Configuring Fail-Safe Module Drivers and PROFIsafe Communication in S7 F Systems and PCS 7

Configuring Fail-Safe Module Drivers and PROFIsafe Communication in S7 F Systems and PCS 7

In SIMATIC PCS 7 and STEP 7 with S7 F Systems, configuring fail-safe I/O modules (such as ET 200SP F-DI 6ES7136-6BA00-0CA0 and F-DO 6ES7136-6DB00-0CA0) requires placing Fail-Safe Channel Driver blocks (F_CH_DI, F_CH_DO) within designated F-Charts and interconnecting their input pins to the symbolic addresses defined in HW Config. You must NEVER manually insert F-Module Drivers (F_DI, F_DO) or diagnostic blocks (F_DIAG). Instead, during CFC compilation, selecting 'Generate Module Drivers' automatically identifies all PROFIsafe modules in HW Config, instantiates the required F-Module Drivers in background @F_... charts, establishes F-Runtime groups, and configures PROFIsafe watchdog monitoring.

Table of Contents

• Executive Summary
• Architecture and Fundamental Mechanics
• Step-by-Step Implementation Procedure
• Verification
• Limitations and Operational Precautions
• Engineer FAQ
• Technical References
• Related Articles
• Related Tags

Executive Summary

Safety-instrumented systems (SIS) implemented with SIMATIC S7 F Systems and PCS 7 adhere to stringent functional safety standards (IEC 61508 SIL 3 / IEC 61511 / EN ISO 13849-1 Cat 4 Ple). When creating a safety program from scratch, novice safety engineers frequently encounter compilation errors such as Please make a safety program (F-Chart) and attempt to manually place low-level safety drivers (e.g. FB360 F_DIAG, FB464 F_DI) into standard CFC charts. In PCS 7, manual instantiation of module drivers violates certified safety architecture rules. Fail-safe driver generation is entirely automated through the CFC compiler and S7 F Systems middleware. This article details the certified workflow for configuring PROFIsafe I/O, explains F-Chart designation, and outlines module driver compilation rules.

Architecture and Fundamental Mechanics

S7 F Systems Architecture, PROFIsafe Protocol, and Automated Driver Generation Mechanics:

• Architecture of Fail-Safe Control in S7 F Systems:
• Safety logic executes inside a certified F-Execution Environment segregated from standard automation logic.
• The CPU 416-5H or CPU 410-5H executes safety logic in a dedicated cyclic interrupt OB (typically OB35 or OB36) configured as an F-Runtime Group.

• All safety communication between the CPU and remote F-I/O traverses standard PROFIBUS/PROFINET media encapsulated inside the PROFIsafe protocol (IEC 61784-3-3), using CRC checksums, consecutive sequence numbers, and strict watchdog timers.

• The Two-Tier Driver Concept in Safety Programming:

• Tier 1: F-Channel Drivers (Engineer's Scope): The engineer places only Fail-Safe Channel Driver blocks (F_CH_DI, F_CH_DO, F_CH_AI) from the S7 F Systems Lib inside an F-Chart. The channel driver is connected directly to the symbolic I/O address configured in HW Config (e.g. E 0.0 or "Estop_Channel_1").
• Tier 2: F-Module Drivers (Compiler's Scope): The CFC compiler's Generate Module Drivers engine scans HW Config, identifies the F-I/O module parameters (F-source address, F-destination address, PROFIsafe monitoring time), and automatically generates:
  1. F_PS_DI / F_PS_DO (PROFIsafe communication drivers).
  2. F_DIAG (Hardware diagnostic monitor).
  3. Interconnections between the module driver and channel driver F_CH_DI.DATA inputs.

• Manual Placement Anti-Pattern: Manually dropping FB360 or FB464 creates disconnected orphan drivers that cause CFC compilation aborts and invalidates safety certification.

• F-Chart Designation Requirement:

• Standard CFC charts cannot host safety blocks. A chart must be designated as an F-Chart (indicated by a distinctive yellow F-symbol in the chart header and task allocation in an F-Runtime group).

