Writing Start Values to S7-1200 TM Encoders via WRREC Record 128

Problem Overview: WRREC Start Value Write Fails on TM PosInput SSI

When an SSI absolute encoder is wired to a SIMATIC TM PosInput 1 or TM PosInput 2 module and the application attempts to call the WRREC (Write Record) instruction with data record 128 to assign a digital input function that writes a new "start value" to the encoder, the call returns a non-zero STATUS word. Common error codes observed in the field include:

• STATUS = 16#80B1 – Length of the record to be written is wrong
• STATUS = 16#80B5 – TM module is not configured / parameterized
• STATUS = 16#80B6 – Access denied (write protection active, or HWID invalid)
• STATUS = 16#80B9 – Feature not supported (DI function not allowed in SSI mode)
• STATUS = 16#80BA – Invalid parameter (record validation mask rejected the payload)
• STATUS = 16#DF80B400 – Firmware-internal error in the lower-level component

The encoder's position continues to read the raw singleturn / multiturn value reported by the SSI interface. There is no runtime "Set" or "Preset" capability exposed through the TM PosInput for absolute encoders. The TIA Portal inspector / parameter editor only offers two choices for the hardware DIs on an SSI configuration: No function and Capture. The Set Reference Point DI function visible for incremental encoder configurations is intentionally hidden when the operating mode is set to "SSI".

Hardware Identification: TM PosInput 1 vs TM PosInput 2

Confirm the exact module variant before applying any of the procedures below. Siemens ships two functionally similar but firmware-different modules that can both read SSI signals and are commonly confused in the field:

Locate the part number on the front label of the module (top right of the housing, white sticker). The MLFB is required to map to the correct parameter record layout in the WRREC payload. TM PosInput 1 with firmware V1.0 does not support all data records described in the TM PosInput 2 manual; if records 128, 130, 131 are not accepted, upgrade to TM PosInput 2 with at least firmware V1.1. Refer to the SIMATIC S7-1200 Programmable Controller System Manual and the TM PosInput 2 device manual for the authoritative record layout.

Root Cause: SSI Encoders Do Not Accept Runtime Start Value Writes

Three independent layers of the system are at play, and any of them alone is enough to block the write:

1. Encoder layer (SSI protocol): The standard SSI (Synchronous Serial Interface) protocol defined in the SSI specification is a one-way master-to-slave clock signal driving a fixed-length data frame (typically 13, 25, or 26 bits) from the encoder to the master. The protocol carries the absolute position, an optional status bit, and nothing else. There is no command frame defined by the standard that would let the master "store" a new mechanical zero into the encoder's internal non-volatile memory. Some manufacturers (SICK, Kübler, Hengstler, IFM, Balluff) provide a proprietary PRESET or TEACH function accessible only through the encoder's own configuration port (RS232 / RS485 / IO-Link / service tool), not through SSI.
2. TM PosInput firmware layer: The TM PosInput 2 firmware implements a parameter record layout where data record 128 is the "Operation" record controlling the module's two DI function assignments. Even when a custom application forces a write to record 128, the firmware only honors the assignment if the configured operating mode is Incremental. With operating mode = SSI, the DI function table is collapsed to {0 = No function, 1 = Capture} and the Set Reference Point / Preset bit is permanently zero in the record validation mask. This is the source of the 80BA "Invalid parameter" return code.
3. TIA Portal parameter editor layer: The TIA Portal device configuration hides the Set Reference Point DI function whenever SSI is selected. The intent is to prevent users from misconfiguring the module and silently writing to an encoder that cannot honor the command. The feature is intentionally not exposed.

Combined, these three layers make the WRREC approach to writing a start value to an SSI encoder on a TM PosInput module impossible. The workarounds below are the supported alternatives.

Data Record 128 Structure and TM Parameter Assignment

For users who still need to understand the record layout (for diagnostic reads, or for incremental encoder applications where the Set function does work), data record 128 (0x80) of the TM PosInput 2 follows this high-level layout. Bytes are zero-indexed. The record length is firmware-dependent; TM PosInput 2 firmware V1.1 expects 32 bytes for DS 128. Always issue an RDREC first to confirm the current payload before WRREC.

Reading DS 128 with RDREC always returns the current parameterized state. Writing it is only successful when OperatingMode = 0 (Incremental) and the user supplies a valid combination of DI functions. With OperatingMode = 1 (SSI), the firmware's record validation mask returns STATUS = 16#80BA and writes nothing. The WRREC instruction help in TIA Portal documents the general record-write call contract; the device-specific rejection logic lives in the module's firmware.

