Resolving Unauthorized Fail-Safe Interconnection Errors and Cross-OB Data Transfer in S7 F-Systems

During CFC compilation of a SIMATIC S7 F-Systems safety program, compiler errors reporting 'Unauthorized interconnection' between safety channel driver parameters and user logic occur when fail-safe blocks and standard (non-safety) blocks are placed into the same CFC runtime group, or when safety signals cross between different cyclic interrupt OBs (e.g. from OB34 to OB35) without safety communication buffers. S7 F-Systems strictly mandates that fail-safe blocks must reside in isolated F-runtime groups containing exclusively safety blocks. Furthermore, cross-OB safety signal transfers must utilize certified F-data communication blocks (F_S_R, F_R_R, F_S_BO, F_R_BO) to guarantee SIL 3 / Category 4 deterministic data integrity.

Executive Summary

In safety-instrumented systems (SIS) deployed in chemical, pharmaceutical, and offshore oil/gas facilities utilizing SIMATIC PCS 7, fail-safe automation is governed by S7 F-Systems running on certified fault-tolerant controllers (e.g. S7-400H / CPU 410-5H). During engineering of emergency shutdown (ESD) circuits—such as integrating dozens of emergency pushbuttons, trip valves, and burner management loops—automation engineers frequently encounter compilation aborts during the F-Compiler run. The compiler reports unauthorized interconnections on safety channel driver blocks (F_CH_DI, F_CH_AI), even though the driver blocks were inserted automatically. This technical article analyzes the strict boundary rules enforced by the TÜV-certified F-Compiler, explains why mixing runtime groups causes aborts, and outlines certified cross-OB signal routing techniques.

S7 F-Systems Safety Architecture: F-Runtime Groups vs Standard Execution Tasks

S7 F-Systems achieves SIL 3 / IEC 61508 compliance through rigorous temporal and logical segregation:

F-Runtime Groups (F-RTGs): Safety blocks execute exclusively within dedicated F-runtime groups bounded by an F-Call block (F_CALL) at the head and system safety checksum monitors.
Deterministic Safety Cycle: Every F-RTG is assigned to a specific cyclic interrupt task (typically OB35 or OB34) with a fixed execution cycle and maximum permissible fault tolerance time (e.g. 100 ms execution, 200 ms timeout).
Absolute Segregation: Non-safety standard blocks (such as standard APL blocks, math functions, or standard driver blocks) can never be placed inside an F-Runtime Group.

Root Cause 1: Mixing Standard and Fail-Safe Blocks in a Common Runtime Group

The most common cause of the 'Unauthorized interconnection' error is accidental runtime group contamination:

When an engineer copies an emergency shutdown channel driver or places a safety block into a CFC chart that contains standard blocks, the CFC editor may assign the safety block to the chart's existing standard runtime group.
During compilation, the F-Compiler parses all safety inputs and outputs. If it detects a safety pin connected to a block residing outside an F-RTG, or if standard code executes inside an F-RTG, it rejects the compilation with an unauthorized interconnection error.

Root Cause 2: Cross-OB Safety Interconnections without Certified F-Communication Blocks

A second critical trigger occurs when a safety program spans multiple Organization Blocks:

Large safety systems often partition fast shutdowns (e.g. 50 ms in OB34) from slow thermal interlocks (e.g. 200 ms in OB35).
In standard CFC logic, connecting an output pin in OB34 directly to an input pin in OB35 is permitted.
In S7 F-Systems, direct cross-OB safety interconnections are strictly illegal. Because tasks execute asynchronously, direct cross-OB wiring risks race conditions and data corruption that violate SIL 3 certification.
Signals transferring between F-RTGs in different OBs must be mediated by certified F-Communication Send and Receive blocks (F_S_BO/F_R_BO for booleans, F_S_R/F_R_R for real values) using safety sequence numbers and timeout monitoring.

Automated Fail-Safe Channel Driver Parameter Wiring

Fail-safe channel drivers (F_CH_DI, F_CH_AI, F_CH_DO) feature automatic driver generation:

When Generate module drivers is executed, the driver generator connects internal diagnostic signals between the channel driver and fail-safe module diagnostic drivers (F_PS_DI, F_PS_AI) in the @ charts.
If the user-placed channel driver was installed in a standard runtime group or an uncertified task, the driver wizard's automated interconnections fail, producing errors that appear directed at parameters outside user control.

