Home
>
Products
>
PLC Programmable Logic Controller
>
|
| Place of Origin | GERMANY |
| Brand Name | SIMENS |
| Certification | CE RoHS |
| Model Number | 6ES7138-4FB04-0AB0 |
The Siemens 6ES7138-4FB04-0AB0 is a four-channel fail-safe digital output module for the SIMATIC ET 200S distributed I/O system — one of the most compact hardware implementations of certified safety output switching available for PROFIBUS-connected systems.
Where standard digital output modules simply switch 24VDC to actuators on command from the PLC, the F-DO module adds a complete layer of self-monitoring, cross-channel comparison, and certified fault-response behaviour that allows the system to demonstrate to certification bodies that the safety function — cutting power to a hazardous actuator — is achieved with a quantified probability of failure that meets SIL 3 or PL e requirements.
This module belongs to the era of distributed safety I/O that transformed how functional safety was implemented in process and machinery automation during the 2000s and 2010s. Before PROFIsafe distributed safety I/O, achieving SIL 3 output switching required dedicated hardwired safety relays — bulky, expensive, inflexible, and difficult to reconfigure.
With PROFIsafe-capable modules like the 6ES7138-4FB04-0AB0, the safety function resides in a 30mm-wide module on the ET 200S station, with the safety communication handled by the PROFIsafe profile running over the standard PROFIBUS DP cable that already carries the standard I/O data.
The safety certification is achieved through the combination of the module's internal fault monitoring architecture and the PROFIsafe communication protocol's own safety measures.
| Parameter | Value |
|---|---|
| F-DO Channels | 4 |
| Output Voltage | 24VDC |
| Output Current | 2A per channel |
| Module Width | 30mm |
| Safety Level (ISO 13849) | Up to PL e |
| Safety Level (IEC 61508) | Up to SIL 3 |
| Protocol | PROFIsafe over PROFIBUS DP |
| Also Compatible With | PROFINET via IM 151-3 PN HF |
| Status | Discontinued spare (Oct 2020) |
The safety integrity ratings of the 6ES7138-4FB04-0AB0 are not marketing labels — they are quantitative assessments of the module's probability of failing to perform its safety function when demanded.
IEC 61508 defines Safety Integrity Level 3 (SIL 3) as a probability of dangerous failure on demand (PFD) in the range of 10⁻⁴ to 10⁻³ per year for low-demand mode safety functions — in other words, the probability that the output fails to de-energise when commanded is between 0.01% and 0.1% per year.
EN ISO 13849-1 Performance Level e (PL e) corresponds to a probability of dangerous failure per hour (PFHd) below 10⁻⁷ — below one dangerous failure per 10 million hours for continuous and high-demand mode functions.
Achieving SIL 3 or PL e with a single output module requires redundancy and diagnostic coverage within the module itself. In the 6ES7138-4FB04-0AB0, each output channel uses a dual-channel switching architecture: two independent semiconductor switches (typically one P-channel and one N-channel device in series, or two independent switching transistors with cross-monitoring) that must both agree to activate the output.
If one switch fails to open when commanded, the other catches the fault and forces the output to a safe (de-energised) state.
The module's internal diagnostics continuously monitor both switches for short circuits, open circuits, and cross-circuit faults — detecting faults that would prevent safe de-energisation before they can become dangerous.
When a fault is detected, the module reports it through PROFIsafe to the F-CPU, which can then initiate the appropriate safety response (initiating a safe state, triggering an alarm, recording the fault event).
PROFIsafe is a PROFIBUS/PROFINET application profile, IEC 61784-3-3 certified, that adds a safety communication layer on top of the standard PROFIBUS or PROFINET telegram structure.
While the standard PROFIBUS telegram carries I/O data between the DP master and the ET 200S station without any safety guarantee, the PROFIsafe telegram adds a CRC (cyclic redundancy check) computed over both the safety data and a sequence number, plus a watchdog timeout mechanism — ensuring that corrupted data, replayed old packets, and lost packets are all detected and responded to safely.
The F-DO module on the ET 200S exchanges PROFIsafe telegrams with the F-CPU (fail-safe CPU). The F-CPU executes the safety programme — written in STEP 7 F-FBs (fail-safe function blocks) using the standard F programming libraries — and sends output commands to the F-DO through PROFIsafe.
