Clearing SINAMICS G120C F01600 F01611 STO Faults via PROFIsafe

Problem Overview

A SINAMICS G120C controlled over PROFINET from a SIMATIC S7-1500 trips F01600 / F30600 and F01611 / F30611 after the Safe Torque Off (STO) safety function is triggered through the on-board digital inputs (typically DI4 and DI5) wired to an emergency-stop circuit. After the safety demand is removed, the drive remains in a faulted state and cannot be acknowledged through the standard control telegram. Only a power-off / power-on cycle restores the drive to a ready state. Because the S7-1500 (non-F variant) used in the original configuration does not support PROFIsafe, the conventional Internal Event ACK path is blocked.

This article consolidates the three supported acknowledgment paths, the diagnostic parameter set used to identify the exact sub-cause, the telegram combinations required for PROFIsafe, and the hardware prerequisites (F-CPU) that govern whether in-cycle acknowledgment is even possible.

Affected Components and Safety Architecture

The fault topology in the original incident comprises:

• Drive: SINAMICS G120C (CU230S-2 or CU240S-2 control unit, firmware ≥ V4.5 for Safety Integrated basic functions). See the SINAMICS G120C Operating Instructions for the firmware-to-control-unit mapping.
• Safety inputs: DI4 and DI5 wired in a dual-channel arrangement to an emergency-stop pushbutton; either input going low (or open, depending on wiring convention) requests STO.
• Controller: SIMATIC S7-1500 (e.g., 6ES7513-1AL02-0AB0, CPU 1513-1 PN) configured without a safety program.
• PROFINET telegram: Standard telegram 352 selected in the device properties; speed setpoint and control word STW1 are exchanged but no PROFIsafe slot is added.

Fault Code Reference: F01600 / F30600 / F01611 / F30611

These four fault numbers represent a pair of mirrored faults across the two processors inside the SINAMICS control unit. The cross-mapping is documented in the SINAMICS G120 / G120C Safety Integrated Function Manual.

Reaction: OFF2 (pulse suppression via the safe shutdown path). The fault is latched and requires explicit acknowledgment; auto-restart on de-selection of STO is not the default.

Fault Value Diagnosis via r0949

The fault value in r0949 (decimal interpretation) pinpoints the immediate cause of F01600 / F30600. Read it using the drive's web server, Starter / Startdrive, or via the S7-1500 with RDREC on the DO index that returns the fault buffer.

Capture r0949 immediately after the fault trips. If 9999 is reported, scroll back through the fault buffer (the drive retains up to 8 fault entries) and read the value of the F01611 entry to find the underlying discrepancy code.

Why the Fault Will Not Acknowledge via Standard Telegram

Standard telegram 352 carries STW1 (control word 1) and ZSW1 (status word 1) only. The control bit that acknowledges a latched safety fault — STW bit 7 = Internal Event ACK — is defined inside the PROFIsafe telegram, not inside STW1 of standard telegrams. Therefore:

• Setting STW1.7 in telegram 352 is interpreted by the drive as Acknowledge fault, which clears standard faults but cannot clear the latched Internal Event of the Safety Integrated channel.
• Only the PROFIsafe host's F-Host application generates the Internal Event ACK bit that reaches the drive's safety channel.

Acknowledgment Methods — Comparison

Method 1 — Power ON Reset

1. Remove the safety demand (close the E-stop circuit so DI4 and DI5 are both high).
2. Power down the SINAMICS line supply (or remove the Control Unit 24 V supply for a CU230S-2; verify the discharge time stated on the drive nameplate).
3. Wait at least the discharge interval specified on the drive — typical SINAMICS G120C minimum: 5 minutes for the DC bus to drop below 50 V; this is read at r0046 in the drive.
4. Re-apply power. The drive performs the safety self-test; F01600 clears automatically if the shutdown path is consistent.

If the fault returns immediately, capture r0949 again — value 1005 or 1010 indicates internal hardware damage and the Control Unit must be replaced.

Method 2 — STO Terminal Deselection with Parameter Reset

This path uses parameter-level commands to perform the select / de-select handshake that the safety function requires. It is intended for commissioning; using it as a routine recovery procedure is discouraged because it momentarily allows the safety channel to enter an inactive state without external supervision.

