SINAMICS G120 STW1 and ZSW1: Every Control and Status Bit

• OFF2 and OFF3 are active-low: the bits must be 1 for normal operation, and clearing them stops the drive.
• Pass through 16#047E before 16#047F. Jumping from 0 straight to the run value often fails.
• Bit 7, fault acknowledge, is edge-triggered. Holding it high hides a repeating fault that will damage the motor.
• Every Siemens drive implementing PROFIdrive uses these same bits, so this knowledge transfers from G120 to S120 unchanged.

Try it first: the Live PLC–VFD Simulator lets you set these bits and watch STW1 and ZSW1 change in your browser — no PLC needed.

Why a Bit Pattern Instead of Commands

A SINAMICS drive runs a state machine defined by the PROFIdrive profile. It moves between states such as "switching on inhibited", "ready to switch on", "ready to operate" and "operation enabled", and it changes state only when the control word presents the right bit pattern for that transition.

This is why there is no "start" instruction. The PLC does not command an action; it presents a condition, and the drive's state machine responds. Understanding that distinction resolves most of the confusion beginners have with drive integration — including why a value that looks correct sometimes does nothing.

Block Diagram: Telegram 1 Words Between PLC and G120

Before decoding the bits, see where the words travel. With Standard Telegram 1 the PLC and the drive exchange two 16-bit words in each direction on every PROFINET cycle — STW1 is the first word the PLC writes, ZSW1 the first word it reads back.

Where are STW2 and ZSW2? Not in a 2/2 telegram. In Standard Telegram 1 the second word out is the speed setpoint NSOLL_A and the second word in is the actual speed NIST_A. Many projects label them CW_02 or "word 2", which is fine, but the real STW2 and ZSW2 only appear in larger telegrams such as Telegram 3 — see SINAMICS G120 Telegram Types Compared.

STW1 — Every Control Bit

Read each hex digit from the bottom of its group upwards: the lowest bit is the rightmost binary digit. Bits 3–0 give 1110 = E, bits 7–4 give 0111 = 7, bits 11–8 give 0100 = 4 and bits 15–12 give 0000 = 0. Written from bit 15 down to bit 0 that is 16#047E.

Short tag names with the bit address and a comment. Copy the list into your tag table, watch table or documentation. The addresses assume the telegram starts at %QW256; Siemens stores the high byte first, so bits 0–7 sit in %Q257 and bits 8–15 in %Q256. Change the byte numbers to match your hardware configuration and keep the swap.

// STW1 - word %QW256 (bits 0-7 = byte %Q257, bits 8-15 = byte %Q256)
// Name      Type  Address   Comment
ON_OFF1      Bool  %Q257.0   // Bit  0 - ON / OFF1 ramp stop
OFF2         Bool  %Q257.1   // Bit  1 - No coast stop - keep TRUE
OFF3         Bool  %Q257.2   // Bit  2 - No quick stop - keep TRUE
En_Oper      Bool  %Q257.3   // Bit  3 - Enable operation (pulses)
En_RFG       Bool  %Q257.4   // Bit  4 - Enable ramp generator
Cont_RFG     Bool  %Q257.5   // Bit  5 - Continue ramp generator
En_SP        Bool  %Q257.6   // Bit  6 - Enable setpoint
Ack_Flt      Bool  %Q257.7   // Bit  7 - Fault acknowledge - pulse only
Res_08       Bool  %Q256.0   // Bit  8 - Reserved
Res_09       Bool  %Q256.1   // Bit  9 - Reserved
Ctrl_PLC     Bool  %Q256.2   // Bit 10 - Control by PLC - keep TRUE
Rev          Bool  %Q256.3   // Bit 11 - Reverse direction
Res_12       Bool  %Q256.4   // Bit 12 - Reserved
MOP_Up       Bool  %Q256.5   // Bit 13 - Motor potentiometer raise
MOP_Dn       Bool  %Q256.6   // Bit 14 - Motor potentiometer lower
CDS          Bool  %Q256.7   // Bit 15 - Command data set select

The active-low behaviour of bits 1 and 2 catches people out. OFF2 and OFF3 are enables, not commands. A PLC that leaves them at 0 while setting bit 0 has told the drive both to run and to coast, and the drive obeys the stop.