If PROFIsafe communication is lost (cable fault, station dropout, CRC error), the F-DO automatically transitions its outputs to the safe state (de-energised) without waiting for a CPU command — the safety of the output is maintained even when the communication path fails.
This "de-energise on communication loss" behaviour is fundamental to the PROFIsafe profile and is what allows safety functions to be implemented over standard fieldbus infrastructure without the fieldbus itself requiring intrinsic safety certification.
The 6ES7138-4FB04-0AB0's 30mm module width (double the standard 15mm) is driven by the more complex internal electronics required for dual-channel output architecture and comprehensive self-diagnostics.
The additional width accommodates the second switching transistor per channel, the cross-monitoring circuitry, and the test pulse generation circuits needed to periodically exercise the switching path and verify that each transistor can actually open and close.
Crucially, the F-DO module does not mount onto a standard ET 200S terminal module.
It requires the specific fail-safe terminal module TM-PF30S47-F1 (3RK1 903-3AA00), which is engineered to support the F-DO's dual-channel wiring requirements and its special connector configuration. Standard TM-P or TM-E terminal modules are not compatible with F-DO modules and cannot substitute for the TM-PF30S47-F1.
This is an important procurement detail: when sourcing a replacement 6ES7138-4FB04-0AB0, the corresponding terminal module must be verified — if it is already installed in the station from the original build, it remains in place when the F-DO electronic module is replaced; if the terminal module is also damaged or needs replacement, the TM-PF30S47-F1 must be sourced separately.
While the standard ET 200S operating mode uses the IM 151-1 or IM 151-3 interface modules on PROFIBUS DP, the 6ES7138-4FB04-0AB0 is also compatible with the IM 151-3 PN HF (High Feature PROFINET) interface module, which enables the ET 200S station to connect via PROFINET IO rather than PROFIBUS DP.
In PROFINET configurations using IM 151-3 PN HF, the F-DO module continues to communicate via PROFIsafe — but now over the PROFINET medium rather than PROFIBUS.
The safety certification remains valid in PROFINET mode; the PROFIsafe protocol's safety measures apply identically over both PROFIBUS and PROFINET transport layers.
This PROFINET compatibility allows the F-DO module to be incorporated into new safety systems designed around PROFINET architecture, and allows existing ET 200S F-DO stations to be retrofitted with PROFINET connectivity by changing only the interface module, without touching the F-DO module or its terminal module wiring.
Q1: What is the difference between a standard ET 200S digital output module and this fail-safe F-DO module in terms of wiring, programming, and certification requirements?
The differences are substantial across all three dimensions.
In wiring: a standard DO module has a single output terminal per channel; the F-DO module's outputs are routed through a dual-switch architecture internally, but from the field wiring perspective the output appears as a single 24V terminal and a common.
However, certain safety applications require 2oo2 (two-out-of-two) voting in the field wiring — connecting the load in series with two F-DO channels so that both must activate for the load to energise. The TM-PF30S47-F1 terminal module provides the appropriate wiring configuration for F-DO safety architectures.
In programming: standard DO modules are addressed as normal output bytes in the process image, written by standard STEP 7 instructions in the standard user OB. F-DO modules are exclusively addressed within the safety programme, which runs in the F-CPU's dedicated F runtime environment in a separate safety OB (typically OB35 or the configured safety OB). Safety programme blocks must be created using Siemens's F-FBs from the F-library and can only be programmed by engineers who have completed Siemens's STEP 7 Safety F-programming training.
In certification: standard DO modules have no safety certification and cannot be used in safety-instrumented functions.
The F-DO module's SIL 3 / PL e certification is documented in its Safety Manual (provided by Siemens), which specifies the architectural constraints, diagnostic coverage requirements, and proof test intervals needed to achieve each certification level in a real application.
The system integrator must verify that the combination of F-CPU, PROFIsafe, and F-DO meets the required SIL/PL for the specific safety function being implemented.
Q2: What happens to the F-DO outputs during a PROFIBUS DP communication failure between the F-CPU and the ET 200S station containing the F-DO module?
Communication failure triggers one of the most fundamental PROFIsafe safety behaviours.
When the PROFIBUS DP master (the F-CPU's DP interface) loses contact with the ET 200S slave station — due to cable fault, bus termination error, station power loss, or any other cause that prevents valid PROFIsafe telegrams from reaching the F-DO module — the F-DO module's internal watchdog timer expires.
