Resolving CU250S-2PN STO PROFIsafe Status Reporting to S7-1500F

Problem Overview

On a SINAMICS G120 drive (PM240-2 Power Module) equipped with a CU250S-2PN Control Unit (article number 6SL3246-0BA22-1FA0), an emergency-stop pushbutton wired to a fail-safe digital input (F-DI 0) successfully forces the drive into Safe Torque Off (STO). The drive itself behaves correctly: the inverter pulses are cancelled, r9772 reports STO active, and the motor is torque-free. The defect is on the PROFIsafe return path: the S7-1517TF safety PLC does not see the STO active bit on the safety status word coming from the drive, although the safety monitoring blocks report a clean PROFIsafe connection (no CRC or sequence-number faults).

The result is a silent gap: the drive is in STO, but the higher-level safety program cannot react, cannot log the event, and cannot perform a controlled restart handshake. The same symptom can also appear as "STO bits never set" inside the StartDrive safety diagnostics view, even though the drive is physically in STO.

Affected System Components

Reference the CU250S-2 Control Units Operating Instructions for the F-DI pin-out, the dual-channel debounce requirements, and the certified cross-fault detection window.

Root Cause: Control Type and PROFIsafe Source

SINAMICS G120 Safety Integrated on the CU250S-2 lets the user select how the drive is to receive its STO command. The selection is held in parameter p9601 and the safety configuration dialog of StartDrive / TIA Portal. There are three possible values:

1. Via PROFIsafe – STO comes from the F-CPU, S_STW1 bit 0.
2. Via terminal (F-DI) – STO comes only from the wired F-DI 0 / F-DI 2.
3. Via terminal and PROFIsafe – both sources are active; the drive ANDs them logically.

When the drive is set to "Via terminal and PROFIsafe" while the F-DI is being used to trigger STO and the F-CPU is simultaneously not driving the STO bit on S_STW1, the F-CPU can never observe STO active in the returned S_ZSW1. The status reported in the safety status word reflects the logical result of the selected source, not the raw F-DI state. Because the F-CPU never sets its own STO bit, the drive never reports STO active back to the F-CPU, even though the F-DI physically pulled the line low. The PROFIsafe telegram is healthy, the CRC is valid, the watchdog is not tripped – the bit just never changes.

Fix 1 – Align the Safety Control Source

If the F-CPU is the master of all safety commands and the wired E-Stop is only an additional hardware interlock, set the control source to Via PROFIsafe:

1. Open the drive in TIA Portal / StartDrive and switch to Safety Integrated.
2. Click on the safety function block (STO or Extended Functions) and select Control via PROFIsafe.
3. If the wired E-Stop is to remain as a backup, configure a separate F-DI for "Safe Stop" and wire the E-Stop to F-DI 2 (X133.4 / X133.5) instead of F-DI 0.
4. Recompile and download to the drive. After download, accept the safety configuration (p9700 = 1, p9701 = 1) and power-cycle if requested.

If the wired E-Stop is the only trigger and PROFIsafe is only used for status reporting, set the control source to Via terminal:

1. Open Safety Integrated → Extended Functions in StartDrive.
2. Select Control via terminals for STO and SS1.
3. Save, compile, and download. The drive will now report STO active in S_ZSW1 bit 0 any time the F-DI is de-energised.

Parameter view after the change (read-only online):

p9601 = 0   (SI enable, integrated functions)  // or 1, 2, 3 – depends on firmware variant
p9621 = 722.0 (BI: SI STO signal source – PROFIsafe / F-DI selection)
p9650 = 0     (SI F-DI switchover – F-DI 0 used)
p9651 = 0.001 (SI STO debounce time, 1 ms typical for F-DI 0)

Fix 2 – Correct PROFIsafe Telegram Selection

PROFIsafe status (S_ZSW1) is only transmitted when the drive is configured with a safety telegram. The CU250S-2 PN supports:

To select a safety telegram in TIA Portal:

1. In the device configuration of the G120, open Properties → PROFINET interface → Telegram configuration.
2. Add telegram 30 (or 31 if extended functions are used). Do not use the standard telegram 1, 2, 3, 5 – these do not contain the S_ZSW status word.
3. Verify the slot assignment: the safety telegram must occupy slot 0 (sub-slot 1) of the drive module.
4. Compile the project and download both the standard and the safety configuration to the drive.

Verifying the telegram online (read-only):

r922[0]  // PROFIdrive PZD telegram, e.g. "30"
r922[1]  // Should equal 30 once a safety telegram is loaded
r9780    // SI status list – bit 0 = STO active, bit 1 = SS1 active, etc.
r9781    // SI change-check word – confirms F-parameters accepted

Fix 3 – Configure the F-CPU Side Correctly

The S7-1517TF side must request the correct telegram, accept the right number of safety bits, and the F-runtime group must run within the configured PROFIsafe monitoring time. A mismatched F-monitoring time is the second most common reason for the F-CPU to not react to STO, especially after a project download.

