Resolving Siemens 810D Alarm 3000 on VMC Re-Commissioning
When a used Siemens 810D-controlled vertical machining center (VMC) is re-commissioned after corrupted ARC file replacement, the most common hard-stop is alarm 3000 (Emergency Stop) with no explanatory message. The alarm is a symptom, not a cause: it tells you that the NC/PLC interface bit NC.A_EMERGENCY has been driven TRUE, but the alarm line itself does not say which part of the ladder or which wired input is responsible. This reference walks through a deterministic procedure for finding the real source of alarm 3000, separating the I/R module (Infeed/Regenerative), the 611D drive enable chain, and the basic PLC program (FC70, OB1, OB100, FB1) so the spindle can jog, the axes can be enabled, and the machine can complete referencing.
810D Architecture Recap for the Field Engineer
The SINUMERIK 810D is a compact NCU integrated into the SIMODRIVE 611D drive bus. The minimum hardware stack on a used VMC re-commission looks like this:
- CCU3 (Compact Control Unit 3) - the NC module containing the NCK (NC kernel), PLC (S7-300 compatible), and COM (communications) tasks. Variants: CCU3.1, CCU3.2, and CCU3.3, differing in NC software version support (Export / Non-Export) and PLC performance.
- PCU20 (Panel Control Unit 20) - the HMI PC module running the SINUMERIK HMI (HMI-Advanced or HMI-Embedded on older builds). This is the panel computer that hosts the operator interface, the tool manager, and the file system where the ARC archives live.
- SIMODRIVE 611D - the modular drive system. The line-up begins with an I/R module (Infeed / Regenerative Feedback) that builds the DC link, followed by 611D power modules for each axis (1FT6 / 1FK6 / 1PH7 motors on the spindle) and the spindle drive.
- MCP (Machine Control Panel) - the operator panel with axis selection, feed override, spindle override, mode switch, NC-Start, NC-Stop, and Emergency Stop pushbutton.
On a 810D (as opposed to the larger 840D with NCU 561/571/572/573), the PLC runs as a software PLC inside the CCU3. The PLC scan time is shared with NC interpolation, so heavy logic in OB1 directly affects block-cycle smoothness - one reason the basic PLC is split into fast FCs and slow FCs.
Where the ARC files fit
The ARC (archive) bundle contains:
- NC machine data (the
_N_MPF_DIRand_N_NCK_DIRfiles plus the_N_INITIAL_INIstartup file) - NCK settable data, R parameters, tool data, zero offsets
- PLC program (S7 project: blocks, symbols, source)
- HMI configuration
- Drive machine data (611D parameters mirrored back to the NC)
On a used machine, the seller may have the PLC/NC backup but not the ARC. Restoring the ARC from the original MTB (machine tool builder) is the only safe path; rebuilding the PLC from a generic basic PLC skeleton is acceptable as a diagnostic step but not as a final state.
Alarm 3000 - Definition, Source, and Why It Has No Reason
Alarm 3000 is defined in the SINUMERIK alarm documentation as:
3000 - Emergency Stop
Cause: The Emergency Stop request was activated. The NC/PLC interface signalDB10.DBX56.1(NC-A_EMERGENCY) is set, or the NCU has detected an internal E-Stop condition (PROFIBUS / PROFIdrive safety path, axis-specific drive fault, encoder failure, or 611D pulse inhibit).
Three independent paths can pull this bit high. Identifying which path is active is the entire diagnostic problem.
| Path | Source | Observable at |
|---|---|---|
| Wired E-Stop chain | MCP E-Stop pushbutton, guard-door interlock, external safety relay | PLC input (typically I0.x or IW0 on the 810D PLC), OR'd into FC70 / OB1 |
| Basic PLC E-Stop logic |
DB8.DBX45.0 ("Basic_PLC_DB".bits[8]) and other PLC-managed conditions |
DB8.DBX45.0 in the basic PLC program; some OEMs route drive faults here |
| NC-internal path | PROFIdrive safety telegram, missing drive, encoder error, pulse inhibit timeout | Alarm log on the HMI; DB10.DBX56.2 (NC-A_INC1) for incremental encoder faults |
Alarm 3000 by itself carries no clear reason field on a 810D HMI-Advanced build (HMI-Operate on 810D is rare). The reason has to be reconstructed by reading the PLC, not by reading the alarm. That is the point of failure most field engineers hit when they are new to 810D.
