SINAMICS S120 PROFIsafe Telegram 30: Safety Controlword Bit Configuration and Fault Acknowledgment

SINAMICS S120 drives with Safety Integrated (SI) require a dedicated PROFIsafe telegram to carry safety controlwords and statuswords between the F-CPU and the drive. PROFIsafe Telegram 30 is the standard telegram used when Safety Integrated Basic Functions (STO, SS1, SBC, SLS, SSM, SDI) are controlled over PROFIsafe from a SIMATIC F-CPU. The 6-byte safety process data channel rides on top of the standard Siemens telegram (e.g., 105, 102, or 352) that handles non-safety motion control. This reference explains the exact bit assignments, the critical "0 = activate, 1 = deselect" rule for safety controlword bits, the role of bit 7 (internal event acknowledge), and the fault acknowledgment behavior that prevents reintegration from clearing safety faults in a shared-device topology.

1. Overview of PROFIsafe Telegram 30 on SINAMICS S120

PROFIsafe Telegram 30 is a vendor-specific PROFIsafe profile for Siemens drives. It is selected per drive object in the SINAMICS commissioning tool (STARTER, SINAMICS Startdrive, or Scout TIA) under the PROFIsafe configuration of the drive. The telegram carries 6 bytes of safety output data (F-CPU → drive) and 6 bytes of safety input data (drive → F-CPU), each preceded by the standard PROFIsafe wrapper (control/status byte, 2-byte CRC, and the 2-byte PROFIsafe address when on PROFIBUS, or a different wrapper on PROFINET IO).

Telegram 30 is used for both Safety Integrated Basic Functions and Safety Integrated Extended Functions. The selection of Telegram 30 is what causes the SINAMICS S120 to expose the safety controlword and safety statusword parameters (S_STW1, S_ZSW1, S_STW2, S_ZSW2) to the cyclic PROFIsafe process image.

From the official Siemens function-block documentation for S120 PROFIsafe control:

"This function block is used for simple controlling of the Safety Integrated Functions of SINAMICS S via PROFIsafe telegram 30."
— Siemens Support entry 109749224, SafetyS120_TO_Axis_DOC_v14_en.pdf

For a SIMATIC S7-1200F controlling a SINAMICS G120 over PROFIsafe, the same telegram is selected:

"A dedicated PROFIsafe telegram is selected for each drive (in this particular example, telegram 30). This telegram includes 6 bytes of input data and 6 bytes [of output data]."
— Siemens Support entry 109746271, 1200F_G120_PROFIsafe_V1_0_EN_DOC.pdf

2. Telegram 30 Process Data Structure

Telegram 30 maps two 16-bit safety words in each direction:

3. The Critical "0 = Activate" Rule

Unlike standard PROFIdrive controlwords, the SINAMICS safety controlword uses a fail-safe active-low logic: a bit value of 0 selects the safety function, while 1 deselects it. This is a deliberate design choice: if the PROFIsafe connection is interrupted, the F-CPU outputs 0 to the drive, which causes the safety function to engage (fail-safe state).

The official Siemens function-block documentation for S120 PROFIsafe control confirms this requirement:

"No, it is not sufficient to set only the SS1 bit, you have to still set the other not used functions just like STO via safety program to 1 (and not to 0 as 0 means safety function is activated!)."
— Siemens Support entry 109749224, SafetyS120_TO_Axis_DOC_v14_en.pdf

In practice, the F-CPU program must output the following to Telegram 30 in the steady-state (no safety request) condition:

S_STW1 (byte 0/1) steady-state = 0b0000_0000_0000_0000 ? NO, must be 0xFFFF = 0b1111_1111_1111_1111

All unused safety-function bits (STO, SS1, SS2, SOS, SLS, SDI+, SDI−, etc.) must be forced to 1 (deselected) by the F-application. The F-CPU cannot rely on a default of zero, because zero is the dangerous/active state.

