Simulating Fail-Safe Analog Inputs and F_CH_AI Quality Bits with SIMIT in PCS 7

When simulating fail-safe analog input signals (e.g. from module 6ES7336-4GE00-0AB0) using SIMIT coupled to PCS 7, the 'F_CH_AI' block will passivate and output substitute values (QBAD = 1, QUALITY = 16#00) unless both the raw process value and the corresponding PROFIsafe Quality/Value Status bit are simulated. In PROFIsafe telegrams, each analog input word is paired with a status byte where Bit 7 represents the Quality bit (1 = Good). Additionally, if the virtual controller and SIMIT start asynchronously, the F-System communication watchdog may trip, requiring a virtual CPU restart and a positive edge on 'ACK_REI' to depassivate the channel.

Executive Summary

Virtual commissioning of safety-instrumented systems (SIS) in SIMATIC PCS 7 (V8.0 through V9.1) using SIMIT Simulation Platform requires simulating both process physics and PROFIsafe communication protocol semantics. When coupling SIMIT to S7-PLCSIM or SIMIT Virtual Controller (VC) to simulate fail-safe analog inputs (such as SM 336 F-AI 6x0/4..20mA HART - 6ES7336-4GE00-0AB0), engineers often find that analog values do not reach the user safety logic. The F-Channel driver F_CH_AI remains passivated with QBAD = 1. This article details the PROFIsafe telegram structure, Quality bit mapping in SIMIT, startup synchronization procedures, and channel reintegration acknowledgment.

Architecture and Fundamental Mechanics

Architectural Mechanics of Fail-Safe Analog Inputs in SIMIT and S7 F-Systems:

S7 F-Systems and PROFIsafe Protocol Foundations:
Fail-safe I/O communication does not rely on raw cyclic peripheral I/O alone. It encapsulates process data inside a PROFIsafe protocol telegram containing sequence numbers, CRC signatures, control/status bytes, and channel-level value status (Quality bits).
The S7 F-Systems channel driver F_CH_AI evaluates the incoming signal. If communication is interrupted, watchdog time (F_WD_TIME) expires, or the channel status indicates fault, the driver passivates: it forces V = 0.0 (or configured substitute value), asserts QBAD = 1, and sets QUALITY = 16#00.
Quality Bit / Value Status Mapping for F-AI:
In fail-safe binary inputs, setting the address plus 1 byte to 1 satisfies the channel status.
For fail-safe analog modules (e.g. 6ES7336-4GE00-0AB0), each analog channel consists of:
1. Process Value: 2 bytes (WORD / INT), e.g. EW 546.
2. Value Status / Quality Byte: Located in the module's diagnostic feedback area (or higher-order control bytes defined in HW Config). Bit 7 (Mask 16#80) represents valid signal quality (1 = Good, 0 = Bad).
In SIMIT, during HW Config import, SIMIT creates coupling signals for both the data word and the associated value status. If the Quality bit is left unmapped or forced to 0, F_CH_AI interprets the channel as defective.
Startup Asynchrony and Watchdog Trip:
When SIMIT and S7-PLCSIM launch, the virtual clock initialization may cause PROFIsafe telegram counters to lag. S7 F-Systems detects a discrepancy and passivates all F-modules.
Stopping and restarting the virtual CPU via SIMATIC Manager re-synchronizes the PROFIsafe sequence counter while SIMIT is running.
Once communication is healthy, F_CH_AI asserts ACK_REQ = 1. The channel remains passivated until a positive transition is applied to ACK_REI (Reintegration Acknowledgment).

