CiA 402 State Machine Explained: States, Transitions, and Troubleshooting
Apr 11, 2026
The CiA 402 standard — also published as IEC 61800-7-201 — defines the device profile every servo drive and motion controller on CANopen, EtherCAT (CoE), POWERLINK, or Sercos-over-EtherCAT speaks. It covers the object dictionary, the DS402 state machine, and the operating modes (Profile Position, Profile Velocity, Profile Torque, Homing, Cyclic Synchronous Position/Velocity/Torque, Interpolated Position). If you commission or debug servo drives, this is the state machine you are looking at whether the label on the drive says Beckhoff, Siemens, Kollmorgen, Yaskawa, Rexroth, Lenze, Maxon, or Omron.
TL;DR
The CiA 402 state machine has eight states. The drive advertises its current state through a 16-bit statusword at object 0x6041; the master commands transitions through a 16-bit controlword at 0x6040. A healthy startup walks the drive through Switch On Disabled → Ready to Switch On → Switched On → Operation Enabled using controlwords 0x0006 → 0x0007 → 0x000F, and the statusword settles at 0x0237 once the motor is live and under control.
What is CiA 402?
CiA 402 started life as a CANopen profile for drives and has since been adopted verbatim as IEC 61800-7-201 (behaviour) and IEC 61800-7-301 (CANopen/EtherCAT mapping). Its scope is deliberately narrow: it defines what a drive must do, not how the bus transports the bits. That is why the same statusword and controlword semantics apply unchanged from a CANopen CAN-bus drive to an EtherCAT CoE slave to a Sercos-over-EtherCAT drive. Vendor-specific extensions are permitted only above bit 15 and in vendor objects above 0x2000 — the lower bits stay portable.
Relation to IEC 61800-7-201
CiA 402 and IEC 61800-7-201 describe the same state machine. Vendors sometimes cite the IEC number in safety documentation and the CiA number in commissioning manuals; they are interchangeable.
Transport-agnostic: CANopen, EtherCAT, POWERLINK, Sercos
On CANopen the statusword/controlword travel as mapped PDOs (TPDO1/RPDO1 by default). On EtherCAT over CoE the same objects are mapped into the cyclic process image. On Sercos over EtherCAT the bits are transported as Sercos IDNs but semantically identical. On POWERLINK it is again PDOs. The state machine in every case is the one described below.
The eight drive states
| State | Power stage | Motor | Motion allowed | Practical meaning |
|---|---|---|---|---|
| Not Ready to Switch On | off | free | no | Drive booting, self-tests running. |
| Switch On Disabled | off | free | no | Ready for enable sequence. DC bus may be up. |
| Ready to Switch On | off | free | no | Drive has accepted Shutdown; ready to close. |
| Switched On | on, zero-current hold | held | no | DC bus up, output stage modulating at zero current. |
| Operation Enabled | on, active | driven per op mode | yes | Drive following motion commands. |
| Quick Stop Active | on | decelerating | only the decel | Executing quick stop per 0x605A. |
| Fault Reaction Active | on | decelerating or coasting | only the reaction | Executing fault reaction per 0x605E. |
| Fault | off | free | no | Latched fault. Read 0x603F for the code. |
Paste a captured statusword value into the CiA 402 Decoder to see which of these states your drive is in.
State transitions in order
A healthy startup walks through a fixed sequence:
- Power-up. Drive enters Not Ready to Switch On automatically, runs self-tests, advertises ready.
- T1 auto → Switch On Disabled. Drive is saying: "I'm alive. Enable me."
- Master writes controlword 0x0006 (Shutdown). T2 → Ready to Switch On.
- Master writes controlword 0x0007 (Switch On). T3 → Switched On. Output stage closes. Motor is energised but setpoints are ignored.
- Master writes controlword 0x000F (Enable Operation). T4 → Operation Enabled. Drive now accepts motion commands per the op mode selected in 0x6060.
Stopping runs the same transitions in reverse, or jumps via Quick Stop (CW bit 2 = 0) or Disable Voltage (CW = 0x0000) for emergency cases.
