SINAMICS S120 Fault and Alarm Code Reference for HMI Integration
The SINAMICS S120 List Manual is the canonical reference document for every fault (F) and alarm (A) number emitted by Control Units, Motor Modules, Line Modules, Terminal Modules, Sensor Modules, and DRIVE-CLiQ components. The document is delivered both as a single searchable PDF and as a structured CSV / XLSX export that is tied to a specific firmware release. This reference consolidates the procedure for retrieving those lists, parsing the entries, and rendering fault texts on TP Comfort panels, WinCC Runtime, and SIMATIC S7 CPUs without inheriting a stale or version-mismatched text database.
1. SINAMICS S120 Diagnostic Architecture Overview
Each drive object on a SINAMICS S120 line (CU320-2, CU310-2, CU305, Motor Module, Active Line Module, Smart Line Module, Basic Line Module, Terminal Module TM31 / TM15 / TM120, Sensor Module SMC10 / SMC20 / SMC30 / SME20 / SME25, Brake Control Module) maintains two separate event channels:
- Faults (Störungen, F-numbers) - latched events that require acknowledgement, are written to the non-volatile fault buffer, and are usually followed by a configured stop reaction (OFF1, OFF2, OFF3, STOP1, STOP2, or none).
- Alarms (Warnungen, A-numbers) - non-latched, transient events written to the alarm buffer. Alarms self-clear when the cause is removed and do not require acknowledgement.
Both channels live in the originating drive object. The Control Unit aggregates them centrally and exposes them to higher-level controllers through three parallel paths:
-
PROFINET / PROFIBUS cyclic and acyclic services - the PLC reads parameter
r0945(fault number),r0949(fault value),r2122(alarm number) and the corresponding text parametersr0947andr2121via the standard PROFIdrive data-record mechanism (DS47 acyclic read). - Web server (SINAMICS Web) - SINAMICS S120 firmware 4.4 SP3 and later ships with an integrated HTTP / HTTPS web server that renders the fault and alarm buffer in a browser or panel Internet Explorer engine.
- STARTER / Startdrive - offline and online diagnostic buffer view, also supporting CSV export directly from the diagnostic window.
When the application requires human-readable texts on a Comfort Panel (TP700 / TP900 / TP1200 / TP1500 / TP1900) or in WinCC Runtime Professional, the engineer must align the firmware-specific List Manual export with the HMI project. The official Siemens path is the List Manual PDF and the matching CSV / XLSX export published on Siemens Industry Online Support.
2. List Manual as the Authoritative Fault Source
The List Manual is published per firmware release on the Siemens Industry Online Support portal. Two English editions are commonly referenced today:
- List Manual S120 / S150 LH1, edition 04/2014 - the historical reference, available as a single 3,000+ page PDF under support entry 99682911. Covers firmware line 2.x and 4.0 - 4.5.
- List Manual S120 / S150 LH1, edition 06/2020 - the current reference, available as a single PDF under support entry 109781807. Covers firmware line 4.7 and later.
The PDF is divided into the following functional groups:
- Fault and alarm lists for Control Units (CU310-2, CU320-2, CU305, CU240E-2 PN variants used in S120 mode)
- Power unit and supply faults (Infeed, Motor Module, single-axis chassis, booksize, blocksize)
- Encoder and Sensor Module faults (resolver, EnDat 2.1 / 2.2, SSI, HTL / TTL, sin / cos, DRIVE-CLiQ encoder interface)
- DRIVE-CLiQ topology faults (missing component, wrong component, firmware mismatch, hot-plug events)
- Communication faults (PROFIBUS DP, PROFINET RT / IRT, EtherNet/IP, Modbus TCP)
- Safety Integrated faults (SBC, SS1, SS2, SOS, SLS, SDI, SLP, SCA, SBR, PROFIsafe)
- Brake control, terminal, and option-module faults (TM31, TM15, TM120, CBE20, CBC10, SMC, SME)
For HMI text generation, the engineer extracts four columns that matter to automation: Fault number, Reaction (OFF1 / OFF2 / OFF3 / STOP1 / STOP2 / none), Acknowledgement (POWER ON, IMMEDIATELY, PULSE INHIBIT), and Cause / Remedy text. The PDF delivers the full text. The CSV / XLSX export delivers the numeric identifier plus a brief cause description - sufficient as a lookup key but never a substitute for the manual text.
