Writing Sinamics S110 Parameters on PROFINET with S7-1200

David Krause13 min read
Industrial NetworkingSiemensTutorial / How-to
Licensed PE Working through this on a live machine? A Maine-licensed engineer can take it from here — included with IMD hardware, by the hour for everything else. Book an engineer

Writing Sinamics S110 Parameters on PROFINET with S7-1200

Overview

The Sinamics S110 is a single-axis servo drive with an integrated PROFINET interface. When controlled by a SIMATIC S7-1200 (for example CPU 1214C DC/DC/DC or DC/DC/Rly), there are two valid ways to read or write drive parameters across PROFINET:

  1. Siemens SINAMICS DriveLib for S7-1200 / S7-1500 — a function block library (FB284 / FB285 / FB286) that encapsulates the acyclic PROFIdrive parameter channel.
  2. Native WRREC / RDREC — the standard S7-1200 record-write/read system blocks, used directly against the drive's parameter channel slot.

This reference covers both paths. It explains the PROFIdrive parameter request/response structure, telegram selection, the role of DriveLib FB286 for parameter access, the dedicated FBs for closed-loop speed (FB285) and basic positioner (FB284) operation, and how to build a fallback solution with WRREC/RDREC when the library cannot be installed.

Prerequisites

Item Requirement
S7-1200 CPU Firmware 4.0 or higher recommended (FW 4.2+ for DriveLib compatibility), e.g. CPU 1214C DC/DC/DC 6ES7214-1AG40-0XB0
Sinamics S110 PN CU305 PN, FW 4.4 / 4.5 / 4.7 / 5.1 (PROFINET variant with X150 port)
TIA Portal V13 SP1 or higher; V15.1 / V16 / V17 for current firmware
Sinamics commissioning tool SINAMICS STARTER or StartDrive (TIA Portal)
PROFINET topology CPU and S110 in same subnet, device name assigned, GSD file GSDML-V2.31-Siemens-Sinamics-S110-20101214.xml (or later) installed
Siemens support account Required to download the DriveLib from the Siemens Industry Online Support portal (free registration)
Note: The DriveLib for S7-1200/1500 is published as entry ID 68034568 on the Siemens Industry Online Support. It must be downloaded with a registered account. Anonymous downloads are not provided.

PROFINET Communication Architecture

The S7-1200 and the S110 exchange two traffic classes over PROFINET:

  • Cyclic process data — control words, status words, setpoints, actual values. Transported in the configured standard telegram (1, 2, 3, 5, 7, 9, 110, or 111).
  • Acyclic record data — used by the DriveLib FBs and by WRREC/RDREC to read/write individual drive parameters. This is the PROFIdrive parameter channel.
S7-1200 CPU 1214C User program (FB284/285/286) PROFINET interface (PN-IO) System blocks: WRREC/RDREC IP / device name: s71200-pn Sinamics S110 CU305 PN Drive object (DO1) Servo Standard telegram (1/2/5/...) Parameter channel (acyclic) IP / device name: s110-pn PROFINET Cyclic: real-time (RT) Acyclic: record (RW) - parameter channel

Telegram Selection for the S110

The telegram determines which cyclic PZDs (process data words) are mapped. With a 1214C the typical choices for a single-axis S110 are:

Telegram PZD count Content Typical use
1 2/2 STW1/ZSW1 + NSOLL/AIST Speed control (FB285)
2 4/4 STW1/ZSW1 + NSOLL/AIST + additional Speed control with torque limit
3 5/9 STW1/ZSW1 + NSOLL/AIST + MIST + … Speed + torque reduce
5 9/9 STW1/ZSW1 + NSOLL/AIST + XIST1 + MIST + … Positioning with EPos basic
7 2/2 STW1/ZSW1 + torque setpoint Torque control
9 10/10 STW1/ZSW1 + NSOLL/AIST + XERR + KPC + XIST1 + XIST2 + MIST Positioning via FB284 in conjunction with positioning telegram
110 4/4 STW1/ZSW1 + NSOLL/AIST + M_LIM/MIST Speed control with torque limit
111 12/12 EPos telegrams: MDI / pos setpoint + actual position Basic positioner (FB284)

Configure the telegram in TIA Portal under Device view → S110 PN → Properties → Module parameters or in StartDrive under the drive device configuration. Both ends must use the same telegram number; mismatch causes a PROFINET alarm ("Telegram configuration error").

