Diagnosing Siemens Profibus Telegram 20 Status Word Bit 3 Stuck

Problem Description

A SIMATIC PLC is exchanging Standard Telegram 20 with multiple Siemens SINAMICS G120/G120C inverters (or similar SINAMICS family) over PROFIBUS DP. The telegram is configured for 6 PZD words read (PLC <- drive) and 2 PZD words write (PLC -> drive). After a process upset the engineer observes three concrete symptoms that contradict normal PROFIdrive behaviour:

1. ZSW1 bit 3 (fault present) is latched at 1 on every drive, even when the drive's local display reports "No Fault".
2. ZSW1 bit 7 (alarm present) never changes even when a real drive alarm is active and visible in the parameter history.
3. Following process values look scrambled (NIST_A, IAIST, MIST) regardless of byte-swap attempts on the Status Word.

The drive parameter history shows fault F1910 was raised the day the six fan inverters dropped out, but only those six were affected — six other inverters on the same PROFIBUS segment continued to run. The PLC's diagnostic buffer contains earlier "station failure" entries for the same DP slaves. The PLC, the drives, and the bus were not all in agreement about whether the drives were faulted, alarming, or healthy.

Standard Telegram 20 PZD Layout

Telegram 20 is the SINAMICS free BICO telegram. Unlike telegrams 1, 2, 3, 4, 352, 354 etc., the PZD slots are not pre-assigned to a fixed signal — the engineer wires each PZD word to a BICO source/select via parameters p2051 (output / PLC -> drive) and p2061 (input / drive -> PLC). The default mapping when p0922 = 20 is:

The 6/2 split reported in the field (6 words read, 2 words write) is therefore consistent with Telegram 20 once BICO is connected for control + speed setpoint on the write side. The PLC receives the ZSW1 as the first word of the read area. Byte-swap on ZSW1 alone, applied before the rest of the process data, is the standard fix for an S7 IM that has been incorrectly configured for little-endian 16-bit word order — see Byte-swap and Endianness below.

ZSW1 Status Word Bit Map (SINAMICS G120 / PROFIdrive profile V4.2)

The behaviour reported in the field — bits 0, 1, 2 working as expected while bits 3 and 7 are wrong — is a strong indicator that the drive itself is healthy enough to update lifecycle bits, but the fault/alarm state is not being latched or cleared correctly. See Root Cause.

Root Cause: F1910 Fieldbus Setpoint Timeout

F1910 is the SINAMICS fault raised when the drive detects the loss of cyclic bus communication. The fault is generated by the PROFIdrive state machine inside the drive; the exact behaviour is governed by:

The sequence that produces the field symptoms is:

1. The PLC is interrupted (e.g. CPU STOP, DP master fail, cable break, EMC burst) and stops emitting cyclic output telegrams to the affected DP slaves.
2. After p2042 ms, the SINAMICS raises F1910, executes OFF2, and latches the fault.
3. Bit 3 of ZSW1 goes to 1; bit 7 will only go to 1 if a warning is pending (F1910 itself is an F-class fault, not an A-class warning).
4. When the bus is restored the drive does not auto-clear the fault. STW1.7 (acknowledgment of fault, positive-edge 0 -> 1) must be sent by the PLC. Until that happens, ZSW1.3 stays at 1, even if the drive is otherwise ready and the local display flashes between "No Fault" and the historical fault entry.

That fully explains the engineer's observation: the drive display is reading the live fault buffer (which is empty), but the PLC is reading the latched ZSW1.3 which is still high because no acknowledgment has been issued. It also explains why the bit appears "stuck on" across all six fans simultaneously — they all tripped on the same bus event and are all waiting for the same acknowledgment edge from the master.

Why Bit 7 (Alarm) Is Silent

ZSW1.7 mirrors r2122.7 (or r2139.7 on newer firmware), which is the OR of all currently active warnings (Axxxx). The behaviour "bit 7 never comes on, even when an alarm happens" combined with "bit 3 stuck" is a clue: the SINAMICS state machine is held in a fault state, and on some firmware versions the alarm summary bit is suppressed while the drive is in fault until the fault is acknowledged. Two concrete reasons for what the engineer saw:

• Warning is short-lived: a transient bus warning (A1910) raised before the timeout escalated to F1910 may have been present for a single telegram cycle. If the PLC DP cycle is 10 ms and the warning was set for 20 ms, the PLC missed the window.
• Alarm latch is reset on fault entry: when OFF2 is executed by the drive, certain internal fault/alarm latches are overwritten. The alarm the engineer saw "yesterday" may have been a historical alarm (visible in the r0947 history buffer) rather than a live one.

Diagnostic Procedure

1. Read the PLC diagnostic buffer. Look for station failure / station return / DP slave diagnostics interrupt entries. A station failure for a DP slave that no longer appears in the live list is direct evidence of a physical-layer event.
2. Read r0947[0..7] on each drive (current fault buffer) and r2122 / r2132. Confirm whether F1910 is still pending (F = 1 in r2132) or already cleared (F = 0).
3. Verify the bus physical layer. Re-torque the PROFIBUS D-sub connectors, inspect the terminating resistors (must be ON at the two physical ends only), and check the shield contact on each connector housing. Look for green LED on the CU (PROFIBUS) — solid green = cyclic exchange, flashing = bus fault, off = no connection.
4. Confirm the telegram selection on both sides. On the drive, p0922 = 20. In HW Config (STEP 7) or the GSD file, the slave must be configured for the same PZD length (6/2). A mismatch causes the master to interpret incoming words at the wrong offsets, which is the most common reason for "values look scrambled".
5. Check p2040 and p2042. If the master scan time is longer than these monitoring times, the drive will spuriously trip F1910 even though the bus is healthy. Recommended: set p2042 >= 2 x the master send cycle.
6. Send an explicit acknowledgment from the PLC by toggling STW1.7 from 0 to 1. Monitor ZSW1.3 — it should fall to 0 within one bus cycle.