3. Numbering Convention and Range Map
SINAMICS fault numbers occupy the range 0 ... 999,999. The high-order digits encode the subsystem and the low-order digits encode the specific event. Although low-order ranges shift between firmware versions, the high-order block is stable across recent releases:
| Number Range | Subsystem | Example Trigger Family |
|---|---|---|
| F1xxxx / A1xxxx | Control Unit (general) | Configuration error, parameter consistency, command source, setpoint source |
| F2xxxx / A2xxxx | Power Module (Motor Module) | Overcurrent, IGBT desaturation, ground fault, thermal overload, output filter |
| F3xxxx / A3xxxx | Supply / Infeed Module | Line undervoltage, pre-charge failure, line overvoltage, mains failure |
| F4xxxx / A4xxxx | Encoder / Sensor Module | Encoder signal lost, track failure, commutation, EnDat / SSI parity |
| F5xxxx / A5xxxx | Closed-loop / open-loop control | Speed controller at limit, following error, Vdc controller, motor identification |
| F6xxxx / A6xxxx | Communication (PROFINET, PROFIdrive profile) | Sign-of-life failure, setpoint timeout, controller sign-of-life, telegram failure |
| F7xxxx / A7xxxx | Function modules, technology packages | Positioning, synchronous operation, basic positioner, DCC, technology controller |
| F8xxxx / A8xxxx | DRIVE-CLiQ topology and hot-plug | Missing component, wrong component, firmware mismatch, CRC error |
| F12xxxx / A12xxxx | Safety Integrated (Failsafe) | STO / SS1 / SLS / SDI / SLP discrepancy, PROFIsafe, F-DI, F-DO |
4. Buffer Locations and Time Stamps
Each Control Unit maintains the following diagnostic registers. All of them are read-only unless stated otherwise.
| Parameter | Meaning | Length / Type |
|---|---|---|
| r0945[0..7] | Fault code (8-slot ring buffer) | Unsigned16 |
| r0947[0..7] | Fault number text index / time stamp (legacy) | Floating-point time |
| r0948[0..7] | Fault time received, drive uptime (ms) | Unsigned32 |
| r0949[0..7] | Fault value (subsystem-specific data) | Integer32 |
| r2109[0..7] | Alarm code (8-slot ring buffer) | Unsigned16 |
| r2122[0..7] | Alarm number text index | Unsigned16 |
| r2123[0..7] | Alarm time received | Unsigned32 |
| r2124[0..7] | Alarm value | Integer32 |
| r2130[0..63] | Combined fault and alarm buffer (chronological list) | Unsigned16 |
| r2131 | Current fault code, bit-coded (one bit per active fault) | Unsigned32 |
| r2132 | Status word, alarms (bit-coded) | Unsigned16 |
| r2133.0..15 | Fault / alarm change bits (0 = fault, 1 = alarm, 8 = safety) | Boolean |
| r2135.12..15 | Status, additional information | Boolean |
| p3981 | Acknowledge all faults (write 0 = reset) | Unsigned8 |
The combined buffer r2130 stores 64 entries in chronological order; each entry is a fault or alarm number. Engineers use slot index 0 for the most recent event and walk down to slot 63 for the oldest. The SINAMICS S120 standard telegrams (Siemens telegram 1, 2, 3, 4, 5, 6, 7, 9, 20, 110, 111, 116, 220, 370) provide status bits ZSW1.E_OFF1, E_OFF2, E_OFF3, E_ACK, E_FAULT, E_ALARM, E_ZSW1_8 (drive warning) directly to the PLC. For S7 programs that only need an at-a-glance summary, parsing ZSW1.E_FAULT and E_ALARM is the recommended entry point.
5. CSV / XLSX Export Workflow
The Siemens support entries 99682911 (04/2014 List Manual) and 109781807 (06/2020 List Manual) both deliver the structured exports. The following procedure aligns an HMI text database with the firmware actually running on the Control Unit.
