Siemens SM 322 DO Retains Last Value During ET 200M Power Fault

1. Problem Statement

On a PROFIBUS DP segment where an ET 200M station (order number 6ES7153-2BA02-0XB0) operates as a slave to an Emerson DeltaV PROFIBUS master, a documented fault symptom appears when the ET 200M backplane and its distributed I/O lose load power (a "power clash"): the digital outputs of the SM 322 module (6ES7322-1BH01-0AA0, 16 DO, 24 V DC, 0.5 A, source-type) do not drive to 0 V as expected by the safety-oriented control philosophy. Instead, the actuator-side measurement shows that the field outputs remain latched at the last commanded value (typically 1) for the duration of the fault, and they only release when the module is fully repowered. The phenomenon is observed on a stand-alone ET 200M (no S7 CPU in the loop) with DeltaV acting purely as Class 1 PROFIBUS master.

2. System Architecture Under Analysis

The reported station has no S7 CPU. Configuration is downloaded entirely from DeltaV using the Siemens GSD file SIEM8150.GSD (ET 200M family). Without an S7 CPU, the diagnostic and parameter services that a STEP 7 project would normally provide are absent; only the PROFIBUS DP-V0 cyclic I/O exchange and DP-V1 acyclic parameter channel are exercised by the DeltaV master.

3. Root Cause Analysis: Why the Output Holds Last Value

3.1 The "Power Clash" Definition

On ET 200M, three independent power domains exist. A power clash is the condition where one or more domains drop while another is healthy:

1. Backplane 24 V (PS 305 / PS 307 on the IM): Powers the IM 153-2 and the module electronics.
2. Load 24 V (L+ terminal on the SM 322): Powers the actuator-side output drivers (high-side MOSFETs in source-type modules).
3. PROFIBUS segment voltage (5 V isolated on the IM): Powers the IM 153-2 ASIC and the bus interface.

When load 24 V on the SM 322 collapses while backplane 5 V remains healthy (typical when the actuator's PSU drops or the field wiring shorts), the high-side driver cannot energize. However, the output stage architecture of the SM 322-1BH01 includes a latch-and-hold register inside the module's output buffer. This register is written by the IM 153-2 from the last valid PROFIBUS telegram. Without a "value = 0" refresh telegram and without a configured "output 0 on fail" substitute, the buffer is read by the driver FSM until the next cyclic update.

3.2 PROFIBUS Slave Behavior in Master Stop / Fault

Per the PROFIBUS DP profile (EN 50170 / IEC 61158), a DP slave reacts to a Watchdog timeout, a Clear_Data command, or a loss of the token with a configurable response. The GSD parameter that controls this is:

Fail_Safe = 0  →  outputs go to 0 (fail-safe state)
Fail_Safe = 1  →  outputs retain last value

For the ET 200M family, the Siemens default in SIEM8150.GSD for slot 1 (SM 322) is Fail_Safe = 0. However, the DeltaV PROFIBUS configurator imports the GSD and, depending on the controller firmware and import version, may apply a non-default profile that overrides Fail_Safe to 1 if the field engineer accepts the auto-substituted value. This is the single most common root cause of last-value retention when the master is from a third-party DCS.

3.3 SM 322 Internal Substitute Value

Beyond the DP-level Fail_Safe, the SM 322-1BH01 also supports a module-level substitute value that is written to the output register when the IM 153-2 detects a fault condition on the load voltage (diagnostic: "Load voltage L+ missing"). The substitute is parameterized via the GSD user parameters byte/bit and is typically:

• Reaction to CPU/master STOP = 0 (output 0)
• Reaction to CPU/master STOP = 1 (output last valid value)

On DeltaV, this is exposed in the slave's "Module Parameters" dialog as "Output on Comm Failure." If the integrator leaves this at the GSD default (which is "0" for the BH01 variant), the symptom should not appear. If the integrator selects "Hold last value," the symptom is by design.

4. Diagnostic Procedure

1. Confirm the GSD version in DeltaV. Open DeltaV Explorer → Configuration → PROFIBUS → Slave DTM → "Device Identification." Record the Vendor ID (0x002A for Siemens), the GSD revision, and the Ident Number. The correct GSD for 6ES7153-2BA02-0XB0 is typically SIEM8150.GSD revision 5 or higher.
2. Inspect the slot configuration. In DeltaV, navigate to the slot corresponding to the SM 322 (1..12). Open "Module Parameters" and screenshot every parameter. Pay specific attention to "Behavior on Fault," "Substitute Value," and "Diagnostic Enable."
3. Verify load voltage at the SM 322. With the system powered, measure L+ (terminals 1 or 31 depending on variant) versus M (terminals 20 or 30). Voltage must be 20.4 V DC to 28.8 V DC per the module's data sheet.
4. Force a power clash. With the controller in Operate and outputs forced ON in DeltaV, remove L+ at the SM 322 terminal block. Observe the output voltage with a true-RMS DMM and a 2-channel scope (one channel on L+, one on the actuator terminal).
5. Read the diagnostic buffer. In DeltaV Diagnostics → PROFIBUS Slave → "DiagData," look for byte 0x10 (set) — "Load voltage L+ missing." This is a hard-confirmation that the SM 322 has detected the clash and acted on its parameters.
6. Compare against the GSD default. Export the active parameter set (DeltaV → Right-click → Export DDB) and compare against the GSD defaults in SIEM8150.GSD using a text editor. Look for Fail_Safe = 1 or Substitute = 1.

