Safety Matrix F-I/O Channel Reintegration: External Reintegration Signals, ACK_REI Warnings, and F_QUITES

To reintegrate passivated fail-safe I/O channels in SIMATIC Safety Matrix using an external signal (such as a plant-wide OS reset button or physical key switch) instead of manually acknowledging individual matrix faceplates, utilize the fail-safe acknowledgment block F_QUITES. When using 'imported channel drivers', interconnect the positive-edge pulse output F_QUITES.Q to the fail-safe acknowledgment input ACK_REI on the F-channel driver blocks (F_CH_AI, F_CH_DI, F_CH_DO). The CFC compiler warning 'I/O ACK_REI of chart is not interconnected internally' occurs when auto-generated matrix driver wrappers expose ACK_REI without an internal link; it can be safely resolved by interconnecting ACK_REI to F_QUITES or setting a permanent parameter acknowledgment value.

Fail-Safe Passivation and Reintegration Principles in S7 F-Systems

In safety-instrumented systems (SIS) running SIMATIC PCS 7 F-Systems and Safety Matrix, fail-safe I/O modules (ET 200M / ET 200SP F-modules) continuously execute internal diagnostic routines. If a physical hardware fault occurs—such as a sensor wire break, field line short circuit, or discrepancy timeout—the safety system passivates the affected channel or entire module. During passivation, the fail-safe driver blocks substitute safe fail-safe default values (typically 0 or configured substitute values).

Once the physical fault is repaired in the field, safety standards (IEC 61508 / IEC 61511) strictly prohibit automatic, unmonitored resumption of normal operation. The channel remains passivated until an authorized operator issues an explicit Reintegration Command (Wiedereingliederung).

Individual Matrix Faceplate Acknowledgment vs Plant-Wide Reintegration

In a plant with dozens of independent Safety Matrices, requiring operators to open every individual matrix faceplate and click the local 'Acknowledge' button after clearing a widespread power dip or MCC trip is inefficient and increases downtime:

The Local Faceplate Path: By default, each Safety Matrix provides an internal acknowledgment mechanism that resets trips and reintegrates internal channels created during matrix transfer.
The Centralized Reintegration Path: Process facilities mandate a 'single point of control'—such as an authorized button on the main safety banner or a physical key switch on the operator console—that simultaneously reintegrates all healthy channels across all Safety Matrices and F-runtime groups in the controller.

Integrating the F_QUITES Block for Centralized OS Reintegration

To implement a centralized, fail-safe operator acknowledgment from WinCC OS, Siemens provides the certified library block F_QUITES (Acknowledge from OS):

Fail-Safe Acknowledgment Token: WinCC operator actions cannot be trusted implicitly by the safety program. F_QUITES implements a certified two-step acknowledgment handshake (often coordinated with SIMATIC Logon or safety password entry).
Pulse Generation: When an authorized operator clicks the central 'Reintegrate F-I/O' button on WinCC, F_QUITES generates a single fail-safe positive pulse (Q = 1) on the safety bus for exactly one safety cycle.
Driving ACK_REI: This fail-safe output F_QUITES.Q is interconnected to the ACK_REI parameter of all fail-safe channel drivers (F_CH_DI, F_CH_AI, F_CH_DO) or the module driver F_MOD_ACT. When the pulse arrives, any passivated channel whose field fault has cleared reintegrates immediately.

Resolving the CFC Warning: 'I/O ACK_REI Is Not Interconnected Internally'

When engineers transfer a Safety Matrix using the option 'Use imported channel driver' (where channel drivers are pre-placed in CFC charts rather than generated automatically by the matrix tool), the compiler frequently emits the warning:

I/O 'ACK_REI' of chart 'Matrix001_CFC/ChannelDriver_Block' is not interconnected internally

This occurs because:

The Safety Matrix transfer tool exposes ACK_REI on the driver wrapper block so that external safety logic can reach it.
If the engineer does not interconnect this pin, the CFC compiler detects an open fail-safe input parameter.
Resolution: If external reintegration is desired, wire F_QUITES.Q directly to this ACK_REI pin. If external reintegration is not used and local matrix faceplate acknowledgment is intended, verify that the internal acknowledgment tag links to the channel driver or set ACK_REI = 0 to suppress floating input warnings.