Step-by-Step Implementation Procedure

Step-by-Step Procedure to Simulate Fail-Safe Analog Inputs in SIMIT:

Verify F-AI Module Configuration in HW Config:
- Open HW Config in SIMATIC Manager.
- Select module SM 336 F-AI 6x0/4..20mA HART (6ES7336-4GE00-0AB0).
- Review the configured I/O addresses (e.g. Input address 546..557) and PROFIsafe parameter block (F_source_address, F_dest_address, F_WD_TIME).
Import HW Config into SIMIT:
- In SIMIT, open the coupling configuration (SIMIT Virtual Controller or PLCSIM).
- Execute Import HW Config.
- Verify that SIMIT generates signals for the analog input word (e.g. IW546) and the associated status signals (_QI / Value Status).
Configure SIMIT Simulation Chart:
- Create a simulation chart in SIMIT.
- Connect your simulated physical process variable (e.g. 0–100% scaled to integer 0..27648) to input IW546.
- Connect a constant Boolean value TRUE (or bit mask 16#80) to the channel Quality/Value Status input signal in SIMIT to declare the channel valid and healthy.
Start Simulation and Resynchronize Virtual Controller:
- Start the SIMIT simulation run.
- In SIMATIC Manager, connect to S7-PLCSIM / Virtual Controller.
- If F_CH_AI displays QBAD = 1, toggle the virtual CPU operating switch to STOP, wait 2 seconds, and return to RUN-P.
- This flushes communication counters and establishes the PROFIsafe connection to SIMIT.
Execute Reintegration Acknowledgment (ACK_REI):
- In the PCS 7 CFC chart, inspect the F_CH_AI block.
- Confirm that ACK_REQ = 1 (reintegration requested).
- Apply a positive pulse (0 -> 1 -> 0) to ACK_REI (or trigger the global safety acknowledgment button on the OS faceplate).
- QBAD transitions to 0, QUALITY changes to 16#80, and the live analog value appears at output V.

Verification

Verification Procedure:
1. Driver Output Verification: In CFC Test Mode, open F_CH_AI. Verify that QBAD = FALSE, QUALITY = 16#80, and output V matches the engineering value corresponding to the SIMIT simulated raw word.
2. Simulation Dynamic Response: Change the simulated process variable in SIMIT (e.g. from 20% to 80%). Verify that F_CH_AI.V updates smoothly in real time without lag.
3. Passivation Fault Simulation: Force the SIMIT Quality bit to FALSE. Verify that F_CH_AI immediately passivates (QBAD = TRUE, V falls to fail-safe substitute value). Restore the bit to TRUE and pulse ACK_REI; verify clean depassivation.

Limitations and Operational Precautions

Operational Precautions and SIMIT Safety Simulation Limits:
- Watchdog Tuning (F_WD_TIME): In virtual simulation, high PC CPU utilization can cause simulation execution jitter. If PROFIsafe communication drops periodically, temporarily increase F_WD_TIME in HW Config (e.g. from 150ms to 500ms) for the simulation session.
- Reintegration Logic: Never tie ACK_REI permanently to TRUE (1); the safety block strictly requires a low-to-high edge transition to execute reintegration.
- Non-Certified Safety Testing: SIMIT simulation is an engineering validation and training tool; it does not replace formal on-machine safety validation required by IEC 61508 / IEC 61511.

Engineer FAQ

Why does F_CH_AI show QBAD = 1 when SIMIT is writing an analog value?

Because the fail-safe channel is passivated. S7 F-Systems requires both the raw value and the PROFIsafe Quality/Value Status bit to be set to valid (Good), followed by an acknowledgment on ACK_REI.

What value indicates a Good signal quality on F_CH_AI.QUALITY?

A hexadecimal value of 16#80 indicates Good quality in PCS 7 F-systems.

Why did restarting the virtual CPU fix the analog communication in SIMIT?

Starting SIMIT and PLCSIM at slightly different moments causes PROFIsafe telegram sequence number mismatches. Restarting the CPU resynchronizes the PROFIsafe session while SIMIT is running.

What is the function of the ACK_REI input on F_CH_AI?

ACK_REI accepts a positive edge signal to acknowledge and depassivate the fail-safe channel after a fault has cleared.

What module number is the fail-safe analog input module discussed here?

The module is the SM 336 F-AI 6x0/4..20mA HART (6ES7336-4GE00-0AB0).

Technical References

Related Tags

SIMIT Simulation
S7 F-Systems
F_CH_AI
PROFIsafe
Fail-Safe Analog

20 respuestas

Simulating Fail-Safe Analog Inputs and F_CH_AI Quality Bits with SIMIT in PCS 7