SINAMICS G120C Safety Commissioning: Resolving PROFIdrive Errors on P10, P9762, and P9763

Commissioning a SINAMICS G120C drive with Safety Integrated (STO via PROFIsafe) on an S7-1500F controller is a well-documented workflow, but field engineers routinely hit a wall when the drive rejects safety commissioning with PROFIdrive parameter errors. This reference documents the exact failure mode, the affected parameters, the root cause, and a verified recovery procedure for the G120C part number 6SL3210-1KE13-2UF2 on firmware V4.7.6, and applies to equivalent G120C PN variants that support PROFIsafe via Telegram 30. Use it as a field-proven sequence when a safety commissioning password prompt is followed by PROFIdrive device reports value invalid or manufacturer specific error on p0010, p9762, and p9763.

1. Overview: G120C Safety Commissioning Workflow

Safety commissioning on a SINAMICS G120C is a two-stage process. The drive must be released from a basic commissioning state before the safety parameter set can be accepted. The standard flow on a new G120C PN is:

1. First power-up: the drive is in basic commissioning mode. The IOP-2 or STARTER / SINAMICS Startdrive wizard walks through motor data, encoder, control mode, command and setpoint sources, and minimum / maximum frequency.
2. Basic commissioning is completed by setting p3900 = 1 (or by exiting the wizard with Calculate factory settings). This exits commissioning mode and enables the safety commissioning wizard.
3. Safety commissioning is started from the parameters menu (online) or from the Safety Integrated wizard. The user is prompted for the safety password (default 0) and assigns a new password to lock p9761.
4. The wizard configures the F-DI / F-DO topology, the PROFIsafe source address (F_Dest_Add), the PROFIsafe telegram (typically Telegram 30), and the SIL/PL limits. After acceptance, p9700 = 1 triggers a CRC check and a RAM-to-ROM copy.
5. Acceptance test is performed on the integrated safety functions (STO, SS1, SLS as supported) and logged in the safety acceptance report.

If step 1 or 2 is incomplete, the safety commissioning wizard opens the password dialog but every write attempt is rejected by the drive because it cannot accept safety parameters while still in a non-released commissioning state. The PROFIsafe stack inside the drive returns a negative response to the parameter write, which STARTER / SINAMICS Startdrive surfaces as the value invalid or manufacturer specific error alarms.

2. Affected Part Numbers, Firmware, and Tooling

The reported failure occurred on the hardware and software stack below. Use this as a baseline when reproducing the issue.

3. Symptoms: The Three-Error Stack

When the safety commissioning wizard is started out of order, the drive surfaces three simultaneous errors. All three are PROFIsafe parameter-write rejections surfaced by the engineering tool, not native drive faults.

The key tell is the order: the safety wizard always writes p0010 = 95 first, and only then writes the password pair p9762 / p9763. If the p0010 write is rejected, the p9762 / p9763 writes are never executed by the drive firmware; the engineering tool then reports the write failures back to the user as the three-error stack shown above.

4. Parameter Decoding: What p0010, p9761, p9762, p9763 Actually Do

Understanding these four parameters is the fastest way to diagnose the failure. Each has a specific role in the safety commissioning state machine.

4.1 p0010 — Drive Commissioning Parameter Filter

p0010 is the parameter filter that gates the parameter write path. The SINAMICS firmware only accepts parameter writes in the current filter group. The relevant values are:

If the wizard tries to set p0010 = 95 but the drive is still in p0010 = 1 (or p0010 = 30) because basic commissioning was never exited cleanly, the write fails and the wizard displays the value invalid error. The full parameter reference is in the SINAMICS G120C List Manual.

4.2 p9761 — SI Password (Read)

p9761 is the read-only view of the current safety password. The default on a new drive is 0. The password is 4 ASCII characters packed into a 32-bit value. Once a non-zero password is written via p9762 / p9763, all subsequent safety parameter changes require the password to be supplied.

4.3 p9762 — SI Password New (Write Only)

p9762 accepts the new password as a 32-bit integer. The wizard packs the 4-character ASCII string and writes it here. After a successful write, p9761 takes the new value on the next power cycle or safety commissioning run.

