Exporting F-Destination Addresses of Distributed Fail-Safe Modules in PCS 7 HW Config

To extract a comprehensive inventory of all distributed fail-safe modules and their assigned F-Destination Addresses (F_Dest_Add) in SIMATIC PCS 7 without manually opening each module dialog, engineers must use the standard Safety Printout (Sicherheits-Druckausgabe) feature in SIMATIC Manager. Open the S7 Program, select Safety Program -> Print, and generate the Safety Summary report to a PDF or text file. This certified document automatically extracts every fail-safe I/O module (ET 200M, ET 200SP, ET 200iSP), its station name, slot position, F_Source_Add, F_Dest_Add, DIP switch binary configuration, and safety CRC signature into an audited, tabular format.

The Role of F-Destination Addresses in PROFIsafe Communication

In SIMATIC PCS 7 safety systems running S7 F-Systems (e.g. V6.2, V6.3, or V6.4, 6ES7833-1FC03-0YA5), fail-safe communication between the F-CPU (such as CPU 410-5H or CPU 417-5H) and distributed fail-safe I/O modules (e.g. ET 200M F-DI 6ES7326-1BK02-0AB0 or ET 200SP F-DI 6ES7136-6BA00-0CA0) relies strictly on the PROFIsafe profile (IEC 61784-3-3).

PROFIsafe encapsulates safety telegrams with a 32-bit CRC, a virtual message sequence number, and addressing identifiers comprising the F-Source Address (F_Source_Add) and F-Destination Address (F_Dest_Add). The F-Destination Address uniquely identifies each physical fail-safe module within an entire automation network. To ensure protection against telegram looping or accidental module misplacement, the configured F_Dest_Add in HW Config must match the exact physical DIP switch setting (on ET 200M/ET 200iSP) or electronic coding element (on ET 200SP/ET 200MP).

During commissioning, factory acceptance testing (FAT), and safety re-certification, engineers must audit hundreds of F-modules across multiple PROFIBUS DP and PROFINET IO subnets to prevent duplicate F-Destination addresses.

Methods for Auditing and Extracting Fail-Safe Address Assignments

Engineers frequently struggle because HW Config does not provide a single 'Export to CSV' button specifically labeled for PROFIsafe parameters. However, SIMATIC PCS 7 and STEP 7 provide multiple built-in mechanisms to extract these addresses without requiring custom scripts:

Safety Program Printout (Certified TÜV Documentation): The official S7 F-Systems documentation engine parses the compiled hardware configuration and safety program to produce a complete equipment schedule listing every F-module, its rack/slot, F-monitoring time, F-Source, and F-Destination address.
HW Config Station Export (.CFG): In HW Config, selecting Station -> Export... exports the full hardware definition as an ASCII text file. Searching this text file for parameter key F_Dest_Add allows engineers to parse all addresses into spreadsheet tools.
Safety Matrix Export Report: When using SIMATIC Safety Matrix (6ES7833-1SM02-0YA5), the cause-and-effect compiler provides an integrated tag-to-channel audit report that cross-references F-channel symbols with F-destination addresses.

Comparison of F-Address Extraction Techniques in SIMATIC PCS 7

The following table compares the available techniques for extracting and verifying F-Destination addresses:

Extraction MethodAccessible LocationOutput FormatCertification LevelEngineering EffortSafety Printout (Sicherheits-Druckausgabe)SIMATIC Manager: S7 Program -> Safety Program -> PrintPDF / Multi-page TextOfficially TÜV-audited and certifiedLowest; 1-click comprehensive reportHW Config ASCII ExportHW Config: Station -> Export...ASCII Text (.cfg)Raw configuration data (requires text parsing)Moderate; requires text search or scriptSafety Administration / F-Program DialogS7 F-Systems Dialog: Display F-BlocksScreen GUI onlyVisual verification onlyHigh; requires scrolling through listSIMATIC Safety Matrix ReportSafety Matrix Editor: File -> Export -> ReportHTML / PDF / ExcelCertified cause-effect auditLow; covers matrix-assigned channelsManual Module InspectionHW Config: Double-click each F-module -> PROFIsafe tabProperty SheetProne to human transcription errorExtremely High; impractical for large plants

