Designing Fail-Safe CFC and Safety Matrix Architectures for Burner Management Systems (BMS) in SIMATIC PCS 7

In SIMATIC PCS 7 running on an S7-410-5H controller with S7 F-Systems for Burner Management Systems (BMS - NFPA 85 / EN 298), safety-instrumented logic is partitioned into dedicated fail-safe organization blocks (OB 30 to OB 38) using certified S7 F-Systems library blocks (F_CH_AI, F_CH_DI, F_CH_DO). Any signal involved in emergency shutdown, flame detection, fuel shutoff valve actuation, or furnace purge interlocks MUST be processed exclusively with fail-safe blocks, fail-safe I/O modules (SM 336 / SM 326), and certified voting blocks. For complex multi-burner start-up sequences and trip logic, engineers utilize SIMATIC Safety Matrix (Cause and Effect methodology) for emergency trip interlocks, paired with standard or safety SFC charts for burner sequencing, ensuring channel passivation and reintegration are handled deterministically.

Standards Compliance: NFPA 85 and EN 298 in Burner Management Systems

Burner Management Systems (BMS) govern boilers, thermal oxidizers, and furnace combustion chambers. Under standards such as NFPA 85 (Boiler and Combustion Systems Hazards Code) and EN 298 (Automatic burner control systems for burners), control logic is legally separated into two categories:

Burner Safety / Interlock Logic (SIL 2 / SIL 3): Supervised purge timing, flame failure tripping, high/low fuel gas pressure trips, combustion air loss trips, and main fuel trip (MFT) valves. This MUST execute in a certified safety controller.
Continuous Process Combustion Control (BPCS): Air-fuel ratio trimming, steam drum level control, and firing rate modulation. This executes as standard DCS logic.

Hardware Partitioning: Standard vs Fail-Safe I/O Modules

When allocating I/O modules across the ET 200M distributed racks for a BMS:

Fail-Safe Digital Inputs (SM 326 F-DI 24x24VDC): Assigned to all safety switches: emergency stop buttons, burner flame scanners, low-low boiler water level switches, and fuel gas high/low pressure switches.
Fail-Safe Analog Inputs (SM 336 F-AI 6x15bit): Assigned to critical safety transmitters: furnace draft pressure, combustion air flow, and drum pressure.
Fail-Safe Digital Outputs (SM 326 F-DO 10x24VDC): Assigned to safety shutoff valves (SSVs), pilot gas solenoid valves, and ignition spark transformers.
Standard Analog Outputs (SM 332 AO): Assigned purely to modulating control valves (modulating air dampers, continuous fuel control valves).

Configuring F-Channel Blocks: F_CH_AI, F_CH_DI, and F_CH_DO

In CFC, every safety signal must be processed through official S7 F-Systems channel blocks:

Analog Processing (F_CH_AI): Converts raw fail-safe input words to engineering values. Generates QBAD (channel fault) and VKE (valid signal). If the signal is used for a shutdown trip, feed the evaluated value into limit blocks (F_LIM_HL, F_LIM_LL). If quality check fails (QBAD = 1), downstream logic must immediately treat the condition as a trip condition (fail-safe de-energization).
Digital Processing (F_CH_DI): Evaluates sensor contact state. Configured with 1oo1 or 1oo2 discrepancy analysis and sensor test pulses.
Digital Output (F_CH_DO): Drives safety valve trip coils. Uses dark-test pulsing to detect actuator wire breaks without dropping the coil.

Safety Matrix vs Sequential Function Charts (SFC) for BMS Sequences

Engineers frequently struggle with choosing between Safety Matrix and SFC for BMS control:

SIMATIC Safety Matrix (Recommended for Trip Logic): Safety Matrix is the industry standard for Cause and Effect logic. It visually maps inputs (Causes: Low Fuel Gas, Flame Loss, E-Stop) to outputs (Effects: De-energize Main Gas Valves, Stop Igniter). It auto-generates certified F-CFC charts with built-in bypass management and SIL 3 approval.
Sequential Function Charts (SFC): Burner light-off requires sequential steps (1. Purge Furnace 5 mins -> 2. Establish Pilot -> 3. Verify Flame -> 4. Open Main Gas -> 5. Release to Modulate). This sequence can be programmed using standard SFCs that coordinate with the safety interlocks, or using certified Safety Matrix Sequential Start-up packages.