The Basic PLC Program on 810D
The Siemens-supplied basic PLC program for 810D/840D is delivered as a fixed structure. Knowing it cold is what makes the difference between "comment out the E-Stop" and "fix the E-Stop."
| Block | Purpose | Typical call |
|---|---|---|
| OB1 | Main cyclic scan. Calls the basic PLC FCs and the MCP FC. | FC2, FC19/FC25/FC24, FC70, FC72, FC100 series |
| OB40 | Hardware interrupt (used by 611D fast inputs, if any) | OEM-specific |
| OB82 / OB85 / OB86 / OB100 / OB101 / OB102 | Diagnostic, startup, restart | OB100 cold restart calls FB1 to initialise the basic PLC |
| FB1 | Initialises the basic PLC state on cold restart (retentive flags, MCP ID, axis configuration) | Called once from OB100 |
| FC2 | Axis / spindle signals - the only FC the user must call in every OB1 cycle | Always in OB1 |
| FC19 | MCP 483C IE (full M-version panel) signal transfer | OB1 if M-type MCP present |
| FC25 | MCP 483C IE T-version (turning) signal transfer | OB1 if T-type MCP present |
| FC24 | Small MCP / handheld unit signal transfer | OB1 if small MCP present |
| FC70 | OEM E-Stop / enable logic - where most machine builders put their E-Stop path | OB1 after FC2 |
FC70 is therefore the natural place to begin reading. The fact that the engineer found the suspect E-Stop path there is the expected outcome, not a coincidence.
Reading the E-Stop path in FC70
When the E-Stop rung drives MC_READY low and the upstream NC.A_EMERGENCY bit follows, the implication is that MC_READY is the result of an AND chain that includes a bit driven somewhere else. The most common candidates on a Bridgeport-pattern VMC are:
- Coolant pressure switch (if equipped)
- Lubrication pressure / lube-OK
- Spindle orientation complete / spindle stopped
- Tool changer in safe state (carousel in, arm parked, drawbar up)
- Drive enable chain (all axis drives reporting
DB3x.DBX61.5andDB3x.DBX61.6)
Of these, the lubrication-OK and tool-changer-safe-state paths are the most frequent culprits on a machine that has had a 4th axis and a Renishaw probe removed but the original PLC retained. Both paths reference hardware that may no longer exist or no longer returns the expected TRUE.
NC/PLC Interface and the Drive Enable Chain
The 810D exposes a fixed set of NC variables on the PLC side. For each axis (X, Y, Z, and a possible 4th) the PLC has a data block range; for each drive (1-6) the same DB is used. The convention is DB3x where x is the drive number. On a 3-axis VMC you typically see DB31 (X = drive 1), DB32 (Y = drive 2), DB33 (Z = drive 3), and DB34 (spindle). With a 4th axis removed, DB35 is still scanned but its enable outputs go nowhere.