The Three Values You Actually Write

The sequence matters. Hold 16#047E for at least one PLC scan and confirm the drive reports ready before writing 16#047F. Many first integrations write the run value immediately at power-up, find nothing happens, and start suspecting the network — when the state machine simply never passed through the ready state.

Stopping is the same transition in reverse. Writing 16#047E clears bit 0 and produces an OFF1 ramp stop using the drive's deceleration time. Writing 16#0000 instead clears the OFF2 enable as well and the motor coasts — a different and usually unintended outcome.

ZSW1 — Every Status Bit

Short tag names with the bit address and a comment. Copy the list into your tag table, watch table or documentation. The addresses assume the telegram starts at %IW256; Siemens stores the high byte first, so bits 0–7 sit in %I257 and bits 8–15 in %I256. Change the byte numbers to match your hardware configuration and keep the swap.

// ZSW1 - word %IW256 (bits 0-7 = byte %I257, bits 8-15 = byte %I256)
// Name      Type  Address   Comment
Rdy_SwOn     Bool  %I257.0   // Bit  0 - Ready to switch on
Rdy_Oper     Bool  %I257.1   // Bit  1 - Ready to operate
Oper_En      Bool  %I257.2   // Bit  2 - Operation enabled - real running signal
Fault        Bool  %I257.3   // Bit  3 - Fault active
No_OFF2      Bool  %I257.4   // Bit  4 - No coast stop active
No_OFF3      Bool  %I257.5   // Bit  5 - No quick stop active
SwOn_Inh     Bool  %I257.6   // Bit  6 - Switching on inhibited
Warning      Bool  %I257.7   // Bit  7 - Warning active
Spd_OK       Bool  %I256.0   // Bit  8 - Speed deviation within tolerance
Ctrl_Req     Bool  %I256.1   // Bit  9 - Control requested
Spd_Cmp      Bool  %I256.2   // Bit 10 - Comparison speed reached
No_Limit     Bool  %I256.3   // Bit 11 - Setpoint reached / limit not exceeded
App_12       Bool  %I256.4   // Bit 12 - Application specific
App_13       Bool  %I256.5   // Bit 13 - Application specific
App_14       Bool  %I256.6   // Bit 14 - Application specific
App_15       Bool  %I256.7   // Bit 15 - Application specific

Bit 6, switching on inhibited, is the underused one. A drive that will not start after a fault is usually reporting this bit, and the cause is that the run command was still present when the fault cleared. The state machine requires the run bit to go low and high again — an important detail if your program holds bit 0 permanently.

Using ZSW1 Correctly on the HMI

The rule is simple and frequently broken: show what the drive says, not what the PLC asked for.

A green "running" lamp driven from the PLC's own command bit will stay lit while the drive is tripped, because the command is still being written. The operator sees a running machine that is not turning. Drive the lamp from ZSW1 bit 2 instead and the indication is always truthful.

The same applies to interlocks. A downstream conveyor that starts because the upstream drive was commanded to run, rather than because it reports operation enabled, will start into a stationary line. Use bit 2 for run interlocks and bit 8 or 11 where the downstream equipment needs the upstream drive to be at speed.

Fault Acknowledge Is an Edge

Bit 7 clears a fault on its rising edge. Holding it at 1 permanently is a mistake that looks like a working system: faults clear the instant they appear, the HMI stays green, and nobody notices that a motor is tripping on overload every thirty seconds until the winding fails.

Handle it properly in code. Detect a rising edge on the operator's reset input, set bit 7 for a short fixed time — around 200 ms — then clear it. A single scan is not enough: it can be shorter than the PROFINET update time, so the pulse may never reach the drive. In a reusable function block this belongs inside the block with a static "previous state" variable, so no caller can get it wrong.

Also acknowledge only what the operator asked for. Automatic, cyclic acknowledgement — pulsing bit 7 on a timer to "keep the line running" — converts a protective device into a decorative one.

These bits are one piece of Siemens PLC and VFD networking — the wider picture covers hardwired control, USS, Modbus, PROFIBUS and PROFINET.