Designing Dual Modular Redundancy (DMR) with Automated I-O Testing in PCS 7

In SIMATIC PCS 7, a Dual Modular Redundant (DMR) architecture is designed using an S7-400H or S7-400FH system (1oo2D / 2oo2 structure) with redundant CPU 410-5H controllers, redundant power supplies, and redundant PROFINET/PROFIBUS networks. Automated I/O Testing (Auto I/O Testing) is the native diagnostic capability of fail-safe and high-availability ET 200 I/O modules to detect dormant hardware faults. It performs cyclic Dark Tests (brief <1ms de-energization pulses to verify output MOSFET switch-off capability without dropping the load), Light Tests (continuity pulses on inputs), and sensor discrepancy time evaluations configured natively in HW Config and monitored via S7 F-Systems driver blocks.

Dual Modular Redundancy (DMR) Architecture: 1oo2D vs 2oo2 Design

In high-integrity process automation, Dual Modular Redundancy (DMR) describes a dual-channel architecture deployed to achieve fault tolerance (high availability) and safety integrity. In SIMATIC PCS 7, DMR is realized via:

1oo2D Architecture (1-out-of-2 with Diagnostics): Two identical processing channels execute in parallel. Extensive internal diagnostics monitor both channels. If channel 1 fails, channel 2 takes over bumplessly (high availability). If an unresolvable discrepancy occurs in a safety context, the system transitions to a de-energized safe state (fail-safe).

The core hardware foundation consists of redundant CPU 410-5H (6ES7410-5HX08-0AB0) or CPU 417-5H controllers linked by high-speed optical synchronization submodules, fed by redundant 24V DC power supply modules, and communicating over redundant fieldbus paths (redundant PROFINET R1 or redundant PROFIBUS DP).

What Is Automated I/O Testing: Dark Tests, Light Tests, and Discrepancy Analysis

A foundational requirement of IEC 61508 / IEC 61511 safety systems is detecting dormant (unannounced) hardware faults before an emergency shutdown is requested. If a digital output remains energized for 3 years continuously, a welded output relay or shorted MOSFET transistor would prevent the valve from de-energizing upon a trip command.

Automated I/O Testing executes continuous, non-disruptive hardware diagnostics:

Dark Test (Dunkeltest - Digital Outputs): The output module briefly shuts off the output switch for a microsecond duration (typically 0.1 ms to 1.0 ms). An internal circuit measures voltage drop across the switch to confirm it can truly open. Because mechanical actuators and solenoids have inertia spanning 10 to 50 ms, the micro-pulse does not disturb plant operation.
Light Test (Helltest - Digital Inputs): The input module injects brief voltage pulses into sensor wiring to detect cross-circuit shorts, wire breaks, and stuck-at-1 faults without registering as false process triggers.
Sensor Discrepancy Evaluation: For redundant dual sensors (1oo2 sensor evaluation), the module tracks the time delta between contacts. If one contact flips while the other lags longer than the configured Discrepancy Time (e.g. 50 ms), the channel driver passivates the input and flags a discrepancy fault.

Hardware Selection: S7-400H vs S7-400FH with Redundant Distributed I/O

When specifying a DMR system in SIMATIC PCS 7, distinguish the system objectives:

S7-400H (High Availability DMR): Focuses strictly on maximum plant uptime. If a CPU, power supply, or fieldbus line breaks, the partner channel maintains uninterrupted plant operation. Uses standard ET 200M/ET 200SP modules.
S7-400FH (High Availability + Fail-Safe DMR): Combines fault tolerance with SIL 3 safety integrity. Incorporates the S7 F-Systems engineering package (6ES7833-1CC02-0YA5). Employs certified fail-safe I/O modules (e.g. F-DI 24xDC 24V, F-DO 10xDC 24V/2A) operating under the PROFIsafe protocol. Auto I/O testing is natively executed by the fail-safe hardware.

