Resolving Siemens 2SpeedPositioning 16#8006 Error in PLCSIM

The 2SpeedPositioning library from Siemens delivers rapid traverse / creep speed positioning for S7-1500 controllers and ET 200SP distributed I/O. When engineers bring this library into a TIA Portal project and run it under PLCSIM or PLCSIM Advanced, the most common stumbling block is the technology object returning status word 16#8006 with the diagnostic text "Cannot open software gate of technology module." The error is not a programming defect in the user block; it is a simulation-environment limitation. This article documents the exact root cause, the parameterization checks required, and the validated remediation paths using PLCSIM Advanced and SIMIT.

1. Problem Statement and Symptom Signature

The error presents as a persistent 16#8006 status code returned by the 2SpeedPositioning function block (FB) on every call. The associated diagnostic buffer entry on the S7-1500 CPU (or ET 200SP interface module) reads:

Diagnostic text: "Cannot open software gate of technology module."
Remedy hint from the FB: "Check the parameterization of the technology module."

The same code can also be raised by the underlying instruction High_Speed_Counter, the technology object TO_Count instance, or by MC_Power / MC_Reset variants that the library wraps internally. Typical observable conditions in the user program:

• FB returns Done = FALSE and Busy = FALSE with Error = TRUE and Status = 16#8006.
• The technology object in TIA Portal diagnostics shows the software gate as closed (red), even after MC_Power has been driven to enable.
• CPU diagnostic buffer lists the technology object by name with event ID 125–129 range (TM Count configuration / gate errors).

1.1 Quick Symptom Table

2. Affected Products, Article Numbers, and Firmware

The following Siemens components are in scope of this fault. Use the listed catalog numbers and firmware versions when reproducing the issue or ordering replacement hardware.

The 2SpeedPositioning application example ships as project 109745386_2SpeedPositioning_PROJ_v10.zip with documentation 109745386_2SpeedPositioning_DOC_v10_en.pdf from the Siemens Industry Online Support. The library targets the S7-1500 Motion Control technology objects and expects a real (or simulated-with-physical-behavior) TM Count channel feeding the position feedback path.

3. Root Cause Analysis

The 16#8006 status code is generated by the TM Count firmware when the user program requests the software gate to open (i.e. SW_GATE = TRUE via MC_Power or the technology object command), but the module's local diagnostics reject the command. The PLC-side text in the technology object diagnostic is "Cannot open software gate of technology module."

Three conditions must be true before the software gate will open:

1. Hardware present and reachable. The TM Count module must be physically inserted (or emulated) and the PROFINET / PROFIBUS link must be in OPERATE / AR-UP state.
2. Configuration consistency. The technology object in TIA Portal must be assigned to the correct slot and channel, with the I/O addresses, signal type (24 V incremental, 24 V pulse, etc.), and filter settings matching the module.
3. Valid process signals. The counter input must be in a defined electrical state. The TM Count firmware will not open the software gate if the hardware gate is closed AND the firmware cannot validate the encoder / pulse input within the configured tolerance window.

When the project is run in PLCSIM (the TIA-integrated simulator), none of the three conditions are satisfied for the TM Count. PLCSIM emulates the CPU program execution but the ET 200SP station is not present, so the technology object has no target module. Status 16#8006 is returned immediately.

When the project is run in PLCSIM Advanced, the situation improves only partially. PLCSIM Advanced emulates the S7-1500 CPU and the PROFINET network, and it can inject diagnostic faults from technology modules as listed in its manual section "Technology module TM Count – Error message of instruction High_Speed_Counter." It does not generate the time-stamped 24 V pulse stream that a TM Count would read from a real encoder, and it does not allow the user to drive the digital inputs of an ET 200SP station as physical bits. Therefore the technology object still rejects the software gate.

4. Step-by-Step Diagnostic Procedure

Before changing the project, follow this ordered checklist. It isolates the failure in under five minutes and rules out the most common configuration mistakes.

4.1 Inspect the Technology Object

1. Open the TIA Portal project.
2. Navigate to Technology objects > [TO_Count_1] > Configuration > Hardware.
3. Confirm the Module slot points to the TM Count channel (e.g. Slot 4, Channel 0).
4. Confirm the I/O addresses for the count value, gate control, and status match the addresses in the device configuration.
5. Open Properties > Signal evaluation. Verify:
   • Signal type: 24 V incremental encoder or Pulse and direction as required by the application.
   • Filter frequency: ≥ 1 kHz (the default of 10 kHz is fine for most 24 V encoders).
   • Counting direction: configurable by program / hardware pin.

