Resolving ET 200SP F-DQ 4x24VDC/2A PM Safety Output Simulation Failures in SIMIT V10.2

In SIMIT V10.2, fail-safe output card ET 200SP F-DQ 4x24VDC/2A PM failing to switch on its physical or simulated safety output (such as Q6.0 remaining at 0 despite safety logic commanding it TRUE in S7-PLCSIM / SIMIT) is caused by the SIMIT simulation coupling misinterpreting the card's P/M-switching (PM) readback and dark-test handshake. Unlike standard P/P-switching cards (e.g., F-DQ 8x24VDC/0.5A PP) which only switch the high-side P-switch, PM-switching modules control both the high-side (P) and low-side (M) switches and perform cyclic bit-pattern readback tests. If SIMIT's simulation component does not model the complementary M-switch signal or if the readback test fails in simulation, the safety driver block (F_CH_DO) passivates the channel, forcing QBAD = 1 and holding the output at 0. To fix this, disable the wire-break and dark-test readback options in HW Config for the simulation session or map the complementary P/M simulation channels in SIMIT.

Executive Summary

Virtual commissioning of safety instrumented systems using Siemens SIMIT and S7-PLCSIM allows complete pre-testing of safety interlocks, emergency shutdowns, and burner management systems. However, engineers simulating distributed ET 200SP fail-safe stations frequently discover that while standard 8-channel P/P safety output modules work flawlessly, 4-channel 2A P/M modules (6ES7136-6DB00-0CA0) remain permanently de-energized. In the AS safety program, the F_CH_DO driver passivates the channel and outputs zero. This failure stems from the strict PROFIsafe diagnostic readback mechanics inherent to PM-switching circuits. Aligning module parameters in HW Config and configuring SIMIT coupling signals restores full safety output simulation.

Architecture and Fundamental Mechanics

The operational architecture of fail-safe digital outputs in S7 F Systems and SIMIT simulation models involves dual-switch topologies and PROFIsafe testing:

PP-Switching vs. PM-Switching Topologies:
* PP-Switching (e.g., F-DQ 8x24VDC/0.5A PP): The module switches only the positive potential (P-switch) to the load. The load's ground return is permanently tied to 0V. Testing involves brief low-pulses (dark test) on the high side.
* PM-Switching (e.g., F-DQ 4x24VDC/2A PM): The module contains two internal semiconductor switches per channel: a P-switch connected to +24V and an M-switch connected to ground (0V). The load is connected floating between the P and M terminals. This provides immunity against single ground faults and cross-circuit faults.
The Cyclic PROFIsafe Readback Test:
* The physical module executes continuous dark tests (brief de-energization pulses of ~1 ms) and light tests to verify that both the P-switch and M-switch can interrupt current.
* Internal diagnostic circuitry reads back the voltage state at both terminals. If the readback does not match the test pattern within the configured readback time (t_DAT), the onboard processor flags a hardware discrepancy.
Failure Mechanism in SIMIT V10.2 Coupling:
* In SIMIT V10.2, the S7-PLCSIM Advanced or Standard S7-PLCSIM coupling maps the fail-safe process output image (PAA). For an F-DQ PM card, the safety program writes to the PROFIsafe output telegram.
* If SIMIT simulates the field load without modeling the complementary P/M ground return, or if S7-PLCSIM expects diagnostic feedback from the virtualized module that SIMIT's coupling does not emulate, the PROFIsafe watchdog trips.
* The AS safety block F_CH_DO detects channel passivation, sets QBAD = 1, and drives output pin Q = 0, preventing the output bit in Q6.0 from ever turning on.

Step-by-Step Implementation Procedure

Follow these procedures to resolve PM safety output simulation failures in SIMIT V10.2:

Adjust F-Module Diagnostic Parameters in HW Config (For Simulation):
* Open HW Config for the AS station in SIMATIC Manager.
* Locate the ET 200SP station and open properties for the F-DQ 4x24VDC/2A PM module (6ES7136-6DB00-0CA0).
* Under the F-parameters / Parameters tab:
- Disable Wire break test (uncheck).
- Disable Dark test or set Maximum readback time dark test to the maximum allowable value (e.g., 5.0 ms or 10.0 ms).
- Set Discrepancy time to 1000 ms.
- Save and compile HW Config.
Verify F-Channel Block Configuration in CFC:
* Open the safety chart containing the F_CH_DO driver block connected to Q6.0.
* Verify that input pin ACK_NEC (Acknowledgment required) is understood: if channel passivation occurs, the block requires a positive edge on ACK_REI (Acknowledgment of reintegration) to depassivate.
* Connect an operator reset signal or simulation pulse to ACK_REI.
Configure SIMIT Coupling for ET 200SP:
* In SIMIT V10.2, open the active coupling (e.g., PLCSIM Coupling or Virtual Controller Coupling).
* Expand the output signals and verify that address Q6.0 is mapped.
* If SIMIT features an ET 200SP Macro / Component, ensure that both the P-potential and M-potential lines are connected to a simulated load component rather than tied directly to standard ground.
Re-import Hardware Configuration into SIMIT:
* In SIMIT, select Coupling > Import.
* Re-import the modified *.xdb or station configuration from STEP 7 to synchronize the updated F-parameters.
Execute Simulation and Reintegrate Channel:
* Launch S7-PLCSIM and SIMIT.
* Download the AS safety program.
* When the safety logic commands the output TRUE, pulse F_CH_DO.ACK_REI.
* Confirm that F_CH_DO.QBAD transitions to FALSE and Q6.0 switches to 1 in SIMIT.

Verification

In SIMIT, observe the signal table for Q6.0. When the AS safety logic asserts the safety interlock, verify that Q6.0 switches from 0 to 1 and remains stable. In CFC test mode on F_CH_DO, verify that QBAD = 0 (channel healthy) and QUALITY = 16#80 (good quality). Verify that connected simulation valves or contactors in SIMIT respond to the energized state.

Limitations and Operational Precautions

Parameter modifications made in HW Config for simulation (such as disabling dark tests or increasing readback times) must be reverted to verified engineering safety specifications before commissioning physical hardware on site. Always maintain separate hardware configurations for virtual simulation testing versus live plant deployment.

Engineer FAQ

Why did the 8x24V/0.5A card work while the 4x24V/2A card failed?

The 8-channel card uses PP-switching, which requires only simple high-side control. The 4-channel 2A card uses PM-switching with strict dual-switch readback diagnostics that SIMIT couplings can fail to satisfy.

What does QBAD = 1 mean on F_CH_DO?

QBAD = 1 indicates that the safety channel is passivated due to a communication timeout, module fault, or readback discrepancy, forcing the output to a safe de-energized state (0).