1. In the device view of the S7-1517TF, open the PROFINET interface and select PROFIsafe on the G120 sub-module.
2. Set the F-destination address (F_Dest_Add). On a CU250S-2 this is set on the drive via p9610 and must match the address typed in TIA Portal (1 to 65534, default 1).
3. Choose the F-monitoring time. Start with 100 ms; tighten to 50 ms only after the bus topology is stable.
4. In the safety program, insert an F-CPU instance and connect it to the G120's PROFIsafe slot. The instance exposes the safety status word at F-CPU.S_ZSW1 and the control word at F-CPU.S_STW1.
5. For logic, use F-CPU.S_ZSW1.%X0 to evaluate STO active in the F-runtime group.

Recommended: LDrvSafe Library for the F-Program

Manually unpacking the safety status word, handling acknowledge logic, and reading the drive's safety diagnostics from the G120 over PROFINET is error-prone. The official Siemens LDrvSafe library (part of the "SINAMICS blocks for SIMATIC S7-1500" package, currently at V2.0 for TIA Portal V17) wraps the G120 PROFIsafe interface into reusable function blocks:

Typical insertion in the F-runtime group:

1. Open the F-runtime group in the F-OB (e.g. OB123 for S7-1500F).
2. Drop an instance of LDrvSafe_S and wire it to the PROFIsafe channel tag from the G120's F-CPU instance.
3. Wire the i_bSTO, i_bSS1, etc. boolean inputs to the F-application logic.
4. Use the q_wS_ZSW1 output of LDrvSafe_S as the mirror of the drive's safety status word for diagnostics and q_bSTOactive as a ready-to-use boolean for further safety reactions.

The LDrvSafe library also pre-formats the F-host acknowledge and the safety lifecycle (passivation, reintegration), so that PROFIsafe passivation events from the drive do not stall the F-runtime group.

Verification

After the three fixes above, perform a commissioning test with the following sequence. The test exercises both the wired and the PROFIsafe path.

1. Power up the drive and the S7-1517TF. Both go to RUN, F-runtime group is active, no F-channel faults.
2. In StartDrive, open Safety Integrated → Diagnostics. r9772.0 should be 0 (no STO), r9780 should show 0000 hex.
3. Press the wired E-Stop. r9772.0 must go to 1 within 5 ms. At the same time, S_ZSW1.%X0 in the F-CPU must go to 1 within one PROFIsafe cycle (typically 8–16 ms).
4. Release the E-Stop. Drive returns to "ready to switch on" only after the F-CPU has raised S_STW1.%X7 (acknowledge / internal event ACK).
5. From the F-CPU side, force S_STW1.%X0 = 1 in the F-program. The drive must enter STO without the E-Stop being pressed. Release by setting S_STW1.%X0 = 0 and pulsing S_STW1.%X7.
6. Disconnect the PROFINET cable while the drive is running. The F-CPU must detect a PROFIsafe fault within F-monitoring time and passivate the channel. Restore the cable, set the F-CPU to reintegration mode, and verify normal operation resumes.

Use the online Watch table in TIA Portal to monitor the following tags in real time:

// Drive-side (read-only)
"G120"."r9780"  // SI status list – bit 0 = STO active
"G120"."r9772.0" // STO status bit

// F-CPU side (LDrvSafe instance)
"DB_LDrvSafe"."q_bSTOactive"
"DB_LDrvSafe"."q_wS_ZSW1"
"DB_LDrvSafe"."q_bDiagAvailable"

Diagnostic Parameters (Read-Only)

The following parameters are essential when the STO status still does not appear on the F-CPU after the configuration change. Read them in the Parameter view of StartDrive:

Common Fault Codes and What They Mean

If the F-CPU passivates the drive channel, read the F-host diagnostic buffer (F-DB) and the drive's fault buffer. The most frequent codes are:

Extended Safety Functions (Optional)

If the application eventually moves beyond STO and needs SS1, SS2, SOS, SLS, SSM or SDI, the F-CPU must drive telegram 31 (not 30) because the additional control and status bits are not present in telegram 30. The wiring of the E-Stop can stay on F-DI 0, but the control type for each extended function is selected in StartDrive under Safety Integrated → Extended Functions → Control. Always set the control type to the same value across all functions in a project – mixing "Via PROFIsafe" and "Via terminal" across STO and SLS is a frequent audit finding.

For SLS limits on the G120, configure p9331[0..3] (4 limit pairs) and the active limit via the speed setpoint on S_STW2. The LDrvSafe_Ext block maps the SLS bits to the correct indices automatically.

Field-Proven Notes

• After every change to the safety configuration, the drive requests a power-cycle and acceptance test. Plan the change during a maintenance window, not during production.
• Never use a standard PROFIdrive telegram (1, 2, 3, 5, 6, 7) for safety. The S_ZSW word is not present in those telegrams and STO active will never be reported.
• On the CU250S-2 PN, F-DI 0 and F-DI 2 are both onboard. F-DI 0 is intended for the STO / SS1 source; F-DI 2 is typically used for SLS limit selection or as a second source.
• Use LDrvSafe V2.0 or later for TIA Portal V17. Earlier versions (V1.x) do not support the CU250S-2 with firmware V5.2 SP3.
• If the safety status appears in the F-CPU but the drive does not act on a S_STW1 command from the F-CPU, check p9601 – the drive is most likely still in "Via terminal" mode.