Resolving the SINAMICS "Shutdown Paths Require Testing" Warning on Power-On

When commissioning or maintaining a machine driven by Siemens SINAMICS S120 drives configured under Safety Integrated (SI) with a SINUMERIK controller, the alarm "Shutdown paths require testing" (yellow/info-level message, F-CPU/SI-coded) can appear after a power-on cycle. This article provides the field-engineering depth required to identify the root cause, apply a reset, and isolate the intermittent hardware condition behind it.

1. Problem Statement

After a controlled or uncontrolled power-off / power-on of a multi-axis machine (e.g., a two-arm feeder with 8 axes – 4 per arm), one or more axes show the SI warning text:

"Shutdown paths require testing"

The symptom is characteristically intermittent:

• It may not appear on every boot.
• It may appear only on certain axes (in field reports, typically only one arm of a dual-arm configuration).
• It may appear on multiple identical machines built with the same configuration (5 machines in one field report).
• The remaining time displayed in P9659 can drop to 0 at the moment of power-on, even though it was non-zero before the previous power-off.

2. Affected Configurations

3. Root Cause Analysis

The "Shutdown paths require testing" warning is raised by the Forced Checking Procedure (FCP), also called the Dynamic Test, of the SINAMICS Safety Integrated functions. The FCP exists because the safety shutdown paths (typically STO via the Safe Torque Off hardware channel) are otherwise dormant for long periods. The standard requires them to be exercised at least once within a configured interval to prove that the wiring, the safe inputs, and the drive's safe shutdown path are still functional.

SI tracks two time variables:

• P9659 – SI FCP remaining time in hours (e.g., 9000.00 = 9000 hours remaining before mandatory test).
• r9780 / r9782 – Counter of how many times the FCP has been executed successfully versus faulted.

Setting bit r9773.31 = 1 indicates that the FCP must be executed. Siemens' standard remediation is the forced check using the test stop sequence (see Siemens Application Note – Testing shutdown paths). However, in production environments the most common reset is to cycle the STO via the wired E-Stop chain.

3.1 Why the warning may show at power-on even when P9659 > 0

The key behavior reported in the field is that P9659 shows hours remaining (e.g., 9000 h) before power-off, but on the very next power-on the FCP flag r9773.31 is already set and P9659 reads 0. There are three engineering-explainable causes:

1. Non-volatile counter drift on abrupt power removal. The remaining-time value is mirrored between the Control Unit and the Motor Module. If the CU is powered down before the save cycle (typically after SI power-up complete state, ~30 s), the CU's mirror can be reset to 0 on next boot, while the Motor Module still holds a non-zero value. The drive then declares the FCP required.
2. STO pulse was effectively not retracted. If the E-Stop line is wired such that a power-on occurs with the STO inputs in an undefined or noisy state for a few ms, the drive registers this as a self-test trigger and sets r9773.31.
3. One specific hardware channel is intermittently failing the FCP. A corroded contact, marginal 24 V supply, or noisy shielded cable on the safe input path of a single axis can cause the internal self-test to fail the verification and flag the FCP as required.

The fact that 5 identical machines exhibit the same fault localized to the same physical arm strongly points to cause (3): a hardware item (cable, terminal, encoder, or Motor Module) is failing the internal self-test intermittently and only on those axes that share a cable run or terminal strip.

4. Diagnostic Procedure

4.1 Read the SI Status Word

Go online with the SINUMERIK HMI or Starter / Startdrive / TIA Portal and navigate:

Drive unit → Drives → [Axis name] → Functions → Safety Integrated

Inspect the following:

4.2 Capture Drive Buffers

Before any reset, download the safety message buffer for each axis (r9771 array) and the regular fault buffer. Look for F01611 or F30611 series messages that indicate the FCP failed due to a hardware defect.

4.3 E-Stop Wiring Continuity

With the machine de-energized, measure the resistance of the dual-channel E-Stop chain per axis:

• Channel 1 path (e.g., F-DI 0): expected < 1 Ω end-to-end.
• Channel 2 path (e.g., F-DI 1): expected < 1 Ω end-to-end.
• Cross-talk between channels: > 1 MΩ @ 500 V.

