How to Prevent QBAD on F-Channel Drivers During S7-400H Redundant Switchovers

To prevent fail-safe channel driver blocks (F_CH_BO, F_CH_BI, F_CH_DI, F_CH_DO) from asserting QBAD = 1 (passivating fail-safe I/O) during CPU 410-5H redundant switchovers or Configuration in RUN (CiR) downloads, increase the PROFIsafe monitoring time (F_WD_TIME) on the affected field devices. During an H-controller switchover or online hardware download, communication across the PROFINET line experiences a brief transmission pause while memory synchronization completes. If the configured F_WD_TIME (watchdog time) on SINAMICS drives or ET 200SP HA stations is tighter than the controller's switchover execution window, the safety runtime group assumes communication has been compromised, passivating safety channels and substituting safe zero values.

Mechanics of PROFIsafe Watchdog Monitoring and Passivation

In SIMATIC PCS 7 Safety Integrated (S7 F Systems), communication between fail-safe controllers and distributed safety nodes (such as SINAMICS S120 drives running Telegram 30 or ET 200SP HA F-modules) is governed by the PROFIsafe profile (IEC 61784-3-3):
- Consecutive Sequence Counters: Every PROFIsafe telegram includes an incrementing sequence number and a 32-bit CRC signature.
- The Watchdog Window (F_WD_TIME): The safety controller and the slave device exchange heartbeats. If a valid telegram is not acknowledged within the configured F_WD_TIME, both ends declare a communication loss.
- Fail-Safe Channel Reaction (QBAD): The channel driver block in CFC asserts output parameter QBAD = 1 and QUALITY = 16#48 (Fail-safe substitute value). The driver outputs zero to the safety program, tripping emergency stops or de-energizing safe torque off (STO) relays.

Why Redundant H-Switchovers and CiR Trigger QBAD Faults

Under normal, steady-state operation, telegram cycle times on PROFINET are rapid (typically 4 ms to 16 ms), easily satisfying default F_WD_TIME settings of 50 ms to 100 ms. However, specific operational events introduce temporary latency:
1. Master-to-Reserve Switchover: When the active CPU 410-5H fails or when a maintenance switchover is commanded, the standby CPU assumes bus mastership. Re-establishing PROFINET System Redundancy (S2) connections takes between 50 ms and 250 ms.
2. Configuration in RUN (CiR): When downloading hardware changes in RUN, the CPU temporarily halts cyclic fieldbus polling for a few execution slices while modifying internal peripheral routing tables.
3. The Watchdog Expiration: If F_WD_TIME on the drive is set to 80 ms, but the switchover requires 120 ms, the timer expires before the new master transmits its first signed telegram, driving F_CH_BO into passivation.

Calculating the Minimum Safe F_WD_TIME Parameter

Siemens publishes a standardized formula to size PROFIsafe monitoring times for high-availability systems:

$$F_WD_TIME \ge T_{switch} + 2 \times T_{cycle} + T_{bus_delay}$$

Where:
- $T_{switch}$: The maximum redundant switchover time of the CPU (for CPU 410-5H, typically 100 ms to 200 ms depending on PROFINET line topology).
- $T_{cycle}$: The execution cycle time of the safety runtime group in the AS (e.g., OB35 at 100 ms).
- $T_{bus_delay}$: Maximum network jitter across switches and optical transceivers.

For standard installations combining CPU 410-5H with SINAMICS drives and ET 200SP HA, configuring F_WD_TIME between 250 ms and 500 ms provides robust resilience against switchover passivation while preserving required SIL 3 / Category 4 safety response ceilings (typical process industry emergency stop requirements permit safety reaction times up to 1,000 ms).

Method: Step-by-Step Tuning in HW Config and F-System Properties

Follow this engineering workflow to eliminate false passivation during switchovers:

Step 1: Open Hardware Configuration (HW Config)

In SIMATIC Manager, navigate to the AS station and open HW Config.
Locate the fieldbus line hosting the affected SINAMICS S120 drive or ET 200SP HA station.

