S7 F Systems Safety Collective Signature Calculation Scope and Non-Safety Signal Interfacing

In SIMATIC S7 F Systems (V6.1 to V6.4) and PCS 7, the compiled Safety Collective Signature (F-Signature) strictly encompasses fail-safe components: fail-safe runtime groups, F-blocks, F-parameter values, and F-I/O hardware configurations. Standard (non-safety) CFC charts, standard blocks, and standard inputs connecting to safety conversion blocks (such as F_BO_F or F_SW_BO) do NOT form part of the safety signature. Consequently, altering, disconnecting, or bypassing standard logic that drives an F-conversion block will NOT alter the safety signature. For safety-critical functions—such as conveyor startup acoustic pre-warning feedback—signals must be wired directly to certified Fail-Safe I/O (F-I/O) modules and evaluated entirely within pure F-blocks.

Executive Summary

During the commissioning and functional safety certification of industrial facilities engineered with SIMATIC PCS 7 and SIMATIC S7 F Systems V6.2 (e.g., CEMAT material handling and long conveyor lines), safety engineers must generate and document the official Safety Collective Signature. A dangerous architectural misconception arises when standard process signals—such as conveyor start permissives, horn acoustic sensors, or pre-warning confirmation contacts—are converted into fail-safe signals using standard-to-safety conversion blocks (F_BO_F, F_SW_BO). Commissioning tests reveal that disconnecting or modifying the standard inputs feeding these conversion blocks produces zero change in the safety signature! This article explains the exact mathematical scope of the S7 F Systems safety signature, clarifies standard-to-safety interfacing rules, and outlines how to maintain safety integrity per IEC 61508 / IEC 62061.

Architecture and Fundamental Mechanics

The calculation scope and architectural boundaries of SIMATIC S7 F Systems are rooted in strict functional safety segregation:

Safety Collective Signature Calculation: When an S7 F Systems program compiles, the F-compiler generates a cryptographic CRC checksum known as the Collective Signature (F-Signature). The signature is computed strictly across:
- All blocks residing inside designated Fail-Safe Runtime Groups (F-Runtime Groups).
- All interconnections between fail-safe block pins.
- All parameter values assigned to fail-safe block inputs.
- The Fail-Safe Hardware Configuration (F-I/O module parameters, F-monitoring times, PROFIsafe addresses).
The Non-Safety 'Blind Spot': Standard (non-failsafe) CFC charts, standard blocks (C_DRV_1D, APL blocks), and standard I/O addresses reside outside F-Runtime Groups. The F-compiler completely ignores standard logic when computing the safety CRC.
Mechanics of F-Conversion Blocks (F_BO_F, F_SW_BO): To allow standard operational commands (e.g., an HMI start command or process interlock) to interact with safety logic, the F-library provides conversion blocks. These blocks take a standard data type (e.g., standard BOOL) and output a fail-safe data type (F_BOOL) with safety redundancy words. However:
- The input to F_BO_F is an untrusted, non-failsafe signal.
- Modifying the upstream standard logic, rewiring the standard input, or forcing it in the CPU does not modify the F-program structure or its compiled code.
- Therefore, the Safety Collective Signature remains completely static.
Functional Safety Principles (IEC 61508 / EN ISO 13849): An automation function cannot claim a Safety Integrity Level (SIL) or Performance Level (PL) if any link in the safety safety chain relies on standard hardware or unvalidated software. If an acoustic pre-warning system is legally required to protect human life from conveyor startup hazards, relying on standard CEMAT logic or standard inputs creates an unmonitored point of failure.

Step-by-Step Implementation Procedure

To correctly engineer safety-critical pre-warning and interlock logic without relying on untrusted standard signals:

Method 1: True Fail-Safe Implementation (Complies with SIL 2 / SIL 3 / PL d / PL e)

Hardware Re-allocation:
- Wire the acoustic pre-warning feedback sensor (e.g., sound pressure switch or current sensor) directly to a Fail-Safe Digital Input (F-DI) module (e.g., ET 200M F-DI or ET 200SP F-DI).
- Wire the pre-warning horn and beacon activation relays directly to Fail-Safe Digital Output (F-DO) modules.
Implement F-Logic in F-Runtime Groups:
- In CFC, place the pre-warning evaluation logic entirely within F-Runtime Groups using certified F-library blocks (e.g., F_TON, F_AND4, F_OR4).
- Interconnect the F-DI channel driver directly to the F-timer logic.
- If the acoustic pre-warning feedback fails to prove sound generation within the calibrated delay (e.g., 5 seconds), the F-logic asserts an internal F-trip, de-energizing the conveyor start release (F-DO).
Compile F-Program and Verify Signature:
- Execute Options -> Safety Program in SIMATIC Manager.
- Click Compile. Note the resulting Collective F-Signature.
- Any subsequent alteration to the pre-warning sensor logic, timer values, or wiring will instantly change the signature.

Method 2: Administrative Controls for Hybrid Signals

If a signal is purely operational and not safety-critical, document in the Safety Requirements Specification (SRS) that the pre-warning is an operational alert, not a certified safety function.
Enable Change Log in SIMATIC Manager to track all modifications to standard CFC charts feeding F-conversion blocks.

Verification

Verify safety signature integrity and F-program execution:

Signature Inspection: In SIMATIC Manager, select Options -> Safety Program. Review the Collective Signature of All F-Blocks with F-Header and F-HW Configuration Signature. Confirm they match the safety documentation.
F-Parameter Change Test: In the F-CFC chart, alter an F-timer preset value. Recompile the safety program. Confirm that the Collective Signature updates to a new hexadecimal value, proving change detection.
Functional Trip Test: Disconnect the acoustic pre-warning sensor on the F-DI rack. Attempt to initiate a conveyor start. Confirm that the fail-safe logic detects sensor feedback absence and halts conveyor release deterministically.

Limitations and Operational Precautions

Never use standard non-failsafe inputs as the sole permissive for safety-critical hazard mitigation. Safety auditors will reject SIL claims if safety releases depend on standard inputs converted via F_BO_F. Furthermore, any modification to the F-program that alters the Safety Collective Signature legally invalidates the safety certificate, requiring re-testing and signature re-signing.

Engineer FAQ

Why does changing a standard input connected to F_BO_F not change the safety signature?

The safety signature only computes checksums across blocks, parameters, and interconnections inside F-Runtime Groups. The standard input originates outside the safety program, so modifications to standard logic do not alter the F-checksum.

What is the intended use of conversion blocks like F_BO_F and F_SW_BO?

They are designed to pass non-safety operator commands (e.g., HMI reset buttons) or non-safety process interlocks into the safety program, provided that the safety program evaluates them safely (fail-safe default on loss of signal).

How is the Safety Collective Signature calculated in S7 F Systems?

It is a cryptographic CRC computed over all compiled F-blocks, F-data blocks, F-runtime sequences, and the F-hardware configuration.

Can an acoustic pre-warning system be certified to SIL 2 if wired to standard I/O?

No. Functional safety standards (IEC 61508 / IEC 62061) require all sensors, logic solvers, and actuators in a safety function to meet the required SIL hardware fault tolerance and architectural constraints.

Where can I view the active safety signature in the running CPU?

In SIMATIC Manager, open Options -> Safety Program online, or inspect the safety administration DB (F_GLOBDB) in CPU memory.

Technical References

Related Tags

S7 F Systems
Safety Signature
F_BO_F
Functional Safety
F-I/O
IEC 61508

20 respuestas

S7 F Systems Safety Collective Signature Calculation Scope and Non-Safety Signal Interfacing