Method 1 — DriveLib FB284 / FB285 / FB286

After installing the SINAMICS DriveLib for S7-1200/1500, three function blocks become available under Libraries → SINAMICS S120 DriveLib in TIA Portal:

Block Purpose Used with telegram
FB285 "SINA_SPEED" Open-loop / closed-loop speed control of a Sinamics drive 1, 2, 3, 110
FB284 "SINA_POS" Basic positioner (EPos) with MDI or traversing block mode 111 (or 9 with external encoder evaluation)
FB286 "SINA_PARA" Acyclic read/write of any S110 / S120 parameter Any (acyclic only — no cyclic data needed)

FB286 — SINA_PARA — parameter access

FB286 is the dedicated function block for the task in the original question: writing (or reading) any S110 parameter through PROFINET. It encapsulates the PROFIdrive parameter channel and handles the request/response handshake automatically.

Standard input / output interface of SINA_PARA (FB286):

I/O Name Type Description
Input Enable BOOL Start of the request on positive edge
Input ReqWrite BOOL FALSE = read parameter, TRUE = write parameter
Input Parameter DINT Parameter number, e.g. 1120 for p1120 ramp-up time
Input Index INT Parameter index (0…255) for indexed parameters
Input ValueReal REAL Value to write (when ReqWrite=TRUE)
Input AxisNo INT Drive object number; for S110 typically 1 (DO1)
Input HW_IDSTW_ZSW HW_IO Hardware identifier of control/status word telegram
Input HW_ID telegram extension HW_IO Optional; required only when using the 6-word extension (telegrams 6/106/116)
Input ErrorAck BOOL Acknowledge pending error
Output Done BOOL Request completed without error
Output Busy BOOL Request in progress
Output Error BOOL Error present
Output Status DWORD Status / error code (16#0000 on success)
Output ValueReal REAL Value read back (when ReqWrite=FALSE)

Typical call structure in SCL:

// SINA_PARA (FB286) — write p1120 (ramp-up time) = 4.0 s to S110
IF bWrite_RampUp THEN
    SINA_PARA_DB.Enable       := TRUE;
    SINA_PARA_DB.ReqWrite     := TRUE;
    SINA_PARA_DB.Parameter    := 1120;        // p1120 ramp-up time
    SINA_PARA_DB.Index        := 0;           // no index
    SINA_PARA_DB.ValueReal    := 4.0;
    SINA_PARA_DB.AxisNo       := 1;           // DO1 of S110
    SINA_PARA_DB.HW_IDSTW_ZSW := hwTelegram1; // from PLC variable table
    SINA_PARA_DB.ErrorAck     := FALSE;
    bWrite_RampUp := FALSE;
END_IF;

// Read p1082 (max speed) on demand
IF bRead_MaxSpeed THEN
    SINA_PARA_DB.Enable       := TRUE;
    SINA_PARA_DB.ReqWrite     := FALSE;
    SINA_PARA_DB.Parameter    := 1082;
    SINA_PARA_DB.Index        := 0;
    SINA_PARA_DB.ValueReal    := 0.0;          // ignored on read
    SINA_PARA_DB.AxisNo       := 1;
    SINA_PARA_DB.HW_IDSTW_ZSW := hwTelegram1;
    bRead_MaxSpeed := FALSE;
END_IF;
HW_ID: The hardware identifier of the S110 telegram must be read from the PLC variable table that TIA Portal generates automatically. For an S110 with telegram 1 it is found under PLC tags → Constant → Telegram_1_Standard. The identifier is the symbolic name or the absolute HW_IO number of that PZD module.