| Signal | Address | Meaning | Required state for motion |
|---|---|---|---|
| Controller enable | DB3x.DBX2.1 |
Servo ON (drive line contactor, DC link charged, I/R ready) | TRUE |
| Pulse enable | DB3x.DBX21.7 |
Pulses ON (drive firing pulses to motor) | TRUE |
| Feed / rapid override |
DB3x.DBX0.x range |
Operator override; not enable but gating | Non-zero |
| Axis-specific enable (1st of 8) | DB3x.DBX1.5 |
OEM use; "axis enable" or "drive enable" | TRUE (OEM dependent) |
| Signal | Address | Meaning |
|---|---|---|
| Speed controller ready | DB3x.DBX61.5 |
Drive reports it is in closed-loop speed control, no fault |
| Position controller ready | DB3x.DBX61.6 |
Drive reports position loop closed, encoder OK |
| Drive fault | DB3x.DBX61.7 |
Drive reports a fault (overcurrent, encoder, I²t, ground fault) |
On a re-commissioned machine, if the engineer forces the drive enable bits in OB1 to TRUE and the response bits DB3x.DBX61.5 and DB3x.DBX61.6 come back TRUE, then the 611D hardware, the I/R module, and the encoder chain are good. If they do not, the problem is hardware (drive bus, encoder cable, I/R module, or the drive parameters themselves) and the PLC code is innocent.
Drive enable state machine
The drive enable sequence follows a fixed progression. The state machine below is the one a service engineer should hold in their head when looking at DB3x online:
I/R Module (Infeed/Regenerative) and NC Variables
The I/R module on a 611D line-up connects the three-phase mains to the DC link and (on regenerative modules) returns braking energy back to the mains. The signals the PLC sees from the I/R module are:
- Ready (terminal 663 on older / X121 on newer I/R modules)
- DC link OK (terminal 48 / LED on module)
- Fault (terminal 5 / LED on module)
If the I/R module is not ready, the 611D power modules will not enable, so DB3x.DBX61.5 and DB3x.DBX61.6 will not come back TRUE, and the NC will set 3000 because the E-Stop chain in the basic PLC will see "not all drives ready" and pull DB10.DBX56.1 high.
A common field failure on machines that have been stored is a pre-charge resistor fault in the I/R module. On power-up, the I/R module pre-charges the DC link through a resistor, then closes the main contactor. If the resistor is open, the module never reports ready, and the E-Stop is permanent. Verify by listening for the contactor closing and by reading the I/R module's seven-segment display - codes like F04, F08, or F15 indicate internal faults specific to the I/R revision. The full fault-code table is in the SIMODRIVE 611D Function Manual and the matching diagnostics manual shipped on the machine's documentation CD.
DB3x.DBX61.5 stays FALSE, and therefore the reason the basic PLC keeps the E-Stop set.NC variable reference table
| Variable | Address | Direction | Purpose |
|---|---|---|---|
| "NC".A_EMERGENCY | DB10.DBX56.1 |
NC <- PLC (PLC sets when E-Stop condition) | Drives the NC into emergency stop state |
| "NC".A_INC1 | DB10.DBX56.2 |
NC <- PLC | Incremental encoder 1 fault request |
| "NC".A_INC2 | DB10.DBX56.3 |
NC <- PLC | Incremental encoder 2 fault request |
| "Basic_PLC_DB".bits[8] | DB8.DBX45.0 |
Internal | OEM-flagged E-Stop aggregate; check cross-reference for W |
| MC_READY (OEM symbol) | OEM-defined | Internal | Master "machine is ready" aggregate |
| DRIVER_READY (OEM symbol) | OEM-defined | Internal | All drives ready aggregate |
| E_611D_ready (OEM symbol) | OEM-defined | Internal | 611D bus-level ready aggregate |
| ServoON | DB3x.DBX2.1 |
PLC -> NC | Controller enable to drive |
| PulsesON | DB3x.DBX21.7 |
PLC -> NC | Pulse enable to drive |
| SpeedCtrlReady | DB3x.DBX61.5 |
NC -> PLC | Drive has closed speed loop |
| PosCtrlReady | DB3x.DBX61.6 |
NC -> PLC | Drive has closed position loop |
Cross-Reference Methodology in STEP 7
The single most useful tool for this kind of problem is the STEP 7 reference data. From the SIMATIC Manager (or the newer TIA Portal, if the project has been migrated):
- Right-click the S7 program (the "Blocks" container) and choose Reference Data > Display.