4.4 p9763 — SI Password Confirmation (Write Only)

p9763 accepts the same value as p9762. The drive compares p9762 and p9763; if they match and p0010 = 95, the new password is committed. A mismatch is reported as a manufacturer-specific error.

4.5 p9601 and p9801 — Quick Sanity Check

Some field procedures (including a suggestion in the original case) call for setting p9601 = 0 and p9801 = 0 as a sanity check during safety recovery. Both parameters are SI enable registers: p9601 is the global SI enable, fail-safe functions control word, and p9801 is the SI enable for the safety MCU. Reading them is a useful diagnostic — if either is non-zero but the safety state machine reports not commissioned, the parameters are out of sync with the commissioning state. The supported recovery is always via the wizard, not by direct parameter writes; the manual reset path is reserved for documented service cases.

5. Root Cause: Stuck in Basic Commissioning Mode

The chain of events in the reported case was:

1. The drives were powered up for the first time and the IOP-2 stepped through motor data and basic setpoints.
2. Engineering jumped to Parameters → Start safety commissioning before the basic commissioning wizard was fully closed and saved.
3. The safety wizard asked for the password. The user typed 0 and a new password. STARTER / TIA accepted the entries at the tool level, then attempted to write p0010 = 95, p9762, p9763 over PROFINET.
4. The drive rejected p0010 because the runtime was still in a non-runtime filter. The drive also rejected p9762 and p9763 because the safety commissioning state was never entered.
5. The IOP-2 simultaneously displayed saving of settings failed because its local write path saw the same rejections.

Other root causes that produce an identical three-error stack include:

• A previous aborted safety commissioning run with p9700 = 1 (CRC / copy) still pending.
• A drive-to-controller parameter set mismatch (e.g. STARTER online vs. the project offline) that STARTER resolves by writing p0010 first.
• Safety commissioning started before the PROFIsafe telegram was activated in the controller hardware configuration (the F-host is not yet online, so the PROFINET safety slot is not open and the drive rejects safety parameter writes).
• The drive is on an older firmware that requires the safety commissioning to be initiated from the IOP-2 only, not from STARTER. The 6SL3210-1KE13-2UF2 on V4.7.6 supports both paths, but the STARTER path requires the basic commissioning state to be cleared first.

6. Recovery Procedure: Step-by-Step

The verified recovery is to exit basic commissioning cleanly, then re-enter safety commissioning. The sequence below takes 10–20 minutes per drive.

1. Power-cycle the drive. This clears any pending parameter write attempts and forces the firmware to re-evaluate p0010 at boot.
2. Connect with STARTER / SINAMICS Startdrive. Go online to the drive via PROFINET. Read r0018 (firmware) and p0010 (current filter). If p0010 is anything other than 0, you are still in commissioning state.
3. Re-run the basic commissioning wizard. In STARTER / Startdrive, open the drive and launch Commissioning → Wizards → Basic commissioning. Walk through motor data, control mode, command source, setpoint source, and ramp times. Accept the defaults if the application is unknown.
4. End the wizard with "Calculate factory settings" or set p3900 = 1 on the parameter write screen. This writes all calculated values to non-volatile memory and clears p0010 to 0.
5. Save the project to ROM (Copy RAM to ROM). Wait for the save to complete. The drive should now be in the standard run state and you should be able to spin the motor from the STARTER control panel.
6. Verify basic run. Before touching safety, jog the drive from the STARTER control panel or with a small fixed setpoint. This confirms the drive is no longer in commissioning mode. If jogging also fails, the issue is not safety-related — go back to step 3.
7. Launch the Safety Integrated commissioning wizard. The password prompt appears. Enter the current password (0 on a fresh drive) and assign a new password of your choice (4 ASCII characters, e.g. 0001).
8. Configure the safety topology. On a G120C PN with PROFIsafe, the typical topology is:
   • SIL level: SIL 2 / PL d / Category 3
   • PROFIsafe source: PROFINET, Telegram 30
   • STO control: from the F-CPU via the LDrvSafe block
   • No terminal-based F-DI; terminals on the G120C PN are not safety inputs in this configuration
9. Assign the PROFIsafe F_Dest_Add. This must match the value configured in the F-CPU safety program. Common practice is to use the last 3 octets of the drive's IP address, e.g. 192.168.0.10 → F_Dest_Add = 10. The value is read back in p9766 / p9767 and p9810 / p9811.
10. Confirm with p9700 = 1 (SI copy RAM to ROM, CRC check). The drive performs a CRC on the safety parameter set. This is a non-recoverable step — wait for the drive to complete and remain in p0010 = 0.
11. Save the project and power-cycle the drive once more to bring up the new safety parameter set cleanly.