- Identify the firmware version on the Control Unit. In STARTER, navigate to the drive object and read parameter
r0018(firmware version) andr0020(firmware build). In TIA Portal with Startdrive, the same values appear in the device diagnostics view. In WinCC Runtime, poll them by acyclic read ofp0009orr0018. - Open the List Manual edition that matches that firmware. The Siemens support page lists editions by date and firmware line. Confirm that the entry "06/2020" or "04/2014" cover the firmware you have.
- Use the PDF as the source of truth for the cause-and-remedy column. For large-scale text provisioning in WinCC or TIA Portal HMI, the CSV export is faster.
- Import the CSV into the HMI engineering tool. WinCC (TIA Portal) supports direct import of fault text libraries via a custom CSV with columns
Number;Reaction;Acknowledgement;Text DE;Text EN;Text ZH;Text .... The column separator must be configured in the import dialog; the standard Siemens export uses semicolon. - For WinCC flexible / ProTool legacy panels, build a tag-based text list. Each text row is keyed by an Integer tag whose value matches the SINAMICS fault number. Index the row range so that the difference between two consecutive fault numbers is no more than the number of rows in the list - the search uses linear lookup.
6. PLC Program Reading the Fault and Alarm Buffer
For SIMATIC S7-1200 / S7-1500 with SINAMICS S120 over PROFINET, the recommended access path is acyclic data-record read. The PROFIdrive profile V4.2 specifies the following standard record indexes:
| Record Index | Content | Data Length | Notes |
|---|---|---|---|
| 0x4040 | Alarm 1 (alarms 0..7) | 62 bytes | Same as r2122 / r2124 |
| 0x4041 | Alarm 2 (alarms 8..15) | 62 bytes | Older firmware only |
| 0x4042 | Fault buffer (8 entries) | 64 bytes | Same as r0945 / r0949 |
| 0x4043 | Manufacturer-specific fault extension | 64 bytes | For vendor-defined data |
| 0x404B | List of all fault codes supported by the drive | variable | Useful for HMI import |
| 0x404C | List of all alarm codes supported by the drive | variable | Useful for HMI import |
The structure of record 0x4042 is:
| Offset | Length | Field | Description |
|---|---|---|---|
| 0 | 2 | Number of valid entries | 1..8 |
| 2 | 32 | Fault codes (4 bytes each, 8 slots) | Same as r0945 |
| 34 | 16 | Slot / drive-object ID | Identifies the originating object |
| 50 | 16 | Specifier | Bit 0: entry valid; Bit 1: entry changed |
Acyclic read is triggered from the S7 program using the standard block RDREC (S7-1500 / S7-1200) or SFC59 RD_REC (S7-300 / S7-400). The call signature for S7-1500 is:
CALL "RDREC_DB" , DB_FaultBuffer
REQ := bStartRead
ID := %IW256 // PROFINET device number, drive 1
INDEX := 16#4042 // Fault buffer record
MLEN := 64
VALID => bValid
BUSY => bBusy
ERROR => bError
STATUS := wStatus
LEN := iLen
RECORD := pBuffer // P#DBX0.0 BYTE 64
The drive number / IO device ID is the one assigned during PROFINET configuration in the topology editor. The record index 0x4042 follows the PROFIdrive profile V4.2 parameter ID for the fault buffer. After the read completes, the S7 program scans the first 4-byte field as an unsigned DWORD; the upper 16 bits are zero and the lower 16 bits are the fault number. The result is written to an HMI tag of type Word, and the HMI text list looks the number up to display the message. The acyclic read also returns a fault value at offset 14..17 (4 bytes, same order as r0949) which provides vendor-specific additional information: motor temperature, encoder index, drive-object ID, frequency, etc. The HMI display can include this value as a second line of the message.
7. WinCC Comfort and TIA Portal Text Library
Once the CSV has been parsed, the engineer creates a text list in the HMI project with the following structure:
- Insert a new Text list in the HMI project under HMI tags > Text lists.
- Set the List range to Number range and provide the minimum (e.g., 100) and maximum (e.g., 99999) of the fault code universe.
- For each imported row, generate one list entry. The key is the fault number. The default text and the language-specific texts are loaded from the CSV columns.
- Wire the text list to a Word tag whose value comes from the S7 acyclic read result (S7-1500) or from the cyclic ZSW1 + ZSW2 status words (compact path, no text for non-mapped numbers).
