Configuring Fail-Safe Analog Input Limits and CH_F_ON in SIMATIC S7 F Systems (SM 336-4GE00)

In SIMATIC S7 F Systems utilizing fail-safe analog input module SM 336-4GE00 (6ES7336-4GE00-0AB0), enabling custom limit monitoring by setting CH_F_ON = 1 on the F_CH_AI driver block causes an immediate channel fault (QBAD = 1) if engineering unit scaling parameters are incorrectly configured. The F_CH_AI driver features an integrated, hardcoded NAMUR live-zero threshold (3.6 mA to 21.0 mA). When enabling user-defined limit thresholds (CH_F_HL and CH_F_LL), the limits must be defined in milliamperes only if parameters VHRANGE and VLRANGE are set to identical values (e.g., both 0.0). If VHRANGE and VLRANGE are configured with engineering units (e.g., 0 to 100 bar), CH_F_HL must be entered in bar, not mA. Furthermore, setting CH_F_HL = 21.6 mA exceeds the module's maximum allowable 21.0 mA measurement limit, triggering an instant out-of-range safety trip.

Fail-Safe Analog Processing Architecture: S7 F Systems and F_CH_AI

In safety-instrumented systems (SIS) certified up to SIL 3 / AK 6 under IEC 61508 / IEC 61511, analog sensor signals (such as reactor pressure, boiler temperature, or gas detection) must be acquired with absolute diagnostic integrity. In SIMATIC S7 F Systems, this is performed by the SM 336-4GE00 (6ES7336-4GE00-0AB0) fail-safe analog input module interfaced via PROFIsafe.

In the safety program (programmed in CFC with S7 F Systems blocks), the module is serviced by the F_CH_AI fail-safe channel driver block. When any discrepancy, wire break, out-of-range signal, or internal card fault occurs, F_CH_AI immediately asserts its safety status output QBAD = 1 and substitutes the process value with a configured safe substitute value (SUBS_V), driving downstream safety interlocks to their certified failsafe state.

The Interplay Between CH_F_ON, NAMUR Limits, and Range Scaling

The F_CH_AI block incorporates two layers of signal limit monitoring:

Hardcoded Module Hardware Limits: The module firmware enforces standard NAMUR NE 43 limits ($3.6\text{ mA} \le I \le 21.0\text{ mA}$). Any current outside this band triggers a hardware diagnostic interrupt in the module, causing QBAD = 1 regardless of software settings.
User-Configurable Limit Monitoring (CH_F_ON): Setting CH_F_ON = 1 activates custom software limit checking using the high limit (CH_F_HL) and low limit (CH_F_LL) inputs.

Parameter ConfigurationPhysical Range ScalingLimit Value InterpretationResulting BehaviorCH_F_ON = 0VLRANGE = 0.0, VHRANGE = 100.0Uses native NAMUR hardware bandNormal operation; trips if $I < 3.6\text{ mA}$ or $I > 21.0\text{ mA}$CH_F_ON = 1, CH_F_HL = 21.6VLRANGE = 0.0, VHRANGE = 0.0Interpreted in milliamperesTRIP (QBAD = 1): 21.6 mA exceeds 21.0 mA module limitCH_F_ON = 1, CH_F_HL = 21.6VLRANGE = 0.0, VHRANGE = 100.0Interpreted in engineering unitsTRIP (QBAD = 1): Process reads e.g. 50 bar, which exceeds 21.6 bar limit!CH_F_ON = 1, CH_F_HL = 95.0VLRANGE = 0.0, VHRANGE = 100.0Interpreted in engineering unitsHealthy: Trips if process value exceeds 95.0 barCH_F_ON = 1, CH_F_HL = 20.5VLRANGE = 0.0, VHRANGE = 0.0Interpreted in milliamperesHealthy: Custom tightening of live-zero current band

Step-by-Step Configuration to Prevent False QBAD Tripping

To parameterize F_CH_AI correctly without triggering false safety trips, choose one of two distinct configuration modes:

Mode A: Tightening the Current Band in Milliamperes (e.g., 3.8 mA to 20.5 mA):
1. On the F_CH_AI block, set VLRANGE = 0.0 and VHRANGE = 0.0 (identical zero values).
2. Set CH_F_ON = 1 to activate limit checking.
3. Set CH_F_LL = 3.8 (must be $\ge 3.6\text{ mA}$).
4. Set CH_F_HL = 20.5 (must be $\le 21.0\text{ mA}$; setting 21.6 mA will cause an immediate trip).

Mode B: Monitoring in Process Engineering Units (e.g., 0 to 100 bar):
1. Set VLRANGE = 0.0 (4 mA = 0.0 bar) and VHRANGE = 100.0 (20 mA = 100.0 bar).
2. If you want software limit monitoring in engineering units, set CH_F_ON = 1.
3. Enter CH_F_LL and CH_F_HL in engineering units (e.g., CH_F_LL = 5.0 bar, CH_F_HL = 95.0 bar).
4. If you only want standard hardware NAMUR protection, leave CH_F_ON = 0.

Verification

Validate fail-safe channel driver configuration using these safety procedures:

Signal Generator Injection: Connect a certified 4-20mA loop calibrator to the SM 336-4GE00 input terminal.
Mid-Scale Health Check: Inject 12.0 mA. In the safety CFC chart, confirm that output V reads 50.0 (if scaled) or 12.0 (if raw mA) and QBAD = 0.
Low-End Trip Validation: Reduce injected current to 3.5 mA. Confirm that F_CH_AI immediately sets QBAD = 1 and passes SUBS_V to the safety program.
High-End Trip Validation: Increase current to 20.8 mA (or above CH_F_HL). Confirm that QBAD asserts cleanly and the safety matrix registers a channel fault.

Limitations and Operational Precautions

When engineering fail-safe analog channels, adhere to strict safety guidelines:

Module Hardware Limit Ceiling: The SM 336-4GE00 cannot read or tolerate currents above 21.0 mA under any software setting. Hardware overrange detection will override all CFC block configurations.
Safety Program Password Protection: Any modification to F_CH_AI parameters alters the Safety Program Collective Signature. Modifying parameters requires entering the F-password and re-generating safety printouts for TÜV compliance.
Wire-Break Parameter in HW Config: In HW Config module properties, ensure 'Wire Break' monitoring is enabled for transducers; disabling it degrades safety diagnostic coverage.

Engineer FAQ

Why did my channel fail when I set CH_F_HL = 21.6 mA?

The SM 336-4GE00 module firmware cuts off valid conversion at 21.0 mA. Any value above 21.0 mA is flagged as an overflow hardware fault, forcing QBAD = 1 regardless of software logic.

Can I use CH_F_ON to create an alarm limit without tripping QBAD?

No. In S7 F Systems, F_CH_AI is a safety channel driver. Any limit violation detected by the driver is considered a channel failure that asserts QBAD = 1. For non-tripping process alarms, use standard APL monitoring blocks outside the F-runtime.

What is the function of the PASS_ON input pin?

PASS_ON allows upstream logic to manually force channel passivation (QBAD = 1), useful for maintenance overrides or scheduled transmitter calibrations.