- In the reference data window, open the cross-reference list (default: View > Cross-References).
- Type the variable name (for example
"NC".A_EMERGENCYorDB10.DBX56.1) into the filter. - STEP 7 lists every block, network, and line that reads or writes the variable, with the access type (R, W, RW) and the location (NWx / Liny).
This is the proper way to do a "global search" for an 810D PLC variable. Use it to find the one network that writes DB10.DBX56.1 or DB8.DBX45.0 and trace back from there. A text search across the source STL will miss symbols that are constructed dynamically and will produce false positives in commented blocks; the cross-reference never does.
How to read an unwired "W" finding
If the cross-reference shows only R (read) and no W (write) for a bit, that bit is being driven by the NC, not the PLC. For DB10.DBX56.1, the NC writes it directly as a result of internal conditions (drive faults, encoder faults, safety path). The PLC can also write it, in which case the cross-reference will show the W. If the only W in the project is in the line you already found in FC70, then the NC is the source and you need to look at the alarm log on the HMI for the underlying NC reason.
Diagnostic Procedure - Step by Step
The following is the deterministic procedure that resolves alarm 3000 on a re-commissioned 810D VMC. It is ordered so that the cheapest checks come first and the invasive checks come last.
-
Read the alarm log on the HMI. Even though 3000 carries no reason, look at the history. A 25201 (encoder fault), 26017 (PROFIdrive safety), or 380001 / 380002 / 380003 / 380004 / 380005 (PROFIdrive fault) anywhere in the last 50 alarms is the actual reason. The HMI's Diagnosis > Alarm Log on a 810D shows the last 50 alarms with timestamp; the file is
/user/sinumerik/hmi/data/log/alarmlogor its predecessor path on HMI-Advanced. - Check the 611D LEDs. All green = drive bus healthy. Any red on the I/R module = hardware issue, do not touch PLC.
- Open STEP 7 online and monitor FC70 online. Watch the E-Stop rung live. Identify which input of the OR / AND chain is the one driving the S output. Write that variable name down.
- Cross-reference that variable. Use Reference Data > Display > Cross-References on the variable. Trace the W (write) location. If the W is in a different FC (FC72, FC100, FC8, etc.), open that block online and monitor it. Repeat until you hit an input from the I/O or from the NC.
- Check the wired E-Stop chain. With the machine in a safe state (no motion, no stored energy), measure continuity through the E-Stop loop. The standard 810D E-Stop input is wired to the first input of a specific PLC byte - find the wiring diagram in the machine's electrical drawing. The bit should be 1 (TRUE) when the E-Stop is released, 0 (FALSE) when pressed.
-
Check the basic PLC E-Stop logic.
DB8.DBX45.0is a typical "Basic_PLC_DB" bit used by the basic PLC to OR in internal faults. Read the STEP 7 source for this bit; it is normally set in the basic PLC's own code, not in OEM code. -
Force the drive enables to isolate the I/R and drive hardware. Temporarily, in OB1, set
DB31.DBX2.1,DB31.DBX21.7,DB32.DBX2.1,DB32.DBX21.7,DB33.DBX2.1,DB33.DBX21.7to TRUE. Read backDB31.DBX61.5,DB31.DBX61.6, and the same for Y and Z. If all six response bits go TRUE, the 611D hardware is healthy and the problem is in PLC logic. If any is FALSE, the hardware is the problem. - Restore original code, fix the offending condition, leave comments. Never commit a "commented-out" network as the final state. The fix must address the underlying condition (sensor wiring, missing input, removed hardware no longer needed).
Staged Commissioning Approach for Used 810D VMCs
For a machine that has been sitting, a staged approach is more reliable than restoring the full ARC and then debugging everything at once. The staging follows the order in which hardware becomes available, not the order in which the original MTB commissioned the new machine.
Stage 0 - Static verification
- Confirm mains voltage and phase rotation at the cabinet disconnect.
- Confirm all 611D modules are seated and address switches are set per the original layout.
