Resolving 840D Powerline Alarm 27090 and Disabling Secondary

Problem Summary

A 2006 DMG Gildemeister GMX-400 linear running SINUMERIK 840D Powerline with NCU 573.5 (6FC5250-6AX30-5AH0), PCU 50, HMI Advanced 06.03.28.00, Safety Integrated enabled, and Simodrive 611 (6SN1124 series) drives was generating two stacked faults on the Z3 axis (axis #5 / drive #5):

• Alarm 26060 — Axis Z3 Encoder 2 Hardware Fault 00101000H During Encoder Initialization. The fouled linear scale on the secondary measuring system could not be initialized. The fouling had to be removed by extracting the scale, but the axis was locked by Safety Integrated.
• Alarm 27090 — Error in data cross check NCK-PLC, DMP 20.01 Bit 00=$A_INSE[1], NCK:1. A safe-input discrepancy between the NCK ($A_INSE[1]) and the PLC ($A_INSEP) image of the emergency stop chain. The alarm latched across the entire control and prevented movement of every axis, including healthy ones.

The combination is unusually difficult because the cross-check alarm blocks any axis motion (so the secondary encoder cannot be worked around), while the hardware fault on encoder 2 blocks the cross-check from clearing cleanly. Resolving it requires three ordered phases: (1) repair or isolate the physical cause of the cross-check mismatch, (2) clear the latched SI checksum state, then (3) reconfigure the axis to operate on encoder 1 only for the duration of the service window.

Affected Hardware and Software Stack

Record the exact component stack before changing machine data. The configuration determines which manuals, function blocks, and SPL displays apply.

The procedure below is written for 840D Powerline. On 840D sl controllers running SW 4.7 SP2 / 4.7 SP3 and later, Siemens introduced a dedicated Single Channel Safety Encoder mode that simplifies the encoder-disable case; see the Siemens Industry Online Support article linked at the end of this document.

Decoding Alarm 27090 — The DMP Cross-Check

The 27090 alarm text breaks down into four pieces that every service engineer must be able to read:

1. 27090 — alarm class. Indicates a Safety Integrated cross-check (Siemens internal class for data cross-check discrepancy).
2. DMP 20.01 — the cross-check list and step. DMP is the data cross-check table identifier. List 20 covers the safe inputs (SGE / $A_INSE). Step 01 is the first position in that list.
3. Bit 00=$A_INSE[1] — the operand. $A_INSE[1] is the NCK-side mirror of safe input number 1 on the axis in question; bit 00 is the lowest bit (the active level of that safe input).
4. NCK:1 — the value the NCK sees. The PLC side ($A_INSEP, mirrored via DB3x.DBX22.x of the assigned axis) is the implicit comparison. The alarm fires because the two sides disagree.

The cross-check is performed at every SI cycle. A single mismatch latches the alarm, and the alarm in turn blocks all SI-related motion (because the controller cannot prove the safe chain is intact). That is why a one-bit disagreement on the e-stop chain immobilises the entire machine.

Cross-check data flow

Root Cause — The Pendant E-Stop Wiring Fault

The SI configuration on this machine had been modified during earlier troubleshooting of the encoder fault. Restoring the machine data was not sufficient because the controller's latched SI state stored the failed cross-check comparison. Worse, the real cause of the cross-check mismatch was a hardware problem, not a configuration problem. Specifically:

1. The pendant e-stop button is a dual-contact device. Both contacts must transition together for the NCK and PLC images of $A_INSE to agree.
2. One of the two wires was physically disconnected at the pendant, so pressing the button moved only one side of the input; releasing it moved only the other side. The two channels therefore drifted in opposite directions.
3. The Siemens cross-check evaluated both channels at every SI cycle. Pressing the button forced the level high on both sides simultaneously (because the missing wire meant the second contact was already floating high through the wiring) — so the alarm cleared with the button held. Releasing it let the floating channel return to its rest state and the alarm returned immediately.

The repair sequence used:

1. Restore the OEM e-stop wiring diagram for the GMX-400 pendant.
2. With power applied and the e-stop released, measure 24 V at the controller input terminals for both channels.
3. Trace from the SI input terminal back through the connector, the cable, and into the pendant. Locate the disconnected wire on the second contact.
4. Re-terminate and re-pin the wire. Verify continuity end-to-end with the e-stop released (closed) and pressed (open).
5. Power-cycle the NCU. Confirm $A_INSE[1] and the PLC image agree under both static states (e-stop pressed, e-stop released).

