Architecting Safety Instrumented Systems in PCS 7: Safety Matrix, F-Systems, and Voting Logic

Architecting a Safety Instrumented System (SIS) in SIMATIC PCS 7 requires integrating S7 F-Systems, the Safety Matrix tool, and fail-safe ET 200M/ET 200SP I/O modules with an S7-400H/F controller. F-Systems compiles fail-safe runtime groups with Profisafe CRC verification, while the Safety Matrix automates cause-and-effect matrix logic. Redundant field sensors are wired in 1oo2, 2oo3, or 2oo2 architectures using dedicated failsafe voting blocks, allowing transparent communication between the safety logic and standard PCS 7 basic process control systems.

PCS 7 Process Safety Architecture Overview

SIMATIC PCS 7 provides a fully integrated Safety Instrumented System (SIS) compliant with IEC 61508 / IEC 61511 up to SIL 3. The process safety architecture combines standard process automation with fail-safe engineering on a unified platform:

Fail-Safe Controllers: S7-400H/F fault-tolerant systems (e.g., CPU 410-5H 6ES7410-5HX08-0AB0 with F-Runtime license, or CPU 417-4F 6ES7417-4HT14-0AB0) execute both basic process control system (BPCS) tasks and safety-instrumented functions (SIF) in segregated runtime groups.
Profisafe Protocol: Fail-safe telegrams carry safety checksums (CRCs), monitoring timers, and sequence numbers over standard PROFIBUS DP or PROFINET IO networks, eliminating dedicated safety wiring.
Engineering Tools: S7 F-Systems (6ES7833-1FC02-0YA5) provides the certified block library and F-Compiler, while SIMATIC Safety Matrix (6ES7807-BA02-0YA5) provides a graphical cause-and-effect programming and visualization interface.

Hardware Selection and Sensor Voting Architectures (1oo2, 2oo3)

To achieve required Safety Integrity Levels (SIL 2 or SIL 3), sensor input architectures must balance safety availability (preventing dangerous failure to trip) with operational availability (preventing nuisance trips):

Voting ArchitectureSensor Count & WiringRedundancy LogicPrimary Benefit / ApplicationSpurious Trip Rate1oo11 Sensor (1 F-AI channel)Single channel tripLow risk SIL 1 / SIL 2 loops without redundancy.High (Any sensor fault causes trip)1oo22 Sensors (2 F-AI channels)Trip if Sensor A OR Sensor B tripsHigh safety integrity (SIL 3); fails safe on any single defect.Moderate (Nuisance trips on sensor drift)2oo22 Sensors (2 F-AI channels)Trip if Sensor A AND Sensor B tripHigh operational availability; prevents nuisance plant shutdowns.Low (Sensor defect does not trip plant)2oo33 Sensors (3 F-AI channels)Majority voting: Trip if 2 of 3 tripOptimal balance of SIL 3 safety integrity and zero nuisance trips.Very Low (Tolerates 1 faulty sensor safely)1oo2D2 Sensors with internal diagnosticsEvaluates sensor diagnostic statusHigh safety and availability using advanced diagnostic transmitters.Low to Moderate

Table 1: Sensor voting architectures supported by S7 F-Systems libraries.

In ET 200M architectures, redundant analog transmitters connect to fail-safe analog input modules (such as 6ES7326-1BK02-0AB0) using active bus modules (6ES7195-7HD10-0XA0) and interface modules (6ES7153-2BA10-0XB0).

Configuring Cause-and-Effect Logic with SIMATIC Safety Matrix

SIMATIC Safety Matrix translates plant Cause-and-Effect tables directly into certified CFC safety programs:

Creating the Matrix:
* In SIMATIC Manager, insert a Safety Matrix object into the plant hierarchy.
* Open the Safety Matrix editor and configure matrix properties (execution cycle, safety group assignment).
Defining Causes (Inputs):
* Define input tags, alarm limits, and voting logic (e.g., 2oo3 pressure transmitters on a separator vessel).
* Specify time delays, bypass configurations, and manual reset requirements.
Defining Effects (Outputs):
* Define target emergency shutdown valves, pump interlocks, or breaker trips.
* Assign fail-safe digital output channels (6ES7326-2BF10-0AB0) or standard BPCS notifications.
Mapping Intersections:
* Place intersections in the matrix grid defining how each Cause activates each Effect (e.g., Immediate trip, Time-delayed trip, or Cascaded trip).
Compilation and Transfer:
* Compile the Matrix. The tool automatically generates certified F-CFC charts containing F_CH_AI, F_CH_DO, and matrix execution blocks (F_MA_...).
* Generate the OS block icons and faceplates with one click to enable operator interaction in WinCC.

Integrating Safety Logic with Standard Basic Process Control Systems (BPCS)

While safety logic must execute in certified F-runtime groups, information must flow seamlessly to standard BPCS and operator stations:
* F-to-BPCS Data Flow: Signals from safety logic (such as safety transmitter values, bypass status, and trip alarms) can be read directly by standard CFC blocks and WinCC faceplates without restrictions.
* BPCS-to-F Data Flow: When the standard system writes to the safety program (such as an operator issuing a bypass or manual reset from an OS client), data must pass through certified safety communication blocks (e.g., F_BO_F or F_QU_F). These blocks enforce confirmation handshakes and passcodes to prevent unauthorized standard code from overriding safety functions.

Verification

To verify safety application functionality:

In SIMATIC Manager, execute Compile Safety Program: confirm that the F-Compiler generates the safety collective checksum without errors.
In the Safety Matrix editor, run the Matrix Verification / Comparison function to verify that generated CFC logic matches the cause-and-effect grid.
In WinCC Runtime, open the Safety Matrix faceplate: verify that all Causes, Effects, and intersections reflect active live status.
Conduct physical loop testing: trip test sensors in 2oo3 configuration and confirm that a single sensor trip generates an alert while two sensor trips trigger the designated safety shutdown valve.

Limitations and Operational Precautions

Never bypass a safety instrumented function without an authorized Management of Change (MOC) procedure and administrative permit.
S7 F-Systems and Safety Matrix require dedicated engineering and runtime licenses (6ES7833-1FC02-0YA5, 6ES7807-BA02-0YA5). Always validate final licensing and MLFBs with an authorized Siemens distributor.
Modifying safety matrix logic requires regenerating and downloading the safety program; changes cannot be downloaded in standard CPU RUN mode if the collective signature changes without safety password authorization.

Engineer FAQ

Where can I find official Siemens PCS 7 safety application examples?

Siemens provides comprehensive application guides: PCS 7 Compendium Part B - Process Safety (Entry ID 63481413), Wiring and Voting Architectures for F-AI (Entry ID 24690377), and Wiring and Voting for F-DI/F-DO (Entry ID 37236961).

What is the difference between S7 F-Systems and SIMATIC Safety Matrix?

S7 F-Systems is the foundational safety engineering platform that provides the F-CFC compiler and certified F-block library. Safety Matrix is an optional high-level engineering and visualization tool that automatically generates S7 F-Systems CFC charts from cause-and-effect tables.

Can safety blocks communicate across different CPUs?

Yes. Safety-related CPU-to-CPU communication is implemented using the F_SENDBO / F_RCVBO or F_SENDR / F_RCVR blocks over Industrial Ethernet, utilizing Profisafe encapsulation to ensure SIL 3 integrity across standard network infrastructure.