Comparative Architecture Matrix: Local Matrix Reset vs F_QUITES Central Reset

The following table compares the two channel reintegration workflows in SIMATIC PCS 7:

| Engineering Dimension | Local Safety Matrix Faceplate Reset | Centralized Reintegration via F_QUITES |
|---|---|---|---|
| Operator Action Scope | Acknowledges 1 individual matrix faceplate | Reintegrates all F-channels plant-wide or unit-wide |
| Underlying Block | Internal matrix logic (F_MATCTL) | Certified library block F_QUITES |
| Safety Execution | Evaluated within matrix execution slice | Executes in F-runtime group; pulses ACK_REI |
| CFC Interconnection | Internal automatic transfer tags | Explicit wiring from F_QUITES.Q to ACK_REI |
| Trip Latch Reset | Clears matrix intersection trip latches | Reintegrates physical I/O; matrix trip reset separate |
| Best Applied In | Small skid systems with 1-2 matrices | Complex refineries / chemical plants with multi-matrix ESD |

Step-by-Step CFC Interconnection and Configuration Workflow

Follow this sequence to establish centralized external channel reintegration:

Insert F_QUITES: In the main F-CFC safety chart, insert an instance of F_QUITES from the S7 F-Systems library.
Configure WinCC OS Acknowledgment: In WinCC Explorer, configure an operator push button linked to the IN parameter of F_QUITES with Authorization Level 6 (Higher process controlling) and SIMATIC Logon safety role verification.
Interconnect to Channel Drivers: Wire output F_QUITES.Q to the input ACK_REI of all imported F-channel drivers (F_CH_DI.ACK_REI, F_CH_AI.ACK_REI).
Compile CFC and Safety Program: Execute a full CFC compilation (Charts -> Compile -> Entire Program). Confirm that the safety signature updates cleanly and the compiler warning 'ACK_REI is not interconnected internally' is eliminated.
Compile OS: Perform an OS compile to update the F_QUITES faceplate and WinCC control tags.

Verification

Verify fail-safe channel reintegration in the running system:

Simulate a wire break on an F-digital input channel. Confirm that the channel passivates (channel driver output Q = 0, PASS_OUT = 1) and the associated Safety Matrix Cause trips into the alarmed state.
Reconnect the wire to clear the physical fault. Verify that the channel remains passivated (PASS_OUT = 1), proving proper safety latching.
On the WinCC OS, click the central 'Reintegrate F-I/O' button linked to F_QUITES.
Confirm that F_QUITES.Q pulses, the channel driver depassivates (PASS_OUT = 0), and live field process values resume flowing into the Safety Matrix.
Verify that acknowledging the matrix faceplate clears any remaining Cause trip latches.

Limitations and Operational Precautions

Adhere to the following safety precautions:

Reintegration vs Trip Reset Distinction: Reintegrating a passivated F-I/O channel restores live signal evaluation, but does not automatically clear a latched Safety Matrix Cause or Effect; safety latch resets must be handled according to plant shutdown logic.
Never Tie ACK_REI Continuously High: Never hard-wire ACK_REI = 1; safety regulations mandate an active low-to-high positive edge transition to acknowledge cleared faults.
Safety Collective Signature: Adding or wiring F_QUITES modifies the safety program and changes the collective F-Signature, requiring formal safety review and re-certification.

Engineer FAQ

Does reintegrating an F-channel automatically reset a tripped Safety Matrix?

No. Channel reintegration restores live field measurements, but latched Safety Matrix Causes and Effects must be reset according to configured safety logic.

Why can't ACK_REI be permanently tied to logic 1?

Safety regulations (IEC 61508) mandate positive edge evaluation for reintegration to ensure an operator actively acknowledges that the fault was repaired.

Does interconnecting F_QUITES require a full CPU download in STOP?

If safety runtime groups are modified or new safety blocks are introduced, delta downloads are supported under S7 F-Systems provided the safety program compilation rules are followed.