Why Forcing or Modifying I/O in Step 7 Fails on PROFINET ET 200SP Until Cable Reconnect

In SIMATIC PCS 7 with a CPU 410-5H and decentralized PROFINET ET 200SP stations, attempting to test I/O by writing values via 'Monitor/Modify Variables' fails because the cyclic controller program and active channel drivers (such as Pcs7DoOut) continuously overwrite the Process Image Output table every cycle. The reason the output only changes when the PROFINET cable is disconnected and reconnected is that the ET 200SP interface module (IM 155-6 PN) cycles through its link-up initialization sequence, temporarily outputting substitute/modified values before the cyclic PLC program re-establishes control. To properly test I/O, put the channel driver into Manual/Simulation mode in CFC or use the official STEP 7 Force Table.

Cyclic Output Overwriting vs Peripheral Forcing

During hardware commissioning of a new PCS 7 automation plant, engineers frequently test field wiring, relays, and solenoid valves on decentralized I/O racks (such as ET 200SP connected via PROFINET IO to a CPU 410-5H).

A classic commissioning anomaly occurs when an engineer opens Monitor/Modify Variables (or HW Config Monitor/Modify):
* The engineer enters an output address (e.g., Q 10.0 or QW 512) and commands a 1.
* The software table confirms: Modification executed successfully.
* Yet, on the physical ET 200SP digital output card, the channel LED remains OFF, and zero volts appear at the terminal.
* Curiously, if the engineer physically unplugs the RJ45 PROFINET cable from the ET 200SP and plugs it back in, the output LED flashes ON for a moment or latches until the next scan!

This occurs because of the fundamental execution model of SIMATIC controllers:
1. The 'Modify' Command is Not a Latch: 'Modify Variables' performs a one-shot write to the process image at the transition of the cycle.
2. Cyclic Overwrite by CFC Drivers: If the CPU has a compiled CFC program running in cyclic interrupt tasks (OB35, OB34), the channel driver blocks (Pcs7DoOut) execute every 100 ms. If the CFC logic commands 0, the driver block overwrites the process image back to 0 within milliseconds of the manual modify command!

Why Reconnecting the Network Cable Temporarily Latches Values

The baffling phenomenon where unplugging and reconnecting the PROFINET cable causes the modified value to appear stems from PROFINET IO state machine recovery:
* When the cable is pulled, the CPU detects station loss, triggering OB86 (Rack Failure).
* The ET 200SP enters local fail-safe mode, freezing or zeroing outputs according to module parameterization.
* When the cable is re-inserted, the PROFINET interface module (IM 155-6 PN) initiates an Application Ready (AR) handshake:
1. The controller establishes the communications relation.
2. The CPU transfers parameterization records and the current static buffer.
3. During this sub-millisecond link-up phase, the buffered modified value is pushed to the physical module output buffer.
4. A few milliseconds later, cyclic user program execution resumes, and the running CFC channel driver immediately re-imposes its logic command, turning the output back off.

Comparison Table - I/O Testing Methods in PCS 7

The following table compares different techniques for testing physical I/O on SIMATIC PCS 7 systems.

Testing TechniqueMechanismLatches Against Cyclic Overwrite?Triggers System Alarms?Recommended Deployment PhaseMonitor/Modify VariablesOne-shot write to process imageNo (Immediately overwritten)NoOff-line testing with CPU in STOPCFC Channel Driver SimulationSet SimOn = 1, write SimPV_InYes (Standard APL feature)Yes (Indicates simulation)Industry Best Practice in RUNTechnological Block Manual ModeCommand OpenMan / CloseManYes (Native control)NoLoop testing / CommissioningSTEP 7 Force Table (FORCE)OS-level peripheral latchingYes (Overrides cyclic program)Yes (Yellow FORCE LED on CPU)Strict emergency testing only

Step-by-Step Procedure for Proper I/O Testing on PROFINET

To test physical outputs on ET 200SP stations cleanly without fighting the cyclic controller program, use one of the two certified methods:

Method 1: Using CFC Channel Driver Simulation (Recommended)

Open CFC Chart in Test Mode:
* Open the CFC chart containing the output channel driver (Pcs7DoOut FB 1871 or Pcs7AnOu FB 1867).
* Activate Test Mode (glasses icon).
Enable Internal Driver Simulation:
* Locate the input parameter SimOn.
* Set SimOn.Value = TRUE and confirm.
* Locate input parameter SimPV_In.
* To energize the output, set SimPV_In.Value = TRUE.
* The channel driver directly energizes the physical output channel on the ET 200SP. The output LED illuminates and 24V DC is delivered to the field device.
Restore Normal Operation:
* Once wiring is verified, set SimOn.Value = FALSE.

Method 2: Using the STEP 7 Force Table

If the channel driver is unassigned:
1. Open the Force Table:
* In SIMATIC Manager, select PLC -> Monitor/Modify Variables -> Variable -> Display Force Values.
2. Declare Force Address:
* Enter the physical peripheral address (e.g., Q 10.0 or PQW 512).
* Set Force Value to TRUE (or desired counts).
3. Activate Forcing:
* Select Variable -> Force.
* Confirm the safety prompt.
* The controller hardware operating system latches the output. The yellow FRCE LED illuminates on the CPU 410-5H front panel.
4. Delete Force Values:
* When finished, select Variable -> Stop Forcing and delete all forced addresses.

Verification

Confirm that physical output signals respond reliably to testing commands:

Verify Physical Channel LED:
* Command the output using Channel Driver Simulation or Force Table.
* Inspect the physical ET 200SP output module. Confirm that the channel status LED illuminates solid green without flickering.
Measure Field Voltage:
* Use a digital multimeter across terminal Q and M. Confirm 24V DC is present.
Verify CPU Operating State:
* Open SIMATIC Manager and press Ctrl+D on the CPU 410-5H.
* Confirm that the CPU remains in solid RUN mode without unhandled diagnostic interrupts.

Limitations and Operational Precautions

Prohibition of Forgotten Force Values: Forcing latches outputs at the operating system level, bypassing all software interlocks. Always verify that the Force Table is empty (FRCE LED extinguished) before handing the system over to operations.
Missing ET 200 Stations Interrupt Flood: When commissioning with only 1 of 6 remote stations connected, the CPU constantly processes OB86 / OB122 interrupts. Ensure organization blocks OB82, OB83, OB85, OB86, and OB122 are present in the Blocks folder to prevent the CPU from tripping to STOP.
Substitute Value Configuration: In HW Config, verify module parameterization under 'Reaction to CPU STOP / Bus Fault' (Freeze last value vs Output substitute value 0).

Engineer FAQ

Why can't I modify inputs (I/O) using Monitor/Modify?

Physical inputs (I / PIW) are refreshed from physical field sensors every scan. Writing to an input is instantly overwritten by the physical module's real hardware state in the next sub-millisecond input update.

Can I test outputs while the CPU 410-5H is in STOP mode?

In STOP mode, the CPU disables peripheral output drivers by default for safety. However, HW Config Monitor/Modify allows testing outputs in STOP if 'Enable peripheral outputs' is explicitly checked in the dialog.

Does the CPU 410-5H support the Force Table over PROFINET IO?

Yes. The CPU 410-5H operating system fully supports hardware forcing across all decentralized PROFINET IO and PROFIBUS DP peripheral addresses.

What happens to forced values during a CPU power cycle?

Forced values stored in the CPU 410-5H non-volatile memory persist through power cycles and warm restarts until explicitly removed via the Force Table.