Problem Overview
On a SINUMERIK 840D sl system equipped with an NCU 572.5 and a PCU 50 HMI controller, the controller can present a sustained boot fault when an axis is left in an unreferenced state across a power-down event. The visible symptom is the simultaneous appearance of:
-
27000NCU1: Axis Drum1 is not safely referenced -
300950NCU1: Axis Drum1 drive 9 is not safely referenced
When the alarm pair appears together, the NCU enters a self-resetting state that mimics an NCK reset: the operator panel backlights flash, the mode keys are ignored, the channel reset button is dead, and the controller will not advance to operator-ready state. Power-cycling and NCK reset alone do not clear the condition because the user agreement for the affected axis has not been re-issued. The condition cascades from the PLC side: when the PLC battery has discharged (< 2.0 V on a 3.6 V lithium cell), the PLC program is lost and the NCU-to-NCU bus handshake collapses, preventing the operator from changing modes to acknowledge the referencing.
This article documents the root cause, the recovery procedure (axis referencing + user agreement), the involved machine data, and the PLC battery preventive maintenance that resolves and prevents the failure on 9-axis systems with multiple coupled NCUs.
SINUMERIK Safe-Referencing Concept
In SINUMERIK 840D sl, the term safely referenced does not mean merely that the encoder has been homed. It means that the absolute position value supplied by the measuring system has been positively compared against the machine zero and that the operator (or the PLC user program) has confirmed the value via the user agreement interface. The system uses two parallel referencing concepts:
- Standard referencing for absolute encoders. Once the absolute encoder is initialized and the controller recognizes the position, the axis transitions to the referenced state automatically.
- Safety Integrated (SI) referencing for drives that participate in Safety Integrated functions (SOS, SLS, SS1, SS2). The drive additionally verifies that the absolute position agrees with the safe position table; if not, alarm 27000 is raised and SI functions remain inhibited until user agreement is granted.
The user agreement is a discrete acknowledgement: the HMI writes to DB31, ... DBB60.4 (axis-specific user agreement bit) or, on Safety Integrated axes, the PLC triggers the safe referencing sequence via $A_DBB or the dedicated NCK command. Until the agreement is registered, the axis remains in the alarm 27000 state and SI motion functions cannot be enabled.
Alarm Catalog: 27000, 27100, and 300950
| Alarm | Source | Meaning | Reset Class |
|---|---|---|---|
| 27000 | NCK (SI) | Axis not safely referenced - the SI referenced state is invalid, lost across power-down, or the user agreement is missing. | NC RESET required after agreement. |
| 27100 | NCK (SI) | At least one axis is not safely referenced. Group alarm generated when 27000 is pending on one or more SI axes. See Siemens ID 109806981 - 27100 description. | NC RESET after per-axis agreement. |
| 300950 | SINAMICS drive | Drive-side reporting of the same condition. The drive has not seen a safe referencing acknowledgment. | Drive warm restart after agreement. |
Machine Data Involved
| MD | Name | Observed / Required Value | Meaning in this Fault |
|---|---|---|---|
| MD34210 | $MA_ENC_REFP_STATE (read) | 2 reported in the field | Indicates the encoder has been referenced and the absolute position is valid. A value other than 2 (i.e. 0 or 1) means the encoder is no longer in the referenced state and alarm 27000 will be raised. |
| MD34110 | $MA_REFP_CYCLE_NR | Set per axis to a unique channel/cycle number | Identifies which NCK channel sequence owns referencing for this axis. Must match the PLC user agreement sequence number. |
| MD34200 | $MA_ENC_REFP_MODE | 1 (incremental) / 2 (absolute, with absolute encoder present) | Defines whether referencing is incremental or absolute. On absolute encoders that lose position, this must be re-evaluated after the mechanical displacement. |
| MD36060 | $MA_STANDSTILL_POS_TOL | Manufacturer default | Tolerance used when validating user agreement against actual encoder position. |
| MD36933 / MD36934 / MD36935 | SI safely referenced configuration bits | Per axis, SI configuration | Enable SI safely referenced monitoring and the safe position tolerance window for user agreement validation. |
The field reading of MD34210 = 2 on the affected Z axis at power-up is significant: it shows the encoder is reporting a valid absolute value, but the controller still raises 27000 because the SI user agreement has not been issued for the current position. MD34210 = 2 is therefore necessary but not sufficient to clear the alarm - the user agreement must still follow.