- Set the text list to Display name mode for symbolic IO fields, or to Text only for plain text display.
For WinCC Professional (SCADA) the equivalent mechanism is the Text library on the HMI server, exported to *.csv and re-imported on translation refresh. The path is Languages & Resources > Text Library > Export. The WinCC text library supports tags of type Integer only; if the source provides a Word value, convert it with a script or a limit check.
8. STARTER and Startdrive Buffer Display
STARTER (legacy, for SINAMICS firmware 2.x and 4.x up to 4.6) provides an offline / online buffer view through the menu Drive > Diagnostics > Faults and alarms. The buffer is downloadable as a CSV with the menu item Save as... directly from the diagnostic window. Startdrive (TIA Portal) exposes the same dialog under Online & diagnostics > Diagnostics buffer. The exported CSV uses semicolon as a separator and encodes the time stamps in SIEMENS-internal floating-point format, which is the number of days since 01.01.1900. Convert to human-readable time with the formula:
TimeSeconds = (FloatValue * 86400) - 2208988800; // 2208988800 = 01.01.1900 to 01.01.1970 in seconds
The resulting UNIX timestamp can be formatted as a date/time string in the HMI using the standard WinCC function FormatDateTime(). STARTER additionally exports the cause text in a human-readable form (multi-line) suitable for printing.
9. SINAMICS Web Server (Firmware 4.4 and Later)
CU320-2 PN and CU310-2 PN with firmware 4.4 SP3 or later ship with an integrated web server. Enable the function by setting p8985 to 1 and configuring p8986 (port, default 443) and the user accounts. The web server exposes the fault and alarm buffer at:
https://<ip>/index.php?lang=en&page=diagbuffer
From a panel-browser integration (TP1200 with Sm@rtServer / Sm@rtClient) the same URL is rendered in the panel's Internet Explorer engine. For headless integration, the JSON API at https://<ip>/api/diagbuffer.json returns the buffer in machine-readable form, ready to be parsed by a custom SCL function in an S7-1500. The JSON response includes the same fields as r0945 / r0949 / r0948 plus a "text" field that is populated from the firmware-internal text table - useful for low-effort HMI integration but only available in the languages baked into the firmware build.
10. Field-Proven Selection of Common Fault Families
The following table lists frequently encountered fault families and the first diagnostic step. Number ranges reflect what appears in the List Manual; the exact code must be confirmed against the firmware edition in use.
| Symptom | Likely Range | First Diagnostic Step |
|---|---|---|
| Motor does not start, IMMEDIATELY ack required | High 1xxxx, often configuration or command-source missing | Read p854, p1155, r0002; verify command source in STARTER / Startdrive |
| Overcurrent on Motor Module | High 2xxxx | Read r0949, motor wiring, encoder cable; check ramp p1120 / p1121 for too steep |
| DC link undervoltage | High 3xxxx | Check line quality, Active Line Module p0210 voltage setting, pre-charge contactor wiring |
| Encoder SSI / EnDat / Resolver fault | High 4xxxx | Check encoder cable shield, parameter p0400 (encoder type), p0425 (resolution) |
| PROFINET sign-of-life failure | High 6xxxx | Cycle time mismatch, IRT vs. RT configuration, watch-dog p2048 |
| DRIVE-CLiQ component missing | High 8xxxx | Topology comparison p0098 / p0099, LED state of the affected component, check that the firmware version of the DRIVE-CLiQ node matches the CU (p7820) |
| Safety Integrated STO discrepancy | High 12xxxx | Read PROFIsafe diagnostics p2048, r9761, r9771, r9772; check F-DI wiring |
| Topological component reported as "wrong" | High 8xxxx, low-order 0xxx | Use STARTER / Startdrive to run topology check; verify article numbers match the BOM |
r0949 and r2124. These parameter values are the vendor-defined additional information (frequency, encoder index, drive-object ID, motor temperature, slot number, firmware mismatch details) that pinpoints the root cause without ambiguity. Skipping the r0949 read and jumping straight to the fault-text lookup is the most common cause of long support tickets.11. DRIVE-CLiQ Topology and Component Identification
DRIVE-CLiQ faults are the single most common category on a running SINAMICS S120 system, because the diagnostic system reports every topology deviation as an F8xxxx / A8xxxx event. The topology is established at first commissioning and stored in the Control Unit. Compare the runtime topology against the stored topology with:
-
p0098- actual topology, drive-object ID assignment -
p0099- configured topology, drive-object ID assignment -
r0097[0..9]- current topology summary, slot-by-slot component article number
The CU writes a new entry to the fault buffer whenever a component is missing, a component is added that was not in the original topology, or a component reports a firmware version that does not match the CU (controlled by parameter p7820). The fault value r0949 contains the slot index and the article number of the affected component, allowing the engineer to identify which physical device is at fault without disassembling the cabinet.
