Siemens F-DQ 8x24VDC/0.5A PP HF Safety Output Programming in TIA Portal V17

Authoritative engineering reference for programming the SIMATIC ET 200SP F-DQ 8x24VDC/0.5A PP HF fail-safe digital output module (article number 6ES7136-6DB00-0CA0) inside a TIA Portal V17 F-runtime group on an S7-1500 F-CPU. The reference covers the architectural rule that prevents standard organization blocks (OB1) from driving F-output tags, the difference between P-switching and PM-switching wiring, the F-channel tag structure exposed by the module, the passivation and reintegration mechanism with ACK_OP, the behavior triggered by force operations, and the diagnostic events that surface in the F-CPU diagnostic buffer.

1. Problem Frame and Engineering Context

The first-time question that arises during commissioning is almost always the same: "Can I write to Q120.0 and Q120.1 from OB1 to switch a 24 V load, the same way I write to a standard DQ channel?" The engineering rule is unambiguous: no. The F-DQ 8x24VDC/0.5A PP HF exposes its output bits as fail-safe I/O tags. The TIA Portal V17 safety editor protects these tags from writes that originate outside the F-runtime group, and the F-CPU runtime will passivate the channel and stop driving the load when an unauthorized write is detected.

The F-DQ 8x24VDC/0.5A PP HF is suitable for safety functions up to:

• SILCL 3 per IEC 62061
• SIL 3 per IEC 61508
• Performance Level e (PL e) and Category 4 per ISO 13849-1

Achieving any of these levels is conditional on correct placement of the safety logic in the F-runtime group, correct PROFIsafe parameter assignment, and a documented acceptance test. The Performance Level or Safety Integrated Level that the installation actually reaches is defined by the entire safety function, not by the module alone: the wiring, the sensor chain, the F-CPU, and the F-runtime group cycle time all contribute. A module that is technically rated to PL e is not in a PL e application if the surrounding logic and wiring are wrong.

2. Module Identification and Technical Data

The F-DQ 8x24VDC/0.5A PP HF is the SIMATIC ET 200SP fail-safe digital output module. The article number (MLFB) is 6ES7136-6DB00-0CA0.

The "PP" suffix in the article number means the module drives a sourcing output. Each channel sources current to a load whose other terminal returns to 0 V (M). A "PM" module such as the F-DQ 4x24VDC/2A PM HF (6ES7136-6DC00-0CA0) is software-switchable per channel between P-switching and M-switching operation; the PP variant is not. Do not substitute the article numbers when reading out wiring diagrams or P&ID schematics.

3. TIA Portal V17 Safety Program Architecture

An S7-1500 F-CPU runs two programs in parallel, and the boundary between them is enforced by the F-system:

1. The standard user program, structured with normal OBs (OB1, OB10, OB35, OB82, etc.). The standard program can read F-shared-DB tags that the F-program has published; it cannot write to F-channel tags, and it cannot call F-blocks directly.
2. The safety program, structured as a single F-runtime group. The F-runtime group owns the F-OB (the main safety block), F-FBs, F-FCs, F-DBs, and F-instances. Only code inside the F-runtime group is allowed to write to F-channel tags.

The F-runtime group runs in a fixed time slice of the F-CPU. The maximum cycle time of the F-runtime group, the F-monitoring time, and the PROFIsafe watchdog are configured centrally in the safety editor. TIA Portal V17 enforces several invariants on the F-runtime group:

• All F-blocks must be instantiated and called from the F-OB, or from an F-FB that the F-OB calls.
• Direct writes to F-channel tags from a standard OB or standard FB are rejected at compile time by the F-compiler and at runtime by the F-system.
• Constants, F-shared-DB tags written by the F-program, and inputs from F-channel tags are the only valid sources for the logic that drives F-channel output tags.
• The F-program is protected by a safety password and a safety signature; any change to the F-program invalidates the signature and requires a new acceptance test.

The boundary between the two programs is crossed only through the F-shared DB. The F-program writes a value to a tag in the F-shared DB; the standard program reads that tag and uses the result to drive standard DQ channels, HMI display, or trending. The reverse direction uses a different mechanism: the F-program reads a standard-side pre-condition from the F-shared DB. This pattern is the only allowed communication between the two execution contexts and is the only path through which a "non-safety variable that commands safety output" can be implemented.