5. SM 322-1BH01-0AA0 Detailed Specification

6. Solution: Forcing Fail-Safe (0) Behavior

6.1 DeltaV Configuration Change

1. Place the DeltaV controller in Program or Out-of-Service.
2. Open the PROFIBUS slave DTM and select the SM 322 slot.
3. Set "Output on Comm Failure" = 0 (or "Output 0" depending on DeltaV version).
4. Set the per-channel substitute value = 0 for all 16 channels.
5. Disable "Hold Last Value on Master Stop" if the option exists.
6. Download to the DeltaV controller.
7. Re-run the power-clash test from step 4 of the diagnostic procedure. Confirm the output goes to 0 V within 1.5 ms of L+ falling below 13 V DC.

6.2 Hardware Mitigation (Independent of Configuration)

If the actuator's safety state requires a hard-wired de-energize, the configuration fix alone is insufficient. Add one of the following:

• Force-guided relay on the output. Use a Phoenix Contact PLC-OSC or equivalent 24 V DC relay whose dropout time is < 10 ms. The SM 322 energizes the relay coil; loss of L+ drops the relay regardless of PROFIBUS state.
• Watchdog timer on the actuator side. For coil-driven devices, add a 1-Hz refresh pulse; a missing pulse de-energizes the actuator via an AND gate or hard-wired logic.
• Separate, dedicated 24 V DC PSU for the load side. A SITOP PSU6900 or Phoenix QUINT with 20% margin over actuator peak inrush; verify the PSU's hold-up time is < 1 ms so a clash actually drops L+ rather than riding through.

6.3 GSD Hardening

Edit SIEM8150.GSD to lock the default substitute value to 0 across all slots:

Module = "SM 322 DO16x24VDC/0.5A" 0x0A
Fail_Safe = 0
Substitute = 0
Diagnostics = 1

Re-import the modified GSD into DeltaV and re-bind all slots. This is the only way to enforce a uniform fail-safe policy across an entire DeltaV project without per-slot intervention.

7. Verification

8. Failure Mode Matrix

9. Extended Discussion: Why No S7 CPU Changes the Equation

When ET 200M is operated with a SIMATIC S7 CPU, the CPU is the Class 1 master and STEP 7 (or TIA Portal) writes the configuration. The default OB 100 / OB 102 startup behavior and the OB 82 / OB 86 error handling force a deterministic response: outputs go to 0 on PROFIBUS fault, and the CPU's diagnostic buffer is filled with detailed hex-coded events. Without an S7 CPU, the DeltaV master is the only configuration source. DeltaV does not interpret all Siemens-specific GSD semantics; it imports the file but the user is presented with a reduced parameter set in the DTM. As a result, the behavior on master STOP is mapped to DeltaV's generic "output on comm failure" parameter, which historically defaults to Hold Last Value in DeltaV versions prior to R5.12.

Additionally, the value status (QI) per channel is only available when DP-V1 is enabled on the IM 153-2 and the DeltaV controller is DP-V1 capable. If DP-V0 is in use, the DeltaV control application cannot read per-channel quality, and a bad output is indistinguishable from a good one in the HMI. For SIL applications, this is a second strong reason to install the force-guided relay mitigation in §6.2.

10. Field-Proven Caveats

• Some DeltaV R5.x versions cache the GSD import. After editing the GSD, delete the slave device, re-import, and re-bind. A "Refresh" does not always reload parameters.
• The IM 153-2BA02 supports redundant PROFIBUS. If only one segment is in use, ensure the unused segment is terminated; floating segments cause intermittent DP errors that look like comm failures and trigger the hold-last-value path.
• The SM 322-1BH01 (without -0AA0 suffix variants) has different diagnostic capabilities. The -0AA0 variant is the most common and is the one this article targets. The -0AB0 and higher suffixes have full channel-level diagnostic and value status.
• Reverse-polarity protection on L+ is not present on all variants. Check the wiring before hot-swapping; reversed L+ can latch the output register in an undefined state.
• If the actuator uses PWM dimming or high-frequency switching, a "fail to 0" behavior must be checked against the actuator's inrush — a hard 0 may be worse than a controlled ramp-down. Adjust the substitute-value policy per channel.

11. References Inside Siemens Documentation

For definitive behavior, consult the official Siemens manuals:

• SIMATIC ET 200M Distributed I/O System Manual — IM 153-2 fault behavior, PROFIBUS DP-V1 parameter set.
• S7-300 Module Data Manual (Reference) — SM 322-1BH01 electrical and diagnostic specification.
• GSD file SIEM8150.GSD — Slot-level Fail_Safe and Substitute defaults.
• EN 50170 / IEC 61158 — PROFIBUS DP master-slave fail-state semantics.
• IEC 61511-1 — Functional safety of safety instrumented systems (SIS), fail-safe de-energize principle.

FAQ