Root Cause Analysis
The direct mechanical cause in the field case is straightforward: hydraulic work on the machine moved the axis while the controller was powered down. Once power was restored, the encoder reported a position that no longer matched the last saved user agreement, and the SI safely-referenced state was invalidated. Alarm 27000 was raised.
The secondary failure is the one that prevents resolution. On a 9-axis machine built around three coupled NCUs:
- The PLC retains the user agreement handshake logic and the cross-NCU bus coordination routine in its retentive image.
- The PLC battery (3.6 V lithium primary cell on the PLC backplane) had decayed to 0.2 V.
- The PLC lost its program and the retentive data on the next power cycle.
- Without the PLC user agreement routine, the NCU cannot be commanded from the operator panel to a mode that allows the user agreement to be re-issued.
- The NCK enters the perpetual reset loop - panel lights flash, no mode change possible, no clear possible.
This is a classic cascade: the mechanical displacement only triggers the alarm; the PLC battery decay is what prevents recovery. The fault will present the same way on any 840D sl system with a discharged PLC battery even without mechanical displacement, because the bus fault alone blocks mode changes.
NCU 572.5 Boot Sequence Under the Fault
When alarm 27000 is pending and the PLC handshake is broken, the NCU 572.5 boot path looks like the following state diagram:
Recovery Procedure
The recovery sequence has two parallel tracks - mechanical and electrical - that must be completed before the alarm can be cleared. Do not attempt to clear alarm 27000 from the HMI before both tracks are complete; the controller will re-raise the alarm immediately and the operator panel will stay in the flashing reset state.
Track A - Restore the PLC
- Verify PLC battery voltage with the controller powered down. A reading below 2.5 V on a 3.6 V lithium cell indicates the cell is end-of-life and the program may already be lost.
- Replace the PLC battery with the manufacturer-specified equivalent (3.6 V lithium primary, e.g. the SINUMERIK PLC backup battery referenced in the PLC hardware manual). Observe correct polarity and install with the controller powered to preserve any remaining retentive data.
- Re-load the PLC project from the most recent backup to the PLC (STEP 7 / TIA Portal as installed).
- Confirm the PLC-to-NCU bus returns to RUN without diagnostics. Check the PLC diagnostic buffer for any residual bus errors before proceeding.
Track B - Re-Reference the Axis
- Bring the affected axis mechanically to the machine home (reference) position. For the Drum1 axis in the field case, jog the axis to the manufacturer-defined reference mark using the handwheel or manual mode only after Track A is complete.
- Verify
MD34210reads 2 in the axis MD view, confirming the encoder is reporting a valid absolute value. - Activate the referencing sequence from the HMI: Commissioning > Axes > Reference, or via the PLC by triggering the referencing FC for the axis.
- Once the axis is physically referenced and the position matches the saved reference within the SI tolerance, issue the user agreement via the HMI menu Commissioning > Safety Integrated > User agreement, or via the PLC user agreement bit (
DB31, ... DBB60.4 = 1) for non-SI axes. - Clear alarm 27000 with NC RESET. Alarm 300950 will clear automatically on the next drive warm restart or after a power cycle.
Track C - Verify the Multi-NCU Bus
- Confirm all three NCUs in the field case report
RUNon the NCU link display. - Check that mode change (JOG / MDA / AUTO) is now accepted at the panel. If mode change still fails, repeat Track A - the PLC program restoration was incomplete.
- Verify the PLC handshake bits in the cross-NCU DB are updating - this confirms the bus is alive.