At this point the safety wizard completes without the three-error stack. The remaining work is the acceptance test described in section 9.

7. PROFIsafe Telegram 30 Configuration

Telegram 30 is the standard PROFIsafe telegram for SINAMICS G drives. It carries a 32-bit safety control word (S_STW1) and a 32-bit safety status word (S_ZSW1) as the process data payload. On the S7-1500F side, Telegram 30 is mapped automatically when the SINAMICS G120 GSD is added to the device configuration. See the SINAMICS G120C Function Manual (Safety Integrated) for the full definition.

Configuration steps in TIA Portal V15:

1. Open the device configuration of the F-CPU. Add the G120C PN from the GSD (GSDML-V2.3x-Siemens-SINAMICS_G120C-….xml).
2. In the device view, drag PROFIsafe Telegram 30 into slot 3. The standard drive telegram stays in slot 1.
3. Set the F-source address on the PROFINET interface. This is a per-CPU value (F_Source_Add) that the F-CPU inserts into every PROFIsafe telegram.
4. Set the F-destination address (F_Dest_Add) on the G120C. In SINAMICS Startdrive this is set during the Safety wizard; in the device configuration of TIA Portal it is also visible in the safety slot properties.
5. Add the LDrvSafe library. The blocks LDrvSafe_SinaGTlg30Control and LDrvSafe_SinaGTlg30Status handle the bit packing / unpacking for Telegram 30.
6. Compile the safety program. TIA Portal will fail the compile if F_Source_Add and F_Dest_Add are inconsistent with the device configuration.

The Telegram 30 S_STW1 bit assignments used by STO are:

8. Safety FB Programming in TIA Portal

The minimum F-runtime group should contain one F-FB (in the reported case, FB1) that owns the G120C safety interface. Inside the FB, the wiring is typically:

// F-runtime group (FB1 in safety program)
// Inputs
i_ESTOP : BOOL;       // F-DI from the safety relay / E-stop chain
i_MODE  : BOOL;       // F-DI for mode select (auto / manual)
// Outputs
q_STW1  : DWORD;      // S_STW1 to drive
q_Drive : ARRAY[1..2] OF LDrvSafe_SinaGTlg30Control;

// Logic
IF i_ESTOP = 0 THEN
    q_STW1.%X0 := 0;   // STO active
ELSE
    IF i_MODE = 0 THEN
        q_STW1.%X0 := 1;   // STO deselected, automatic run
    ELSE
        q_STW1.%X0 := 1;   // STO deselected, manual run
    END_IF;
END_IF;

q_Drive[1](PassIn := q_STW1, PassOut => w_Drive1STW);
q_Drive[2](PassIn := q_STW1, PassOut => w_Drive2STW);

The LDrvSafe_SinaGTlg30Control block takes the S_STW1 DWORD and packages it into the PROFIsafe payload for the standard Telegram 30 slot. On the read side, LDrvSafe_SinaGTlg30Status unpacks the S_ZSW1 feedback from each drive, including the active STO bit, the SS1 bit, and the SLS bits. The block-face documentation and wiring example are in the LDrvSafe Library for Telegram 30 application example.

9. Acceptance Test Execution

The acceptance test is the documented evidence that the safety chain has been validated. The SINAMICS G120C acceptance log is generated by the safety commissioning wizard (or via the Startdrive acceptance test tool) and must be signed by the responsible safety officer.