Channel Passivation, Reintegration Handshakes, and Quality Codes

When an electrical fault (wire break or short circuit) occurs on a safety channel:

Passivation: The F-module passivates the channel, forcing VKE = 0 (safe state) and asserting QBAD = 1.
Reintegration: Once the physical wire is repaired, the channel does NOT automatically return to service. S7 F-Systems enforces a deliberate operator handshake using the F_QUITES block. The operator pulses the acknowledge input (ACK_REI), allowing the channel to reintegrate bumplessly.

Comparison of BMS Functional Subsystems and Implementation Blocks

The following table summarizes the implementation architecture for Burner Management System components in PCS 7:

BMS SubsystemSafety Integrity LevelHardware ModuleSoftware Block / ToolFail-Safe BehaviorEmergency Fuel Gas Trip (MFT)SIL 3SM 326 F-DO (6ES7326-2BF10-0AB0)Safety Matrix / F_CH_DODe-energize to trip (V = 0V)Flame Scanner MonitoringSIL 3SM 326 F-DI (6ES7326-1BK02-0AB0)F_CH_DI + 1oo2 VotingFlame loss trips fuel in < 1 secFurnace Draft Pressure TripSIL 2 / SIL 3SM 336 F-AI (6ES7336-4GE00-0AB0)F_CH_AI + F_LIM_HLHigh draft trips boiler combustionModulating Firing Rate ControlBPCS (Non-Safety)Standard SM 332 AO ModuleStandard APL PIDConLHolds last position or fail safeFurnace Purge SequencerSIL 2CPU 410-5H Common ChassisSafety SFC / Matrix SequencerAborts purge if air flow drops

Verification

Verify Burner Management System safety logic:
1. In SIMATIC Manager, select Options > Edit Safety Program; confirm that the safety program compiles cleanly with a validated Safety Program CRC.
2. Disconnect a flame scanner wire during simulated firing; verify that F_CH_DI.QBAD asserts immediately, triggering the Safety Matrix Main Fuel Trip in under 100 ms.
3. Confirm that all fail-safe digital output channels de-energize (0V DC) and close all fuel safety shutoff valves.
4. Reconnect the wire; verify that the channel remains passivated until an operator pulse is applied to ACK_REI via the safety faceplate.

Limitations and Operational Precautions

Never bypass safety interlocks using standard software memory bits or force tables on a live burner. Any bypass implemented during commissioning must utilize the official certified Safety Matrix Bypass function, which logs active bypasses into the electronic audit trail and enforces maximum bypass duration timers. Safety logic execution times must be configured within deterministic cyclic interrupt OBs (OB 35) with guaranteed cycle deadlines.

Engineer FAQ

Can standard APL blocks be connected to F-channel outputs?

Standard blocks cannot read fail-safe signals directly inside the safety OB. You must use official conversion blocks (F_BO_FGD - Fail-safe to standard boolean) to pass safety statuses to standard WinCC visualization or BPCS blocks.

What is the difference between Safety Matrix and standard CFC programming?

Standard CFC requires manually placing and interconnecting hundreds of logic gates (AND, OR, NOT) to create shutdown interlocks. Safety Matrix allows engineers to define a tabular Cause-and-Effect spreadsheet that automatically compiles into certified, error-free F-CFC charts.

Why did the CPU enter STOP mode after compiling safety CFCs?

If the maximum execution time of the safety runtime group exceeds the configured cycle time of OB 35, the S7 F-Systems watchdog timer trips, forcing the CPU 410-5H into STOP mode to preserve plant safety. Calculate safety execution load using the S7 F-Execution Time table.