1. Confirm the safety demand is removed (DI4 = high, DI5 = high).
2. Read the current safety password with r9762 (returns a decimal value used as the password in step 3).
3. Call the safety commissioning function: write the password to p9762 and write p9700 = 1 (factory reset of safety parameters) — only if the previous configuration must be wiped. For a clean de-select of an existing configuration, set p9761 = 0 (de-select STO) and trigger p9700 = 1 as the commit.
4. Cycle the safety configuration by toggling p9761: write the safety password from r9762, then set p9761 = 0 (de-select), then run p9700 = 1 to commit.
5. Power-cycle the Control Unit to make the new configuration effective.

Equivalent sequence from Starter / Startdrive: select Drive > Functions > Safety Integrated > Change settings > De-select STO. The tool reads r9762, requests the password, and writes the parameter set in the correct order.

Method 3 — PROFIsafe Internal Event ACK (Bit 7 of STW)

This is the recommended in-cycle path for production systems. The PROFIsafe telegram extends the standard control word with a safety-specific STW in which bit 7 carries the Internal Event ACK signal. A falling edge on this bit clears the Internal Event of the Safety Integrated function and acknowledges the latched fault.

Pre-conditions:

• F-CPU (e.g., 6ES7515-2FM02-0AB0 S7-1515F-2 PN or 6ES7513-1FM03-0AB0 S7-1513F-1 PN).
• PROFIsafe address configured on the G120C (p9610) and matching F-destination address in the F-host.
• Safety telegram selected on the drive — typically telegram 30 (Safety Integrated extended) or telegram 900 (vendor-specific safety payload). See the G120C list manual for the supported safety telegrams.
• F-runtime license active on the CPU.

Acknowledgment sequence in the F-application (F-FBD or F-CFC / Structured Text):

F-Host application:
  // STW_S bit 7 = Internal Event ACK
  // The PROFIsafe driver updates STW_S from the F-host's acknowledgment tag.
  IF safety_fault THEN
      ack_stw_bit7 := TRUE;       // assert Internal Event ACK = 1
      // safety_faults_word evaluates the drive's S_ZSW bits; clear when ZSW_S bit 7 = "Internal Event pending" goes low
      WAIT_FOR ZSW_S.bit7 = 0;
      ack_stw_bit7 := FALSE;      // falling edge on STW_S bit 7 — drive acknowledges the Internal Event
  END_IF;

The drive requires a falling edge, not a static level. Holding the bit high will not clear the fault on its own; the F-host must toggle the bit from 1 back to 0 after the safety fault clears.

Telegram Configuration: 352 vs 30 / 900

The standard control telegram (e.g., 352) and the PROFIsafe safety telegram are additive — they coexist on the same PROFINET slot, not mutually exclusive. The standard telegram continues to carry speed setpoints and STW1, while the safety telegram adds the safety payload.

Do not attempt to "switch" the drive from telegram 352 to a safety telegram. Instead, add the safety telegram slot in addition to 352 in the device configuration of TIA Portal. The drive's p0922 must list both telegrams, separated by a comma — e.g., p0922 = 352, 30. After writing p0922, the drive performs a restart to activate the new slot assignment.

Hardware Prerequisites for PROFIsafe

For a retrofit, replacing a standard S7-1513-1 PN with an S7-1513F-1 PN requires only the CPU swap — the project, hardware configuration, and program logic transfer with no change in I/O mapping. The F-program block is then added as a separate F-runtime container parallel to the standard user program.

Commissioning Workflow in TIA Portal

1. Open the project and swap the CPU to the F-variant. Transfer the configuration.
2. Open the G120C device view. Under Device configuration > PROFINET interface > Telegram configuration, add telegram 30 in addition to the existing 352.
3. Assign the F-destination address (F_Dest_Add) — must match the value programmed into p9610 on the drive. The PROFIsafe address is a numeric value between 1 and 65534; 0 disables PROFIsafe.
4. Compile the project and download to the F-CPU. The F-CPU will request a "safety mode activation" password the first time the F-blocks are downloaded.
5. In the F-program, generate the F-I/O DB. Map the S_STW output and S_ZSW input. Drive bit 7 of S_STW with the Internal Event ACK tag.
6. Trigger an E-stop event; verify F01600 trips, then verify the F-program clears it within one PROFINET cycle after the E-stop is released.

Verification Checklist

Run a forced dynamization test weekly on drives that stay in STO-released state for long periods. The G120C performs this automatically if p9650 (test stop time) is configured — typical value: 8 hours. The drive will briefly trip STO and re-enable, exercising the safe shutdown path. A failure here generates C30711 first as a warning, then F30711 if not acknowledged within p9652.