Sinumerik 840C Alarm 9106: Clearing Cycle Counter Exceeded Fault

Problem Overview

The reported fault occurs on a Gleason-Hurth ZS-150 CNC gear-hobbing machine controlled by a Siemens Sinumerik 840C. During a production shift, the machine stops and posts alarm 9106 to the CRT. After the alarm appears:

• JOG mode remains fully functional. The operator can still traverse every axis manually and verify mechanical motion.
• MDA mode accepts the block but Cycle Start is rejected the moment a tool-change command such as M11 or M10 is executed, and the same 9106 alarm reappears.
• AUTO mode refuses to start any part program for the same reason.

The alarm text, as displayed by the 840C, is shown in three different language forms because of the OEM's multilingual alarm database:

• 9106  Number of cycle exceeded
• 9106  Time number of cycle exceeded
• 9106  Maximum number of cycle exceeded

All three strings are routed to the same OEM error path; the wording only changes with the active language bit. The 9106 ID is the only thing the operator sees, and it is not a Siemens standard NC alarm.

Why the Machine Operates in JOG but Not MDA / AUTO

JOG, MDA, and AUTO execute completely different logic chains inside the 840C. JOG uses a manual path that does not invoke part-program interpretation, tool-change sequencing, or OEM cycle accounting. MDA and AUTO, by contrast, both run through the same part-program interpreter and therefore pass through the same OEM cycle-counter check that raises 9106.

The fact that the alarm pops the instant an M10 or M11 (work-holding/clamping) command is issued tells the engineer two useful things:

1. The cycle counter is checked before the M-function is allowed to fire, i.e. it is a pre-execution check implemented in the PLC, not an NC interpreter alarm.
2. The counter is incremented by a value greater than 1 per cycle, otherwise simply running the M-code once could not push the machine over the threshold. Most Gleason-Hurth hobbers count 1 per part, but some variants count 1 per hob pass or 1 per shift.

Sinumerik 840C Alarm Numbering Convention

The 840C alarm pool is divided into three bands:

Alarm 9106 therefore must be raised by a STEP 5 block inside the integrated PLC. The two STEP 5 mechanisms typically used to raise a PLC alarm on a 840C are:

• Calling FB 200 with the alarm number in DW0 (set/clear alarm interface).
• Writing to the PLC-NC interface word DB 39 alarm bit field (less common on 840C).

Both methods require a set condition that the OEM programmer wired in their own block. On Gleason-Hurth machines, this set condition is almost always FB 201 or a child of it, which performs cycle accounting and protection interlocks.

Root Cause: OEM Cycle-Counter Logic in FB 201

FB 201 on the ZS-150 is a custom OEM block. Per the operator's hard-copy documentation, the block is implemented as a STEP 5 function block with the following structure (paraphrased from the schematic, names match Gleason's naming convention):

The block is also responsible for raising the 9106 alarm and for setting the flag M 128.7 (Merker flag, byte 128, bit 7) that the operator has observed is stuck in the active state. M 128.7 is therefore not an alarm bit by itself; it is the status output of FB 201 indicating that the cycle counter has reached or exceeded its setpoint. Other blocks in the program (such as the work-holding clamp block and the spindle-enable chain) consult M 128.7 to refuse further motion in MDA / AUTO.

Understanding M 128.7 and the Counter Setpoint

In STEP 5, the Merker (flag) area is a byte-addressed bit memory. M 128.7 means byte 128, bit 7 of that area. On a Sinumerik 840C with the standard S5-130WB / S5-135W PLC, the Merker range is 0–255, so M 128.7 is a legitimate address. It is also a popular address for OEM status flags because it sits in the upper half of the flag area, well clear of the Siemens-reserved low bytes (M 0.0 – M 31.7 are mostly used by the standard 840C firmware for interface flags).

