Bypassing ET200S RTD Module to Prevent SF and BF Faults

1. Problem Description

An ET200S distributed I/O station configured with a 4AI RTD module (typical catalog number 6ES7134-4JB51-0AB0) is expected to keep the rest of the rack online when the temperature module is pulled for service, replacement, or fault isolation. On a default STEP 7 / TIA Portal configuration, removing the module causes the Interface Module (IM151 or IM151-3PN) to light both the red SF (System Fault) LED and the red BF (Bus Fault) LED, the CPU diagnostics buffer records a station failure, and—if no error OB is loaded—CPU STOP follows within milliseconds.

The user-observed symptom set is:

• IM151 SF LED steady red
• IM151 BF LED steady red (or flashing, depending on IM variant)
• CPU diagnostics buffer: "Station failure" with rack number 0 and detailed diagnostic: "Module does not exist / module removed"
• DI/DO modules downstream of the missing slot report good process values (outputs are frozen or zeroed depending on substitute value settings), but the CPU's cyclic OB1 is interrupted by OB85/OB86 calls
• If the CPU is S7-300 or Simotion D425 without OB83/OB85/OB86 loaded, the CPU goes to STOP with diagnostic buffer entry "OB not loaded" or "STOP caused by I/O access error"

The required outcome is that the system continues running with the RTD module physically absent, the CPU stays in RUN, and the IM does not indicate a hard fault.

2. Root Cause Analysis

ET200S head-end modules validate the actual configuration of the backplane against the configured (preset) topology at every power-up and on every plug event. When an I/O slot becomes empty, the IM writes a station diagnostic frame to the PROFIBUS-DP or PROFINET controller. The CPU receives this as a slot-level diagnostic interrupt and as a rack/IO failure notification.

Three independent mechanisms determine what happens next:

To bypass the RTD without a system fault, at least one of the following must be true:

1. The CPU must contain the appropriate error OBs to swallow the diagnostic event (S7-300, S7-400, Simotion D425), OR
2. The slot must be declared as "not present" in the hardware configuration so the IM does not report it as missing, OR
3. The IM151 firmware must support module exclusion via the PM-e power module control byte so the slot is held in a de-energized, non-reported state.

3. CPU-Specific Solution: S7-300 with Error OBs

An S7-300 CPU (e.g., 315-2 PN/DP, 317-2 PN/DP, 319F-3 PN/DP) does not expose an "Actual vs. Preset Mismatch" checkbox in HW Config. The supported workaround is to load the diagnostic error organization blocks into the S7 program. Each OB handles a specific fault class. Loading an OB with empty body (or with logging code) prevents the CPU from going to STOP.

Minimum block shells in STEP 7 V5.5 or TIA Portal V16+:

// OB83 - Insert/Remove Module Interrupt
// Local temp LOB#12 = OB start info
// LOB#16 = logical base address of module (if pull) / 0xFFFE (if insert)
// LOB#17 = 0xB0=remove, 0xB1=insert
// Empty body: system continues, diagnostic buffer records the event

// OB86 - Loss of Rack / Station Failure
// LOB#16 = rack number (0 for ET200S on PROFINET)
// LOB#17 = 0xC4=station failure coming, 0xC5=station failure going
// Empty body: CPU stays in RUN, BF/SF cleared when module re-inserted

Add the OBs via Insert > New Object > Organization Block in the STEP 7 project tree. Compile, download to the CPU, and perform a CPU restart. Verify the OBs are present in Online & Diagnostics > Diagnostics Buffer > OB Loaded.

4. CPU-Specific Solution: S7-400 with "Actual = Preset" Checkbox

On an S7-400 CPU (e.g., 414-3 PN/DP, 416F-3 PN/DP) running STEP 7 V5.5 or TIA Portal, the IM151 properties dialog contains the option "Actual = Preset / module replacement during operation" with a sub-checkbox for tolerance of missing modules. The configuration path is:

1. Open HW Config (STEP 7) or Device View (TIA Portal).
2. Click the IM151-1 / IM151-3PN in the ET200S station.
3. Open Properties > Operating Mode.
4. Enable "Activate module replacement during operation" if the station supports it (IM151-1 STANDARD, IM151-3PN, IM151-8 PN/DP CPU).
5. Enable "Support module replacement without PG" if hot-swap without a programming device is required.
6. Compile and download the hardware configuration.