Automated I/O Testing Mechanisms in SIMATIC PCS 7 Systems

The following table summarizes automated I/O diagnostic mechanisms in SIMATIC PCS 7 fail-safe and redundant architectures:

Diagnostic Test TypeTarget Module TypeDiagnostic MechanismPhysical Fault DetectedPlant Operational ImpactDark Test (Bit Pattern Test)Fail-Safe Digital Output (F-DO)Microsecond shut-off pulse (<1 ms)Shorted MOSFET switch, welded contactZero (Imperceptible to actuators)Light TestFail-Safe Digital Input (F-DI)Microsecond test pulse injectionCross-circuit wire short, stuck-at-1Zero (Filtered by input filter)Discrepancy Time Analysis1oo2 Redundant SensorsSoftware timer in F-channel driverStuck mechanical microswitch, wire breakPassivates faulty channel; alarms WinCCWire Break / Open LoopAnalog Input (4–20 mA HART)Impedance / current floor detectionCut field cable, disconnected transmitterSets channel Quality Code to Bad (16#00)Redundant I/O PassivationRedundant ET 200 ModulesModule driver status handshakeModule hardware failure, backplane bus faultBumpless switch to partner module

[!NOTE]
Commercial Accuracy Notice: S7-400H fault-tolerant hardware redundancy is distinct from S7 F-Systems safety licensing. Designing > a fail-safe DMR system requires S7 F-Systems engineering licenses (6ES7833-1CC02-0YA5), F-Runtime licenses per CPU, and > certified fail-safe ET 200 I/O modules. Standard hardware redundancy alone does not establish SIL 3 safety compliance.

Verification

Verify that the DMR system and automated I/O diagnostics are functioning:

Bumpless CPU Failover: Power off the primary CPU in Rack 0. Verify that the standby CPU in Rack 1 assumes master status instantly without dropping digital outputs or causing actuator bumps.
Dark Test Verification: Measure the output of an energized fail-safe DO channel using an oscilloscope. Observe the periodic microsecond test notch (<1 ms), confirming active switch-off testing while the field relay remains firmly held.
Sensor Discrepancy Test: Disconnect one leg of a dual-redundant digital input. Verify that upon exceeding the configured discrepancy time, the F-channel driver passivates the channel, logs an alarm on WinCC, and provides safe substitute values.

Limitations and Operational Precautions

Observe these guidelines when designing DMR and Auto I/O testing systems:

High-Speed Electronic Loads: Very sensitive high-speed electronic relays or digital PLC inputs (response time <1 ms) can interpret Dark Test pulses as true turn-off signals. If connecting to electronic inputs, disable the Dark Test or configure a suitable test pulse width in HW Config module parameters.
Discrepancy Time Sizing: Size sensor discrepancy timers appropriately (e.g. 50 ms for microswitches, 200–500 ms for heavy mechanical gate switches) to avoid nuisance passivations during normal mechanical travel lag.
Proof Test Intervals: Automated I/O testing significantly extends required safety proof-test intervals, but does not eliminate periodic physical inspection mandated by plant safety management guidelines.

Engineer FAQ

What is the difference between DMR (Dual Modular Redundancy) and TMR (Triple Modular Redundancy)?

DMR uses two processing channels with internal diagnostics (1oo2D). TMR uses three processing channels with 2-out-of-3 hardware voting (2oo3). In modern PCS 7 architectures, DMR with CPU 410-5H and automated diagnostics achieves SIL 3 safety and 99.999% availability without the expense of triple hardware.

Will the Dark Test pulse cause my process valves to flicker or close?

No. Dark test pulses last less than 1 millisecond. Standard solenoid valves and industrial contactors have mechanical response times of 20 to 50 milliseconds and cannot respond to microsecond pulses.

How is Auto I/O Testing enabled in SIMATIC PCS 7?

Auto I/O testing is configured in HW Config under the Object Properties of each fail-safe module (e.g. enabling 'Short-circuit test', 'Dark test', and setting 'Max. test time').

Can I do Auto I/O Testing on standard non-safety ET 200M modules?

Standard modules support basic wire break and impedance diagnostics, but advanced Dark Tests and cross-circuit testing require certified fail-safe modules (such as 6ES7326-1BK02-0AB0 or ET 200SP F-modules).