WRREC Error Code Mapping

The WRREC STATUS word is laid out per PROFINET / PROFIdrive conventions. Codes prefixed with DF are module-internal errors returned to the CPU via the standard PROFINET error channel. The full list is documented in the S7-1200 system manual; the table below is filtered to what is relevant to TM PosInput parameter writes.

Solution 1: Software Offset Method (Recommended)

This is the standard Siemens-approved pattern for situations where the absolute encoder cannot be physically re-zeroed. The principle: read the encoder position, capture a known mechanical reference once at commissioning, and apply a fixed offset in the application so that the displayed position is the desired engineering value (e.g. 0 mm at the bottom of a lift, or 500.0 mm at a wire-change height). The encoder's own absolute value is left untouched.

Steps for a wire-change / recipe-change application (the exact scenario from the source thread):

1. Mechanically move the axis to a known reference position. Mark this point in the mechanical drawing – it is the only position where the offset is defined.
2. Read the raw encoder value at that position. For TM PosInput 2 with optimized block access the tag is exposed as "TM_PosInput_DB".ActualValue (LREAL or DINT depending on the device configuration). For TM PosInput 1 the tag is "TM_PosInput_DB".IO_Position (DINT).
3. Compute the offset: Offset := DesiredValue - iRaw. For TM PosInput 2 use LREAL arithmetic to avoid precision loss on long-stroke axes.
4. Store the offset in a retentive tag (set the Retain attribute on the data block) so it survives a power cycle / CPU STOP-RUN transition.
5. In the application program, compute the engineering value on every scan: iEngineering := ActualValue + Offset.
6. Trigger the capture in software on a DI0 / DI1 edge if you need a high-precision homing event. The DI's hardware Capture function latches the position to a separate tag ("TM_PosInput_DB".CaptureValue) without overwriting the absolute counter.

SCL implementation example (TIA Portal V16+, S7-1200 CPU 1215C DC/DC/DC with TM PosInput 2, SSI 25-bit multiturn). Drop this FB into a Program block and call it once per encoder channel from OB1 or a cyclic interrupt OB:

FUNCTION_BLOCK "FB_AbsEncoderOffset"
{ S7_Optimized_Access := 'TRUE' }
VERSION : 0.1
VAR_INPUT
  iRawPosition : REAL;     // From TM PosInput 2 IO-tag ActualValue
  iSetOffset   : BOOL;     // TRUE to latch current raw value as new reference
  iDesiredRef  : REAL;     // Engineering value at the reference point (e.g. 0.0)
END_VAR
VAR_OUTPUT
  oEngineering : REAL;     // Position in engineering units (mm, deg, ...)
  oOffset      : REAL;     // Active offset
  oStatus      : WORD;     // 16#0000 = OK, 16#8001 = offset not yet learned
END_VAR
VAR
  sOffset      : REAL;     // Retain via IDB attribute
  sLearned     : BOOL;     // Retain via IDB attribute
  sR_TRIG      : R_TRIG;   // Edge detection for offset latch
END_VAR
BEGIN
  sR_TRIG(CLK := iSetOffset);
  IF sR_TRIG.Q AND NOT sLearned THEN
      sOffset  := iDesiredRef - iRawPosition;
      sLearned := TRUE;
  END_IF;
  oOffset      := sOffset;
  oEngineering := iRawPosition + sOffset;
  oStatus      := SEL(g:=sLearned, IN0:=16#8001, IN1:=16#0000);
END_FUNCTION_BLOCK

Notes for S7-1200:

• Use the Standard LPD / PI types supplied with TIA Portal – search the project library for "TM_PosInput_2". The standard PLC Data Types for TM PosInput are installed with STEP 7 Basic.
• For first-commissioning on an empty line, the sLearned flag can be forced TRUE with a watch table so the operator is not required to jog to a known position before start-up. Document this in the validation / OQ file.
• Validate the sign convention by jogging the axis in the positive direction and confirming that oEngineering increases monotonically. A reversed encoder direction can be corrected in TIA Portal (Properties → Encoder → Signal evaluation → Invert) or by negating the offset.
• For motion control, see the S7-1200 Motion Control V6.0 in TIA Portal V17 function manual for axis homing with the offset technique.

Solution 2: Mechanical Alignment with Reference Position

If the application cannot tolerate a software offset (rare, but seen in safety circuits or SIL-rated paths where the offset must be visible to the F-CPU), physically align the encoder housing so that the mechanical zero of the axis coincides with an encoder position of zero (or any value you can post-process in HMI). Steps:

1. Loosen the encoder mounting clamp or coupling.
2. Move the axis to the engineering reference point (the "zero" you want to display).
3. Rotate the encoder shaft (or its coupling) so that the SSI readout is the desired raw value, typically 0, 1, or any single-turn multiple of 360° / singleturn resolution. Use the TIA Portal online monitor on the TM PosInput IO tag to read the live value.
4. Re-tighten the coupling. Verify by jogging the axis full stroke and confirming the engineering readout covers the required range without wraparound.

