Resolving G120 250-S 2PN PROFINET Error 0x0239CB in TIA Portal

1. Problem Description: G120 PROFINET Communication Breakdown

A SINAMICS G120 with CU250S-2 PN Control Unit has been integrated into a TIA Portal project for speed control via PROFINET. The engineering PC, S7 PLC, and drive share a /24 subnet (255.255.255.0), and the controller is intended to cyclically exchange Standard Telegram 1 with the drive. After a successful initial parameter check, the operator attempted to download the project to the PLC. Immediately following the download, the PLC entered the SF (System Fault) state with a blinking red error LED, and TIA Portal lost the ability to establish an online connection to the CPU.

The drive's BF (Bus Fault) LED began blinking, indicating that the PROFINET interface could not establish a cyclic relationship with the IO Controller. While the PLC was still pingable from the engineering station, the CPU refused all TIA Portal online access. A diagnostic readout in StartDrive reported 16#02:39CB with the text "PROFINET: No cyclic connection", confirming that the IO Controller never moved past the AR (Application Relationship) establishment phase.

This failure pattern is reproducible on any G120 PN system whenever the project download disrupts the existing PROFINET name assignment, when the configured telegram does not match the drive, or when the IP stack of the CPU and drive are not coherent at the moment the AR is negotiated.

2. Network Topology and Addressing

The reference architecture is a single PROFINET line with three nodes on one subnet:

The PC network adapter must be set to Obtain IP via DHCP or to a static 192.168.0.3 address with the same gateway behaviour as the controller. Disable any second network interface (Wi-Fi) on the engineering station to prevent TIA Portal from binding the wrong adapter when it scans the subnet.

3. Root Cause Analysis

Three concurrent defects are typically present when a G120 PN configuration works once, then dies on download:

1. Device-name desync: The PROFINET device name stored in the G120 differs from the name configured in the TIA Portal device list. The IO Controller queries the device by name (DCP), not by IP, before opening the AR.
2. IP/subnet inconsistency: The TIA Portal online view shows the drive as "offline" while the configured project has the correct IP. The drive's actual IP (visible from StartDrive online) does not match the project IP because the IO Device is using a fallback IP from a previous commissioning.
3. Telegram mismatch: Telegram 1 in the project does not match what is loaded in the drive. The CU250S-2 PN rejects the AR with a PNIO user-diagnostic alarm of the form 0x02:39xx, which the CPU surfaces as 0x0239CB in the diagnostic buffer.

Any one of these defects is sufficient to keep the drive's BF LED blinking and the PLC's SF LED lit. The 0x0239CB alarm is the drive's PROFINET stack reporting that the cyclic channel could not be established within the watchdog window after the AR was opened by the controller.

4. Error Code 0x0239CB Interpretation

The diagnostic string 16#02:39CB is a PROFINET user-diagnostic alarm, not a standard SINAMICS fault number (F08501, F08502, etc.). The decoded structure is:

In StartDrive's Online & Diagnostics tree, the matching plain-language text is "PROFINET: No cyclic connection". The drive PROFINET stack has accepted the connection request from the IO Controller but the configured telegram has not been parameterised, or the IO Controller has dropped the AR because of an alarm acknowledgment failure. This alarm is recoverable; it does not require a factory reset of the CU250S-2 PN.

5. LED Status Reference

Read the LED pattern on every node before changing any parameter. The combination of LED states is what tells you which defect is dominant.

6. Telegram 1 Configuration on the G120

Standard Telegram 1 is the default for G120 speed control and consists of two 16-bit words in each direction:

The 16-bit STW1 control word must be sequenced per the PROFIdrive profile:

1. Bit 0 = OFF1 (rising edge: ready to run)
2. Bit 1 = OFF2 (always 1, coast stop if 0)
3. Bit 2 = OFF3 (always 1, fast stop if 0)
4. Bit 3 = Enable operation (rising edge: pulses enabled)
5. Bit 4 = Enable ramp generator (ramp enable)
6. Bit 5 = Unfreeze ramp generator / continue setpoint
7. Bit 6 = Enable setpoint (must be 1 to accept NSOLL_A)
8. Bit 10 = Control by PLC (must be 1, otherwise drive ignores NSOLL_A)

The typical control word sequence for ramp-up via Telegram 1 is: 0x047E → 0x047F (low word), high word 0x0000 until the drive reports ZSW1 bits 0,2,10 set, then NSOLL_A is applied. If Telegram 1 is not selected both in the project and in drive parameter p0922 = 1, the AR is rejected by the drive with 0x0239CB even when the device name is correct.

7. PROFINET Device Name Assignment

The PROFINET device name is a case-sensitive string stored in non-volatile memory on the CU250S-2 PN. It is queried by the IO Controller via DCP before any AR is opened. The IP address alone is not enough to start a cyclic relationship.

Verify the name from TIA Portal:

1. Open the project, expand Devices & Networks.
2. Right-click the G120 → Properties → General → PROFINET interface → Ethernet addresses.
3. Note the field PROFINET device name. In the reference case this is g120drive.
4. Open Online → Accessible nodes. Select the network adapter and click Start search. The G120 should appear with its MAC and the IP 192.168.0.2 if the name in the device matches the name stored in the drive.

If the name is wrong, reassign it without losing the IP:

1. Right-click the G120 in the project → Assign PROFINET device name.
2. Select the IO Device, the IO Controller (the S7 PLC), and confirm.
3. TIA Portal flashes the G120's LINK LED to confirm; the new name is committed to non-volatile memory.

