Integrating Fail-Safe I/O Modules (ET 200M F-DI 6ES7336-4GE00-0AB0) and S7 F Systems Logic in PCS 7

In SIMATIC PCS 7, integrating fail-safe I/O cards (such as the ET 200M 24-channel F-DI module 6ES7336-4GE00-0AB0) and programming safety logic requires an F-capable controller (such as an AS 410-5H or CPU 414-4H/417-4H), S7 F Systems engineering software, and an S7 F Systems Runtime license per CPU. In HW Config, insert the F-DI module into an ET 200M station, set the hardware DIP switch to match the configured F-destination address (F_Dest_Add), configure channel sensor evaluation (1oo1 or 1oo2), and set the CPU safety password. In CFC, insert an F-Runtime group inside a cyclic interrupt OB (typically OB35), instantiate the fail-safe channel driver (F_CH_DI FB379), interconnect signals with F-logic blocks (F_AND4, F_OR4), and compile the safety program with CRC signature generation. Validate all safety hardware configurations and licensing with an authorized Siemens distributor or the Siemens Industry Mall.

Executive Summary

Implementing functional safety in SIMATIC PCS 7—such as emergency shutdown (ESD), burner management systems (BMS), or fire and gas (F&G) loops—requires integrating fail-safe distributed I/O modules into standard process automation architectures. Control engineers adding safety cards like the ET 200M fail-safe digital input 6ES7336-4GE00-0AB0 must follow rigorous hardware configuration, PROFIsafe addressing, and software safety block engineering rules. Bypassing these procedures results in hardware bus faults, CPU STOP conditions, or blocked safety compilation. This guide provides the complete engineering workflow for configuring fail-safe hardware, setting PROFIsafe parameters, and programming fail-safe CFC charts using S7 F Systems.

Architecture and Fundamental Mechanics

The PCS 7 functional safety architecture combines standard process control and SIL 3 safety execution within a single unified controller:
1. Controller and Hardware Prerequisites:
- Requires an F-capable automation system (e.g., CPU 410-5H or S7-400H with fail-safe capability).
- The S7 F Systems engineering add-on must be installed on the Engineering Station, and each physical CPU requires an S7 F Systems Runtime license in Automation License Manager.
2. PROFIsafe Communication Protocol and Hardware Addressing:
- Fail-safe I/O modules communicate over standard PROFIBUS DP or PROFINET using the PROFIsafe profile (IEC 61784-3-3).
- Every fail-safe module possesses an internal F-parameters block containing:
a. F_Source_Add: Identifies the F-CPU.
b. F_Dest_Add: Unique hardware address set physically via a 10-position DIL/DIP switch on the side of the module (e.g., 6ES7336-4GE00-0AB0).
c. F_WD_Time: Watchdog monitoring time (typically 100–250 ms) during which PROFIsafe frames must be acknowledged.
3. Safety Program Partitioning in CFC:
- Safety logic executes inside dedicated F-Runtime groups within cyclic interrupt OBs (e.g., OB35 at 100 ms).
- All safety blocks originate from the S7 F Systems Lib (e.g., F_CH_DI FB379 for inputs, F_CH_DO FB380 for outputs, F_AND4, F_OR4, F_RS_FF).
- S7 F Systems enforces strict separation: standard non-fail-safe signals cannot connect directly to safety inputs without explicit converter blocks (F_BO_F).
4. Password Protection and CRC Signatures:
- Compiling the safety program prompts for the CPU Safety Password, verifies strict logical rules, and computes a unique mathematical signature (Collective F-Signature / CRC).

Step-by-Step Implementation Procedure

Configure Fail-Safe I/O Module in STEP 7 HW Config:
a. Open HW Config for the target AS station.
b. Expand the ET 200M distributed I/O station (e.g., IM 153-2).
c. From the catalog, navigate to PROFIBUS-DP -> ET 200M -> Modules -> F-DI -> SM 326 F-DI 24xDC24V (6ES7336-4GE00-0AB0) and insert it into an available slot.
d. Open module properties, navigate to the 'F-Parameters' tab, and note the assigned F_Dest_Add (e.g., 1024).
e. Under 'Inputs', configure channel pairs for either 1oo1 (single sensor) or 1oo2 (redundant sensor) evaluation, and set sensor evaluation type (2-wire vs 4-wire, discrepancy times).
f. On the physical module, configure the 10-position DIP switch on the side housing to match the binary representation of F_Dest_Add.
Configure Safety Parameters on the CPU:
a. In HW Config, double-click the CPU to open Object Properties.
b. Navigate to the 'Protection' tab: set the Protection Level to 3 (Password protection) and assign the master safety password.
c. Save and compile HW Config and download to the controller.
Create F-Runtime Group in CFC:
a. Open SIMATIC Manager and create a new CFC chart inside the S7 program chart folder (e.g., Safety_ESD).
b. Open the chart, select Options -> Customize -> Compilation/Download, and verify the chart is designated for safety execution.
c. In the Run Sequence editor, verify that an F-Runtime group (@F_OB35_...) is instantiated inside OB35.
Program Fail-Safe Channel Drivers and Safety Logic:
a. Open the S7 F Systems Lib in the CFC block catalog.
b. Drag the fail-safe digital input driver F_CH_DI (FB379) onto the chart.
c. Connect input VALUE of F_CH_DI to the symbolic address of the configured F-DI channel (e.g., ESD_Pushbutton_Raw).
d. Interconnect Q (output signal) to downstream safety logic blocks (e.g., F_AND4, F_SHUTDN).
e. Configure channel acknowledgment inputs (ACK_NEC, ACK_REI) to manage channel reintegration after wire break or module passivation.
Compile Safety Program and Verify Collective Signature:
a. In CFC Editor, select Chart -> Compile -> Charts as Program.
b. When prompted, enter the Safety Password.
c. The compiler synthesizes safety communication drivers, fault evaluation routines, and calculates the Collective F-Signature (CRC).
d. Download the safety program to the CPU and enter the safety password to confirm authorization.

Verification

In STEP 7 HW Config online, open Module Information for 6ES7336-4GE00-0AB0: verify the module status is healthy, green, and operating without passivation.
In CFC online, monitor the F_CH_DI block: actuate the field safety device (e.g., push the ESD emergency stop button) and verify Q changes state instantly with PASS_OUT = 0.
Disconnect one sensor wire to simulate an open circuit: verify PASS_OUT = 1 (channel passivated), an F-channel passivation alarm is logged, and the block enters safe state 0.
Reconnect the wire and pulse ACK_REI: confirm the channel reintegrates cleanly.

Limitations and Operational Precautions

Safety programs require strict version-controlled documentation. Modifying any block within an F-Runtime group alters the Collective F-Signature, which mandates formal safety re-validation and approval under IEC 61508 / IEC 61511.

Engineer FAQ

What does the DIP switch on the 6ES7336-4GE00-0AB0 module configure?

The 10-position DIP switch sets the physical PROFIsafe destination address (F_Dest_Add), which must match the configured address in HW Config.

What block is used to read fail-safe digital inputs in PCS 7 CFC?

The F_CH_DI block (FB379) from the S7 F Systems Library.

Do fail-safe channel driver blocks consume AS RT Process Objects?

No. Standard F-channel drivers and safety logic blocks consume zero AS RT Process Objects.

What happens when a wire break occurs on an F-DI channel?

The channel passivates immediately, forces safe state 0 on output Q, sets PASS_OUT = 1, and requires an acknowledgment (ACK_REI) to reintegrate after repair.