Byte-Swap and Endianness

PROFIdrive telegrams are always transmitted as big-endian 16-bit words on the wire. SIMATIC S7 CPUs are also big-endian internally, so a correctly-mapped I/O area in the PLC does not need a byte-swap on the wire. The engineer reports that byte-swapping the Status Word makes "the values of each bit" look correct. The most likely explanation is that the I/O area in the S7 has been configured or assigned incorrectly:

• Wrong peripheral addressing mode: the PZD area is being read as two separate bytes (PQB/PIB) and re-assembled in the wrong order in user code. Use PEW / PAW 16-bit accessors, not PEB / PAB.
• Optimised block access on S7-1500: the "optimised" / "non-optimised" setting of the input image determines whether the byte order is preserved or reversed. Check the data block access mode in TIA Portal.
• Cross-compiler / OPC DA gateway: an intermediate HMI or OPC server may be re-ordering words to fit little-endian registers.

A clean fix is to keep the PZD area in a 16-bit-aligned structure and avoid touching individual bytes. The following S7 ST snippet shows the recommended structure for 6-word input + 2-word output:

// Input (drive -> PLC) and output (PLC -> drive) PZD area for one slave
// Slave configured for 6 PZD in, 2 PZD out on Telegram 20
TYPE UDT_PZD_T20 :
   STRUCT
      ZSW1   : WORD;   // PZD1 IN  - Status word 1
      NIST_A  : INT;    // PZD2 IN  - Speed actual, 0.01 % of p2000
      IAIST   : INT;    // PZD3 IN  - Current actual, 0.01 % of p2002
      MIST    : INT;    // PZD4 IN  - Torque actual, 0.01 % of p2003
      PIST    : INT;    // PZD5 IN  - Power actual, 0.01 % of p2004
      freeIn  : INT;    // PZD6 IN  - user-mapped
      STW1    : WORD;   // PZD1 OUT - Control word 1
      NSOLL_A : INT;    // PZD2 OUT - Speed setpoint, 0.01 % of p2000
   END_STRUCT;
END_TYPE

PROFIBUS Station Diagnostics in STEP 7 / TIA Portal

To confirm whether the bus event is still ongoing or only historical, the master must be interrogated. Two standard mechanisms:

• SFC13 / SFB52 (DP diagnostics): returns the station diagnostics of a DP slave including module status, channel-related diagnostics, and identifier-format diagnostics. A DPNRDLG call that reports BUS_FLT = 1 for a slave confirms the slave is currently flagged as faulty by the master.
• SFB54 (alarm messages from DP slaves): receives the diagnostics interrupts that the slave raises when its state changes. A burst of F1910 diagnostics alarms across all six fan drives is the smoking gun.

In TIA Portal, the same data is available in Online & Diagnostics > Diagnostics > PROFIBUS DP > Station. The "Status of the DP slave" field should be green; red indicates the slave has been removed from the cyclic exchange.

Recovery Sequence (After Root Cause Is Resolved)

1. Bring the DP bus back to a clean state. All six DP slaves should report "ready" on the local LED.
2. From the PLC, write STW1 = 047E hex (binary 0000 0100 0111 1110) to the affected drives: OFF1 = 0, OFF2 = 1, OFF3 = 1, enable = 0, ramp-function generator enable = 1, setpoint enable = 0, fault acknowledge bit 7 = 1. This pre-clears the latch.
3. After one cycle, write STW1 = 047F hex (same as above with bit 0 = 1, ready to switch on). ZSW1.7 (alarm) should remain 0; ZSW1.3 (fault) should drop to 0 if F1910 is no longer pending.
4. Re-issue the run command: STW1 = 047F then STW1 = 047F + enable (final value depends on application — typically 0x047F followed by 0x047F with the operating condition word sent last).
5. Monitor ZSW1.0, ZSW1.1, ZSW1.2 to confirm normal state. Confirm ZSW1.3 stays 0 and ZSW1.7 toggles when a real warning is injected.

Robustness Recommendations for Fan / Cooling Applications

Losing six of twelve fans to a single bus event is symptomatic of a single point of failure. Where a PROFIdrive-controlled fan is in a life-safety or thermal-protection loop:

• Set the F1910 reaction to a non-latching warning via p2118 = 0 for as long as the application can tolerate loss of speed reference. With p2118 = 0 the drive raises A1910 (warning) instead of F1910 (fault) and continues running at the last valid setpoint.
• Set p2042 to a value at least 3 x the master send cycle. For a 10 ms send cycle, p2042 = 30 is a typical starting point.
• Use p0852 (BI: enable operation) and p1140 (BI: ramp-function generator enable) to keep the drive enabled even if the fieldbus setpoint times out, with the last ramp-function generator value held.
• Where the bus is non-redundant, consider a top-up resistor / capacitor on the setpoint input (NSOLL_A) with p1155 = 0 (setpoint source) to fall back to a local fixed speed on bus loss. This is a real engineering decision — verify against your machine's risk assessment.
• Redundant bus for safety-critical cooling is the gold standard; the SINAMICS G120 with CU250S supports PROFIBUS DP-V1 master-slave redundancy. A ring topology with OLM / repeater is a more accessible alternative.

Commissioning Verification Checklist

Frequently Asked Questions