On S7-400, the mismatch tolerance is implemented as: the IM continues to update the remaining slots, the BF LED is suppressed for the missing slot, and the SF LED remains off if the slot was previously reported as "module not present at configured address". S7-400 still benefits from OB82/OB85/OB86/OB122 being loaded; the checkbox is a CPU-side tolerance, not a substitute for error handling.

5. IM151 Solution: Module Exclusion via PM-e Control Byte

Newer IM151 head-end modules (firmware V3.x and later for IM151-1 STANDARD, V7.x and later for IM151-3PN) partnered with a PM-E power module expose a configuration management bit field. Writing 1 to the corresponding bit logically removes the module from the configuration without changing HW Config. Writing 0 re-enables it.

Siemens documents the procedure in the following support entries:

• Siemens Support Entry 25548014 — Module exclusion with IM151 and PM-e
• Siemens Support Entry 25548028 — Configuration management for ET200S module removal

Mechanism summary:

1. Reserve a control byte in the IM151's I/O address space. Default offset depends on the slot number; for the RTD at slot 4 with IM151-3PN starting at I-address 0, the configuration control byte is typically PIW/PQW 4 or PQB 4, depending on the slot mapping rule.
2. Set bit pattern 0x01 in the configuration byte = disable slot 1, 0x02 = disable slot 2, 0x04 = disable slot 4, and so on (bit position = slot number minus 1).
3. Read back the status byte to verify the bit acknowledged (returns 1 once the IM has applied the exclusion).
4. On module re-insert, write 0 to the bit to re-enable diagnostics.

// STL excerpt - S7-300/400 - disable RTD module at slot 4 via IM151 control byte
// Assumes IM151 configuration control byte mapped to QW 20
      L     W#16#0004        // Bit for slot 4 (0x04)
      T     QW 20            // Pulse-disable RTD module

// Re-enable: write 0
      L     W#16#0000
      T     QW 20

// SCL excerpt - S7-1500 with IM151-3PN via PROFINET
// slotExclusionBits is a BYTE mapped to the configuration control area
IF (rtdslotDisable = TRUE) THEN
    slotExclusionBits := slotExclusionBits OR 16#04;  // bit 2 = slot 4
ELSE
    slotExclusionBits := slotExclusionBits AND (NOT 16#04);
END_IF;

Behavior when exclusion is active:

• IM151 does not raise a station diagnostic for the excluded slot.
• SF/BF LEDs remain off (BF may flash briefly during exclusion transition, then clear).
• Process image for that slot is frozen at the last value or 0 per substitute value rule.
• No OB82/OB83/OB86 call is generated for the excluded slot.

6. Simotion D425 Solution

Simotion D425 (6AU1425-0AA00-0AA0, firmware V4.4 and later) uses the same I/O error OB concept as S7-300 when paired with an ET200S station over PROFINET. The relevant TO (Technology Object) addresses and I/O fault handling are configured in SCOUT / SCOUT TIA. The required steps are:

1. Open the Simotion project in SCOUT.
2. In the HW Config, expand the PROFINET IO system and locate the ET200S station.
3. Right-click the IM151-3PN and select Properties > Slot Diagnostics.
4. Enable "Module removal without CPU STOP" and select the RTD slot in the per-slot exception list.
5. Compile HW Config and download to D425.
6. Verify that the error handling program unit on the D425 contains the _TaskFaultTask equivalent or a subscribed I/O error handler; for Simotion V4.4+ this is configured under Project > Fault Tasks.