Step 2: Adjust F-Monitoring Time on the Slave Device

Double-click the fail-safe communication submodule:
- For SINAMICS S120: Select the Safety Telegram 30 (or Telegram 31/901) slot properties.
- For ET 200SP HA: Double-click the F-DI or F-DQ module and select the PROFIsafe tab.
Locate parameter F_WD_TIME (F_monitoring time in ms).
Increase the value from default (e.g., 100 ms) to 350 ms (or calculate based on project safety response analysis).
Repeat for all fail-safe modules connected across the redundant PROFINET line.

Step 3: Check S7 F Systems Compilation Settings

Open the CFC chart containing the safety runtime group.
Select Options -> Safety Program -> Customize.
Verify that the Safety execution time (F-cycle time) matches your configured OB35 interval.
Verify that the Maximum acceptable process safety time accommodates the updated F_WD_TIME.

Step 4: Save, Compile, and Download

In HW Config, select Station -> Save and Compile.
Execute PLC -> Download to Module... (Download changes in RUN via CiR).
If an F-signature change is detected, compile the safety program and execute an F-change download.

Verification

To verify that the system is immune to switchover passivation:
- Open the CFC charts monitoring F_CH_BO and F_CH_BI in online Test Mode.
- On the active CPU 410-5H, command a manual redundancy switchover via SIMATIC Manager (PLC -> Module Information -> Operating Mode -> Switchover).
- Confirm during the switchover:
- Controller primary status transfers smoothly between CPU 0 and CPU 1.
- Driver parameter QBAD remains rigidly 0 (FALSE).
- Safety digital outputs to the SINAMICS drive remain high, and the drive does not trip on Safe Torque Off (STO).
- Check CPU diagnostic buffer: verify zero entries for "Communication failure in safety program" (Event ID 16#75D1).

Limitations and Operational Precautions

Regulatory Safety Response Limits: Increasing F_WD_TIME increases the worst-case time required for the controller to detect a genuine broken cable. Always verify that the increased watchdog time does not violate the plant's official Hazard and Operability (HAZOP) and Safety Requirement Specification (SRS) emergency response deadlines.
Avoid Excessive Watchdog Settings: Do not set F_WD_TIME arbitrarily high (e.g., 2,000 ms). Setting excessive times compromises fast machine-protection safety functions (e.g., high-speed press trips or centrifuge braking).
Depassivation Handshake: If passivation does occur, the channel driver requires an operator depassivation handshake via input pin ACK_REI = 1 once communications recover.

Engineer FAQ

What is the difference between QBAD and PASS_OUT?

QBAD is the channel-specific passivation flag on driver blocks indicating that the specific I/O channel is outputting fail-safe substitute values. PASS_OUT indicates whole-module passivation generated by the F-module management block.

Can I change F_WD_TIME without stopping the CPU?

Yes. On modern S7-400H / CPU 410-5H controllers, PROFINET parameters and safety watchdog times on distributed slaves can be updated online using Configuration in RUN (CiR), provided the safety program is downloaded via approved F-change download.

Why do SINAMICS drives passivate faster than ET 200SP HA modules?

Drive inverters often default to very tight internal factory watchdog settings (e.g., 20 ms to 50 ms) optimized for high-speed motion control, whereas process I/O defaults to 100 ms.

What should I do if QBAD still appears despite setting F_WD_TIME to 500 ms?

Check for physical packet loss on the PROFINET line. High packet collision rates, failing fiber transceivers, or network switch broadcast storms can delay packets longer than 500 ms, triggering passivation.

Technical References

Siemens Industry Online Support: SIMATIC S7 F/FH Systems - Configuring and Programming Manual.
SIOS Entry 109742323: PCS 7 Compendium Part A - Configuration Guidelines (Section: Safety Integrated).
SIOS Entry 109809264: SIMATIC Process Control System PCS 7 Fault-Tolerant Process Control Systems (S7-400H).
PROFIsafe System Description: Technology and Application (PROFIBUS & PROFINET International).

Related Tags

S7-400H
CPU 410-5H
PROFIsafe
S7 F Systems
QBAD
F_WD_TIME
Industrial Automation

How to Prevent QBAD on F-Channel Drivers During S7-400H Redundant Switchovers