4. Prerequisites

Before configuring the F-DQ in TIA Portal V17, validate the following hardware and software prerequisites:

• TIA Portal V17 (V17.0 or later update) installed, including the STEP 7 Safety V17 option package.
• S7-1500 F-CPU with current firmware. Examples: CPU 1515F-2 PN (6ES7515-2AM02-0AB0, firmware V2.9.x or later), CPU 1516F-3 PN/DP (6ES7516-3AN02-0AB0), or CPU 1518F-4 PN/DP (6ES7518-4AP00-0AB0). Cross-check the firmware in the SIMATIC S7-1500 System Manual.
• ET 200SP interface module IM 155-6 PN ST or IM 155-6 PN HF (6ES7155-6AU30-0CN0 / -0AA0) configured as a PROFINET IO device.
• F-DQ 8x24VDC/0.5A PP HF (6ES7136-6DB00-0CA0) plugged onto a compatible BaseUnit (BU type A0).
• PROFIsafe address assignment tool or DCP assignment via TIA Portal to program the F-source address and F-destination address into the F-DQ module.
• Access to the F-CPU safety signature printout from the most recent accepted project.

5. P-Switching and PM-Switching Wiring Topologies

Wiring selection for an F-DQ depends on the "PP" or "PM" suffix in the article number and on the type of load. The distinction is the first thing to verify on the bench, because the diagnostic question "P or PM-switching" maps to a specific module variant.

5.1 P-Switching (F-DQ ... PP)

For the F-DQ 8x24VDC/0.5A PP HF, the channel sources current. The conventional wiring is:

• Supply: 24 V DC applied to the BaseUnit power bus (L+ / M).
• Load: connected between the channel terminal (e.g., DO0) and 0 V (M).
• Behavior: when the safety program sets the channel VALUE = TRUE, the output transistor closes and the load is energized with 24 V DC sourced from the module.

The PP module performs internal dark- and light-period test pulses on each output to detect cross-circuits and wire breaks. The pulse widths and the discrepancy monitoring are defined in the module manual. The application must tolerate the brief interruptions caused by these test pulses. Mechanical relays and most contactors are fast enough; some low-power sensors and LED indicators may need to be filtered or the channel's wire-break monitoring disabled in the F-DQ parameter assignment.

5.2 M-Switching and PM-Switching (F-DQ ... PM)

The F-DQ 4x24VDC/2A PM HF (6ES7136-6DC00-0CA0) is software-switchable per channel:

• P-switching mode: equivalent to the PP module topology above.
• M-switching mode: load connected between 24 V supply and the channel terminal; the channel sinks current to 0 V when closed.

When the source question asks "P or PM-switching", the correct answer for the 6ES7136-6DB00-0CA0 is "P-switching only". If PM-switching is required by the load, replace the module with the 6ES7136-6DC00-0CA0 and configure the channel mode in the device configuration of TIA Portal V17. The two modules are not interchangeable in hardware design or in device description.

6. Step-by-Step F-DQ Programming Procedure

The following procedure configures Q120.0 and Q120.1 of the F-DQ 8x24VDC/0.5A PP HF from an S7-1500 F-CPU in TIA Portal V17.

1. Insert the ET 200SP station under the PROFINET IO system of the F-CPU. Add the F-DQ 8x24VDC/0.5A PP HF in the correct slot of the device view. TIA Portal will populate the I/O addresses (default: outputs at Q120..Q120 byte 0 = channels 0..7).
2. Open the module properties → "F-parameters". Set the F-source address (F-CPU PROFIsafe source), the F-destination address (PROFIsafe address of the module), and the F-monitoring time. Default F-monitoring time is 150 ms; do not increase it without a safety-engineering review.
3. Open the module properties → "Channel parameters". For each used channel, enable the value status (QI) and assign the channel's "Behavior on CPU STOP" to "Passivate channel" (default).
4. Compile the project. TIA Portal will mark the F-CPU as a "safety-related CPU" and the F-DQ as a "safety-related module".
5. In the program blocks, add a new F-runtime group (default name "F_RTG1") with a call of an F-OB (default name "Main_Safety_OB"). The F-OB owns the cyclic processing of the safety program.
6. Inside the F-OB, or in an F-FB called by the F-OB, write the logic that drives Q120.0 and Q120.1. Example in Structured Text:

// F-FB "FB_FDoorCtrl" (F-runtime group: F_RTG1)
// Called from F-OB "Main_Safety_OB"

IF "iSafetyOK" AND "iCmd_Start" THEN
    "F-DQ 8x24VDC/0.5A PP HF".Channel[0].Value := TRUE;  // Q120.0
    "F-DQ 8x24VDC/0.5A PP HF".Channel[1].Value := TRUE;  // Q120.1
ELSE
    "F-DQ 8x24VDC/0.5A PP HF".Channel[0].Value := FALSE;
    "F-DQ 8x24VDC/0.5A PP HF".Channel[1].Value := FALSE;
END_IF;

// Operator acknowledge (ACK_OP) for reintegration after a passivation
"F-DQ 8x24VDC/0.5A PP HF".Channel[0].ACK := "iAck_OP_Q120_0";
"F-DQ 8x24VDC/0.5A PP HF".Channel[1].ACK := "iAck_OP_Q120_1";

7. Map the F-shared-DB tags (e.g., "iSafetyOK", "iCmd_Start", "iAck_OP_Q120_0") from a standard FB that pre-conditions the F-program inputs. The F-program reads these tags; the standard program writes them. This is the only allowed communication path between the two programs.
8. Set the maximum cycle time of the F-runtime group to a value that ensures the F-monitoring time of every F-I/O is satisfied. TIA Portal V17 provides a runtime measurement in the safety editor that reports the worst-case observed cycle time. The default maximum cycle time of 50 ms is adequate for most discrete applications; high-channel-count stations may require tuning.
9. Compile, download, and sign the safety program. Run the acceptance test and store the safety signature.

7. Why OB1 Driving F-DQ Outputs Is Invalid

Writing to the channel VALUE tag of an F-DQ from OB1 (or any other standard OB/FB) fails on three independent levels:

1. Compile time: the F-compiler in TIA Portal V17 raises an error ("Write access to safety-related I/O tags is only permitted in the F-runtime group") when the project is compiled. The download is blocked. The same error fires when a standard FB calls an F-FB that does the write, because the F-compiler tracks the call graph.
2. Runtime (if the write is patched or forced): the F-system in the F-CPU monitors access to F-channel tags. A write from outside the F-runtime group is detected as a safety integrity violation; the affected channel is passivated (output = 0) and the F-CPU writes a diagnostic buffer entry of class "Safety" with an event referencing the passivated channel.
3. Functional design: the F-runtime group is the only execution context that has the safety signature and the F-monitoring timing. Writing the output from OB1 bypasses the F-monitoring envelope and the cross-checking that the F-system performs on F-tag updates. The safety level stated in the declaration of conformity is not met, even if the F-CPU does not detect a runtime violation.

Both example programs in the source question attempted the OB1 write pattern. The second example (writing a non-safety variable that then commands the safety output) is also invalid: a non-safety BOOL written from OB1 cannot, by design, drive an F-channel VALUE tag. The F-channel driver is owned by the F-runtime group, and the F-system passivates the channel when the F-channel driver is bypassed. The "non-safety variable that commands safety output" pattern is a misconception; the F-system does not route standard-side writes into F-channel tags.

8. Why Forcing an F-DQ Channel Stops the CPU

The TIA Portal "Force" function operates on I/O tags in the process image. For F-channel tags, force is blocked at compile time by the safety editor. The TIA Portal V17 safety diagnostics surface one of the following events when an operator attempts to force an F-channel tag, or when the F-system detects a write that bypasses the F-runtime group:

• Event class "Safety" with text "F-I/O passivated", referenced to the affected F-DQ channel.
• Event class "Safety" with text "PROFIsafe communication error", referencing the F-source and F-destination address of the affected module.
• Event class "Safety" with text "F-monitoring time exceeded", which can transition the F-CPU to STOP if the F-runtime group is the affected owner.