4. Bit 7: Internal Event Acknowledge

Bit 7 of S_STW1 byte 0 is the Internal Event Acknowledge bit. It is used to clear safety faults of the F-CPU-internal safety logic and of the SINAMICS safety firmware that prevent normal deselection of a safety function.

The standard PROFIdrive acknowledge (bit 7 of STW1, "Acknowledge fault") does not reset safety faults of the F016xx/F306xx/F017xx/F307xx family. Those faults are cleared only by:

1. A 0→1 edge on bit 7 of the PROFIsafe safety controlword (S_STW1.7), or
2. An ACK on the SINAMICS safety diagnostics page (commissioning tool) in a debug session.

Confirmation from the discussion thread on this exact point:

"Bit 7 is for the safety acknowledge of safety faults just like F16xx and F306xx and F17xx and F307xx, the reintegration won't reset any safety faults."
— Siemens Support entry 109749224, SafetyS120_TO_Axis_DOC_v14_en.pdf

Application example of the acknowledge edge in structured text (F-CPU side):

// F-CPU structured text, F-runtime group
// Latch the acknowledge on a rising edge of the operator request
IF (opAck AND NOT ack_prev) AND drive_ready THEN
    int_event_ack := TRUE;  // S_STW1.7 = 1 this cycle
ELSE
    int_event_ack := FALSE; // S_STW1.7 = 0 (auto-fall so it is a real edge)
END_IF;
ack_prev := opAck;

5. Standard STW1 Acknowledge vs PROFIsafe Internal Event Acknowledge

When a SINAMICS S120 is operated as a shared device between a standard PLC and an F-CPU, the standard controlword (STW1) and the safety controlword (S_STW1) are written by different controllers. This raises a practical question: if the standard PLC issues an ACK on bit 7 of STW1, will the safety faults clear?

Answer: No. The standard controlword ACK (bit 7 of STW1) clears standard drive faults (Fxxxx that are not safety-relevant), but it has no effect on safety faults of the F016xx/F306xx/F017xx/F307xx families. Those faults can only be acknowledged from the F-CPU side via the Internal Event Acknowledge (bit 7 of S_STW1) or via the SINAMICS commissioning tool.

"The acknowledge bit from the standard controlword (not profisafe) will not reset these faults? The profisafe part is controlled from another plc (Sinamics is shared device) then the standard controlword."
— Siemens Support entry 109749224, SafetyS120_TO_Axis_DOC_v14_en.pdf

Consequence for shared-device architectures: the standard PLC does not need to communicate with the F-CPU to acknowledge a safety fault, but the operator HMI must route the acknowledge to the F-CPU, not to the standard PLC. A typical pattern is a single global HMI tag (e.g., HMI_AckSafetyFaults) consumed in the F-runtime group and gated by a safety-relevant enable (e.g., operator key-switch, no active safety function, drive at standstill).

6. Safety Fault Numbering on SINAMICS S120

SINAMICS S120 reports safety faults in four families, each with both the drive-side and Control Unit-side number:

7. Reintegration vs Acknowledgment

SINAMICS distinguishes between two recovery paths after a safety event:

Reintegration only restores the drive to operation when no safety fault is latched. If a safety fault is present, the safety controlword bits are ignored, and the drive remains in the safe state until S_STW1.7 has been pulsed.

This is the basis of the field-proven rule quoted from the field report:

"the reintegration won't reset any safety faults."
— Siemens Support entry 109749224, SafetyS120_TO_Axis_DOC_v14_en.pdf

8. Shared-Device Configuration (F-CPU + Standard PLC)

In a SINAMICS G120/S120 shared device, the drive's two PROFIsafe/PROFINET slots are split between two controllers: a standard CPU controls motion (telegram 105, 102, or 352) and an F-CPU controls safety (PROFIsafe Telegram 30). The Siemens TIA Portal / Scout TIA documentation describes this configuration:

"Only the safety modules have to be configured. PROFIsafe telegram (PROFIsafe telegram 30 in the example). SIEMENS telegram (SIEMENS telegram 352 in the example)."
— Siemens TIA Portal cloud docs, SINAMICS G120 shared by SIMOTION and F-CPU

Configuration rules for a shared device with Telegram 30:

1. Assign the SINAMICS drive to the standard PLC (slot 0, the standard telegram).
2. Assign the SINAMICS safety subslot (PROFIsafe subslot) to the F-CPU.
3. On the drive side, configure PROFIsafe address (F_Dest_Add) and F_Source_Add such that the F-CPU and the drive agree (default F_Dest_Add typically starts at 1 and increments per drive).
4. Select Telegram 30 in the drive's PROFIsafe configuration; the safety controlword and statusword are then mapped to the F-CPU's process image.
5. Configure the standard telegram (e.g., 105) for the motion side; its STW1/ZSW1 contain the motion enable, not the safety functions.
6. Verify in the TIA Portal device view that the standard CPU does not have access to the PROFIsafe subslot and that the F-CPU does not have access to the standard telegram's motion bits.

9. PROFIsafe Telegram Selection: 30 vs 901/902

Some users conflate Telegram 30 with Telegram 901 or 902. The distinction is critical:

Telegram 30 is the correct choice for SINAMICS S120 with Safety Integrated and an F-CPU. Confirm with the configuration tool:

// SINAMICS parameter view
p9610 = 30    // PROFIsafe telegram type (read-only after safety configuration commit)
p9611 = ...   // PROFIsafe address assignment
p60022 = ...  // F-Host (PROFIsafe source address)

If the drive shows a p9610 mismatch with the F-CPU's configured telegram, the F-CPU will report a PROFIsafe parameterization error (F01650 / F30650), and the drive will refuse to enter the operating state.

10. SINAMICS Parameter Assignments for Telegram 30

When Telegram 30 is selected, SINAMICS S120 uses the following parameter (BICO) assignments to feed the safety controlword into the safety firmware:

Use the SINAMICS trace to record r9780, r9781, r9782, r9783, and r9798/r9799 during a safety-function transition. This is the most direct way to verify that the F-CPU is driving the safety controlword correctly and that the drive is interpreting each bit as expected.

11. F-CPU Programming Pattern (TIA Portal F-LAD/F-FBD)

The recommended pattern in the F-CPU is to assemble S_STW1 from individual safety-bit variables, never from a raw integer written from the standard application. A typical F-FBD implementation in the F-runtime group:

// Deselect masks for unused safety functions
S_STW1.byte0.bit0  := NOT request_STO;       // 0 = STO select, 1 = deselect
S_STW1.byte0.bit1  := NOT request_SS1;       // 0 = SS1 select, 1 = deselect
S_STW1.byte0.bit2  := TRUE;                  // SS2 deselected (unused)
S_STW1.byte0.bit3  := TRUE;                  // SOS deselected (unused)
S_STW1.byte0.bit4  := TRUE;                  // SLS bit 0 (unused)
S_STW1.byte0.bit5  := TRUE;                  // SLS bit 1 (unused)
S_STW1.byte0.bit6  := TRUE;                  // SS1E deselected (unused)
S_STW1.byte0.bit7  := int_event_ack_edge;    // 0->1 acknowledge pulse
S_STW1.byte1       := 16#FF;                 // all Extended bits deselected
S_STW1.word2       := 16#0000;               // S_STW2 unused
S_STW1.word4       := 16#0000;               // reserved

The int_event_ack_edge signal is generated by a one-shot F-FB that detects a rising edge of the operator's acknowledge request and pulses the bit for exactly one F-runtime cycle:

// Edge detection in F-runtime group
int_event_ack_edge := (ack_request) AND (NOT ack_request_prev);
ack_request_prev   := ack_request;

12. Commissioning and Verification Procedure

After configuring Telegram 30 in the SINAMICS project and the F-CPU project, follow this verification sequence before declaring the safety function operational:

1. Static safety I/O check. In the F-CPU watch table, force S_STW1 = 16#0000. Verify in the SINAMICS trace that r9780 = 16#0000 and that the drive enters the safe state (STO active, no torque). Confirm S_ZSW1.0 (STO active) = 1.
2. All-bits-deselect check. Force S_STW1 = 16#FFFF (with the exception of bit 7, which must be 0). Verify the drive returns to operating state, S_ZSW1.0 = 0, and no safety fault is pending.
3. Individual bit trip check. Force each safety-function bit (0, 1, 2, 3, 10, 11) to 0 one at a time, with all other bits at 1. Verify the corresponding S_ZSW1.x status bit goes to 1 within the configured monitoring time.
4. Acknowledge path check. Trigger a forced safety fault (e.g., momentarily set S_STW1.0 = 0 with the SS1 transition not completed, to force a stop-time-exceeded fault). Verify that pulsing S_STW1.7 from 0 to 1 and back clears the F016xx/F306xx fault from the SINAMICS fault buffer.
5. Shared-device check. From the standard PLC, attempt to write to the F-CPU's safety subslot. The TIA Portal device view should show a "no access" configuration; the standard PLC write attempt should be rejected at the controller boundary.
6. PROFIsafe communication failure simulation. Disconnect the PROFINET cable between the F-CPU and the SINAMICS drive. Verify the drive enters the safe state (F01650 / F30650 logged) and that the F-CPU reports the F-CPU-side PROFIsafe error.
7. Re-integration test. Restore the PROFIsafe connection, clear the F01650 / F30650 fault by pulsing S_STW1.7, and verify the drive returns to operating state without operator intervention other than the acknowledge.
8. Validation sign-off. Generate the SINAMICS safety diagnostics report (in STARTER/Startdrive) and the TIA Portal F-program printout. Have both reviewed and signed by the responsible safety engineer per the project's safety plan.

13. Common Pitfalls and Field-Proven Caveats

• Forgetting to deselect unused bits. A new S_STW1 default of 16#0000 (all zeros) is a fail-safe state but it is also a permanent stop request. The F-CPU must explicitly output 16#FFFF (with the acknowledge bit at 0) to allow motion.
• Mixing up SS1 and STO acknowledgment. SS1 has a time-monitored off-ramp. If the drive cannot decelerate in time (e.g., a heavily loaded axis with the wrong OFF3 ramp in p1135), the SINAMICS logs F01620 / F30620 and the safety function remains engaged. The fix is to tune the off-ramp, not to repeatedly pulse the acknowledge bit.
• Standard STW1 ACK does not clear safety faults. If the standard PLC is given a single global "ACK" key and that key is wired only to the standard STW1, the operator will be unable to clear safety faults. Provide a separate "Safety ACK" key bound to a tag consumed by the F-CPU.
• Re-integration without a clean safety state. If the F-CPU program deselects SS1 (sets S_STW1.1 = 1) while a safety fault is latched, the drive stays in the safe state. The operator will incorrectly conclude that the safety function is "stuck." Always clear the fault first (S_STW1.7 pulse), then deselect.
• PROFIsafe address mismatch after replacement. When a SINAMICS Control Unit is replaced, the PROFIsafe address (F_Dest_Add) on the new CU must be re-entered. If the F-CPU still holds the old address, the new drive will log F01650 / F30650 and refuse to operate.
• Firmware version differences. Telegram 30's exact byte layout for S_STW2 and the SLS bit field has been extended over firmware versions. If the F-CPU was built against an older SINAMICS firmware description, an upgrade may require a re-compile and re-validation. Always check the safety diagnostics after any firmware change.
• Test stop not acknowledged. SINAMICS S120 with Safety Integrated Extended Functions requires a periodic dynamic test (the test stop). The drive sets S_ZSW1.12 (test stop required) when the test is due. The F-CPU must acknowledge this by setting S_STW1.12 to 1 within the configured interval; otherwise the drive logs a safety fault. The interval is configured in p9659.
• SS1E vs SS1. Telegram 30 distinguishes between SS1 (internal ramp, time-monitored in the drive) and SS1E (external ramp, where the higher-level controller decelerates and the drive merely monitors the time). Mixing these up produces unexpected STOP A events because the wrong ramp is being monitored.