Step-by-Step Procedure to Isolate Safety Runtime Groups and Cross-OB Signals

To resolve fail-safe compiler errors and establish verified safety interconnections:

Audit Runtime Groups in Runtime Editor:
* Open the CFC Runtime Editor (Ctrl + R).
* Identify all F-Runtime Groups (typically designated with yellow safety icons or beginning with F_).
* Verify that only yellow fail-safe blocks reside inside F-RTGs. Move any standard blocks into separate, non-safety runtime groups.
Ensure Channel Drivers Are in Safety Tasks:
* In the Runtime Editor, confirm that all F_CH_DI and F_CH_AI blocks are placed inside an F-RTG under the safety OB (e.g. OB35).
Implement F-Send / F-Receive Blocks for Cross-OB Signals:
* If a safety signal from OB34 must be read by logic in OB35, delete the direct CFC line interconnection.
* In the OB34 safety chart, place block F_S_BO (Fail-Safe Send Boolean). Connect the safety signal to IN.
* In the OB35 safety chart, place block F_R_BO (Fail-Safe Receive Boolean). Interconnect OUT to the receiving safety block.
* Connect the communication identifier and timeout parameters between F_S_BO and F_R_BO.
Recompile Safety Program:
* Select Chart -> Compile -> Charts as Program.
* Check Generate module drivers.
* Allow the F-Compiler to verify all safety signatures.

Fail-Safe Interconnection and Communication Error Matrix

The following table provides diagnosis and remediation for S7 F-Systems compilation faults:

F-Compiler Diagnostic MessageUnderlying Safety ViolationSpecific Blocks InvolvedRequired Safety RemediationUnauthorized interconnectionSafety block placed in standard runtime groupF_CH_DI, F_CH_AIMove fail-safe block into dedicated F-Runtime GroupCross-OB safety interconnection illegalDirect pin connection between different OBsF-blocks in OB34 -> OB35Interpose certified F_S_BO / F_R_BO or F_S_R / F_R_RStandard block in F-RTG detectedNon-safety block placed inside safety containerStandard APL block in F-RTGMove standard block out of F-Runtime GroupF-Cycle time exceedance warningSafety execution task exceeding configured maxF-Task in OB35Increase OB cycle time in HW Config or partition safety logicF-Checksum mismatch during compileSafety logic modified without updating signatureF-Signature containerEnter safety password and accept newly calculated signature

Verification

Confirm that the safety program compiles and executes in full compliance with safety standards:

F-Compilation Log Verification: Verify that CFC compilation completes with 0 errors. Confirm that the F-Compiler displays the dialog Compilation of safety program completed successfully with a new valid safety collective signature.
Safety Program Password Validation: Enter the safety engineering password to commit the compiled safety image.
Online Safety Status: Download the program to the F-CPU. In CFC Test Mode, verify that all safety blocks report healthy status (QBAD = FALSE, QUALITY = 16#80).
Emergency Shutdown Trip Test: Actuate an emergency stop pushbutton on the plant floor. Confirm that the safety driver asserts immediate de-energization of the safe output within the certified process safety time.

Safety Matrix and Fail-Safe Delta Download Considerations

When engineering complex cause-and-effect safety architectures:

Utilize SIMATIC Safety Matrix: The Safety Matrix tool automatically generates certified CFC charts and F-RTGs, eliminating manual runtime group placement errors.
F-Delta Downloads: S7 F-Systems allows safety modifications to be downloaded in RUN mode without stopping the process, provided that strict safety engineering password verification and signature validation procedures are followed.

Limitations and Operational Precautions

Never bypass safety interconnections by converting fail-safe signals to standard booleans and back to fail-safe via uncertified logic. Converting safety signals through standard markers or DBs invalidates the functional safety certification of the plant.

All fail-safe I/O modules, safety CPUs, and S7 F-Systems software packages must be validated against official Siemens safety catalogs and confirmed through an authorized Siemens distributor quotation.

Engineer FAQ

Can standard logic read a signal from a fail-safe block?

Yes. Standard blocks can read outputs from fail-safe blocks, but standard signals can never be connected directly into safety inputs without certified F-conversion blocks.

Why are F-blocks yellow in the CFC editor?

Yellow coloring is the standardized IEC 61508 visual indicator denoting that a block belongs to the TÜV-certified fail-safe runtime domain.

What blocks are used to transfer real values between different safety OBs?

Use block F_S_R (Fail-Safe Send Real) in the sending task and F_R_R (Fail-Safe Receive Real) in the receiving task.

Does moving a block to a different runtime group change its physical execution time?

Yes. Blocks execute in the exact cyclic interval of the Organization Block to which their runtime group is assigned (e.g. 100 ms for OB35).

Resolving Unauthorized Fail-Safe Interconnection Errors and Cross-OB Data Transfer in S7 F-Systems