Simulating Hardware Faults and Channel Driver Bad Signals in SIMIT for PCS 7

Simulating hardware faults, channel driver failures (Bad = 1), and diagnostic organization blocks (OB82, OB83, OB86) in SIMATIC SIMIT depends on whether the simulation environment utilizes the software-based SIMIT Virtual Controller (VC) or the hardware-based SIMIT Unit. In the SIMIT Virtual Controller, channel faults for analog inputs are simulated by forcing raw sensor values beyond the permissible overshoot/undershoot range (< -32768 or > 32767), while digital channel faults are simulated by manipulating the Mode_xx diagnostic parameter on the module driver block or writing invalid Quality Codes (16#00). In contrast, a physical SIMIT Unit provides native, protocol-level hardware fault injection, enabling direct triggering of OB82 wire breaks, OB83 module pulls, and OB86 station dropouts.

Simulation Architecture: SIMIT Virtual Controller vs SIMIT Unit

Virtual commissioning of SIMATIC PCS 7 automation software requires validating safety interlocks, alarm limits, and channel driver fault reactions without endangering physical plant hardware. When testing how PCS 7 APL channel drivers (Pcs7AnIn, Pcs7DiIn) react to hardware failures, engineers utilize Siemens SIMIT Simulation Platform.

However, the capability to inject faults differs fundamentally between two simulation architectures:

SIMIT Virtual Controller (VC): Software emulation of the S7-400 / CPU 410 controller executing on a Windows PC. The VC emulates the cyclic process image (inputs/outputs) and user program execution, but does not emulate the physical ASIC hardware registers of distributed I/O interface modules (IM 153-2 / IM 155-6).
SIMIT Unit (Hardware-in-the-Loop): A dedicated hardware appliance connecting real controllers (S7-400H / CPU 410-5H) to virtual fieldbuses (PROFIBUS DP / PROFINET IO) at the electrical and protocol frame layer.

Analog Input Fault Simulation in SIMIT Virtual Controller

In standard PCS 7 systems, analog input channel drivers (Pcs7AnIn / FB1869) evaluate both the raw integer process value (PV_In) and the module driver status:

Fault ScenarioSIMIT Virtual Controller MethodSIMIT Unit (Hardware-in-the-Loop) MethodChannel Driver ReactionWire Break / UnderflowSet SIMIT raw integer signal < -32768 (e.g., -32769 or 16#7FFF)Inject 'Wire Break' fault on simulated channelBad.Value = 1, Quality Code 16#00, Alarm assertedShort Circuit / OverflowSet SIMIT raw integer signal > 32767 (e.g., 32768 or 16#8000)Inject 'Short Circuit' fault on simulated channelBad.Value = 1, Quality Code 16#00, Alarm assertedDigital Channel Wire BreakManipulate Mode_xx parameter on module driver to 16#00Select Channel -> Inject 'Wire Break'Bad.Value = 1, Quality Code 16#00, Trip logic activeStation Loss / Rack FailureDisconnect VC network couplingTrigger 'Device Failure' on PROFINET deviceOB86 interrupt executed, all rack channels badModule Removal Under PowerNot supported in pure VC (requires driver script)Trigger 'Module Pulled' (OB83)OB83 interrupt executed, QMODF = 1

For analog signals in SIMIT VC, driving the simulated raw integer variable to an out-of-range value immediately causes the S7-400 CPU firmware to flag an overflow/underflow, forcing Pcs7AnIn.Bad.Value = 1.

Digital Channel Driver Fault Simulation Workarounds

Unlike analog inputs where integer boundaries indicate faults, a digital input in the SIMIT Virtual Controller is a simple boolean bit (0 or 1). Both states represent valid process conditions (Open or Closed), meaning a boolean signal cannot inherently represent a 'Wire Break' or 'Bad Quality'.

To simulate digital channel faults in SIMIT Virtual Controller without a SIMIT Unit:
1. Manipulate Module Driver Mode Parameter: In the Continuous Function Chart @ charts, the module driver (MOD_D...) possesses channel mode inputs (Mode_00 to Mode_15). Setting a channel's Mode_xx to 16#00000000 signals an invalid channel configuration, forcing the linked Pcs7DiIn into Bad = 1.
2. Quality Code Injection via SimS7 Driver: In SIMIT, create an auxiliary simulation component that writes directly to the QC (Quality Code) structure of the channel driver block, setting it to 16#00 (Bad) or 16#28 (Bad, process related).
3. Simulation Input Mode on APL Blocks: Parameterize the channel driver with SimOnLi = 1 and inject simulated bad values (SimPV_In).

Hardware-Level Fault Injection Using SIMIT Unit (HWIL)

When using a physical SIMIT Unit (such as SIMIT Unit PN or DP 6DL8900-...):
1. Open the SIMIT project with the SIMIT Unit coupling active.
2. In the SIMIT project navigation tree, expand the configured PROFINET IO or PROFIBUS DP network.
3. Locate the specific distributed I/O station (e.g., ET 200M or ET 200SP HA) and drill down to the individual I/O module and channel.
4. Right-click the channel or module and select Simulate Fault.
5. Choose the fault type: Wire Break, Short Circuit, Module Fault (OB82), Module Removed (OB83), or Station Failure (OB86).
6. The SIMIT Unit generates the exact hardware diagnostic telegrams, triggering the corresponding diagnostic interrupt OB in the real S7-400 CPU.

Verification

To verify channel driver fault reactions in PCS 7:
1. In SIMIT, trigger an analog underflow fault on simulated transmitter PIT_101.
2. Open the CFC chart in PCS 7 containing the associated Pcs7AnIn block.
3. Verify that Pcs7AnIn.Bad.Value = 1, PV_Out.ST = 16#00, and that the substituted value (SubsPV) is applied if configured.
4. In WinCC Runtime, open the faceplate for the associated analog monitoring block; confirm that a yellow/red maintenance diagnostic icon appears and that the alarm triggers in the alarm banner.

Limitations and Operational Precautions

Fault injection tests should be conducted exclusively on isolated simulation environments or Virtual Controllers. Never inject simulated faults or alter module driver parameters in a production automation program connected to live industrial machinery, as forcing channel faults can trigger emergency shutdown (ESD) interlocks and trip operational equipment.

Engineer FAQ

Can SIMIT Virtual Controller trigger OB82 and OB86 interrupts?

By default, standard SIMIT VC only exchanges process image I/O data. Triggering diagnostic OBs requires either the SIMIT Unit hardware or specialized SIMIT scripts interacting with the PLCSIM Advanced API.

Why doesn't driving a digital input to 0 in SIMIT make Pcs7DiIn show 'Bad'?

Because 0 is a completely valid logic state (de-energized). A channel driver only asserts Bad = 1 when the underlying hardware module driver reports a diagnostic wire break, module fault, or out-of-range condition.