When a channel is passivated, its output is forced to 0, the QI bit is cleared, and the module requires reintegration. The F-CPU may transition to STOP depending on the configured behavior of the F-runtime group. In STOP, the F-DQ channels are de-energized because the PROFIsafe host is no longer sending valid telegrams; the F-DQ enters the safe state (output = 0) and the motor or contactor that the channel was driving is de-energized.

The question in the source ("If I just want to force out Q120.0 to test, motor will be running?") has the answer: no. Force on an F-channel tag is not allowed; the F-CPU blocks it. The motor must not run from a forced F-output. If the motor runs when an unauthorized write is attempted, the safety function has been defeated and the installation is unsafe.

9. Diagnostic Messages, Quality Information, and Passivation

Each F-DQ channel exposes a structured tag with the following elements (names follow the TIA Portal V17 default; field names may differ in non-English project locales):

Passivation is the F-system response to any of:

• PROFIsafe communication failure (CRC error, watchdog timeout, address mismatch, F-monitoring time exceeded).
• Internal module diagnostic (overload, wire break, short circuit at the output, sensor supply out of range).
• Channel discrepancy error (the readback does not match the setpoint within the configured discrepancy time).
• Unauthorized write to an F-channel tag (e.g., a force that bypassed the safety editor, or a write from a standard OB).

When a channel is passivated, its output is forced to 0, the QI bit is cleared, and the module requires reintegration. Reintegration is performed by the F-program after the cause is cleared, by pulsing the channel's ACK bit in the F-runtime group. TIA Portal V17 provides the operator-acknowledge instruction set (ACK_OP, ACK_NEC, ACK_GL) inside the F-library to formalize the acknowledgment path. ACK_OP is the per-channel operator-acknowledge (rising-edge); ACK_NEC is the necessary-acknowledge (forced on CPU STOP/STARTUP); ACK_GL is the global acknowledge for all F-I/O of the F-CPU.

10. Verification and Acceptance Test

The acceptance test must verify, for every used F-DQ channel:

1. Channel de-energizes on loss of PROFIsafe communication. Disconnect the PROFINET cable at the ET 200SP interface module; the output must drop to 0 within the configured F-monitoring time (default 150 ms).
2. Channel de-energizes on CPU STOP. Set the F-CPU to STOP via TIA Portal (online → stop); the output must drop to 0 ("Behavior on CPU STOP" = "Passivate channel").
3. Channel de-energizes on wire break at the load (if wire-break monitoring is enabled). Disconnect one load lead; the channel must report wire break and passivate.
4. Channel de-energizes on channel-level diagnostic (overload, short circuit, discrepancy). Inject the fault with a test load; the channel must passivate and the diagnostic buffer must show the corresponding event.
5. Reintegration requires operator acknowledgment. Pulse the ACK bit from the HMI or from a watch table; the channel must reintegrate, the QI bit must return to 1, and the output must respond to the F-program setpoint. The F-program cannot auto-reintegrate a passivated channel.

Record the observed response times, the F-monitoring time configuration, the safety signature, and the CRC of the safety program. The acceptance test record is part of the safety file and must be archived for the lifetime of the installation. The signature must be reproducible: any later change to the F-program or to the F-module parameters must invalidate the signature, which forces a re-test.

11. Troubleshooting Matrix

12. Field-Commissioning Checklist

Before energizing the safety outputs, run this checklist at the cabinet:

1. Confirm 24 V supply at the BaseUnit power bus, L+ to M, within 19.2 V to 28.8 V.
2. Confirm the F-DQ status LED is green (no fault) before plugging any load.
3. Open TIA Portal online → diagnostics → diagnostic buffer; confirm no F-events.
4. For each channel: drive the setpoint from the watch table inside the F-runtime group; confirm the readback matches; confirm the load responds.
5. Force the F-runtime group into STOP from TIA Portal; confirm every load de-energizes within the F-monitoring time + propagation delay.
6. Pull the PROFINET cable from the IM 155-6; confirm every load de-energizes within the F-monitoring time + propagation delay.
7. Reconnect; pulse ACK from the F-program; confirm the channel reintegrates and QI = 1.
8. Sign the safety program; print the safety signature; archive.