Simulating PROFIBUS DP Station Failure and Rack Diagnostics in S7-PLCSIM

To simulate the loss of PROFIBUS DP communication between an S7-400 controller and an ET 200 distributed I/O station in S7-PLCSIM, trigger a hardware diagnostic interrupt (OB86) using PLCSIM's built-in error simulator. Simply setting input words to zero in a variable table does not trigger fieldbus fault evaluation or PCS 7 module drivers. In S7-PLCSIM, navigate to 'Execute -> Trigger Error OB...', select 'Rack Failure (OB86)', and enter the station failure event (Event Class 16#39, Fault ID 16#C4) with the DP station address. The simulated CPU executes OB86, causing PCS 7 RACK and MOD_D1 driver blocks to issue WinCC maintenance alarms and set channel quality codes to Bad (16#00).

Why Simple I/O Forcing Fails to Simulate Fieldbus Station Loss

When commissioning automation software in S7-PLCSIM, engineers frequently attempt to test bus loss scenarios by setting input process image variables (e.g. %IW512 = 0) via a variable table (VAT). In SIMATIC PCS 7, this test is fundamentally flawed.

In PCS 7, process signals are conditioned through Advanced Process Library (APL) channel driver blocks (such as Pcs7DiIn and Pcs7AnIn), which do not evaluate raw data values alone. Instead, they rely on hardware diagnostic blocks (RACK, MOD_D1, MOD_D8) generated by the driver generator. These diagnostic blocks evaluate Organization Blocks: OB86 (Rack Failure) and OB82 (Diagnostic Interrupt). If OB86 is not invoked by the controller operating system, the channel drivers continue reporting a Quality Code of 16#80 (Good), masking fieldbus failures in the operator interface.

S7-PLCSIM Error OB Triggering Architecture (OB86 and OB82)

S7-PLCSIM incorporates a dedicated simulation interface to test fault-tolerant logic and diagnostic interrupts without physical hardware:

Organization Block 86 (OB86 - Loss of Rack / Station): Triggered when a distributed I/O station drops off PROFIBUS DP or PROFINET IO (e.g. cable severed, power lost to ET 200M interface module 6ES7153-2BA10-0XB0).
Organization Block 85 (OB85 - Program Execution Error): Triggered when cyclic OBs attempt to update process image partitions belonging to unreached modules.
Organization Block 82 (OB82 - Diagnostic Interrupt): Triggered when an individual channel experiences wire break, short circuit, or sensor power failure.

By manually injecting these standardized event telegrams into the PLCSIM execution pipeline, the full PCS 7 diagnostic chain is activated exactly as on a live industrial plant.

Step-by-Step Procedure to Trigger DP Station Failure in PLCSIM

Follow this procedure to inject an authentic PROFIBUS DP station failure into an active PLCSIM instance:

Determine Hardware Parameters: In SIMATIC Manager HW Config, note the configured PROFIBUS DP station address (e.g. Station 3) and the logical base address (LADDR) of the IM 153 interface module.
Open PLCSIM Error Dialogue:
- In the S7-PLCSIM application window, navigate to Execute -> Trigger Error OB....
- Select Rack Failure (OB86).
Configure the Failure Telegram:
- Set Event Class: 16#39 (Incoming event / Station failed).
- Set Fault ID: 16#C4 (Failure of a DP slave station).
- Set DP Master System ID: Match the master system ID configured in HW Config (typically 1).
- Set Station Number: Enter the DP station address (e.g. 3).
Trigger Fault: Click Trigger. PLCSIM immediately passes the telegram to the simulated CPU operating system.
Restore Station (Outgoing Event): To simulate communication recovery, repeat the process with Event Class: 16#38 (Outgoing event / Station return).

Alternative Virtual Commissioning Tools: SIMIT Simulation Platform

For advanced simulation requirements, manual injection via PLCSIM dialogues becomes labor-intensive. The SIMIT Simulation Platform (6DL8913-0AK00-0AB5) automates this process:

SIMIT connects to S7-PLCSIM or Virtual Controllers via high-speed shared memory couplings.
SIMIT automatically imports the hardware configuration from the PCS 7 project.
Disconnecting a simulated ET 200 station in the SIMIT graphic canvas automatically generates the appropriate OB86 frames, driving true dynamic virtual commissioning.

PLCSIM Error Simulation Parameters for Fieldbus Faults

The following table specifies parameter entries for simulating various hardware faults in S7-PLCSIM:

Target Hardware FailureTarget OBEvent ClassFault ID (EV_NUM)Required Sub-ParametersResulting PCS 7 Driver BehaviorDP Station Loss (Incoming)OB8616#3916#C4Master System ID, DP Station AddressRACK block alarms; channel Quality Code 16#00DP Station Recovery (Outgoing)OB8616#3816#C4Master System ID, DP Station AddressStation clears; Quality Code transitions to 16#80PROFINET Device FailureOB8616#3916#CBPROFINET IO System ID, Device NumberRACK alarms; maintenance station fault bannerModule Wire Break (Channel)OB8216#3916#42Module Base Address (LADDR)MOD_D1 alarms; channel enters substitute value

[!NOTE]
Commercial Accuracy Notice: S7-PLCSIM is included as part of the SIMATIC PCS 7 Engineering Software license package > (6ES7658-1EX58-0YA5). Hardware simulation testing via PLCSIM consumes no physical Process Objects or controller hardware authorizations.

Verification

Verify that the simulated fieldbus loss propagates throughout the PCS 7 architecture:

CFC Channel Driver Quality Code: Open a CFC chart online monitoring an input on the failed station. Verify that the channel block output (Bad) asserts to TRUE and that the Signal Quality (ST) transitions from 16#80 to 16#00.
CPU Diagnostic Buffer: Open PLC -> Diagnostic Buffer in SIMATIC Manager. Confirm that an entry 'Failure of distributed I/O station' is logged under OB86.
WinCC Alarm and Maintenance Station: Verify that the WinCC Alarm Logging displays the system alarm 'DP Station failure' and that the Maintenance Station faceplate marks the rack with a red wrench symbol.

Limitations and Operational Precautions

Observe these boundaries when simulating fieldbus failures:

PLCSIM Single-Instance Limits: Standard S7-PLCSIM simulates a single CPU. It cannot simulate redundant S7-400H partner switchovers triggered by fieldbus line breaks.
Process Image Updates: In PLCSIM, process image partition cyclic updates do not physically halt when OB86 is triggered unless the channel driver substitute value logic takes control.
Restore Outgoing Events: Always trigger the matching outgoing event (16#38) to clear fault flags before ending the simulation session.

Engineer FAQ

Why didn't forcing an analog input word to 0 simulate a communication failure?

Setting an input to 0 merely provides a numeric value of 0. PCS 7 channel drivers evaluate hardware status via OB86/OB82 and module diagnostic blocks. Without OB86, the block treats 0 as a valid measurement.

Where do I find the DP station address to enter into PLCSIM?

Open HW Config in SIMATIC Manager, select the ET 200 station on the PROFIBUS line, and check the address listed in the station header (e.g. (3) IM 153-2).

Can I simulate wire breaks on individual analog channels in PLCSIM?

Yes. Use 'Execute -> Trigger Error OB -> Diagnostic Interrupt (OB82)', enter Event Class 16#39, Fault ID 16#42, and the module logical start address.

Does SIMIT require manual entry of OB86 telegrams?

No. SIMIT automates fieldbus failure simulation. Toggling a station switch in SIMIT automatically generates proper OB86 telegrams to the virtual controller.