8. Online Diagnostics Procedure in TIA Portal

When the PLC refuses the TIA Portal online connection, use these tools in order. Each tool gives a different view of the same failure.

1. Network view > Online & Diagnostics: open the PLC, switch to Online, read PROFINET diagnostics. The IO Device entry for the G120 shows a status of Not connected with a reason code of No AR.
2. Topology view > Compare: the topology editor highlights any port partner mismatch. A direct PC ↔ PLC ↔ drive line is normally uncritical, but a managed switch with LLDP disabled will also break the AR.
3. StartDrive Online & Diagnostics: navigate to PROFINET → Telegram → Telegram selection and confirm p0922 = 1. The diagnostic buffer lists 0x0239CB with timestamp and a slot index.
4. CPU diagnostic buffer: Online & Diagnostics → Diagnostic buffer. Look for an event of class I/O fault referencing slot 1 of the G120; the associated text names the IO Device and the cause.
5. Accessible nodes: in the project tree, click Online → Accessible nodes, choose the network adapter, and run Search. The G120 should appear with the same IP and the same name as in the project. If it appears with IP 0.0.0.0, the drive has lost its name and is on a fallback IP.

9. Step-by-Step Recovery Procedure

Apply the steps in the listed order. Do not skip ahead; the order is designed to make the system converge with a single PLC download at the end.

1. Power-cycle the G120 with the PROFINET cable connected. Wait 15 seconds for the CU250S-2 PN to complete its boot, then read the LEDs. A steady green LINK confirms the physical layer.
2. Verify the engineering PC's IP. From a Windows command prompt run ipconfig /all. The active adapter must show 192.168.0.3 / 255.255.255.0. Disable Wi-Fi and any other active adapter.
3. Reset the drive to factory defaults for communication only: in StartDrive, Functions → Reset to factory settings and select Communication parameters only. Do not reset motor data; doing so will require a new drive commissioning.
4. Set Telegram 1 on the drive: Commissioning → Telegram configuration, set p0922 = 1 and p2079 = 1 if you also want extended diagnostics. Save to non-volatile memory.
5. Assign the PROFINET device name from the TIA Portal project to the G120. The MAC address visible in Accessible nodes identifies the physical hardware. Confirm the IP 192.168.0.2 is shown for the named device.
6. Compare the project offline vs. online: in the network view, click the G120, then Online → Compare offline/online. Any mismatch in telegram, name, IP, or subslot configuration must be resolved by downloading the offline project to the drive (StartDrive download).
7. Compile the PLC project and download it to the S7 CPU. Choose Download to device → Complete, not Hardware configuration only. A complete download is required to re-establish the AR after a name change.
8. Observe the LEDs: the G120's BF should go dark within 5 seconds, the PLC's SF should clear, and ZSW1 should report Ready to switch on in the watch table.

10. Verification Tests

After the recovery steps, run these checks in order. Each test produces a pass/fail signal that maps to a specific subsystem.

The reference speed N_IST scaling is N_IST = (NIIST_A / 0x4000) * p2000, where p2000 is the reference speed in the drive (e.g., 1500 rpm). A 0x4000 setpoint with p2000 = 1500 rpm yields 1500 rpm measured at the motor shaft.

11. Common Pitfalls and Edge Cases

• Mixing TIA Portal and StartDrive device-name assignments: TIA Portal and StartDrive each have a separate record of the device name. The drive itself only stores one name. Always assign from the same tool that owns the project, then download.
• Subnet mask mismatch on the PC: a Windows adapter set to /16 (255.255.0.0) will still ping the PLC and drive, but the broadcast-based DCP name query in TIA Portal fails silently. Set the PC explicitly to /24.
• Firmware mismatch on the G120: a CU250S-2 PN with V4.7 firmware and a TIA Portal V17 GSD may negotiate a telegram the firmware cannot decode. Match the GSD to the firmware version or update the Control Unit to the latest V5.x firmware.
• Duplicate IP: if a second device on the plant network has 192.168.0.2, the drive's BF LED stays on steady, not blinking. Resolve by changing the duplicate IP first.
• DNS / hostname resolution on the PC: TIA Portal uses NetBIOS in some flows. A Windows network with network discovery turned off can break Accessible nodes even when the network is healthy.
• Power-down between downloads: a download interrupted by a power cycle leaves the G120 holding the previous AR. After power-up the new AR is rejected until the CPU redownloads. Always do a complete download, not just a single block.
• Antivirus / firewall: a corporate firewall that blocks UDP port 34964 (PNIO DCP) silently breaks TIA Portal's Accessible nodes. Allow it on the engineering station.

12. Engineering Reference Summary

For a typical S7-1200 / S7-1500 with one SINAMICS G120 CU250S-2 PN, a greenfield PROFINET speed-control project converges when the following invariants hold simultaneously:

• All nodes share 255.255.255.0 and one common IP prefix (here 192.168.0).
• Each PROFINET device name in the TIA Portal project matches the name stored on the physical device.
• The telegram in the TIA Portal slot matches the telegram in p0922 of the drive.
• The PC network adapter is selected explicitly in TIA Portal's PG/PC interface.
• No firewall or VPN client filters PROFINET DCP or PNIO frames.
• The CPU diagnostic buffer is empty of IO fault events before commissioning the application.

When 0x0239CB appears, treat the system as a name or telegram problem first, a wiring problem second. The 0x0239CB diagnostic is a useful pointer to the cyclic-data channel, but the actual repair is almost always in device-name assignment or telegram selection, not in the diagnostic alarm itself.