- Check encoder cables for strain and continuity; even one broken wire in an EnDat cable will keep
DB3x.DBX61.6FALSE and pull the E-Stop high through the NC-internal path. - Verify the 24 VDC control power supply; under-voltage on 24 V will collapse the PLC and the I/O modules.
Stage 1 - HMI and NC power-up
- Power the PCU20 and CCU3 only. Do not enable the 611D drives yet.
- Confirm the HMI boots to the SINUMERIK main screen. If the HMI is blank, the issue is the PCU20 / Windows-CE / disk image, not the NC or the drives.
- Confirm the PLC runs (the PLC status light on the CCU3 is solid green, not flashing).
Stage 2 - Build a minimal PLC program
Create a fresh S7 project and load only the basic PLC skeleton:
- OB1 containing one network:
CALL FC 2(axis signals). That is the absolute minimum the NC requires. - OB100 containing one network:
CALL FB 1, DB 7(basic PLC initialisation). - Load the project. The HMI will report the NC is in "PLC stop" or "PLC not configured" if the basic PLC skeleton is missing - that is expected at this stage.
Do not load the original OEM FC70 / FC71 / FC72 / FC100 at this point. Once the basic skeleton runs cleanly, the drive enable chain is the next step.
Stage 3 - Verify drive bus and I/R module
With the basic PLC skeleton running and the E-Stop released, monitor DB3x.DBX93.x range (drive status) and the I/R module LEDs. The I/R module should charge the DC link, the contactor should close, and the I/R module's READY output should go TRUE. If not, address the hardware before going further.
Stage 4 - Enable drives manually
In the minimal OB1, after the CALL FC 2, add three networks that set the drive enables:
// X axis (drive 1)
SET
S DB31.DBX 2.1 // Servo ON
S DB31.DBX 21.7 // Pulses ON
// Y axis (drive 2)
SET
S DB32.DBX 2.1
S DB32.DBX 21.7
// Z axis (drive 3)
SET
S DB33.DBX 2.1
S DB33.DBX 21.7
Monitor the response bits:
// Expect TRUE on all six of these
A DB31.DBX 61.5 // X speed ctrl ready
A DB31.DBX 61.6 // X pos ctrl ready
A DB32.DBX 61.5
A DB32.DBX 61.6
A DB33.DBX 61.5
A DB33.DBX 61.6
All six TRUE means the hardware is healthy. The remaining problem is then in OEM PLC code, not in the cabinet.
Stage 5 - Load OEM PLC and trace E-Stop
Now load the OEM blocks (FC70, FC71, FC72, FC100, etc.). Use the diagnostic procedure above (cross-reference, online monitor) to find the exact E-Stop source. With the drives already proven good, the cross-reference can be used efficiently to chase every bit that contributes to DB10.DBX56.1.
Specific Failure Modes on Removed-Axis Re-Commissions
The Venture 2818L shipped with a 4th axis and a Renishaw probe. When those are removed, the PLC code still references their ready signals. Common traps:
| Removed hardware | PLC signal left behind | Typical failure |
|---|---|---|
| 4th axis (A axis, drive 4) |
DB34.DBX61.5, DB34.DBX61.6 (drive 4 ready) |
OEM ANDs all drives ready into MC_READY; missing 4th drive ready keeps MC_READY low |
| Renishaw OMP / OTS probe | Probe-OK input, probe-armed input | OEM waits for probe-armed TRUE in tool-change chain; missing probe keeps chain incomplete |
| Tool changer servo / turret | Tool-changer-in-position, drawbar-up, drawbar-down | Stuck in tool-change mode blocks next-start; some OEMs only clear on drawbar-down |
| Coolant through-spindle (TSC) | TSC pressure-OK | AND into MC_READY or AND into "ready to start" |
The fix is to either remove the now-irrelevant input from the AND chain (the clean option) or to wire a permanent TRUE (24 V) to the input terminal that the removed hardware used (the ugly-but-fast option). The clean option requires a PLC programmer who understands the OEM code; the fast option requires the wiring diagram.
