C135 PCS 7 (PCS7)
6C
6 Cielo Ciencia y Tecnología
·Publicada en C135 PCS 7 (PCS7)

Resolving Safety Matrix F-Shutdown Group Interconnection Errors in PCS 7 F-Systems

Resolving Safety Matrix F-Shutdown Group Interconnection Errors in PCS 7 F-Systems

In SIMATIC PCS 7 S7 F Systems and Safety Matrix, fail-safe blocks cannot be placed directly into an Organization Block (OB) task without an F-runtime group, nor can F-blocks belonging to different F-shutdown groups be interconnected directly. When an F-channel driver (such as F_CH_DI in OB35) is connected to a Safety Matrix cause in a different cyclic task (such as OB34), the compiler throws errors 'E: An F-block is located directly in task OB...' and 'E: Unauthorized interconnection of the F-parameter... between shutdown groups'. To resolve this, place the Safety Matrix and its driver blocks within the same cyclic interrupt task and F-shutdown group, or use fail-safe communication blocks (F_S_BO / F_R_BO) to bridge signals across shutdown groups.

Table of Contents

Architecture of F-Runtime Groups and F-Shutdown Groups in S7 F Systems

In SIMATIC S7 F Systems (6ES7833-1FC02-0YA5), fail-safe logic execution is strictly partitioned to guarantee deterministic cycle times, fault containment, and certification compliance according to IEC 61508 / IEC 61511:

  • F-Runtime Groups: All fail-safe blocks (e.g., F_CH_DI, F_CH_DO, F_SC_CA, F_MATR_C) must be inserted into an F-Runtime Group residing inside a cyclic interrupt organization block (typically OB30 to OB38). An F-block can never exist as a "loose" block placed directly into an OB task. Every F-runtime group is bookended by an F-Control Block (F_CTRL) that monitors cycle time and checksums.
  • F-Shutdown Groups: S7 F Systems aggregates one or more F-runtime groups into an F-Shutdown Group. The primary function of an F-shutdown group is selective fault isolation: if a severe diagnostic fault (such as a communication timeout or corrupted signature) occurs within one shutdown group, only that specific group is halted and passivated, allowing other independent safety functions in separate shutdown groups to remain operational.

When SIMATIC Safety Matrix (6ES7833-1SM02-0YA5) transfers its cause-and-effect logic into CFC, it creates dedicated F-runtime groups. If the run sequence or task allocation is misconfigured, the safety compiler aborts with strict error codes.

Why Direct Interconnections Between Different Shutdown Groups Are Prohibited

Safety engineering principles dictate that an un-isolated failure must never propagate from one safety boundary into another:

  • Asynchronous Execution & Jitter: If F_CH_DI executes in OB35 (e.g., 100 ms cycle) and the Safety Matrix executes in OB34 (e.g., 200 ms cycle), direct signal interconnections would cross asynchronous time boundaries. Without deterministic handshaking, race conditions and data corruption can occur.
  • Cascading Fault Invalidation: If Shutdown Group A faults and enters safe state (de-energizing outputs and freezing internal variables), a directly wired block in Shutdown Group B would read corrupted or ambiguous memory. S7 F Systems strictly prohibits direct chart-to-chart wiring across shutdown group boundaries to prevent unmanaged fault propagation.
  • Compiler Enforcement: During compilation, the S7 F compiler inspects the execution hierarchy. Any direct pointer linking an output of Shutdown Group 1 to an input of Shutdown Group 2 triggers a fatal compilation error.

Understanding the Compiler Error Messages (OB Task vs Shutdown Group)

Engineers encounter two specific compiler error messages when this architectural rule is breached:

  1. E: An F-block is located directly in task OBxx [Place the block within a runtime group]:
    * Meaning: A fail-safe block was manually dragged into a chart or generated in an OB task where it sits outside an official F-Runtime Group container. In CFC Run Sequence, every F-block must sit underneath a runtime group marked with the safety shield icon.
  2. E: Unauthorized interconnection of the F-parameter '<Path>' between shutdown groups '<GroupA>' and '<GroupB>' [Remedy 2: Always use communication blocks F_S_R, F_R_R or F_S_BO, F_R_BO...]:
    * Meaning: A signal line connects an F-block in one shutdown group (e.g., OB35 / SafetyMatrix35) to an F-block in another shutdown group (e.g., OB34 / SafetyMatrix34). S7 F Systems explicitly halts compilation and provides the required remedy.

