST).
2. In the drive's PROFIBUS configuration (STARTER → Configuration → PROFIBUS message frame), set the message frame to Standard telegram 1 (STW1 + NSOLL + ZSW1 + NIST, 4 words each direction).
3. On the TP177B, create two raw-word tags, one for NSOLL and one for ZSW1. Bind the input field to NSOLL with Mode = Output only — do not read it back through PKW. The HMI's PLC-style tag memory is byte-swapped relative to the drive; check the byte order with a known reference value (for example, 1500.0 RPM = 0x453B8000) and apply a swap-word or swap-dword tag function if necessary.
4. For values outside 0–32 767, the 16-bit NSOLL word is insufficient. Use telegram 3 or 5 (32-bit NSOLL, often labelled NSOLL_B) and bind a 32-bit tag. NSOLL_B is parameter r2050[1] from the controller's perspective and p1155[1] from the drive's perspective. See the Sinamics S120 List Manual for the active setpoint-source BICO chain.

Cyclic PZD writes bypass the PKW channel entirely. The setpoint is delivered to the drive every 4–8 ms (default PROFIBUS cycle time for a single slave) and the WRITE-reply-zero problem cannot occur because there is no write reply.

Fix E: BICO Re-interconnection of the Setpoint

If the drive is correctly configured with p1000 = 2 (analog setpoint) and the operator needs to drive a fixed setpoint, the BICO chain can be rewired to use a parameter as the analog-setpoint source. The flow is:

Analog input 1 (AI1, r0752.0)
   --> p0755 (scaling)
   --> p1070[0] (main setpoint)         <-- this is the choke point
   --> p1075 (additional setpoint)
   --> r1078 (smoothed actual setpoint)
   --> p1110 (RFG input)

By writing the operator's value to p1070[0] (an indexed parameter, IND = 0), the HMI's PKW write can be made race-free. p1070[0] is a BICO source — it accepts a connector number. The standard pattern is to interconnect a free connector (for example, CCONT) and drive that connector from a custom parameter that the HMI writes. For most panels this is over-engineered; it is included for completeness.

Verification

1. With the HMI online, type a value of 1234.5 RPM and press ENTER.
2. Verify on the TP177B that the field shows 1234.5 (not 0) immediately after ENTER.
3. In STARTER online, expand Drive → Setpoint channel → Speed setpoint and confirm r1078 = 1234.5 within 200 ms.
4. Read p1001 directly in STARTER. It must equal 1234.5.
5. Repeat the test ten times. All ten entries must succeed without an intermediate drop to 0.
6. Capture a PROFIBUS trace for one entry. The trace must show: exactly one WRITE request to p1001, exactly one WRITE reply, and no follow-up READ that returns PWE = 0. The presence of a follow-up READ with PWE = 0 indicates that the staging fix is incomplete.
7. Check ZSW1 bits 1, 2, 4, 5 in the trace. None may transition to 0 during the write.
8. Run a soak test: 100 entries in 10 minutes, monitoring r0021 (smoothed actual speed value) for any excursion below 50 RPM. Zero excursions are required.

Reference Parameter Table

Best Practices for HMI-to-Sinamics Setpoint Writes

• Match the tag data type to the parameter type. Sinamics p-parameters that carry engineering units are almost always 32-bit IEEE 754 floats. Use a Real tag, not Int.
• Decouple input field and readback display. Use an Input-only field for the operator's entry and a separate Output-only field for the drive's echo. Never bind both halves of the same field to the same PROFIBUS tag.
• Prefer cyclic PZD for closed-loop setpoints and acyclic PKW for setup parameters. PZD is faster, deterministic, and immune to the WRITE-reply-zero problem. Reserve PKW for commissioning, configuration, and read-only diagnostics.
• Always confirm p0003 ≥ 1 on the drive before HMI writes are expected to succeed. A drive that has been freshly commissioned or has been reset to factory defaults often returns to p0003 = 0.
• Verify p1000 in the drive configuration. The most common reason an HMI-driven p1001 write has no effect is that p1000 is not 3. Document p1000 in the project commissioning sheet.
• Lock the panel image version. Document the exact panel image (for example, V14.01.01) in the project so a future update cannot regress the PKW handling. Archive the image binary in the project documentation.
• Capture a PROFIBUS trace at commissioning. A 10-second trace showing one successful setpoint change is the baseline for diagnosing any future intermittent behaviour.
• Use BOP20 as the reference path. Any setpoint change that succeeds on BOP20 and fails on HMI is by definition an HMI-side issue, not a drive-side issue. The reverse is also useful — drive-side faults manifest on both paths.