12. HMI Update Strategy After a Firmware Upgrade
SINAMICS S120 firmware upgrades (e.g., from 4.5 to 4.7) can introduce new fault and alarm numbers, change reaction class, or repurpose old numbers. The upgrade procedure for the HMI text database is:
- Update the List Manual reference in the support entry for the new firmware. The 06/2020 edition covers the 4.7 firmware line; firmware 5.x is documented in a separate List Manual update.
- Compare the old CSV and the new CSV. Tools such as WinMerge or Beyond Compare (semicolon-separated) highlight the additions and modifications. A useful automated check is
comm -23 new.csv old.csv | sorton a Linux workstation to list the newly added numbers. - Re-import the modified rows into the WinCC text library.
- Transfer the project to the panel and re-test the Acknowledge all faults button (which writes to p3981 = 0).
- Document the firmware-to-text-list mapping in the validation file (e.g., CSV trail) for later audits.
13. Verification and Commissioning Checks
After the HMI text integration is complete, perform the following verification sequence before handing the system over to production.
- Trigger a known fault (e.g., remove encoder cable on a warm drive) and confirm that the HMI displays the correct fault number, the message text, the configured reaction, and the time stamp.
- Press the HMI "Reset faults" button. Confirm that the control-word bit STW1.7 (Acknowledge) is set for at least 50 ms, then cleared. Confirm that the drive pulses re-enable if the cause is removed.
- Force a known alarm (e.g., over-temperature warning) and confirm that it appears in the alarm banner without requiring acknowledgement.
- Verify that the time stamps agree with the CPU time. If there is drift of more than 500 ms, set the SINAMICS time via
p3100/p3101to use the PROFINET time-of-day synchronization, or write the time using SFC0 (set clock) / SFC1 (read clock) from the S7. - Read the combined buffer r2130 in Startdrive and verify that the chronological order matches what the HMI shows.
- Disconnect one DRIVE-CLiQ node and re-connect. Confirm that the topology fault is reported with the correct slot index in the fault value (r0949).
14. Worked Example - Displaying a Fault on a TP1200
The following end-to-end example is built around a S7-1500 CPU, a CU320-2 PN at PROFINET device ID 3, and a TP1200 Comfort panel.
- In the PLC, declare a data block
DB_Drivewith a Word tagdwFaultCodeand a DWord tagdwFaultValue. - Add an RDREC block reading data record 0x4042 from device 3. The call is triggered every 500 ms by a cyclic interrupt OB (OB30..OB38).
- The first 4 bytes of the read return the most recent fault code. Copy the lower 16 bits to
DB_Drive.dwFaultCode. The bytes 14..17 carry the fault value - copy toDB_Drive.dwFaultValue. - In the HMI project, add an HMI tag Tag_FaultCode of type Word, pointed at
DB_Drive.dwFaultCode, and Tag_FaultValue of type DWord, pointed atDB_Drive.dwFaultValue. - Create a text list tlS120Faults with 6000 entries, range 100..99999.
- Import the CSV. Each row becomes one entry: Default text = the cause text, English text = the English text, and so on.
- Place an IO field bound to Tag_FaultCode (showing the number) and a Symbolic IO field that shows the text list entry referenced by the same tag. Place a second IO field bound to Tag_FaultValue to display the additional information.
