Reintegrating Passivated Fail-Safe I/O Channels After PROFIsafe CRC and Message Frame Faults

In SIMATIC PCS 7 fail-safe systems (S7 F Systems), when a fail-safe module passivates due to PROFIsafe communication faults, CRC errors, or channel wire breaks, all outputs drive to zero and inputs substitute safe values (QBAD = 1). Once the physical or communication fault is repaired, fail-safe channels do not recover automatically; they remain locked in passivation. Safe recovery requires an explicit acknowledgement pulse applied to the ACK_REI input of the fail-safe channel driver block (F_CH_DI, F_CH_DO) or a global safety reset via ACK_GL.

Passivation Principles in S7 F Systems and PROFIsafe

Functional safety standards (IEC 61508 and IEC 61511) dictate that whenever a safety-critical fault occurs—whether in field wiring, sensor hardware, or digital communication—the automation system must immediately assume a predefined de-energized fail-safe state. In SIMATIC PCS 7 fail-safe architectures (S7 F Systems), this transition is known as passivation.

During passivation:
* Fail-Safe Digital Inputs (F-DI): The F-channel driver block (F_CH_DI) ceases reading field inputs and outputs a constant logical 0 (or configured substitute value) to the safety logic.
* Fail-Safe Digital Outputs (F-DO): The F-channel driver block (F_CH_DO) forces internal process demands to 0, and the physical module hardware switches off all output power transistors.
* Diagnostic Flags: The channel driver sets output QBAD = 1 and PASS_OUT = 1, while resetting QUALITY = 16#00.

To prevent hazardous machinery restarts or uncontrolled chemical dosing when an intermittent electrical connection briefly heals itself, the PROFIsafe standard strictly prohibits automatic unlatched recovery. The system mandates a deliberate, validated operator action known as reintegration.

Channel Passivation vs. Module-Wide Passivation

Understanding the scope of passivation is essential for targeted diagnostics:
1. Channel-Level Passivation:
Occurs when a localized field fault is detected on an individual channel (e.g. wire break, sensor short circuit, or discrepancy time error between dual-channel contacts). Only the affected channel sets QBAD = 1. Other healthy channels on the same module continue normal fail-safe operation.
2. Module-Level Passivation:
Occurs when the communication link between the F-CPU and the fail-safe interface fails entirely (e.g. PROFIsafe CRC error, communication timeout F_WD_Time, sequence number mismatch, or backplane bus fault). In this state, the module's dual processors cannot validate incoming safety messages, forcing all channels on the physical module into passivation simultaneously. The module's red SF LED illuminates solid red.

The Role of ACK_REI, ACK_GL, and Reintegration Timing

Reintegration of passivated fail-safe I/O requires coordination between the fail-safe driver blocks in CFC:
* ACK_REI (Acknowledge Reintegration):
An input parameter on individual channel blocks (F_CH_DI, F_CH_DO, F_CH_AI). Applying a positive edge (0 -> 1 -> 0) to this input commands the block to evaluate if the hardware diagnostic has cleared. If the fault is gone, the block clears QBAD and restores live process values.
* ACK_GL (Global Acknowledgement):
In S7 F Systems, rather than wiring hundreds of individual pushbuttons, engineers deploy the F-Control block (F_CONTROL) or F-Cycle block. An operator pressing a central 'Fault Acknowledge' button on the WinCC OS pulses ACK_GL, which automatically broadcasts a synchronized reintegration request to all passivated blocks in the safety program.
* ACK_REQ (Acknowledgement Request):
An output parameter on the channel driver indicating that the underlying hardware error has cleared and the block is waiting for an operator acknowledgement edge.

Safety Channel Status and Passivation Signal Matrix

The following matrix details the operational states and signal statuses of S7 F Systems channel driver blocks during the passivation and reintegration cycle:

Operational PhasePhysical Fault Present?QBAD OutputPASS_OUT OutputACK_REQ OutputRequired Operator ActionNormal OperationNo000None (Continuous monitoring)Fault DetectedYes (CRC / Wire break)110Repair field wiring or communication hardwareFault Cleared (Standby)No (Hardware healthy)111System is ready for reintegration pulseReintegration EdgeNo000Positive edge on ACK_REI or ACK_GL appliedInvalid AttemptYes (Fault still active)110Acknowledgement ignored; channels stay passivated

Step-by-Step Procedure for Reintegrating Passivated F-Modules

Follow this standardized engineering procedure to restore passivated safety I/O:
1. Identify the Passivated Block and Cause:
- In WinCC Alarm Logging, check incoming safety alarms.
- Open STEP 7 HW Config, go online, and inspect the module diagnostic buffer to confirm whether the issue was a field wire break or a PROFIsafe CRC frame fault.
2. Eliminate the Underlying Hardware Root Cause:
- For field wiring: repair the broken wire, eliminate ground faults, or verify 24 V DC sensor power.
- For PROFIsafe CRC errors: verify the DIL address switch on the rear of the module (F_Dest_Add), clean active bus connectors, or replace defective IM 153-2 interface modules.
3. Verify Acknowledgement Request Readiness:
- In CFC online, observe the affected F_CH_DO or F_CH_DI block.
- Confirm that the physical fault is gone and ACK_REQ = 1. If ACK_REQ remains 0, the block still detects active hardware diagnostic faults.
4. Issue the Reintegration Pulse:
- From the WinCC OS operator station, click the Reset Safety Alarms / Reintegrate button, or in CFC toggle the tag connected to ACK_REI / ACK_GL from 0 to 1 and back to 0.
5. Verify Channel Restoration:
- Confirm QBAD and PASS_OUT immediately reset to 0.
- Verify that output channels restore their commanded process states and input channels resume transmitting live field values to safety interlock matrices.

Verification

Verify full recovery and safety integrity:
1. Observe the physical module in the ET 200M or ET 200SP rack: All red SF LEDs must be completely extinguished.
2. In WinCC OS, confirm that safety alarm banners clear and return to normal green/grey state.
3. In CFC test mode, verify that F_CH_DO.QBAD = 0, F_CH_DO.PASS_OUT = 0, and output values (V) track the input demand (VALUE).
4. In Safety Matrix (if deployed), verify that all degraded voting channels clear and the matrix status indicates 100% healthy sensor redundancy.

Limitations and Operational Precautions

Never automate an unconditional cyclic loop to pulse ACK_REI continuously; doing so violates IEC 61508 safety standards by defeating unlatched fault protection.
Reintegrating fail-safe outputs will instantly energize field equipment (e.g. opening safety valves or energizing motor contactors) if the safety interlock conditions are satisfied; verify field personnel are clear before acknowledging.
Replacing fail-safe modules requires strict hardware verification; always match the exact part number (MLFB) and safety firmware release.

Engineer FAQ

Can I configure S7 F Systems to automatically reintegrate channels without operator acknowledgement?

Yes, by setting input parameter ACK_NEC = 0 (Acknowledgement not necessary) on the fail-safe channel driver. However, this is only permissible after a formal Process Hazards Analysis (PHA) confirms that automatic restart presents no physical hazard to personnel or plant equipment.

Why does pulsing ACK_REI fail to clear QBAD on my F-channel?

If the underlying physical fault is still present (such as an unresolved short circuit, active communication timeout, or unpowered field transmitter), ACK_REQ remains 0 and any pulse on ACK_REI is safely ignored by the block.

What is the difference between PASS_OUT and QBAD on fail-safe channel blocks?

PASS_OUT indicates that the channel is currently passivated (operating on substitute values). QBAD is an inverted quality status indicating bad quality; in most standard F-channel blocks, QBAD and PASS_OUT switch simultaneously.