On the Venture 2818L specifically, the 4th axis is normally DB35. After disabling it in machine data (set MD20050[4] = 0 and blank the slot in the 611D line-up), the PLC code that ANDs DB35.DBX61.5 and DB35.DBX61.6 into MC_READY must be edited. If the original FC70 references U DB35.DBX 61.5 in the AND chain, change that line to a permanently true constant (e.g., UN M 0.0 shorted, or insert a comment and replace with a = TRUE contact on a spare flag bit).
Online Monitoring and PLC STOP Recovery
On a live 810D, modifying OB1 while it is being scanned can cause the PLC to go STOP. Two rules reduce the risk:
- Edit OB1 in STEP 7, but do not download. Use Monitor/Modify to toggle the bits you want to force. This is a soft change that does not require a download and does not crash the PLC.
- If you must download, do it from a complete OB1 build. A half-edited OB1 will be rejected or will cause the PLC to STOP. The CCU3 will then set its PLC STOP bit, which by itself is an E-Stop condition in many OEM blocks.
When the PLC goes STOP, the NC will issue alarm 2000 (Signals from PLC not OK) and the drives will drop out. To recover, fix the offending block, download, and clear the alarm. If the PLC is in STOP and you cannot download because the port is busy, cycle the NCU control power (the small toggle on the front of the CCU3) to bring the PLC back to RUN-RUN.
Recovery procedure from PLC STOP during commissioning
- Connect STEP 7 online to the 810D (MPI / PROFIBUS to the CCU3's X122 port, or Ethernet to the PCU20 if the routing is set up).
- Read the diagnostic buffer (PLC > Diagnostic Buffer). The entry will name the OB that caused the STOP.
- Open that OB, fix the error.
- Download the corrected OB.
- Use PLC > Clear/Reset to bring the PLC back to RUN. (This is a warm restart only; the NCK retains its state.)
- Reset the alarm with the HMI's Cancel / Reset key.
Verification Checklist and Common Pitfalls
Once alarm 3000 is cleared and the drives enable, run through the following before declaring the re-commission good.
| Check | Expected result | Method |
|---|---|---|
| E-Stop chain wired | Wired E-Stop opens the loop; 24 V across input when released | Multimeter at PLC input |
| All drives ready |
DB3x.DBX61.5 and DB3x.DBX61.6 TRUE for every configured axis and the spindle |
STEP 7 online monitor |
| Jog X, Y, Z | Each axis moves in both directions at jog feedrate | HMI JOG mode |
| Reference X, Y, Z | Each axis traverses to its reference cam and sets the reference point | HMI JOG-REF mode |
| M00 / M01 / M02 / M30 | Stop / optional stop / program end all behave per DIN 66025 | Run a known program |
| Tool change | Spindle orients, magazine indexes, drawbar up / down, tool number updates | M06 T01, M06 T02 |
| Spindle jog and orient | Spindle rotates in both directions and orients to tool-change position | M19, M03 S500, M05 |
| Feed and rapid override | Override dial changes feedrate and rapid | Override to 0%, 50%, 100%, 120% |
| Axis enable on MCP | Axis enable button gates motion per axis | Toggle off X, attempt jog |
| Coolant, chip conveyor, lube | Outputs respond to M08 / M09, conveyor forward, lube cycle | M08, M09, conveyor test |
Common pitfalls that turn a one-hour debug into a multi-day outage:
- Missing MTB backup of the original ARC. The MTB (machine tool builder) is the only party with the exact machine data, tool data, and OEM PLC that the original machine was shipped with. If the seller has only the previous owner's partial backup, request the MTB's version - it includes the compensation data (sag, cross-comp, leadscrew error comp) that no one else has.