4.2 Read the CPU Diagnostic Buffer

1. Go online with the PLCSIM Advanced instance.
2. Open Online & diagnostics > Diagnostic buffer.
3. Search for events of class "Error – Technology module" with event IDs in the 125–129 range.
4. Note the text. Typical entries: "Software gate cannot be opened – signal error" or "Configuration error: signal type."

4.3 Validate the Hardware Gate

The software gate can only open when the hardware gate is also open. In the technology object, the hardware gate is controlled by:

• A digital input assigned to HW_GATE on the TM Count module, or
• The PROFINET slot signal PGood from the interface module, or
• Internal Always enable setting (development only).

If the hardware gate is wired to a real DI of the ET 200SP, it will always read FALSE in PLCSIM. Set the hardware gate to "internal gate, always open" only for the simulation test, then revert for production.

4.4 Confirm Simulation Type

1. Verify the active instance in PLCSIM Advanced > Instance field. It must match the S7-1500 CPU you are programming.
2. Confirm the project was downloaded to the PLCSIM Advanced instance (not to a remote CPU).
3. Confirm you are using a project-compatible TIA Portal version (e.g. TIA V17 with PLCSIM Advanced V5, or TIA V18 with V6).

5. Solution Path A – Enable PLCSIM Advanced and Override the Gate

This is the fastest path when the goal is to validate the high-level sequence logic of the 2SpeedPositioning block without simulating the counting pulses. The technique bypasses the hardware gate for the duration of the simulation only.

5.1 Configure PLCSIM Advanced

1. Install PLCSIM Advanced V4.0 SP1 or later. Refer to the PLCSIM Advanced manual (entry ID 109769604) for the licensed features matrix.
2. Launch PLCSIM Advanced and start a new instance. Select the matching CPU type and firmware.
3. In TIA Portal, choose the PLCSIM Advanced instance as the download target.

5.2 Modify the Technology Object for Simulation

1. Open Technology objects > [TO_Count_1] > Properties > Hardware gate.
2. Change the hardware gate assignment to "Not assigned – hardware gate permanently open". This removes the dependency on a physical DI.
3. Set the signal type to "Pulse and direction" with direction positive so the module does not require quadrature validation.
4. Save and compile.

5.3 Force the Software Gate from the User Program

Add a small initialization block that calls the technology object's SW_GATE command directly. In SCL this looks like:

// Simulation-only gate initialization
IF "PLCSIM_Active" THEN
    // Bypass MC_Power sequence for testing
    "TO_Count_1".SW_GATE := TRUE;
    "TO_Count_1".SW_GATE_ENABLE := TRUE;
END_IF;

After the software gate is open, the 2SpeedPositioning FB transitions through the rapid-traverse phase, switches to creep speed, and triggers the Done output when the simulated count reaches the configured setpoint. Note that the count value still does not increment, so you must drive TO_Count_1.CounterValue from the watch table or from a small SCL ramp function.

6. Solution Path B – Add a SIMIT Behavior Model

This is the only path that provides a realistic signal chain. SIMIT (Siemens Machine Simulator) emulates the field level: a virtual 24 V encoder generating the pulse train that the TM Count would see in production. Combined with PLCSIM Advanced, it forms the standard Siemens virtual commissioning toolchain.

6.1 Install SIMIT

1. Install SIMIT V10 (or newer, V11 is current). Refer to the SIMIT system manual (entry ID 109772648) for hardware and licensing prerequisites.
2. Activate the required license: SIMIT Basic for counter signals, SIMIT Professional for the full 2SpeedPositioning behavior model.
3. Confirm coupling: SIMIT can be coupled to PLCSIM Advanced via the PLCSIM Advanced coupling option (PROFINET, 1 ms update).

6.2 Import the Behavior Model

1. Open the SIMIT project template 2SpeedPositioning_BehaviorModel.simit from the Siemens application example. The template is bundled with the project zip 109745386_2SpeedPositioning_PROJ_v10.zip.
2. Import the GSD file of the ET 200SP station so SIMIT recognizes the TM Count module.
3. Map the SIMIT virtual encoder output to the channel that the technology object is configured for.
4. Start the simulation. The encoder generates the 24 V pulse stream; the TM Count firmware (running in PLCSIM Advanced) counts the pulses and opens the software gate as soon as the first valid edge is detected.