FB285 — SINA_SPEED — speed axis operation

Use FB285 when the S110 is operated as a pure speed axis. The block provides ramp generator, enable logic, and a complete set of input / output signals. Telegram 1, 2, or 110 is required. Typical SCL call:

SINA_SPEED_DB(
    EnableAxis     := bEnableAxis,
    SpeedSetpoint  := rSpeedRef,        // RPM
    AxisNo         := 1,                // DO1
    HW_IDSTW_ZSW   := hwTelegram1,
    HW_IDNSOLL_AIST:= hwTelegram1,
    Enable         := bDriveEnable,
    AckError       := bAck
);

FB284 — SINA_POS — basic positioner

Use FB284 when the S110 runs the integrated basic positioner (EPos) and you need to trigger MDI blocks or traversing blocks from the S7-1200. Telegram 111 is the standard choice. Output signals cover position setpoint, velocity override, mode selection, and jogging. Detailed signal mapping is given in the DriveLib documentation.

Method 2 — Native WRREC / RDREC (PROFIdrive parameter channel)

If DriveLib cannot be installed, or if the S7-1200 firmware is older than required, the same functionality is achievable with the standard record-write/read system blocks. The PROFIdrive parameter channel is located on slot 0 / sub-slot 1 of the drive; each drive object has its own parameter access point.

PROFIdrive parameter request (write)

Byte offset Field Value (write p1120 = 4.0) Note
0 Request reference 01 hex Unique per request, mirrored in reply
1 Request ID 01 hex (write) / 02 hex (read) —
2 Axis (DO) 01 hex 01 hex = DO1 (Servo)
3 Number of parameters 01 hex One parameter per request
4 Attribute 10 hex 10 hex = value, 20 hex = description, 30 hex = text
5 Number of elements 01 hex —
6 Parameter number (high) 04 hex p1120 = 0x0460
7 Parameter number (low) 60 hex
8 Subindex 00 hex —
9 Reserved 00 hex —
10 Format 41 hex 41 hex = FLOAT4 (IEEE-754)
11 Number of values 01 hex One value follows
12-15 Value 80 00 00 00 hex 4.0 in IEEE-754 single precision

S7-1200 sample — WRREC write of p1120

// Build 16-byte request buffer
myWriteRequest[0]  := 16#01;  // request reference
myWriteRequest[1]  := 16#01;  // request ID  = write parameter
myWriteRequest[2]  := 16#01;  // axis = DO1
myWriteRequest[3]  := 16#01;  // 1 parameter
myWriteRequest[4]  := 16#10;  // attribute = value
myWriteRequest[5]  := 16#01;  // number of elements
myWriteRequest[6]  := 16#04;  // p1120 high
myWriteRequest[7]  := 16#60;  // p1120 low
myWriteRequest[8]  := 16#00;  // subindex
myWriteRequest[9]  := 16#00;  // reserved
myWriteRequest[10] := 16#41;  // format = IEEE-754 float
myWriteRequest[11] := 16#01;  // 1 value
myWriteRequest[12] := 16#80;  // 4.0 in IEEE-754 little-endian
myWriteRequest[13] := 16#00;
myWriteRequest[14] := 16#00;
myWriteRequest[15] := 16#00;

// Trigger the write
WRREC_DB(REQ      := bWriteStart,
        ID       := hwTelegram1,
        INDEX    := 47,         // 16#2F = parameter access slot
        LEN      := 16,
        DATA     := myWriteRequest,
        DONE     => bWriteDone,
        BUSY     => bWriteBusy,
        ERROR    => bWriteError,
        STATUS   => wWriteStatus);
Index 47 (16#002F): In PROFIdrive the parameter channel index is decimal 47 on slot 0 of the drive. On the S110, slot 0 sub-slot 1 is the DAP; the parameter access record is the standard PROFIdrive record (RPAL/RPAQ). Some firmware revisions use slot 0 sub-slot 0 with the same index; verify with the S110 firmware help (press F1 on the parameter in STARTER / StartDrive).

