Monitoring Fail-Safe Digital Input Modules and Decoding PROFIsafe Signals in SIMATIC S7 F-Systems

Monitoring Fail-Safe Digital Input Modules and Decoding PROFIsafe Signals in SIMATIC S7 F-Systems

In SIMATIC PCS 7 with S7 F-Systems, Fail-Safe Digital Input modules (such as SM 326 F-DI 24xDC24V) cannot be monitored using standard STEP 7 Variable Tables (VAT) or HW Config online views because raw peripheral memory contains encrypted PROFIsafe protocol frames, CRC signatures, and sequence counters rather than plain boolean bits. Attempting to read raw addresses yields static or corrupted data. To monitor fail-safe inputs, open the CFC safety chart containing the fail-safe channel driver block (F_CH_DI or F_DI_16) in Test Mode. The channel driver decodes the PROFIsafe telegram, outputting the valid process signal on output Q and fault status on QBAD.

Table of Contents

• Executive Summary
• PROFIsafe Protocol Encoding and Peripheral Memory Isolation
• Why Standard Variable Tables (VAT) Fail for Safety I/O
• Decoding Fail-Safe Inputs via Safety Channel Drivers (F_CH_DI)
• Safety Signal Monitoring Method Comparison Matrix
• Step-by-Step Procedure to Monitor Fail-Safe Inputs in CFC
• Verification
• Limitations and Operational Precautions
• Engineer FAQ
• Technical References
• Related Articles
• Related Tags

Executive Summary

Deploying emergency stop circuits, burner management interlocks, and safety instrumented systems (SIS) in SIMATIC PCS 7 utilizes the certified S7 F-Systems package alongside fail-safe distributed I/O modules (e.g. SM 326 F-DI 24xDC24V, 6ES7326-1BK02-0AB0). During commissioning, automation engineers frequently connect remote emergency stop (ESD) panels over fiber-optic Optical Link Modules (OLMs), verify that physical module LEDs illuminate when pushbuttons are pressed, and verify that HW Config reports healthy communication. However, when attempting to monitor input states in a standard STEP 7 Variable Table (VAT) or HW Config 'Monitor/Modify' window, the inputs appear completely inactive or show static zeros. This behavior is a direct consequence of PROFIsafe protocol encapsulation. This guide explains how fail-safe data is decoded and monitored.

PROFIsafe Protocol Encoding and Peripheral Memory Isolation

Standard non-safety digital input modules map direct electrical contact states to input image bits (e.g. I 0.0 = 1). In contrast, Fail-Safe I/O operates over the PROFIsafe (Black Channel) protocol (IEC 61784-3-3):

• Telegram Overhead: Every input frame packages raw sensor states with a 4-byte PROFIsafe control/status header, a continuous 24-bit sequence counter, and a 32-bit CRC signature.
• Peripheral Scrambling: The S7 CPU's standard peripheral image holds encrypted protocol frames, not raw boolean contacts.
• Dedicated Decryption: Decoupling and validating this safety frame is performed exclusively by certified S7 F-Systems runtime libraries executing in fail-safe Organization Blocks (e.g. OB35).

Why Standard Variable Tables (VAT) Fail for Safety I/O

Attempting to monitor fail-safe input addresses in a standard VAT table fails for two structural reasons:

1. Protocol Masking: The byte at PIB 0 represents PROFIsafe protocol metadata; inspecting individual bits (I 0.0) yields fluctuating protocol bits rather than switch positions.
2. Safety Security Boundaries: S7 F-Systems prevents standard non-certified tools from altering or evaluating safety signals directly, ensuring TÜV compliance.

Decoding Fail-Safe Inputs via Safety Channel Drivers (F_CH_DI)

In S7 F-Systems, safety signals are accessed exclusively via certified F-Channel Drivers:

• Block F_CH_DI (FB379): The primary interface block for digital fail-safe inputs.
• Parameter VALUE: Connects to the symbolic hardware address of the channel.
• Output Q: Outputs the true, validated fail-safe boolean process value (1 = 24V present, 0 = de-energized/safe state).
• Output QBAD: Asserts 1 if the channel is passivated (wire-break, short-circuit, or discrepancy fault).
• Output QUALITY: Provides NAMUR-compliant quality status.