Use a flexible bellows or jaw-type coupling (e.g. Kübler 8.0000 series, Huco or similar) to avoid introducing mechanical stress that will bend the encoder shaft over time. A radial load above the encoder's specification will degrade the bearings and cause the absolute value to drift slowly over months of operation, even if the initial zero is correct.

Solution 3: Incremental Encoder with DI-Triggered Set

If the application can be refit with an incremental encoder + zero marker, the original Set Reference Point workflow works as expected. Configure the TM PosInput as Incremental in TIA Portal, assign DI0 (or DI1) to the Set Reference Point function, and trigger the input once at the reference position. The module then loads a user-supplied value (record 128 byte 16..23) into the counter, after which all subsequent counts are referenced to that value.

Configuration steps in TIA Portal (V16+):

1. Device configuration → TM PosInput 2 → Properties → Operating mode = "Incremental encoder".
2. DI0 → Function = "Set reference point". Edge = "Rising".
3. Set value: enter the desired engineering value at the reference point (this is what the counter will show immediately after the DI edge).
4. Compile and download. The configuration record is written automatically by TIA Portal on project download – no manual WRREC needed for the initial setup.
5. For runtime updates of the Set value, use WRREC on DS 128 with the table layout shown above and a valid OperatingMode = 0.

For SSI encoders the same TM module can still be used as an SSI input – but the Set function is permanently disabled. The only way to get a runtime "Set" on an SSI encoder is to leave the SSI encoder and switch to one of the encoder families listed below:

SCL Implementation of the Offset (Full Pattern)

The snippet below shows the full commissioning-grade implementation, including one-shot learn, retentive storage, plausibility check, and a HMI tag interface. It can be dropped into an S7-1200 project as an FB and instantiated per encoder channel.

FUNCTION_BLOCK "FB_PosOffset_1Ch"
{ S7_Optimized_Access := 'TRUE' }
VERSION : 0.1
   VAR_INPUT
     iRaw       : LREAL;       // From TM PosInput instance DB ActualValue
     iCmd_Learn : BOOL;        // HMI: "Learn reference"
     iCmd_Clear : BOOL;        // HMI: "Clear learned offset"
     iRefValue  : LREAL;       // HMI: desired engineering value at reference
     iMaxDelta  : LREAL := 1.0E9; // plausibility window around expected raw
   END_VAR
   VAR_OUTPUT
     oPos       : LREAL;       // Engineering value
     oOffset    : LREAL;       // Active offset
     oValid     : BOOL;        // Offset has been learned
     oDiag      : WORD;        // 16#0000=OK, 16#8001=not learned, 16#8002=plausibility fail
   END_VAR
   VAR RETAIN
     sOffset    : LREAL;
     sValid     : BOOL;
   END_VAR
   VAR
     RT_Learn   : R_TRIG;
     RT_Clear   : R_TRIG;
     sTmp       : LREAL;
   END_VAR
BEGIN
   RT_Learn(CLK := iCmd_Learn);
   RT_Clear(CLK := iCmd_Clear);
   IF RT_Clear.Q THEN
       sOffset := 0.0;
       sValid  := FALSE;
   END_IF;
   IF RT_Learn.Q THEN
       sTmp := iRefValue - iRaw;
       IF ABS(sTmp) < iMaxDelta THEN
           sOffset := sTmp;
           sValid  := TRUE;
       ELSE
           oDiag := 16#8002;   // Plausibility: the requested ref is too far from current raw
       END_IF;
   END_IF;
   oOffset := sOffset;
   oPos    := iRaw + sOffset;
   oValid  := sValid;
   oDiag   := oDiag AND (NOT sValid);  // Keep 8002 sticky until next learn
END_FUNCTION_BLOCK

Use this FB on a cyclic OB (e.g. OB1, or a faster OB200 if TM PosInput 2 is configured for 1 ms position update). The instance DB must have the Retain attribute on sOffset and sValid; otherwise a power cycle will lose the learned reference and force a re-learn. The plausibility window iMaxDelta should be sized to the largest legitimate engineering value (e.g. 10 000 mm for a 10 m stroke). Anything beyond that is treated as operator error and the offset is not updated.