Solution 1: Co-Locating Blocks in the Same Cyclic OB Task (Recommended)

For the vast majority of process safety applications, the simplest, most efficient, and standard Siemens design practice is co-locating all related safety logic into a single cyclic interrupt OB:

  • In SIMATIC Manager / CFC, assign both the field I/O channel drivers (F_CH_DI, F_CH_AI) and the Safety Matrix logic (F_SC_CA, F_MATR_C, F_SC_EF) to the same cyclic interrupt task (e.g., OB35 with a 100 ms execution cycle).
  • Ensure both runtime groups are assigned to the same F-Shutdown Group in the F-System configuration.
  • In the CFC Run Sequence editor, order the blocks logically:
    1. Input Channel Drivers (F_CH_DI, F_CH_AI)
    2. Safety Matrix Logic (@Matrix...)
    3. Output Channel Drivers (F_CH_DO, F_CH_AO)
  • Result: Signals flow synchronously within the same deterministic task without requiring communication blocks or incurring inter-task cycle delays.

Solution 2: Cross-Shutdown Group Communication via F_S_BO and F_R_BO

When process requirements mandate separate shutdown groups (for example, in large plants where Unit 1 in OB35 must safely trip an isolation valve in Unit 2 running in OB34 without sharing common shutdown behavior), engineers must use certified fail-safe communication blocks:

  • For Boolean Signals:
  • In the transmitting shutdown group (e.g., OB35), instantiate block F_S_BO (F-Send Boolean).
  • Connect the output of the source F-block (e.g., F_CH_DI.Q or Cause output) to F_S_BO.IN.
  • In the receiving shutdown group (e.g., OB34), instantiate block F_R_BO (F-Receive Boolean).
  • Interconnect F_S_BO.OUT to F_R_BO.IN.
  • Connect F_R_BO.OUT to the Safety Matrix cause input pin.
  • For Real / Analog Signals:
  • Use F_S_R (F-Send Real) and F_R_R (F-Receive Real).
  • Communication Safety:
    These communication blocks manage asynchronous handshakes, buffer data across cycle boundaries, and detect data loss. If the transmitting shutdown group halts, F_R_BO safely transitions its output to the pre-configured fail-safe substitute value (SUBS_ON / SUBS_VAL).

Comparison of Co-Located vs Distributed F-Shutdown Group Architectures

The following table compares the two architectural strategies for resolving shutdown group interconnections:

Architectural MetricCo-Located F-Shutdown Group (Same OB)Cross-Shutdown Groups via F_S_BO / F_R_BOCyclic Task AllocationSingle cyclic OB (e.g., OB35 100 ms)Multiple cyclic OBs (e.g., OB35 & OB34)Shutdown IndependenceEntire group trips together on faultIsolated tripping (one unit can stop while other runs)Additional Communication BlocksZero (direct chart connections permitted)Requires paired F_S_BO / F_R_BO blocksSignal Transmission Delay0 cycle delay (immediate synchronous transfer)1 to 2 task cycles delay for handshakingCPU Memory OverheadMinimumAdditional F-data blocks and communication instancesEngineering ComplexityVery Low (standard practice)Moderate (manual block wiring and addressing)Recommended Use Case90%+ of standard Safety Matrix applicationsSegregated plant units requiring independent shutdown

Step-by-Step Procedure to Correct Safety Matrix Run Sequences

To eliminate compiler errors and establish a compliant run sequence:

  1. Inspect Safety Matrix Configuration:
    * Open the Safety Matrix object (.xms).
    * In the menu, select Matrix > Properties.
    * Under the Execution tab, verify which cyclic interrupt task is selected (e.g., OB35).
  2. Harmonize the Run Sequence in CFC:
    * Open any CFC chart and press Ctrl+F5 (or click Edit > Run Sequence).
    * Expand the cyclic tasks in the Run Sequence window.
    * Locate the F-Runtime Group containing F_CH_DI and the group containing the Safety Matrix.
    * If they are located in different OBs (e.g., OB35 and OB34), drag the Safety Matrix runtime group into OB35, placing it immediately following the channel drivers.
  3. Verify F-Block Placement in Runtime Groups:
    * Ensure that no F-blocks reside directly under the root of an OB task. Every F-block must sit indented under an official F-runtime group folder (marked with yellow safety icon).
  4. Alternative: Inserting F_S_BO / F_R_BO:
    * If tasks must remain separate, open the CFC chart.
    * From the S7 F Systems library (under F-Communication), drag F_S_BO into the source chart (OB35) and F_R_BO into the target matrix chart (OB34).
    * Wire the source signal to F_S_BO.IN. Connect F_S_BO.OUT to F_R_BO.IN.
    * Wire F_R_BO.OUT to the Safety Matrix # External Connection cause pin.
  5. Recompile Safety Program:
    * In CFC, select Chart > Compile > Entire program.
    * Ensure Generate module drivers is checked.
    * Confirm that the compiler finishes with 0 Errors.

Verification

Verify compliant operation and deterministic signal transfer:
1. In CFC, initiate a compile; verify that errors E: An F-block is located directly in task... and E: Unauthorized interconnection... are completely absent.
2. In the CFC Run Sequence editor, confirm that all fail-safe blocks reside exclusively inside validated F-runtime groups marked with safety shield symbols.
3. If using F_S_BO / F_R_BO, open the CFC chart in Test Mode (online monitor). Toggle the input signal in OB35 and confirm that F_R_BO.OUT in OB34 updates reliably within 1-2 execution cycles without asserting ERROR or SUBS.
4. Open Options > Safety Program and confirm that the safety program compiles cleanly and generates a valid collective signature (F_SIG).

Limitations and Operational Precautions

  • Execution Order Within F-Runtime Groups: F-blocks must execute in strict chronological sequence: Inputs -> Logic -> Outputs. An inverted execution sequence (evaluating matrix logic before channel drivers read physical inputs) adds an unnecessary 100 ms cycle latency to emergency shutdown reaction times.
  • Cycle Time Overrun: Consolidating massive safety matrices into a high-frequency cyclic OB (e.g., OB35 at 50 ms) can exceed CPU processing capacity. Use CPU Module Information (Ctrl+D in SIMATIC Manager) to monitor OB35 execution time; if it exceeds 60% of the cycle interval, increase the cycle time or distribute across tasks using communication blocks.
  • Software Licensing: Engineering S7 F Systems and Safety Matrix requires valid software licenses (6ES7833-1FC02-0YA5 and 6ES7833-1SM02-0YA5).
  • Commercial Accuracy: All fail-safe hardware modules (e.g., 6ES7326-1BK02-0AB0) and engineering software packages must be verified against current Siemens safety engineering standards. Procure via an authorized Siemens distributor quotation.

Engineer FAQ

Can I connect a standard (non-safety) signal to F_S_BO?

No. F_S_BO is a fail-safe communication block that strictly requires a fail-safe boolean input (F_BOOL). To connect a non-safety standard signal (such as a control room manual trip from WinCC) into a safety shutdown group, you must use a standard-to-failsafe conversion block such as F_BO_F8 or F_SWC_P with appropriate safety qualification.

What happens if an F-Shutdown group faults while using F_S_BO / F_R_BO?

If the transmitting shutdown group trips or encounters an internal diagnostic fault, F_S_BO stops transmitting valid safety frames. The receiving block F_R_BO detects communication loss, asserts its ERROR output, and outputs the safe substitute value (SUBS_VAL, typically FALSE / 0) to ensure the receiving matrix initiates its safe trip action.

Why did the Safety Matrix generate into OB34 when my channel drivers are in OB35?

When a Safety Matrix is created, its default execution task is defined in the matrix properties. If the engineer does not change the default task from OB34 to match the rest of the project's safety I/O (typically OB35), the matrix transfers into a different task, causing the interconnection fault.

Is there a maximum number of F-Shutdown Groups in an S7-400 F-CPU?

S7 F Systems supports up to 255 F-runtime groups, but typical industrial applications should be kept to a small number of well-defined shutdown groups (typically 1 to 4) to maintain clarity and minimize communication block overhead.

Technical References

Related Articles

Related Tags

  • Safety Matrix
  • S7 F Systems
  • F-Shutdown Group
  • F-Runtime Group
  • F_S_BO
  • F_R_BO
6 respuestas