5. Standard Reset Procedure

The Siemens-recommended way to clear r9773.31 after confirming the safety circuit is intact is to perform the Forced Checking Procedure:

1. Ensure machine is in a safe state, all personnel clear, drives ready but not enabled.
2. Press the E-Stop pushbutton (engage STO).
3. Verify STO active for the affected axes via r9773 and the drive LED indicators (yellow flashing on SINAMICS).
4. Hold E-Stop for at least the configured debounce + test window (typical minimum 500 ms; check P9650/P9651).
5. Release E-Stop.
6. Acknowledge the safety messages via the configured ack mechanism (e.g., DB31.DBX7.7 – SI acknowledge).
7. Power-cycle or run the test stop sequence via the PLC FB (FB11 / safety FB per Siemens library).

Per Siemens Support ID 109974210, the shutdown paths of up to 6 axes can be tested sequentially using the dedicated block; verify the assignment in the FC block so that the FCP is forced on each axis in turn, not only on the ones whose r9773.31 was set.

6. Isolating the Intermittent Hardware Fault

Because the field report shows that the same warning reappears on power-on in roughly the same axes, the E-Stop reset is masking a real hardware issue. Use this matrix to localize it:

7. Why the Fault Appears on Power-On Only

Three engineering reasons combine to explain the field observation:

1. STO is not asserted before power-off. If the E-Stop is not pressed before the main contactor drops, the SINAMICS sees a hard power-down with STO inactive. This is allowed, but the FCP self-test on the next power-up will require a verification cycle, and on borderline hardware (e.g., marginal capacitors on the F-DI filter) it can flag the path as untested.
2. Power-on inrush noise. The first 200–800 ms of a power-on produce a large inrush on the DC bus and on the 24 V rail. If F-DI filtering is on the edge, the safety logic can interpret transient logic levels as a failed test and demand a re-test.
3. Marginal encoder or SMC module. The Extended Safety Functions on SINAMICS (SS2, SLS, SDI, etc.) close the loop through the encoder. A single dropped sample during the power-on self-test will flag the FCP.

8. Recommended Long-Term Mitigation

• Configure P9659 to a value that fits the maintenance window (Siemens default 8760 h = 1 year).
• Implement a PLC-driven FCP at every scheduled shift change or every 24 h, using the FB from the Siemens safety library. This guarantees the warning never propagates to power-on.
• Replace Phoenix-style screw terminals that show oxidation on the E-Stop chain.
• Verify 24 V supply to F-DI with an oscilloscope at the drive terminal, not at the cabinet.
• Always issue E-Stop before opening the main disconnect. This keeps the SINAMICS in a known STO state across the power-down.
• Document the parameter set in the machine's safety acceptance report (per IEC 61800-5-2 / ISO 13849).

9. Verification After Reset

After performing the FCP reset, verify the following sequence before returning the machine to production:

1. Online check: r9773.31 = 0 for all axes.
2. P9659 should display a positive non-zero value (e.g., 8759 h if reset just after the 1-year mark).
3. Issue an E-Stop and confirm the drive immediately drops torque (STO active, drive LED goes yellow flashing).
4. Release E-Stop, acknowledge, and verify the drive re-enables without warning.
5. Run a controlled motion on each of the 8 axes at low velocity; verify no F01611 / F30611 appears in the buffer.
6. Power-cycle the machine twice to confirm the warning does not return on subsequent cold starts.

10. Related Fault Codes and Parameters

Cross-references in Siemens documentation:

• SINUMERIK ONE: Testing shutdown paths (ID 109974210)
• Application Note – Testing shutdown paths (PDF)

11. Standards Context

The forced checking procedure is mandated by IEC 61800-5-2 (Adjustable speed electrical power drive systems – Safety requirements) and is a key element of ISO 13849-1 (PL e / Cat 4) designs. The purpose is to detect a dormant fault in the shutdown path that would prevent the safety function from operating on demand. The test must be executed at least once within the FCP interval, and any failure of the test places the drive into a safe state and demands operator intervention. Always verify that the FCP interval recorded in your machine's safety validation report matches P9659.