Step-by-Step Procedure to Generate the Audited Safety Printout

Follow this step-by-step procedure to generate the comprehensive fail-safe address list using S7 F-Systems:

Compile Hardware Configuration and Safety Charts:
- In HW Config, select Station -> Save and Compile. Ensure no consistency errors exist.
- In the CFC Editor, compile the safety program (Chart -> Compile -> Changes only or Entire program).
Open the Safety Program Dialog:
- In SIMATIC Manager Component View, navigate to the S7 Program folder of your safety controller.
- Select Options -> Safety Program (or right-click S7 Program and select Safety Program).
Configure Print Settings for Fail-Safe Hardware:
- In the 'Safety Program' dialog, verify the overall safety program status and CRC signature.
- Click the Print button at the bottom of the dialog.
- In the print selection dialog, select the scope of documentation: ensure F-Modules / Distributed I/O is checked.
- Choose a target printer configured as a PDF printer (e.g., Microsoft Print to PDF or Adobe PDF) or select 'Print to file'.
Extract and Review the F-Destination Table:
- Open the generated PDF report. Locate the section titled Fail-Safe Distributed I/O Modules (Fehlersichere Dezentrale Peripherie).
- The table displays columns: Station Name, Subnet (PROFIBUS DP / PROFINET IO), Rack, Slot, Module MLFB, F_Source_Add, F_Dest_Add (both decimal and hexadecimal), and the exact physical switch representation (DIP switch 1-10 on/off).

Verification

Verify the extraction accuracy through the following steps:
1. Select three representative distributed stations (e.g., an ET 200M remote rack on DP, an ET 200SP island on PN, and an ET 200iSP intrinsically safe rack).
2. Cross-check the decimal F_Dest_Add listed in the generated PDF report against the value shown in HW Config under Module Properties -> PROFIsafe -> F_Dest_Add.
3. Confirm that the physical DIP switch settings on the physical ET 200M module match the switch diagram provided in the Safety Printout table.
4. Verify that the Safety Program collective CRC (Signature) displayed on the report matches the online CPU safety signature displayed in the Module Information dialog.

Limitations and Operational Precautions

Never Duplicate F-Destination Addresses Across the Same Network: PROFIsafe addresses must be strictly unique within the reach of any F-CPU broadcast domain. Duplicate F_Dest_Add values cause module communication faults and safety passivation.
Safety Printout Validity: The Safety Summary document is legally binding for functional safety compliance under IEC 61508 / IEC 62061. Any subsequent modification to HW Config invalidates the previous printout and requires re-compilation and re-printing.
Online vs Offline Discrepancies: The printout reflects the offline engineering database. If a physical module's DIP switches were modified in the field without re-downloading HW Config, communication will passivate with a CRC / communication error.

Engineer FAQ

Can I export the F-Destination addresses directly to Microsoft Excel?

While there is no direct 'Export to XLS' button in HW Config, you can generate the Safety Printout as a text file or searchable PDF and copy the tabular section into Excel. Alternatively, export the HW Config station as .cfg and use a simple script or Excel delimiter wizard to parse lines containing F_Dest_Add.

What is the difference between F_Source_Add and F_Dest_Add?

F_Source_Add identifies the fail-safe controller (CPU) initiating safety telegrams, whereas F_Dest_Add uniquely identifies the target distributed fail-safe I/O module. The pair (F_Source_Add, F_Dest_Add) guarantees that safety telegrams cannot be misrouted across different controllers.

How are F-Destination addresses assigned in ET 200SP compared to ET 200M?

In ET 200M, F_Dest_Add is set via physical 10-position DIP switches on the side of the module. In ET 200SP, the address is assigned electronically via the engineering tool (Assign F-Destination Address command in STEP 7 / HW Config) and permanently stored in the BaseUnit's coding element.