1. Power up the drive with the safety program running on the F-CPU.
2. Verify the drive reports normal operation (no F-faults on the S_ZSW1 status word).
3. Test STO select. From the safety input (E-stop or mode switch), drive S_STW1.0 = 0. The drive should coast to a stop and report STO active in S_ZSW1. Log the stop time.
4. Test STO deselect. Release the E-stop. The safety FB drives S_STW1.0 = 1. The drive should report STO deselected and be ready to accept a run command. The conveyor should be free to run.
5. Repeat the select / deselect cycle at least 3 times to verify deterministic behavior.
6. If SS1 is in scope, test the SS1 ramp and STO-after-ramp sequence.
7. Save the acceptance log as a PDF and attach it to the machine file. The log includes the CRC of the safety parameter set, the firmware versions, and the test results.

The STO bit is S_STW1.0 on the LDrvSafe side. The status word S_ZSW1.0 mirrors the same bit. If S_ZSW1.0 = 0 after S_STW1.0 = 1, the PROFIsafe link is alive but the drive is still seeing the STO select from a different source — check the F-DI wiring on the F-CPU and the mode selector.

10. Verification Checklist

Use this list after the recovery procedure to confirm the safety chain is operational.

11. State Diagram: Why Basic Commissioning Must Exit First

The state diagram below shows the failure path and the recovery path through the G120C commissioning state machine.

12. Common Pitfalls and Field Notes

The following issues have been observed in the field on G120C PN with PROFIsafe and are worth checking before a full re-commissioning.

12.1 Password Re-entry After Power-Cycle

The safety password is stored in non-volatile memory on the drive. If you forget the password, the only recovery is a manufacturer-specific reset, which is service-level work. Document the password in the machine file.

12.2 Telegram 30 vs Standard Telegram Confusion

Some legacy projects use the standard drive telegram (Telegram 1) for non-safety control and PROFIsafe Telegram 30 for safety. Make sure the standard telegram is configured for non-safety control (STW1, NSOLL_A, NIST_A) and Telegram 30 is configured for the PROFIsafe payload only. Mixing the two will produce S_ZSW1 values that do not match what the safety FB expects.

12.3 TIA Portal V15 vs V15.1 GSD Migration

On TIA Portal V15, the G120C GSD is the V2.3x series. On TIA Portal V15.1 and later, the GSD is updated to V2.34. The Telegram 30 layout is unchanged, but if you mix GSDs in a multi-project migration the F-signature is invalidated. Re-run the safety wizard in that case.

12.4 IOP-2 "Saving of Settings Failed"

The IOP-2 surfaces the same PROFIdrive write rejection that STARTER shows. The IOP-2 will not save a partial safety commissioning; the entire sequence must succeed or none of it is committed. If the IOP-2 reports the error, do not trust that any of the p9762 / p9763 writes have landed — verify with STARTER.

12.5 Drive-Controller Parameter Mismatch

If STARTER / Startdrive goes online and detects a parameter mismatch with the project offline, the tool attempts to write the entire drive configuration. This can include a p0010 transition that conflicts with an active safety commissioning. Resolve the mismatch before launching the safety wizard.

12.6 Drive Replacement in the Field

Replacing a G120C PN in the field means the new drive starts in factory-default state with safety password 0. The project offline has the configured parameters. The recovery is identical to a first-time commissioning — basic wizard, save, safety wizard, save, acceptance test. There is no "transfer" of safety parameters from the project to the drive without going through the safety wizard.

12.7 PROFINET Name and IP Consistency

The F_Dest_Add is per-device. If the drive is replaced and the PROFINET device name is changed, the safety wizard must be re-run with the new F_Dest_Add. A common field error is to copy the offline project with the old F_Dest_Add and forget to re-run the wizard after the IP / name change.

13. Quick-Reference Parameter Map

14. Related Official Documentation

• SINAMICS G120C Operating Instructions — primary reference for the part number 6SL3210-1KE… family
• SINAMICS G120C Function Manual (Safety Integrated) — STO / SS1 / SLS function description and parameter reference
• SINAMICS G120C List Manual — complete parameter list including p0010, p9700, p9761, p9762, p9763, p9766, p9767, p9810, p9811
• S7-1500F / ET 200S Safety Manual — F-CPU side, F_Source_Add / F_Dest_Add, F-runtime group
• LDrvSafe Library for Telegram 30 (application example) — block-face documentation and wiring

FAQ