Verification and Commissioning

After applying the offset (or mechanical re-alignment, or incremental encoder swap), validate the result with a structured test sequence:

1. Retain check: Power cycle the CPU and TM module. Confirm that the learned offset / encoder zero survives the restart (Retain flag set on the instance DB or in M-retentive area).
2. Reference point accuracy: Jog the axis to the reference point using the HMI manual control. Compare the engineering readout to the actual mechanical position. Acceptance: deviation < ±1 encoder LSB, or per the application specification. For an SSI encoder with 13-bit singleturn and 25 mm lead the LSB is 25 mm / 8192 ≈ 3 µm.
3. Monotonicity and rollover: Jog to both ends of the travel. Confirm the readout monotonically increases (or decreases if the encoder direction is reversed). Check that no rollover occurs within the working range. For an SSI encoder with 25 bits (13 single + 12 multi) and a 25 mm lead, the rollover is at 2¹² × 25 mm = 102 400 mm – usually large enough not to be a concern, but verify against the application range.
4. DI Capture stability: If using the DI Capture function for high-precision homing, command a reference motion and confirm that the captured value is stable across 10 consecutive runs. The capture timestamp is in the same IO-tag set; in TM PosInput 2 it is exposed as CaptureTimeStamp (DINT or LREAL, nanoseconds, depending on FW).
5. Recipe / wire-change scenario: For wire-change / recipe-change applications, simulate a recipe switch and verify that the offset is updated correctly without disturbing the encoder wiring or the SSI position value. A recipe switch in the HMI should call the Learn input of the FB with the new RefValue and an operator confirmation step.
6. PROFINET diagnostics: Use the SIMATIC Automation Tool or PRONETA to monitor PROFINET diagnostics on the TM module during commissioning. A healthy SSI link will show zero diagnostic entries in the channel diagnostics; a noisy link or wrong bit length setting will produce 0x0102 / 0x0103 entries in the module's diagnostic buffer (CRC / frame error).

Field Notes and Edge Cases

Why not just write the start value to the encoder over IO-Link or RS232? Some encoder manufacturers expose a service interface (e.g. Hengstler ACURO preset over a serial configuration tool) that can store a new zero in the encoder's non-volatile memory. This is a one-time, vendor-specific action. It does not change the fact that the TM PosInput cannot trigger that action over SSI on the S7-1200. Use the vendor tool for permanent re-zero at the encoder, and use the software offset method for recipe-driven value changes.

Mixing virtual and physical axes: In a motion control application with S7-1200 TO (Technology Object) axis and a TM PosInput as encoder source, the offset must be applied before the position is fed to the TO. The TO itself has no notion of an encoder offset – it only sees the position value coming from the IO. If the offset is applied at the application level after the TO consumes the position, the TO's homing status and actual position will not reflect the engineering value, and any subsequent MC_Home / MC_MoveAbsolute command will move to a mechanical position that does not match the displayed coordinate. Reference: S7-1200 Motion Control V6.0.

Multi-turn rollover: For multi-turn SSI encoders (e.g. 12-bit multi × 13-bit single = 25 bit total), the position is unique across 4096 revolutions. After 4096 revolutions the value rolls over to zero. If the application can run more turns than the encoder's multiturn range, the software offset will accumulate the error. In that case, count the wraps in the application by tracking a separate persistent wrap counter incremented on a rollover detection, and add WrapCount × 2^SingleturnBits × SingleturnResolution to the offset.

Wire-break / lost frame handling: TM PosInput 2 sets the Error and Status bits in the IO tag interface when an SSI frame error occurs. In the application, freeze the last good position and raise a maintenance alarm rather than continuing to use a stale or jumped value. The FB above does not handle wire-break by design – wrap that logic in a separate safety block and interlock any motion that depends on the encoder reading.

TM PosInput 2 firmware V1.2 additions: New DI functions and an expanded diagnostic record set were added. Confirm with the encoder manufacturer that the encoder exposes a vendor-specific PRESET / RESET line before relying on any new "Set absolute preset" function – it is not the standard SSI PRESET (which does not exist). The PROFIsafe / safety functions of TM PosInput 2 are documented in the functional safety addendum, separate from the standard manual.

CPU 1211C / 1212C slot limit: The TM PosInput 1 / 2 occupies a signal module slot. On the CPU 1211C with one SB slot, the maximum number of TM PosInput modules is 0. On the CPU 1214C / 1215C / 1217C, the limit is the number of free signal module slots (2 / 8 / 8 respectively for a stock 1214C / 1215C / 1217C). Plan the slot count for SSI + DI before commissioning, and check the S7-1200 Easy Book for the current maximum configuration.

Bake_Cupcake and example projects: The Siemens "Bake_Cupcake" example project (and similar application examples in the Siemens Online Support) demonstrates software offset and recipe-driven reference management on the S7-1200 / TM PosInput. Use these as a starting reference for the application architecture, then add your own retain / learn / HMI logic on top.