S7-1200 sample — RDREC read of p1082

// 8-byte read request (header only)
myReadReq[0] := 16#02;  // reference
myReadReq[1] := 16#02;  // request ID = read
myReadReq[2] := 16#01;  // axis = DO1
myReadReq[3] := 16#01;  // 1 parameter
myReadReq[4] := 16#10;  // attribute = value
myReadReq[5] := 16#01;  // 1 element
myReadReq[6] := 16#04;  // p1082 high
myReadReq[7] := 16#3A;  // p1082 low (0x043A)

RDREC_DB(REQ      := bReadStart,
        ID       := hwTelegram1,
        INDEX    := 47,
        MLEN     := 32,
        DATA     := myReadResp,
        VALID    => bReadValid,
        BUSY     => bReadBusy,
        ERROR    => bReadError,
        STATUS   => wReadStatus,
        LEN      => iReadLen);

After a positive read, bytes 10-13 of myReadResp contain the parameter value as IEEE-754 single precision. Swap bytes from big-endian (PROFIdrive) to little-endian (S7-1200) before assigning to a REAL tag.

Procedure — Step-by-step with DriveLib

  1. Register on the Siemens Industry Online Support portal and download entry 68034568 ("SINAMICS S120/S110 DriveLib for S7-1200/1500").
  2. Open TIA Portal and switch to the project view. Choose Options → Global libraries → Open library and select the unzipped DriveLib file.
  3. Add the S110 PN device to the project (right-click Devices & networks → Add new device → Drives → Sinamics S110). Assign a PROFINET device name (e.g. s110-pn) and IP address.
  4. Configure the standard telegram. Click the S110 device and under Module parameters → Telegram configuration insert the required telegram (1, 2, 5, 110, 111…). TIA Portal automatically generates the matching PLC tag DB and the HW_IO constant.
  5. Open the PLC program block. From the global library drag SINA_PARA_DB (data block) and SINA_PARA (FB286) into the project. Repeat for SINA_SPEED (FB285) and SINA_POS (FB284) as required.
  6. Wire the HW_IDSTW_ZSW input of FB286 to the hardware identifier of the PZD slot created in step 4 (use the constant from the PLC tags table).
  7. Compile the project and download to the CPU 1214C.
  8. Establish the PROFINET connection (assign device name → S110 cycles up → green PROFINET LED on both ends).
  9. Test with a known parameter such as p1120 (ramp-up time) or p1082 (maximum speed). Trigger Enable on FB286 and confirm Done=TRUE, Status=16#0000.
  10. Read the parameter back in the same way with ReqWrite=FALSE and verify the value matches what was written. Persist with p0971 = 1 if the value must survive a power-off (see note below).
Persistence (RAM → ROM): Parameters written through the acyclic channel are stored in volatile RAM of the S110. To save them non-volatilely, write p0971 = 1 after the last change (or use STARTER / StartDrive's "Copy RAM to ROM"). The S110 will then write its parameter set to the CF card / non-volatile memory. Allow approximately 3-6 s for the save operation to complete; DO1 reports a write activity on the display.

Verification

Check Expected result How to verify
PROFINET link Green link LED on S110 and S7-1200 port Physical inspection, TIA Portal "Online & diagnostics → PROFINET diagnostics"
Device name s110-pn visible in TIA topology Accessible nodes scan, "Assign PROFINET device name" tool
Cyclic data ZSW1 bit 0 (ramp-up complete) toggling Monitor STW1 / ZSW1 with watch table or online trace
FB286 write Done=TRUE, Status=16#0000 Watch FB286 output tags online
Read-back value Equals written value Issue a second FB286 read with ReqWrite=FALSE
Parameter persisted Value still present after power cycle Power off, restart, read parameter again
STARTER / StartDrive consistency Same value visible in online mode Connect STARTER in parallel, navigate to the same parameter