14. Diagnostic Trace Recipe for Telegram 30

To capture a complete picture of a safety-function event, configure a SINAMICS trace with the following signals and trigger conditions:

// SINAMICS trace configuration (STARTER / Startdrive)
Trace signals:
  r9780   (S_STW1 image)
  r9781   (S_STW2 image)
  r9782   (S_ZSW1 image)
  r9783   (S_ZSW2 image)
  r9798   (P1 diagnostic word)
  r9799   (P2 diagnostic word)
  r9722.0 (cross-check status)
  r9723   (SI P1 active safety function)
  r9724   (SI P2 active safety function)
  r9747   (SI fault code, most recent)
  r9748   (SI fault time, most recent)
  r9752   (SI P1 fault status)
  r9753   (SI P2 fault status)

Trigger:
  Condition: r9782 bit 7 (internal event) goes high
  Pre-trigger: 200 ms
  Post-trigger: 800 ms
  Sample rate: 1 ms (1 kHz)

This trace is the authoritative record for a safety-incident root cause analysis. Save the trace with the project documentation; never delete it without a sign-off from the safety engineer.

15. Comparison: Telegram 30 vs SIMATIC F-CPU F-Shutdown Matrix

The F-CPU's safety program typically uses a structured shutdown matrix to combine sensor inputs (e.g., E-Stop, guard door, light curtain) into the final S_STW1 word. A common pattern is to OR the safety requests across the matrix and then invert the result to produce the deselect signals:

// Conceptual shutdown matrix output (F-FBD)
any_safety_request := estop_active
                   OR guard_door_open
                   OR light_curtain_tripped
                   OR SLS_limit_exceeded
                   OR local_safe_stop_request;

S_STW1.bit0 := NOT any_safety_request;   // STO deselect
S_STW1.bit1 := NOT any_safety_request;   // SS1 deselect
S_STW1.bit2 := NOT estop_active;         // SS2 (unused) -> always deselected
... etc

The advantage of this structure is that the F-application never has to manage the 0/active vs 1/deselect polarity of individual bits; the matrix output is "no request" (1) and the bit assignment takes care of the inversion. This minimizes programming errors in machines with many E-Stops and guard doors.

16. Summary of Key Field Rules

• Telegram 30 is the correct PROFIsafe telegram for SINAMICS S120 Safety Integrated with a SIMATIC F-CPU.
• All unused safety-function bits in S_STW1 must be 1 (deselected) by the F-application; a default of 0 is a stop request.
• Bit 7 of S_STW1 (Internal Event Acknowledge) must be pulsed (0→1→0) to clear safety faults of the F016xx/F017xx/F306xx/F307xx families.
• The standard PROFIdrive STW1.7 (acknowledge) does not clear safety faults.
• Reintegration (deselecting the safety function) does not clear a latched safety fault; the Internal Event Acknowledge must be pulsed first.
• In a shared-device topology, only the F-CPU writes the safety subslot; the standard CPU must not have write access to S_STW1.
• SINAMICS S120 and SINAMICS G120 share the same PROFIsafe Telegram 30 layout; the same F-CPU program can drive both with appropriate parameter mapping.

For the official Siemens documentation referenced in this article, see:

• SafetyS120_TO_Axis_DOC_v14_en.pdf (Siemens Support 109749224)
• 1200F_G120_PROFIsafe_V1_0_EN_DOC.pdf (Siemens Support 109746271)
• SINAMICS G120 shared by SIMOTION and F-CPU (TIA Portal cloud docs)