6.3 Verify the Coupling

In the TIA Portal online diagnostics, the TO_Count_1 should now show:

• Hardware gate: open (green)
• Software gate: open after the first MC_Power cycle
• Counter value: incrementing with the SIMIT pulse stream
• Status of 2SpeedPositioning: 16#0000 during execution, 16#8000 on Done

7. Solution Path C – Validate on Real Hardware

For final acceptance testing, no simulation is sufficient. The recommended approach is:

1. Build the control cabinet with a real CPU 1515-2 PN (or similar) and a real IM 155-6 PN ST plus TM Count 2x24V.
2. Wire a 24 V incremental encoder (e.g. Siemens 6FX2001-2HB02) to channel 0 of the TM Count.
3. Download the project, then observe the technology object online. The software gate opens within one cycle of OB91 (synchronous cycle, typically 1–4 ms).
4. Run a controlled axis motion: command rapid traverse to position 1000 mm at 200 mm/s, then creep speed 10 mm/s to the final position. The library's Done output should pulse TRUE on reaching the target.

This validation step is mandatory before shipping a machine. SIMIT and PLCSIM Advanced are not safety-grade and must not be used as the sole evidence of a working safety interlock.

8. 2SpeedPositioning Library – Technical Background

The 2SpeedPositioning library implements a two-stage positioning algorithm commonly used in hydraulic and pneumatic axis control, in stepper-motor / servo-on-off applications, and in any topology where a high-speed rapid traverse is followed by a low-speed creep to obtain a precise stop.

8.1 Algorithm Stages

8.2 Library Interfaces

The FB exposes the following standard inputs:

• enable – start the sequence
• setpointPosition – LREAL target in user units (mm, °, increments)
• rapidSwitchOffOffset – distance before setpoint at which to drop from rapid to creep
• creepDistance – safety margin before final setpoint
• hwidCount – HW_IO of the TM Count technology object
• hwDO_Rapid, hwDO_Creep, hwDO_Brake – HW_IO of the digital outputs

Outputs: active, busy, done, error, status (WORD, format 16#…).

8.3 Status Code Map

Engineers are encouraged to read the full 2SpeedPositioning documentation (PDF) for the complete status code list and the recommended reaction strategy.

9. Technology Module Parameterization Reference

The following parameter sets are the minimum required for the TM Count to accept a software-gate-open request. Use them as a checklist during project review.

9.1 Required Module Parameters

9.2 TIA Portal Configuration Path

1. Project tree → Devices & networks.
2. Select the ET 200SP station → slot of the TM Count.
3. Open Properties > Parameters in the inspector.
4. Set the parameters listed in 9.1.
5. Click Compile > Hardware (rebuild all).
6. Open the technology object and confirm it auto-detects the new channel.

10. Verification Checklist

Run the following checks after applying any of the solutions. Mark each item as Passed / Failed / N/A.

11. Troubleshooting Matrix

Match the symptom to the cause and the fix quickly.

12. Performance and Sizing Notes

For real-time control of a 24 V incremental encoder, the CPU must service the TO_Count update within the configured cycle time. Use the following rules of thumb when sizing the system:

• Set the OB91 (synchronous cycle) to 1 ms for a TM Count with 100 kHz input.
• For 200 kHz operation, drop to 500 µs if the CPU firmware supports it (CPU 1518-4 PN/DP at V3.0).
• Reserve at least 1 ms of OB1 free time for the 2SpeedPositioning FB and the user logic. A 2 ms OB1 is the safe default for non-safety applications.

The maximum counter frequency is bounded by:

f_max [Hz] = 1 / (T_filter + T_cyclic)

where T_filter is the configured input filter and T_cyclic is the OB91 cycle time. With T_filter = 100 µs and T_cyclic = 1 ms, f_max = ~909 Hz. To go above this, switch to a 5 V differential signal via the TM PosInput 2 (6ES7138-6BA00-0BA0) where the supported bandwidth is 1 MHz per channel.

13. Best Practices and Field Notes

• Always keep the hardware gate signal explicit. Using "permanently open" is acceptable only inside the simulation. In production, route the hardware gate through a safety DI (F-DI) of an ET 200SP F-module to enable the safety stop category.
• Version-pin the library. The 2SpeedPositioning project zip (entry ID 109745386) is versioned. Use the matching TIA Portal version: V15.1 → PLCSIM Advanced V3, V16 → V4, V17 → V5, V18 → V6.
• Separate simulation and production projects. Keep the "hardware gate = permanently open" branch in a separate project variant (or behind a PLCSIM_Active compile flag) so that a wrong download cannot disable the safety gate on the shop floor.
• Monitor the diagnostic buffer continuously. Wrap the FB call in a small wrapper that logs every 16#80xx status to a data log. The combination of status and CPU uptime is invaluable for post-mortem analysis.
• Validate the F-CPU signature for safety axes. If the axis is part of a safety function (SIL 2 / SIL 3 per IEC 62061 / ISO 13849-1), the TM Count must be in a safety-approved slot and the hardware gate must be F-DI driven. Verify against the F-CPU signature generated in TIA Portal's safety administration.

14. Frequently Asked Questions