Clearing Alarm 27090 Without Disabling Safety

Once the wiring is intact, the alarm is still latched because the SI checksum state was disturbed during the earlier MD edits. The correct sequence:

1. Restore MD 36901 ($MA_SAFE_FUNCTION_ENABLE) to its original value for every axis. On this machine the original axis-level value was 0x41 (bit 0 = safe standstill SH, bit 6 = safely reduced speed SG).
2. Restore MD 1301 ($MN_SAFE_FUNCTION_ENABLE) at the control level to its original value, also 0x41.
3. Do not edit MD 36998 ($MA_SAFE_ACT_CHECKSUM). This is the calculated checksum the NCK computes from the current safe configuration.
4. Open Startup → Drives → Safety Integrated → Copy SI Data. This snapshots the calculated checksums.
5. Run Confirm SI Data. This writes MD 36999 ($MA_SAFE_DES_CHECKSUM) for every axis to match the calculated MD 36998.
6. Power-cycle the NCU. The 27090 alarm clears because the cross-check now sees agreement between NCK and PLC.

Manually entering MD 36999 by typing the value from MD 36998 will also clear the alarm, but only if performed immediately after restoring MD 36901 / MD 1301 / MD 36912, and only if no other axis was modified in the meantime. The Copy / Confirm sequence is preferred because it does the calculation for every axis at once and documents the change in the SI log.

Disabling the Secondary Measuring System for Service

The objective is to operate the Z3 axis temporarily on encoder 1 only so the fouled linear scale (encoder 2) can be removed, cleaned, and reinstalled. The procedure assumes SI is functional, the 27090 alarm is cleared, and the axis is parked at a safe position with the safety doors closed.

Preconditions

• Safe standstill confirmed (SH active) for all axes.
• NCU powered for at least one full SI boot with cleared cross-check.
• Backup of all SI machine data via the standard archiving procedure (Startup → Series Commissioning → Save). Save before making changes.
• DMG customer-specific PLC logic identified. On GMX-400 machines the encoder-1/encoder-2 selection is gated by DB99.DBX399.2; coordinate the change with the OEM logic.

Step-by-step MD edits

1. Verify SI inputs and outputs healthy in the SPL display: Diagnosis → Service displays → SPL. Note the position values for both encoders of the affected axis. If encoder 2 reads garbage or 0, the scale fault is confirmed.
2. For axis Z3 (axis #5) set: MD 30200 $MA_NUM_ENC = 1 (number of encoders).
3. For axis Z3 set: MD 36901 $MA_SAFE_FUNCTION_ENABLE = 0x0 to take the axis out of Safety Integrated for the service window.
4. Set the control-level flag MD 1301 $MN_SAFE_FUNCTION_ENABLE = 0x0 — the per-axis and global flags must agree, otherwise other axes generate cross-check alarms at boot.
5. Set MD 36912 $MA_SAFE_ENC_INPUT_NR = 1 for axis Z3 so the SI encoder assignment points to measuring circuit 1.
6. Run Copy SI Data and Confirm SI Data. Power-cycle the NCU.
7. On reboot, confirm: no 27090 alarms; the SPL display for drive #5 (Z3) is empty (as expected when SI is disabled on that axis); the SPL display for all other axes shows healthy, matching positions.
8. Move the axis in JOG at slow velocity. Verify position tracking in the service display and that the controller is using motor encoder only (set MD 32000 $MA_MAX_AX_VELO = 1 if needed to keep motion conservative while the scale is out).

PLC interface bits involved

If the axis still alarms during motion

Two recurring symptoms and their remedies:

• Position mismatch at first motion, SPL shows different positions on each side — the SI encoder grid or resolution does not match the active encoder. Restore the original MD 36901 = 0x41 and MD 1301 = 0x41, leave MD 30200 = 1, and instead try inverting the SI encoder polarity via MD 36925 $MA_SAFE_ENC_POLARITY [AX5] by flipping the sign from +1 to −1 (or vice versa). Re-run Copy/Confirm.
• Alarms on other axes at boot, SPL for Z3 blank as expected — the global SI flag (MD 1301) was taken to zero while other axes still expect SI active. Restore MD 1301 to its original value. Per-axis MD 36901 may be set to 0 only for Z3; the other axes must remain at 0x41.