Statusword → state identification
The first seven bits of the statusword identify the state uniquely. The canonical masks:
| State | Mask | Value (hex) |
|---|---|---|
| Not Ready to Switch On | 0x004F | 0x0000 |
| Switch On Disabled | 0x004F | 0x0040 |
| Ready to Switch On | 0x006F | 0x0021 |
| Switched On | 0x006F | 0x0023 |
| Operation Enabled | 0x006F | 0x0027 |
| Quick Stop Active | 0x006F | 0x0007 |
| Fault Reaction Active | 0x004F | 0x000F |
| Fault | 0x004F | 0x0008 |
On a live bus the statusword also has bit 4 (Voltage Enabled) and bit 9 (Remote) set — so Operation Enabled typically reads as 0x0237 rather than 0x0027. The mask-based detector still identifies both values as Operation Enabled. For the full bit-by-bit breakdown see the statusword bit reference.
Controlword command summary
The controlword uses bits 0–3 to command state transitions and bit 7 for fault reset. The six values you will actually send:
| Command | Controlword | What it does |
|---|---|---|
| Disable Voltage | 0x0000 | Force to Switch On Disabled. Motor coasts. |
| Shutdown | 0x0006 | → Ready to Switch On. |
| Switch On | 0x0007 | → Switched On. Output stage closes. |
| Switch On + Enable Operation | 0x000F | → Operation Enabled. Motor under control. |
| Quick Stop | 0x0002 | → Quick Stop Active. Controlled decel. |
| Fault Reset | 0x0080 (rising edge) | → Switch On Disabled, if fault cleared. |
Fault Reset is edge-triggered — holding CW.7 high after the first reset blocks subsequent clears. Pulse it (~10–50 ms) rather than leaving it asserted. For every controlword bit in every mode see the controlword cookbook.
Operating modes and their statusword bits
Statusword bits 10, 12, 13 and controlword bits 4, 5, 6, 9 are operation-mode specific — their meaning depends on 0x6060 (Mode of Operation). Brief tour:
- PP — Profile Position (mode 1). CW.4 = New Setpoint (rising edge). SW.10 = Target Reached. SW.12 = Setpoint Acknowledge (handshake). SW.13 = Following Error.
- PV — Profile Velocity (mode 3). SW.10 = Velocity in window. SW.12 = Zero Speed.
- HM — Homing (mode 6). CW.4 = Start Homing. SW.12 = Homing Attained. SW.13 = Homing Error.
- CSP / CSV / CST — Cyclic Sync Position / Velocity / Torque (modes 8/9/10). SW.12 = Drive Follows Command Value. SW.13 = Following Error (CSP). SW.10 (Target Reached) is often undefined in cyclic modes — use SW.12.
Every drive exposes 0x6061 (Modes of Operation Display) so you can check which mode is active before interpreting the OMS bits.
Vendor implementations
CiA 402 is a standard, but every major vendor extends or reinterprets parts of it. The bits that matter most are documented consistently; the edge cases are where engineers lose days.
Beckhoff AX5000 / AX8000 / EL72xx
The EL72xx servo terminals expose the canonical statusword cleanly but use bits 14–15 for extras like "TxPDO toggle" and "warning latched". The AX8000 sometimes signals "Motion Active" in bit 8. Under TwinCAT NC, the NC axis wraps the CiA state machine — MC_Power.Enable roughly translates to Shutdown → Switch On → Enable Operation, but NC injects its own drive-on/regulator-on logic and can hold the axis in Switched On if bDriveOn/bRegulatorOn differ. NC faults appear as ADS error codes, not always as CiA bit 3.
Siemens SINAMICS (and PROFIdrive mapping)
SINAMICS S120 and V90 run PROFIdrive by default, not CiA 402. PROFIdrive uses STW1 (control word 1) and ZSW1 (status word 1) with a different state machine (states S1–S5b, ON/OFF1/OFF2/OFF3 transitions) and different bit meanings. If your SINAMICS is on PROFINET, you are almost certainly looking at ZSW1, not 0x6041. SINAMICS over EtherCAT or the V90 MF variant exposes CiA 402 directly, but Siemens still reserves statusword bits 8, 14, 15 for manufacturer use.