- Add a button "Acknowledge faults" wired to a tag that toggles STW1.7 from the S7 program via the standard telegram PZD1, or a button that writes
p3981 := 0via an acyclic WRREC call. - Place an additional alarm view control bound to the standard WinCC alarm buffer. Enable the alarm class "SINAMICS Drive" and configure the alarm text to read the same CSV-imported text list. WinCC will then render every active and acknowledged alarm with the matching fault / alarm text.
15. Localization and Multi-Language Deployment
The List Manual 06/2020 export supports nine user-interface languages. When deploying to a multi-language site, the recommended workflow is:
- Translate the CSV into all required languages. The columns Text DE, Text EN, Text FR, Text IT, Text ES, Text ZH are already present in the standard export.
- Open the HMI project in TIA Portal and switch the project language to each target language in turn.
- Re-import the CSV in each language and verify the text list.
- Use the TIA Portal Translation tool under Languages & Resources > Project Texts > Export to extract the per-language text lists for review by native speakers.
- Document the translation source (CSV column) and the translation date in the project audit log.
16. Performance and Cycle-Time Considerations
Acyclic PROFINET reads take 30..60 ms per record on a CU320-2 PN over a 1 ms IRT cycle. For sub-100 ms reaction time on critical faults, use the cyclic ZSW1 / ZSW2 status words that report the active fault and alarm states every PROFINET cycle (1..4 ms). The S7 program can latch the ZSW1.E_FAULT rising edge and then trigger the acyclic read in the background to retrieve the fault number. The cyclic path is recommended for safety-related display, where a missed event can confuse the operator; the acyclic path is the source of the actual message text.
For an S7-1500 controlling multiple drives, sequence the acyclic reads in a 100 ms time slice per drive, or use the indexed array mechanism (PROFIdrive parameter channel with multiple base slots) to read several drives in a single PROFINET frame. The slot multiplexing reduces bus load and gives a deterministic update time for the entire fleet.
17. Reference Documentation
Refer to the following official Siemens documents for the canonical list, the parameter reference, and the diagnostic record specification:
- SINAMICS S120 / S150 List Manual, edition 04/2014 (LH1) - S120 / S150 List Manual LH1 (04/2014)
- SINAMICS S120 / S150 List Manual, edition 06/2020 - S120 / S150 List Manual LH1 (06/2020)
- SINAMICS S120 Function Manual (parameter descriptions, default values, application notes) - searchable in the Siemens support portal under entry 99685175
- PROFIdrive Profile V4.2 (PI International) for the data record layout 0x4040..0x404C
18. Frequently Asked Questions
Where do I find the SINAMICS S120 fault and alarm CSV file?
Open the Siemens Industry Online Support page for List Manual entry 109781807 (06/2020 English edition) or the legacy 99682911 (04/2014). Both files include a CSV export linked under "Attachments". The support page also lists per-firmware variations.
Can the same fault number mean different things in different firmware versions?
Yes. SINAMICS S120 firmware releases can change the meaning, reaction, and acknowledgement class of a number. Always re-import the CSV that matches the firmware loaded on the Control Unit. The drive reports its own firmware in r0018 and r0020.
What is the difference between r0945 and r2130?
r0945 is the fault-code ring buffer (8 entries) for faults only. r2130 is the combined chronological buffer (64 entries) of faults and alarms intermixed. Use r0945 for HMI banners; use r2130 for the full history and audit log.
How fast can I poll the fault buffer via PROFINET?
Acyclic RDREC takes 30..60 ms per record on a CU320-2 PN over a 1 ms IRT cycle. For faster reaction, use the cyclic ZSW1 / ZSW2 status words that report the active fault and alarm states every PROFINET cycle (1..4 ms).
Do safety faults need a separate HMI text list?
Recommended. Safety Integrated faults use the F12xxxx range, and PROFIsafe diagnostics (r9761, r9763, r9771, r9772) carry additional information such as the cross-check failed signal and the F-DI index. A separate HMI text list keyed to the safety range prevents normal drive messages from being mistaken for safe stop conditions.
How do I convert the SIEMENS time stamp to a human-readable date?
Multiply the floating-point value by 86400 to get days-to-seconds, then subtract 2208988800 (the seconds between 01.01.1900 and 01.01.1970). The result is a UNIX timestamp. Format with FormatDateTime() in WinCC or with the standard S7 time-conversion routines.