- Commenting out networks to silence alarms. The E-Stop chain has redundancy for a reason. Commenting out a network to clear 3000 can leave the E-Stop button dead, the guard-door interlock disabled, or the spindle over-speed detection open. None of these are acceptable on a production machine.
- Modifying FB1 or FC2. The Siemens basic PLC FB1 and FC2 are written by Siemens and assume a fixed interface. Modifying them will break the NC's interface contract and produce alarms 2000, 2001, 2002, 2003, or 3000 in new and creative ways. Always call them; never edit them.
-
Forgetting the 4th axis in the machine data. If the hardware is removed but
MD20050[$n](axis configuration) still references the 4th axis, the NC will expect drive 4 to report ready and the basic PLC will hold MC_READY low. The clean fix is to zero out the 4th axis in the machine data and to blank the drive slot in the 611D line-up. - Incorrect ARC restore target. The ARC contains the NC and PLC. If the previous owner's ARC was from a different machine configuration (e.g. with the 4th axis still enabled), restoring it will re-introduce the missing-hardware E-Stop. Cross-check the ARC's machine data against the actual cabinet.
- Using the wrong port for STEP 7 online. The CCU3's X122 is the MPI / PROFIBUS port, not X121 (which is the PROFIBUS-DP to the drives). Connecting STEP 7 to X121 by accident is a common mistake and produces "target not found" errors that have nothing to do with the E-Stop.
- Red lines in the FC monitor after a code change. If a contact is red in the FC / FB online view, the variable it references is not declared. Either declare it in TEMP / STAT of the FC / FB header, or replace the red reference with a declared local or global variable. Red lines do not stop the PLC, but they make monitoring useless and hide real faults.
FAQ
What does Siemens 810D alarm 3000 mean, and why does it show no reason text?
Alarm 3000 means the NC has been told to enter Emergency Stop state because the NC/PLC interface bit DB10.DBX56.1 ("NC".A_EMERGENCY) is TRUE. The 810D HMI-Advanced does not display a per-bit reason for 3000; the reason has to be reconstructed by reading the PLC online and cross-referencing the bit. Look at the alarm history (Diagnosis > Alarm Log) for related alarms such as 25201, 26017, or 380001-380005 that point at the real underlying cause.
I have a CCU3 with a non-Safety-Integrated 810D. Do I still need FB1 and FC2 in the basic PLC program?
Yes. FB1 (basic PLC initialisation, called from OB100) and FC2 (axis / spindle signal transfer, called from OB1) are required regardless of whether the Safety-Integrated option is licensed. They are part of the NC/PLC interface contract. Calling them is the absolute minimum; editing them is not supported.
What is the difference between DB3x.DBX2.1 (Servo ON) and DB3x.DBX21.7 (Pulses ON)?
Servo ON is the controller enable: it tells the drive to close its line contactor, charge the DC link via the I/R module, and become ready to receive commands. Pulses ON is the firing enable: it tells the drive to start switching the IGBTs and apply voltage to the motor. Both must be TRUE for motion. A common commissioning sequence is Servo ON, wait for drive ready (DB3x.DBX61.5), then Pulses ON.
The drives enable when I force the bits in OB1, but the OEM PLC keeps the E-Stop set. What now?
Use STEP 7 Reference Data (cross-reference) on the variables in the OEM E-Stop rung in FC70. Identify the one bit that the AND chain waits on. Trace that bit's W (write) location - that is the real condition you need to fix. Common candidates on a used VMC are lube pressure, drawbar position, tool-changer-in-safe-state, and the 4th-axis-ready bit. Fix the condition, not the symptom.
Can I just re-flash the original ARC and skip the diagnostic step?
Only if the cabinet is identical to the original configuration - same drives, same MCP, same tool changer, same lubrication system, same 4th axis. If anything has been removed (4th axis, probe, TSC, conveyor), the original PLC code will reference its ready signal and the E-Stop will persist. In that case, edit the PLC to drop the references to the removed hardware, or restore hardware-equivalent signals (24 V tied to the relevant input) before re-flashing.