Step-by-Step Implementation Procedure

1. Configure F-I/O Modules in HW Config:
   * In HW Config, insert the fail-safe digital input (6ES7136-6BA00-0CA0) and output (6ES7136-6DB00-0CA0) cards into the ET 200SP station.
   * In Object Properties under the F-Parameters tab, verify:

   • F_dest_address (unique PROFIsafe destination address matching the physical module DIP switches).
   • F_monitoring_time (e.g. 100 ms).
   • In the Addresses tab, assign symbolic names in the Symbol Table for active safety channels (e.g. "ES_Button_1" on E 10.0).
   • Save and compile HW Config.

2. Create an F-Chart in SIMATIC Manager:
   * In SIMATIC Manager Component View, navigate to S7 Program > Charts.
   * Insert a new CFC chart; name it (e.g. F_Safety_Logic).
   * Open the chart in CFC Editor.

3. Insert F-Channel Drivers:
   * Open the CFC block catalog; expand S7 F Systems Lib > F-Blocks.
   * Drag and drop F_CH_DI (FB377) onto the chart sheet.
   * Right-click input pin VALUE and select Interconnection to Address....
   * Select the symbolic address created in Step 1 (e.g. "ES_Button_1").
   * Repeat for output channels using F_CH_DO.

4. Configure F-Runtime Group in Cyclic Interrupt OB:
   * Open the Run Sequence (Ctrl + F5) in the CFC Editor.
   * Ensure the F-blocks are scheduled within an F-Runtime Group placed inside a fast cyclic interrupt OB (e.g. OB35).

5. Compile Charts and Generate Module Drivers:
   * Select menu Chart > Compile > Changes only (or Entire Program).
   * In the compilation dialog, ensure Generate Module Drivers is checked.
   * Click OK. The compiler automatically creates @F_... charts containing F_DIAG and F_PS_* blocks, completes all PROFIsafe interconnections, and reports compilation success.

Verification

1. In SIMATIC Manager Charts folder, confirm that system charts prefixed with @F_ were generated automatically.
2. Open the F-Chart in CFC; enter Test Mode (online).
3. Press the physical emergency stop button wired to the F-DI card; confirm that F_CH_DI.Q transitions from TRUE to FALSE.
4. Confirm that the PROFIsafe diagnostic output F_CH_DI.QBAD remains 0 (indicating healthy communication without passivation).

Limitations and Operational Precautions

Never alter or delete blocks inside autogenerated @F_... charts manually. Any modification to the safety program alters the Safety Signature (CRC), requiring formal safety re-verification and documentation before plant startup.

Engineer FAQ

Why did CFC report 'Please make a safety program (F-Chart)'?

Safety blocks from S7 F Systems Lib were placed in a standard chart or outside an assigned F-Runtime group in a cyclic OB.

Do I need to manually insert F_DIAG or F_DI module drivers?

No! Never insert F-Module Drivers manually. The 'Generate Module Drivers' compiler function automatically creates and connects them.

What block connects to physical safety I/O channels?

Fail-Safe Channel Drivers: F_CH_DI for digital inputs, F_CH_DO for digital outputs, and F_CH_AI for analog inputs.

What is an F-Runtime Group in PCS 7?

An F-Runtime Group is a certified execution container inside a cyclic interrupt OB (e.g. OB35) bounded by safety start and end blocks.

What determines PROFIsafe address assignment?

The F_dest_address configured in HW Config, which must match the physical coding switch or e-coding element on the F-I/O module.

Technical References

• SIMATIC S7 F/FH Systems - Configuring and Programming Manual
• SIMATIC Safety - Configuring and Using Safety Engineering
• PROFIsafe System Description - Technology and Application

Related Articles

• Resolving Module Driver QMODF Faults and Bad Signal Quality in SIMIT and PCS 7
• Comparing PCS 7 APL vs Basis Library Architecture and Configuring Channel Driver Simulation
• Resolving PROFIBUS Intermittent Signal Faults and S7-400 Cycle Time Overrun Alarms in PCS 7
• Resolving SIMOCODE pro V Module Driver Generation Errors on CPU Integrated DP Ports in PCS 7

Related Tags

• S7 F Systems
• PROFIsafe
• F_CH_DI
• F_CH_DO
• Generate Module Drivers
• Fail-Safe I/O
• F-Chart
• PCS 7 Safety