Calculating Fail-Safe Rate of Change for F_CH_AI in SIMATIC S7 F-Systems

To calculate the rate of change (dPV/dt) from an F_CH_AI channel driver within a certified SIMATIC S7 F-Systems safety program, use the standard fail-safe delay block F_DEADTM (FB 320) from the F-Systems Library. Because safety runtime groups forbid uncertified SCL code or standard APL derivative blocks, rate-of-change logic must be constructed using certified F-blocks: feed the analog value into F_DEADTM to buffer it over a configured delay window (T_DELAY), subtract the delayed output from the live value using F_SUB_R (FB 347), and divide by the elapsed time using F_DIV_R to obtain a verified, SIL 3 compliant rate of change.

Functional Safety Constraints in S7 F-Systems Runtime Groups

In industrial safety applications governed by IEC 61508 / IEC 61511 (e.g., detecting rapid pressure surges in chemical reactors or rate of temperature rise in exothermic processes), measuring the rate of change ($
rac{dPV}{dt}$) is a common trip requirement.

However, within SIMATIC S7 F-Systems (V6.x / F-Library V1.3):
* All blocks placed inside the Safety Runtime Group (executed typically in OB35 with fail-safe signatures) must be TÜV-certified fail-safe blocks (prefixed with F_).
* Standard CFC blocks (such as Derivative, RateLim, or standard math functions) are strictly prohibited inside F-runtime groups; the safety compiler will abort with compilation error Block not permitted in F-Program.
* Custom SCL code cannot be inserted unless written and compiled under the specialized S7 F-Systems Safety Programming Environment with certified safety signatures.

Therefore, engineers must implement rate-of-change algorithms using pre-certified modular building blocks provided by the standard F-Library.

Mathematical Principle of Discrete Rate of Change Calculation

In discrete sampled systems, the time derivative of a continuous analog signal is approximated using backward finite differences:

$$
rac{dPV}{dt} pprox
rac{PV(t) - PV(t - \Delta t)}{\Delta t}$$

Where:
* $PV(t)$: The current, live process value output by the fail-safe analog channel block F_CH_AI.V.
* $PV(t - \Delta t)$: The historical process value captured $\Delta t$ seconds in the past.
* $\Delta t$: The measurement time base (e.g., 5 seconds, 30 seconds, or 1 minute).

To obtain $PV(t - \Delta t)$ safely without uncertified circular buffers, the F-Systems Library provides the certified delay block F_DEADTM (FB 320).

Step-by-Step CFC Implementation with F_DEADTM and Arithmetic F-Blocks

Follow this engineering workflow to construct a SIL 3 rated rate-of-change evaluation circuit in CFC:

Place Fail-Safe Blocks in the Safety Chart:
* Open the safety CFC chart.
* From the F-AppLib / F-Systems catalog, insert:
- F_DEADTM (FB 320 - Dead Time / Delay block).
- F_SUB_R (FB 347 - Fail-Safe Real Subtraction).
- F_DIV_R (FB 348 - Fail-Safe Real Division).
- F_LIM_R or F_CMP_R (FB 342 - Comparator to evaluate trip limits).
Configure Signal Connections:
* Connect F_CH_AI.V (the live analog floating-point value) to:
- F_DEADTM.IN
- F_SUB_R.IN1 (current value $PV(t)$).
- Connect the delayed output F_DEADTM.OUT to F_SUB_R.IN2 (historical value $PV(t - \Delta t)$).
Configure Dead Time and Scaling:
* Set F_DEADTM.TIME to your target measurement window (e.g., T#10s for rapid surges, or T#60s for slow thermal drift).
* Connect the difference output F_SUB_R.OUT ($\Delta PV$) to F_DIV_R.IN1.
* Configure F_DIV_R.IN2 with the numerical time constant representing $\Delta t$ in seconds or minutes (e.g., 10.0 or 1.0).
Link to Safety Interlocks:
* Feed the rate-of-change result from F_DIV_R.OUT into F_CMP_R to compare against your maximum allowable rate threshold (e.g., $> 5.0^\circ ext{C/min}$).
* Interconnect the comparator output to your fail-safe shutdown matrix or emergency depressurization valve logic.

Verification

In SIMATIC CFC, open the safety chart in dynamic test mode.
Force a step change or ramp on the input signal of F_CH_AI.
Verify that:
F_DEADTM.OUT trails the live input by exactly the configured delay time.
During a steady ramp, F_SUB_R.OUT displays a stable non-zero delta proportional to ramp velocity.
When the signal is constant, the calculated rate of change drops cleanly to 0.0.
Compile the safety program. Confirm that the F-Compiler calculates valid safety CRC signatures with zero errors.

Limitations and Operational Precautions

F_DEADTM utilizes internal ring buffer memory. Configuring excessively long dead times (e.g., several hours) consumes significant safety work memory.
High-frequency sensor noise on analog signals can cause artificial spikes in rate-of-change calculations. Filter raw input signals using the fail-safe smoothing block F_PT1 prior to F_DEADTM if electrical noise is present.
Ensure that division by zero is mathematically impossible: never assign 0.0 to F_DIV_R.IN2.

Engineer FAQ

Why can't I use the standard PCS 7 Derivative block (Derivative)?
Standard APL blocks lack fail-safe self-testing, redundant memory checking, and safety signatures. Placing a standard block in an F-runtime group invalidates the safety certificate of the entire CPU.
What happens to F_DEADTM during a safety CPU restart?
During a restart, F_DEADTM initializes its buffer with the current input value, preventing false transient rate spikes during plant startup.
Is F_DEADTM certified for SIL 3 applications?
Yes. F_DEADTM is an official component of the TÜV-certified SIMATIC S7 F-Systems library, suitable for SIL 3 / Category 4 safety functions.

Technical References

SIMATIC S7 F/FH Systems - Configuring and Programming Manual (A5E00278788).
SIMATIC S7 F-Systems Library Description and Block Reference.
IEC 61508 / IEC 61511: Functional Safety of Safety-Instrumented Systems for the Process Industry.