For Simotion, OB83 (insert/remove) is mapped to the technology system. The D425 enters STOP only if the I/O fault escalates to the operating system; with module removal configured as "non-fatal" the device continues executing the motion program and reports the missing slot only to the diagnostic buffer.

7. STEP 7 / TIA Portal Configuration Procedure

Step-by-step for the most common case: S7-300 with ET200S station over PROFINET, 4AI RTD module on slot 4.

Prerequisites:

• STEP 7 V5.5 SP4+ or TIA Portal V16 Update 5+
• ET200S station with IM151-3PN (6ES7151-3BA23-0AB0 or later) firmware V7.0+
• PM-E (6ES7138-4CB11-0AB0 or 6ES7138-4DA02-0AB0)
• 4AI RTD module (6ES7134-4JB51-0AB0) at slot 4

Procedure:

1. Open the project and navigate to the ET200S device view.
2. Mark the RTD module at slot 4 and open Properties > Module Parameters > Diagnostics. Enable Wire break and Overflow diagnostics so the module raises OB82 on channel fault.
3. Open the IM151 properties, go to Operating Mode, and enable module replacement support (only if a PM-E is mounted).
4. Add the OBs to the S7 program: OB82, OB83, OB85, OB86, OB122. Leave bodies empty if no logging is required.
5. Configure substitute values on the RTD slot: set "Behavior on CPU STOP" to "Substitute value = 0" or "Keep last value" to prevent outputs from drifting.
6. Compile and download HW Config and the program to the CPU.
7. Perform a warm restart (STOP → RUN) to activate the new configuration.

8. Verification Procedure

After the configuration is downloaded, verify the system tolerates RTD removal:

1. Confirm CPU is in RUN; the RUN LED is steady green.
2. Confirm IM151 SF and BF LEDs are OFF; ON LED is green; LINK LEDs on PROFINET port are flashing green.
3. Open Online & Diagnostics > Diagnostics Buffer on the CPU. There should be no "OB not loaded" or "STOP caused by I/O access error" entry.
4. Pull the RTD module from slot 4 with the station powered.
5. Within 1 second, observe: CPU remains in RUN; SF LED may briefly flash red and then extinguish; BF LED remains off; DI/DO modules continue to update process values.
6. Check the diagnostics buffer for new entries: "Insert/remove module interrupt (OB83)" with rack 0, slot 4, event code 0xB0 (removal); followed by "Module OK" when reinserted, event code 0xB1 (insertion).
7. For ET200S over PROFINET, also verify the I&M (Identification & Maintenance) data of the station is still accessible in the device view.

9. Affected Products and Compatible Firmware

10. Diagnostic Buffer Event Code Reference

11. Troubleshooting Matrix

12. Field-Proven Caveats

• Substitute value drift: When the RTD slot is excluded via PM-e control byte, the process input word (PIW) for that slot retains the last scanned value, not a substitute. If the application code uses the temperature as a permissive (e.g., heater enable), add explicit validity checking in the user program.
• Configuration consistency: The "Slot empty" option in HW Config (right-click the slot → Do not occupy) is preferred for permanently empty slots. Use the PM-e control byte only when the slot is intermittently present (true hot-swap).
• PROFINET vs. PROFIBUS differences: On PROFIBUS-DP, the IM151-1 STANDARD reports missing modules with a diagnostic bit at byte 0 of the station diagnostic. On PROFINET, the same event is reported as a channel diagnostic (API 0, slot 0, subslot 1). The CPU-side handling is identical, but the GSD file interpretation differs.
• Simotion D425 with V4.2 firmware: Earlier D425 firmware does not correctly map OB83 to a non-fatal fault. Upgrade to V4.4 SP1 minimum before relying on the tolerance mechanism. Simotion D425 firmware history documents the change set.
• ET200S vs. ET200SP: The question and answers are scoped to ET200S. On ET200SP (with BaseUnit type U0 and BU-Send), the module exclusion mechanism is different and uses the slot "Reserve" or "Reassign" function in TIA Portal. Do not apply ET200S procedures to an ET200SP station.

FAQ