The logic chain that drives M 128.7 typically looks like this:

      FB 201  (OEM cycle counter)
        |
        |   DW 4 (actual)  >  DW 0 (setpoint)
        |   AND  DW 9 (reset auth) = 0
        |   AND  not (cold start in progress)
        v
       =1 --------------------> S M 128.7
                              &
                              =>  CALL FB 200  (set alarm 9106)

      R M 128.7   <---   operator reset pushbutton  (F-key or DB bit)
                       OR service-engineer reset (DW 9 := 1, then clear)

The block can only be released by:

1. Reducing the cycle actual (DW 4) below the setpoint, or
2. Increasing the setpoint (DW 0) above the actual, or
3. Authorizing a service reset by writing 1 to DW 9 and then clearing the alarm from the HMI.

Locating the Cycle-Counter Data Word in STEP 5

Before modifying anything, the engineer must identify which Data Block (DB) holds the cycle counter. On the ZS-150 the OEM documentation usually shows it in DB 51, but a structured search is faster than guessing:

1. Connect a Siemens PG 685 / PG 740 programmer (or a modern PC with S5 for Windows + the original Siemens PC-TTY or AS511 protocol converter) to the PLC service port on the 840C.
2. Go online in STEP 5 and request STATUS of FB 201.
3. Search the cross-reference (XRF) for any data word that is read and compared to a constant (the limit). The constant is usually entered as a KC or KF value inside the FB source, e.g. L KF +5000 followed by <=F against DW 4.
4. The matched DW is the actual counter; the matching load constant gives the current setpoint.

For reference, the typical addresses for a Gleason-Hurth ZS-150 are:

If your hard copy shows different numbers, the structure is the same; only the DB number and the DW offsets change.

Procedure: Resetting the Counter and Clearing 9106

The correct fix is to make the actual count lower than the setpoint, then cancel the alarm. There are three legitimate methods, listed from the safest to the most invasive. Do not simply force M 128.7 to 0 from the PG; that hides the symptom but leaves the counter in the "exhausted" state, and the next part program will resurrect the alarm.

Method 1 — Operator Reset via the OEM HMI (Preferred)

1. Place the machine in JOG.
2. Open the OEM service page (usually reached by pressing the SERVICE or DIAGNOSTIC softkey, then entering the OEM password).
3. Navigate to the Cycle counter line and press RESET COUNTER. The OEM page will:

• Display current actual and setpoint.
• Decrement the actual to 0, or to the value programmed in the OEM's "service-life counter" field.
• Clear M 128.7.
• Send a clear request to FB 200 to remove alarm 9106 from the alarm line.

4. Press CANCEL on the alarm line to acknowledge 9106.
5. Switch to MDA, run a no-op block such as N10 M00, then test with M10 / M11 to confirm the cycle path is released.

Method 2 — Direct PG Online Edit (Service Engineer)

1. Connect the PG and go online with the PLC.
2. Open the data block that holds the counter (typically DB 51).
3. Use the FORCE / OVERWRITE function (or Modify in S5 for Windows) to write the actual counter:

      DB 51
        DW 0  KF +5000     (setpoint – do NOT change unless authorized)
        DW 4  KF +0000     (actual – reset to 0)
        DW 9  KF +0001     (reset authorization = 1, then back to 0 after the operation)

4. Set DW 9 = 1 first; the OEM code will not accept a counter write while the authorization bit is 0.
5. Write DW 4 = 0 (or to whatever the OEM's "remaining cycles" allow).
6. Set DW 9 = 0 to lock the block again.
7. Open FB 201 in STATUS and confirm that the set instruction for M 128.7 is no longer energized and the reset instruction has fired.
8. Cancel the alarm with the CANCEL key on the HMI.

Method 3 — Adjust the Setpoint (Only if Engineering-Approved)

Sometimes the cycle limit is intentionally set to a maintenance threshold (e.g. "after 5000 parts, force a hob inspection"). If that is the case, the correct action is to perform the maintenance, not to extend the setpoint. If the OEM has approved a higher limit:

1. Open DB 51.
2. Change DW 0 from its current value (e.g. KF +5000) to the new value (e.g. KF +7500).
3. Save the DB to the EPROM / flash module of the PLC.
4. Cycle power on the 840C so the new value is re-read at cold start.