Verification
After the recovery, run the following verification sequence before returning the machine to production:
| Step | Action | Pass Criterion |
|---|---|---|
| 1 | Power-cycle the controller (NC OFF / NC ON). | NCU boots to operator-ready state within 60 seconds. |
| 2 | Read MD34210 for every axis. |
All axes report 2 (absolute, referenced). |
| 3 | Read the alarm line on the HMI. | No 27000, 27100, or 300950 alarm present. |
| 4 | Change mode from JOG to MDA to AUTO. | Mode change accepted; channel reset clears. |
| 5 | Jog each axis in JOG mode at 10% rapid override. | Motion allowed; SI monitoring functions active. |
| 6 | Run an SI test stop (where required) on each axis. | Test stop completes without 27000 / 300950 re-appearing. |
| 7 | Run a part program in AUTO with the operator door closed. | Program completes; no new alarm on the alarm history line. |
PLC Battery Preventive Maintenance
The PLC battery is the single most common cause of the secondary cascade that blocks 27000 recovery on multi-NCU machines. Recommended maintenance practice:
- Replacement interval: Replace the lithium backup battery every 3 years regardless of measured voltage, or sooner if any controller event reports low battery.
- Voltage check: Measure annually with the controller powered. Replace at first reading below 2.7 V on a 3.6 V cell.
- Hot-swap requirement: Always replace with the controller powered, otherwise the retentive PLC image (including the user agreement handshake routine) is lost.
- Backup policy: Maintain a current STEP 7 / TIA Portal project backup on external media after every PLC program change so the user agreement routine can be restored in the event of total battery loss.
Troubleshooting Matrix
| Symptom | Likely Cause | Action |
|---|---|---|
| 27000 + 300950 on power-up after mechanical work | Axis moved while powered down; SI referenced state invalidated. | Re-reference the axis to the machine zero, issue user agreement. |
| Panel lights flash, no mode change, no reset accepted | PLC program loss, multi-NCU bus handshake collapsed. | Verify PLC battery, restore PLC project, then re-reference. |
| 27000 clears momentarily, returns on next NCK reset | User agreement not saved or SI safely-referenced configuration incomplete. | Save the agreement via Commissioning > Safety Integrated > User agreement; verify MD36933 / MD36934 / MD36935 are correct. |
| 27000 only on Z axis after every power-down | Z axis absolute encoder position drifts at power-down, or MD34200 mismatch. | Check mechanical coupling and MD34200; verify encoder backup battery. |
| 27100 (group alarm) without 27000 detail | One or more SI axes have unreferenced sub-components (e.g. second encoder). | Open the alarm detail view; resolve the underlying 27000 / drive alarm first. |
Related Configuration Pitfalls
Two recurring configuration mistakes extend the recovery time even after the mechanical and PLC issues are resolved:
Frequently Asked Questions
Why does the NCU stay in the flashing reset state when alarm 27000 is pending?
The flashing reset state is the controller's behavior when the PLC handshake is broken, typically because the PLC program is missing or the PLC battery has failed. The NCK cannot accept a mode change, channel reset, or alarm clear until the PLC returns to RUN and the cross-NCU bus handshake completes. Restore the PLC program and battery before attempting to clear 27000.
Can I bypass the user agreement by changing MD34210 to 2?
No. MD34210 is a status MD that reflects the encoder referencing state; it cannot be forced to 2 to bypass the user agreement. The user agreement must be issued by the operator or the PLC after the axis is mechanically referenced. Forcing MD values to clear SI alarms is a safety violation and will be detected by the SI diagnostics on the next test stop.
What is the difference between alarm 27000 and alarm 27100?
Alarm 27000 is the per-axis alarm - it identifies which axis is not safely referenced. Alarm 27100 is the group alarm raised by the controller when one or more axes are in that state. Clear the underlying 27000 (and 300950 from the drive) first, then 27100 will clear with the next NC RESET.
Why does the Z axis in particular lose user agreement after every power-down?
The most common cause is an MD34200 mismatch on a retrofitted absolute encoder, or a discharged encoder backup battery on the drive side. On machines where the Z axis carries the heaviest mechanical load, gravity-induced drift at power-down can also displace the encoder beyond the SI safely-referenced tolerance window. Investigate mechanical drift, encoder battery, and MD34200 in that order.
How do I prevent the fault from recurring after recovery?
Maintain a strict PLC battery replacement schedule (every 3 years or at first sub-2.7 V reading), keep a current STEP 7 / TIA Portal project backup offline, and verify MD34200 / MD34210 values for every absolute encoder axis at every commissioning review. Lock-out / tag-out hydraulic and mechanical actuators during extended power-downs to prevent accidental displacement of unreferenced axes.