Safety Signal Monitoring Method Comparison Matrix

The following table compares monitoring methods for fail-safe I/O in SIMATIC PCS 7:

Step-by-Step Procedure to Monitor Fail-Safe Inputs in CFC

Method: Monitoring F-DI Channels in CFC Test Mode

1. In SIMATIC Manager, open the safety chart containing the fail-safe channel driver (e.g. F_CH_DI for Emergency Stop PB).
2. Confirm that parameter VALUE is interconnected to the hardware symbol (e.g. "ESD_PB01" mapped to I 0.0).
3. In the CFC menu bar, select Debug > Test Mode (or click the Test Mode icon).
4. Right-click the block icon and select Watch On.
5. Observe parameter Q: If the physical contact is closed and healthy, Q = TRUE (green text).
6. Observe parameter QBAD: If the channel is healthy, QBAD = FALSE. If QBAD = TRUE, the channel is passivated.
7. Physically press the Emergency Stop pushbutton: Observe parameter Q transition cleanly to FALSE in real time.
8. Release the pushbutton: If configured for manual reintegration, observe ACK_REQ = TRUE; pulse input ACK_REI to restore Q = TRUE.

Verification

To verify fail-safe digital input processing:

1. Discrepancy Fault Test: For 1oo2 (2-channel equivalent) sensor evaluations, disconnect one leg of the dual contact. Confirm that QBAD asserts, output Q drops to 0 (safe state), and diagnostic buffer logs a discrepancy timeout.
2. Wire-Break Test: Disconnect the field wire. Confirm that the module front SF LED lights red, channel LED blinks, and QBAD = 1 in CFC.
3. Reintegration Check: Reconnect wire, pulse ACK_REI. Confirm that QBAD resets to 0 and live tracking resumes.

Limitations and Operational Precautions

• Safety Password Required: Editing or toggling forced states in safety charts requires entering the authorized safety program password.
• Never Bypass QBAD: Never bridge or bypass output QBAD in safety logic; ignoring passivation defeats TÜV safety certification.
• Sensor Evaluation Settings: Verify module sensor evaluation in HW Config: Ensure '1v1 (1oo1)' or '2v2 (1oo2)' matches physical field contact wiring (single vs dual channel).

Engineer FAQ

Can fail-safe inputs be forced in CFC Test Mode?

F-Systems allows forcing safety signals only under strict administrative password control within certified test environments.

Why does Q remain 0 after fixing a tripped emergency stop button?

Safety standards mandate that safety blocks require explicit operator acknowledgment (ACK_REI rising edge) before returning to active operation.

Does S7-PLCSIM support simulating F-DI modules?

Yes, S7-PLCSIM supports S7 F-Systems simulation when the F-Configuration license is installed.

Technical References

• Siemens AG: SIMATIC Industrial Software S7 F/FH Systems - Configuring and Programming (Doc No. A5E00049000)
• Siemens AG: SIMATIC S7-300 Fail-Safe Signal Modules Manual (Doc No. A5E00085586)
• PROFIBUS Nutzerorganisation e.V. (PNO): PROFIsafe - System Description V2

Related Articles

• https://industrialautomation.net/search?query=s7+f+systems+monitoring+fail+safe+di+modules+cfc
• https://industrialautomation.net/search?query=why+vat+tables+fail+to+monitor+profisafe+inputs
• https://industrialautomation.net/search?query=f_ch_di+qbad+passivation+and+reintegration+ack_rei

Related Tags

• https://industrialautomation.net/search?query=simatic-pcs7
• https://industrialautomation.net/search?query=s7-f-systems
• https://industrialautomation.net/search?query=safety
• https://industrialautomation.net/search?query=profisafe