Troubleshooting Matrix

Symptom Likely cause Remedy
FB286 Status = 16#80B1 HW_ID does not point to the S110 PZD slot Open PLC tags, locate the correct HW_IO for the configured telegram, re-link
FB286 Status = 16#80C3 / 16#80C5 No PROFINET connection or device name mismatch Assign PROFINET device name to the S110; verify the S110 is in the same subnet
Status = 16#DF80 Parameter is read-only or not present on S110 Check parameter list in the S110 List Manual; verify FW version
Status = 16#DF01 / 16#DF02 Format mismatch (writing INT to a FLOAT parameter) Use format 16#41 (FLOAT4) for floating-point parameters; check parameter documentation
WRREC / RDREC STATUS = 16#80A2 Slot/index not supported Use the correct PROFIdrive parameter channel index (47 decimal = 16#2F)
WRREC STATUS = 16#80AB Len > max record length Reduce buffer to 16 bytes for single-parameter write, 8 bytes for read
Value reverts after power cycle Parameter written to RAM only Write p0971 = 1 (or use STARTER "Copy RAM to ROM")
Done stays FALSE PROFINET watchdog or telegram mismatch Verify both ends use the same telegram number; check watchdog time (default 3 ms is acceptable for S110)
Drive not appearing in topology GSD file missing or wrong version Install the latest GSDML for the S110 from the Siemens support site and re-import device

Special Notes for the S110

  • The S110 has exactly one Drive Object (DO1 = Servo). All parameters numbered p0001 to r9999 are addressed with axis/DO = 1.
  • The S110 is firmware-bound to PROFINET RT. PROFINET IRT is not supported; cyclic update times down to 1 ms are available.
  • Basic safety functions (STO over PROFINET, PROFIsafe) require a Safety Integrated firmware option and telegram 30 / 31 / 901 / 902.
  • The acyclic parameter channel can carry one or two parameters per record (16#01 / 16#02 in the "number of parameters" field). For batch writes build the request up to 240 bytes total.
  • Some parameters are read-only (r… instead of p…). The drive returns error 0xDF80 in the response. Always cross-check in the S110 List Manual (entry ID 109739545).

Related Documents

FAQ

Which Siemens library contains the function blocks FB284, FB285, and FB286?

All three are part of the SINAMICS S120/S110 DriveLib for S7-1200/1500, published as support entry 68034568. A free Siemens Industry Online Support registration is required to download it. Once installed, the blocks appear in the TIA Portal global library under "SINAMICS S120 DriveLib".

Can I write S110 parameters from a S7-1200 without the DriveLib library?

Yes. The PROFIdrive parameter channel is acyclic record data, so the standard S7-1200 system blocks WRREC (write) and RDREC (read) can be used directly against the S110 with hardware identifier of the PZD slot and record index 47 (16#2F). You must build the 16-byte parameter request header yourself.

Why does my parameter value disappear after the S110 is powered off?

Because parameter writes over the acyclic channel are stored in volatile RAM. To persist them, write p0971 = 1 (save parameter set to non-volatile memory), or use the STARTER / StartDrive "Copy RAM to ROM" function. The save operation takes 3-6 s to complete.

Which telegram should I select for FB286 acyclic parameter access?

FB286 works with any telegram; it does not use the cyclic payload. However, the HW_IDSTW_ZSW input must point to a valid PZD slot configured on the S110. For most S110 applications this is telegram 1 (speed), 2, 3, 5, 110, or 111 (basic positioner). Telegram 111 is used together with FB284.

What does the FB286 status code 16#DF80 mean?

It is the PROFIdrive error code meaning "parameter is read-only / access denied". The parameter is either an r-parameter, requires a specific access level, or is not present on the S110 firmware version. Verify the parameter number in the S110 List Manual (entry 109739545) and confirm the drive is in the correct operating state (e.g. some parameters are write-protected while the drive is running).

Back to blog