Upon expiry, the module unconditionally de-energises all four F-DO outputs and enters a safe state, without waiting for an explicit command from the CPU (which it can no longer reach). This passive fail-to-safe behaviour is a core requirement of the PROFIsafe profile and the IEC 61508 framework.
The CPU's F-runtime simultaneously detects the communication loss and generates the appropriate safety programme response (typically transitioning to STOP or safe shutdown logic). The F-DO outputs remain de-energised until communication is restored, the module's status is verified, and the safety programme explicitly re-activates the outputs through a deliberate operator action or restart sequence.
There is no automatic re-activation of F-DO outputs after a communication fault, even after communication is re-established — deliberate re-activation is required to confirm that safe conditions have been verified.
Q3: The module is rated for SIL 3. Does this mean any application using this F-DO module automatically achieves SIL 3, or are there additional requirements?
The module rating is a necessary but not sufficient condition for achieving SIL 3 in a real safety application.
The module provides the hardware architecture and diagnostic coverage to support SIL 3, but the entire Safety Instrumented Function (SIF) — from the final actuator back through the F-DO, through the PROFIsafe communication, through the F-CPU safety programme, through the safety logic, to the initiating sensor — must be assessed as a complete safety loop.
Key additional requirements include: using a SIL 3-capable F-CPU with appropriate hardware fault tolerance; using PROFIsafe over PROFIBUS with the configuration meeting PROFIsafe timing requirements; writing the safety programme using certified F-FBs according to the programming constraints in the Siemens Safety Manual; performing the Safety Integrity calculation (PFD/PFHd) for the entire safety loop using the failure rates from each component's Safety Manual; implementing proof testing at the interval specified in the Safety Manual; and ensuring that the application engineering is performed by qualified functional safety engineers (ideally TÜV-certified FSEs).
The 6ES7138-4FB04-0AB0's Safety Manual, available from Siemens Industry Online Support, is the authoritative reference for all these requirements and must be reviewed as part of any safety application development.
Q4: How does the test pulse mechanism work in the F-DO, and can it cause brief output interruptions that might interfere with connected loads?
The F-DO module periodically generates test pulses — brief, controlled de-energisation pulses on each output channel — to verify that the output switching transistors are functioning correctly and can actually de-energise when commanded.
This is a standard diagnostic mechanism in fail-safe output modules, required to achieve the diagnostic coverage (DC) needed for SIL 3 / PL e. The test pulses are typically in the microsecond range — short enough that the connected load (a safety relay, contactor coil, or solenoid) does not have time to de-energise and re-energise during the pulse, because the load's electromagnetic inertia prevents state change in such short interruptions.
However, this depends on the load's characteristics: loads with very fast response times (some electronic devices with minimal inductance) might detect the test pulse as a brief glitch. The F-DO module's Safety Manual specifies the maximum test pulse duration and the minimum load inductance / response time required to ensure that test pulses do not cause nuisance switching of the load.
For the majority of safety relay coils and electromechanical contactors used in machinery and process equipment, the test pulse duration is well below the coil dropout time, and no interference with load operation occurs.
Q5: The module was discontinued in October 2020. What is the recommended replacement for new installations, and can existing 6ES7138-4FB04-0AB0 units be maintained with spare parts?
For new safety automation designs, Siemens recommends the SIMATIC ET 200SP Distributed I/O system with the appropriate F-DQ (Fail-Safe Digital Output) modules, such as the F-DQ 4×24VDC/2A PPM module for ET 200SP.
The ET 200SP platform is the current-generation successor to ET 200S, providing equivalent safety functionality with smaller module widths, faster configuration, and compatibility with TIA Portal and STEP 7 Safety Advanced.
Existing installations using the 6ES7138-4FB04-0AB0 can continue to be maintained using spare modules sourced from the industrial surplus market — stocks of discontinued Siemens safety modules are well-established in the industrial spare parts network. When procuring refurbished or used F-DO modules for safety applications, the unit's complete test history, safety seal integrity, and firmware version must be verified before installation.
The Safety Manual requires that any replacement module be verified for its safety certificate validity and that the safety function is proof-tested after replacement.
A migration project to ET 200SP should be considered if the installed ET 200S station needs significant modification or if the number of F-DO modules in the installation is large enough to justify the engineering investment before the end of spare parts availability.
Contact Us at Any Time