Re-initialization and Restart Sequence

After the counter has been corrected, the 840C and its integrated PLC must be brought back into a clean state. Use the following order; deviating from it can leave the NC in follow-up disabled state and require a full re-reference of all axes.

1. Mode select to JOG on the operator panel.
2. From the HMI, press the CANCEL (C) key repeatedly until the alarm line is empty.
3. Press the RESET key on the NC keyboard. The 840C performs a soft reset of the NC kernel. Watch the seven-segment status display: it should finish at 00 with no other digits blinking.
4. If the machine has a separate PLC STOP / RUN selector, confirm that the PLC is in RUN (the "PLC" LED on the 840C is steady green, not flashing). If the PLC is in STOP, switch to RUN. The PLC will read OB 1, OB 21 (or OB 22 for restart) and then re-evaluate FB 201 with the corrected counter.
5. Re-reference every axis that was on MDA / AUTO hold. Use the reference-point approach keys in JOG with the appropriate axis-direction button until the axis reaches the reference cam and the NC marks the position as referenced.
6. Switch to MDA and run a one-line test:

      N10 M11            ; clamp
      N20 G04 F2         ; dwell 2 s
      N30 M10            ; unclamp
      N40 M30            ; end of program

7. Confirm that the cycle counter (visible in the OEM service page) increments by exactly 1 after M30.
8. Switch to AUTO and run the production program. The 9106 alarm should not reappear.

Verification and Commissioning Checks

After the reset, the engineer must verify four things, in this order:

Check #4 is the most important and is the one that is most often skipped. A counter that is reset but no longer trips is a counter that has lost its safety function; it will not protect the machine on the next maintenance interval.

Field-Proven Caveats for Legacy 840C Installations

The 840C is a long-discontinued platform. Engineers working on it should keep the following in mind:

• PLC program on EPROM. On most 840C machines the STEP 5 program is on a 27C256 or 27C512 EPROM in a memory submodule. Any "online" edit you make from the PG is volatile and will be lost at the next power-off. To make the change permanent you must program a fresh EPROM and physically swap the submodule. Some sites use a battery-backed RAM submodule instead; in that case the change survives power-off and you can save it with the PG.
• FB 200 / FB 202 alarm interface. The 840C uses FB 200 to set/clear PLC alarms and FB 202 to transfer alarm acknowledgements. If alarm 9106 reappears immediately after a cancel, the issue is that FB 200 is being continuously set by FB 201 – i.e. the set condition is still true. The fix is to clear the set condition (counter), not to fight the cancel key.
• OEM password. Gleason-Hurth's HMI pages are password-protected. The default password for the 840C OEM builds is usually on a sticker inside the electrical cabinet door. If the sticker is gone, contact Gleason's service desk (or the Hurth successor organization) with the machine serial number – do not attempt to brute-force the password from the PG; some builds lock the PLC after three failed attempts.
• PG compatibility. A USB-to-RS232 adapter is not enough to talk to a 840C PLC. The PLC expects the Siemens AS511 protocol at 9600 baud over a TTY (20 mA current loop) interface. Use a real Siemens PG, or a PC with S5 for Windows + the original Siemens PC-TTY adapter, or a third-party AS511-compatible cable.
• M flags are not retentive by default. On a 840C PLC, M 128.7 will clear on a cold restart if the set condition is no longer true. If the machine keeps M 128.7 = 1 after a power cycle, the counter in DB 51 is still ≥ setpoint; the data is on EPROM, the M flag is recomputed at every cold start.
• Siemens documentation archive. The 840C is out of active support, but Siemens keeps installation, commissioning, and programming manuals available in the Siemens Industry Online Support archive. Search for "SINUMERIK 840C" to find the operator's guide, the PLC programming manual, and the alarm list manual.
• OEM machine builder remains the authority. The OEM's PLC project is the single source of truth. The 840C HMI strings, the menu layout, the meaning of every flag above M 200, and every alarm above 8000 belong to the machine builder, not to Siemens. Cross-check any change with the OEM before deploying it.

Frequently Asked Questions