Kollmorgen AKD and AKD2G
AKD follows CiA 402 closely but adds a hardware enable input (HWENABLE) that must be high in addition to CW = 0x000F. You can command Operation Enabled over the bus and sit in Switched On forever if HWENABLE is low. Manufacturer bits 14–15 typically signal STO status and brake released. AKD2G packs more into statusword bit 8 (often a homing-subphase or motion-task flag).
Yaskawa Sigma-7
Heavy use of manufacturer bits. Statusword bit 8 is commonly Brake Released (BK signal); bit 14 commonly Tuning-less Active or auto-tuning subphase; bit 15 homing subphase details beyond CiA bit 12. Fault sub-codes follow Yaskawa's A.xxx / b.xxx numbering rather than CiA emergency codes — matters when decoding 0x603F.
Rexroth IndraDrive
IndraDrive descends from Sercos. Rexroth documents the master control word as ACCESS / ACTIV with bits like HS (halt/stop), EN (enable), RF (drive on) that map loosely to CiA SO/EV/EO. ctrlX Drive unifies on CiA 402 over EtherCAT but keeps Sercos parameters accessible as P-0-xxxx. When debugging, know whether you are on an IndraDrive with Sercos semantics or ctrlX with native CiA.
Maxon EPOS4
Controlword bit 11 is commonly used for endless movement toggles in PP mode — not canonical. EPOS4 also does not always tolerate jumping from Switch On Disabled straight to 0x000F; send the full sequence 0x0006 → 0x0007 → 0x000F.
Lenze, Omron, Delta, Elmo, Copley
- Lenze i950 / 9400: keypad can hold the drive in local control, dropping the Remote bit (SW.9) to 0.
- Omron 1S / G5: warning register separate from the statusword; SW.7 can be set without a CiA fault code.
- Delta ASDA: fault-reset edge behaviour has been more lenient on older firmware — pulse the bit.
- Elmo Gold / Platinum: older firmware keeps an "MO" (Motor On) bit orthogonal to CiA's Operation Enabled — you can be in CiA OE with MO off in legacy firmware.
- Copley Accelnet: event status register parallel to 0x6041; some faults surface there first.
Troubleshooting quick hits
- Stuck in Switch On Disabled: STO, emergency stop, or safety input not asserted. Bit 4 (Voltage Enabled) is the fast check.
- Not Ready to Switch On that never clears: DC bus is not up, or drive firmware is not finished initialising.
- In Switched On but motor will not move: CW.3 (Enable Operation) is not set, or mode 0x6060 is not what you think.
- Fault that will not reset: CW.7 is being held high, not pulsed — the first reset worked, the second did not.
For the full troubleshooting guide see Debugging CiA 402 Drive States.
Frequently asked
Is CiA 402 the same as DS 402? Yes. DS 402 is the older CiA document number; the current name is CiA 402-2 (behaviour) and CiA 402-3 (data mapping). IEC 61800-7-201 is the ISO-hosted version.
What is the difference between the statusword and the controlword? The statusword (0x6041) is drive-to-master: the drive reports state. The controlword (0x6040) is master-to-drive: the PLC commands transitions.
Why is Quick Stop (bit 5 / bit 2) active-low? So that a disconnected or crashed master — controlword = 0x0000 — naturally commands a safe stop instead of accidentally enabling the drive.
Does Fault Reset require a rising edge? Yes. Holding CW.7 high continuously means only the first fault is cleared. Pulse it.
Can I send controlword 0x000F directly from Switch On Disabled? Some drives tolerate it, most do not. Send 0x0006 → 0x0007 → 0x000F for portability.
Try it: decode your statusword
Open the CiA 402 Statusword & Controlword Decoder →
Paste a value you captured from your drive. The decoder highlights the matching state on the DS402 state machine, shows which bits are set and what they mean, and lets you click any state to load its canonical controlword and statusword.