Field-proven sequence (worked case)

// Step 1 — encoder count
MD30200[AX5]      = 1

// Step 2 — SI off for the service axis only
MD1301            = 0x41   // control-level: keep SI on globally
MD36901[AX5]      = 0x00   // axis-level: Z3 out of SI for service

// Step 3 — SI encoder assignment
MD36912[AX5]      = 1      // measuring circuit 1

// Step 4 — Siemens confirm sequence
Startup > Drives > SI > Copy SI Data
Startup > Drives > SI > Confirm SI Data
NCU power-cycle

// Step 5 — verify SPL before motion
Diagnosis > Service displays > SPL
// SPL for AX5 must be empty (SI inactive)
// SPL for all other axes must show agreement

Critical Machine Data Reference

Verification and Commissioning Checks

1. SPL display — Diagnosis → Service displays → SPL. Confirm that $A_INSE and $A_INSEP agree on every active axis. The display must be blank on axes where SI has been intentionally disabled for service.
2. Service Axis display — Diagnosis → Service Axis. Confirm that encoder 1 is the active position source for Z3 (the column header or icon indicates which encoder the controller is referencing).
3. Acceptance test / reduced-speed test — With the safety doors closed and the axis in JOG at the reduced safe velocity (set via MD 36931 and friends), traverse the axis in both directions. Watch for any new 2700x, 2709x, or 2606x alarm.
4. E-stop functional test — With the axis stationary, press the e-stop. Both channels of $A_INSE must change state together. Release. Confirm the SPL still shows agreement. Repeat three times.
5. Document the temporary configuration — Annotate the backup archive with the date, the MDs that were modified, and the intended re-commissioning date. Re-enabling the secondary measuring system requires the reverse sequence plus a fresh acceptance test.

Pitfalls, Edge Cases, and Field Notes

• MD 1301 must track MD 36901. If MD 1301 remains at 0x41 (SI globally enabled) while MD 36901 for Z3 is taken to 0x0, every other axis will alarm at boot because their per-axis expectation matches the global state, but Z3 does not. Either set both to 0x0 (disabling SI globally — rarely acceptable on a machine tool with safety doors and reduced-speed mode), or keep MD 1301 at 0x41 and disable SI only on Z3 by also setting MD 36912 to a value that the cross-check accepts.
• Manual MD 36999 edits are not equivalent to Copy/Confirm on multi-axis systems. The Copy/Confirm sequence validates the cross-check signature for every axis that participates in SI, while a manual edit only affects the axis whose MD you typed.
• PLC customer blocks gate the change. On DMG machines the customer PLC (DB99) frequently latches encoder-2 logic. With MD 30200 = 0, edits to DB3x.DBX1.5 / DB3x.DBX1.6 appear to revert because the PLC is enforcing its own selection. Coordinate with the OEM PLC logic, or temporarily force DB99.DBX399.2 = 0 in a controlled manner and confirm in the Service Axis display.
• Polarity swap via MD 36925 is the cheapest first try. If the SPL shows a constant offset between NCK and PLC positions after the encoder count is reduced, the most likely cause is counting direction. Flipping MD 36925 polarity avoids mechanical rework.
• The 27090 alarm blocks all axes, not just the affected one. Plan for machine-wide downtime when this alarm is present; do not assume it is local to the reported axis.
• Do not bypass the SI cross-check by clearing the alarm with PLC logic. The cross-check is a safety function. The alarm must be cleared by fixing the underlying input disagreement, never by forcing $A_INSEP.

When the secondary encoder cannot be reused

If the linear scale is mechanically damaged or its signal integrity cannot be restored, plan for either a replacement scale or a permanent single-channel Safety Integrated configuration. On 840D sl controls with software version 4.7 SP2 / 4.7 SP3, Siemens introduced a Single Channel Safety Encoder mode specifically for this case, allowing the second measuring system to be implemented as a single-channel encoder while retaining a valid safety chain. Refer to the Siemens Industry Online Support article on the new Safety Integrated features for that software version: SINUMERIK 840D sl New features for Safety Integrated in Software versions 4.7 SP2 and 4.7 SP3. Note that this article covers 840D sl; on Powerline the same goal must be reached via the per-axis MD 36901 / MD 36912 configuration described above.

Re-Commissioning the Axis After Scale Service

When the cleaned or replacement scale is reinstalled:

1. Re-measure the encoder grid spacing with a reference scale and update MD 36917 if needed.
2. Restore MD 30200 = 2, MD 36901 = 0x41, MD 1301 = 0x41, MD 36912 = 2 (or the original value).
3. Run Copy SI Data, then Confirm SI Data. Power-cycle the NCU.
4. Verify in SPL that both encoder positions are reported and agree on a slow traverse.
5. Run the full Safety Integrated acceptance test for the affected axis (reduced-speed test, safe-stop test, safe-position test as applicable to the configured scope). Document the test results in the machine log.

Frequently Asked Questions