Fail-Safe Analog Channel Driver F_CH_AI in SIMATIC PCS 7 - Passivation and Substitute Value (PASS_ON and SUBS_ON) Behavior

In SIMATIC PCS 7 F-Systems (S7 F Systems), the fail-safe analog channel driver F_CH_AI governs channel passivation and substitute value output via parameters PASS_ON and SUBS_ON. When a hardware fault or communication error occurs with PASS_ON = 0 and SUBS_ON = 0, the channel passivates automatically and output V outputs the fail-safe default value (typically 0.0 or fail-safe low), while holding the last valid value is strictly prohibited unless explicitly configured. If a process trip relies on low pressure (< 10 Bar) and a transmitter faults at 51 Bar, configuring SUBS_ON = 1 with a defined safe substitute value (SUBS_V) guarantees immediate trip initiation upon sensor passivation.

F_CH_AI Fail-Safe Architecture and Safety Principles

In safety-instrumented systems (SIS) compliant with IEC 61508 and IEC 61511, fail-safe channel drivers process physical sensor inputs from fail-safe modules (e.g. 6ES7336-4GE00-0AB0):
* F_CH_AI: The standard fail-safe analog input channel driver block in S7 F Systems.
* Passivation (Passivierung): When an F-module detects a wire break, short circuit, internal hardware fault, or PROFIsafe communication loss, the affected channel is passivated to protect the safety integrity level (SIL).
* De-Energize to Trip: In functional safety, a faulted sensor must drive the safety loop into its predetermined safe state (typically de-energized / tripped).

Passivation Mechanics - PASS_ON, PASS_OUT, and Hardware Faults

The passivation status of F_CH_AI is determined by both internal module diagnostics and external logic:
* PASS_ON (Input BOOL): Enables manual passivation command. If PASS_ON := TRUE, the channel is forced into passivation by application logic (e.g. maintenance bypass or companion sensor discrepancy). If PASS_ON := FALSE, passivation occurs strictly upon detected hardware faults.
* PASS_OUT (Output BOOL): Indicates active channel passivation. When PASS_OUT = TRUE, the module channel is passivated due to hardware diagnostics or PASS_ON assertion.
* QBAD (Output BOOL): Set to TRUE concurrently with PASS_OUT to signal degraded sensor health to upstream Safety Matrix or CFC interlock logic.

Substitute Value Behavior - SUBS_ON and SUBS_V in Safety Loops

The critical parameter determining process trip behavior during sensor failure is SUBS_ON:
1. Behavior when SUBS_ON := 0:
* When passivated (PASS_OUT = TRUE), output V outputs the standard fail-safe default value: 0.0 (or lowest engineering range value).
* Crucial Safety Rule: S7 F Systems certified safety library blocks never hold the last valid value across a safety passivation when configured for de-energize to trip.
2. Behavior when SUBS_ON := 1:
* Output V outputs the value assigned to parameter SUBS_V (Substitute Value).
3. The Pressure Trip Scenario:
* Pressure operating point: 51 Bar. Trip setpoint: < 10 Bar (Low Pressure Trip).
* If the sensor wire breaks and SUBS_ON := 0, output V falls to 0.0 Bar. Because 0.0 Bar < 10 Bar, the low-pressure trip triggers immediately, placing the plant into the safe state!
* If the safety requirement is high pressure trip (> 60 Bar), setting SUBS_ON := 1 and SUBS_V := 100.0 Bar ensures that transmitter failure instantly initiates the high-pressure safety shutdown!

Fail-Safe Channel Driver Parameter Configuration Matrix

Evaluate the parameter combinations and resulting output states of F_CH_AI:

Parameter ConfigurationPhysical Channel StatePASS_OUTOutput V StateSafety Function ImpactPASS_ON=0, SUBS_ON=0Healthy (51 Bar)FALSELive Process Value (51 Bar)Normal process monitoringPASS_ON=0, SUBS_ON=0Faulted (Wire Break)TRUEFail-Safe Zero (0.0)Triggers Low-Trip (<10 Bar)PASS_ON=0, SUBS_ON=1Faulted (Wire Break)TRUESubstitute Value (SUBS_V)Configurable safe trip valuePASS_ON=1, SUBS_ON=0HealthyTRUEFail-Safe Zero (0.0)Forced maintenance passivationPASS_ON=0, SUBS_ON=0High Trip Function (>60 Bar)TRUE0.0Dangerous (Trip missed without QBAD)!

Verification

To confirm proper fail-safe channel driver behavior:
1. In CFC Editor, place F_CH_AI and connect output V to the Safety Matrix cause block.
2. Verify that QBAD is interconnected to the cause block's fault trip input.
3. Switch CFC to Test Mode online; observe live process pressure at 51 Bar.
4. Physically disconnect the 4-20 mA transducer field cable to simulate a field wire break.
5. Verify on the F-module front panel that the channel LED illuminates red.
6. In CFC, confirm that PASS_OUT := TRUE, QBAD := TRUE, and output V transitions immediately to the safe value (0.0 Bar), causing the safety trip to fire.

Limitations and Operational Precautions

Never evaluate analog output V alone in safety shutdown logic without evaluating QBAD. In high-pressure trip applications (> 60 Bar), a faulted sensor falling to 0.0 Bar will fail to trip if logic evaluates only V > 60.0. Safety logic must always evaluate (V > 60.0) OR (QBAD = TRUE) to guarantee fail-safe de-energization upon transmitter failure. Always perform functional safety validation testing after modifying fail-safe driver parameters.

Engineer FAQ

Does F_CH_AI ever hold the last valid value when passivated?

No. S7 F Systems TÜV safety certification prohibits holding an uncontrolled stale analog value during channel passivation, as this would violate IEC 61508 fail-safe principles.

Why did the plant not trip if the trip was set for high pressure?

If the trip logic checked only V > 60 Bar, sensor passivation to 0.0 Bar prevented the trip from executing. The safety matrix must incorporate QBAD to trip upon sensor failure.

How is a passivated channel reintegrated back into service?

After repairing the field cable, the channel remains passivated until an authorized operator issues a reintegration command via input ACK_REI := TRUE.

What is the difference between F_CH_AI and standard Pcs7AnIn?

F_CH_AI is a certified fail-safe block with PROFIsafe CRC checksum verification running in the F-Execution OB, whereas Pcs7AnIn is a standard process control driver.