Simulating Fail-Safe Channel Drivers and Safety Parameters in SIMATIC S7 F-Systems

In SIMATIC S7 F-Systems, you cannot simulate fail-safe signals by manually overwriting internal driver parameters such as CHADDR, CH_INF, or raw hardware quality codes. The PCS 7 Driver Generator automatically manages these private interconnects to guarantee SIL 3 safety integrity. To simulate safety logic in S7-PLCSIM or during offline testing, activate the built-in simulation mechanism on fail-safe channel driver blocks (such as F_CH_DI FB346 or F_CH_DO FB347) by setting SIM_ON = TRUE and driving the simulated process value via SIM_I, or configure the safety program under F-Tool simulation mode.

Architecture of Fail-Safe Driver Blocks and Parameter Protection

In SIMATIC S7 F-Systems, fail-safe channel driver blocks—such as F_CH_DI (FB346), F_CH_DO (FB347), and F_CH_AI (FB348)—bridge physical fail-safe I/O modules (such as ET 200M fail-safe modules 6ES7326-1BK02-0AB0 or 6ES7326-2BF10-0AB0) to the fail-safe application logic running in an S7-400H/F controller (e.g., 6ES7410-5HX08-0AB0).

When you compile the CFC chart with the Generate Module Drivers option enabled, the PCS 7 driver generator automatically creates diagnostic blocks (F_MOD_DG, F_PS_12) and interconnects private parameters on each channel driver block. Parameters such as CHADDR (hardware channel physical base address), CH_INF (internal module channel diagnostic info), and SUB_1 / SUB_2 contain CRC signatures, Profisafe communication sequence numbers, and driver diagnostic pointers.

These internal inputs are protected by safety compiler checksums. If an engineer attempts to manually unlink, force, or overwrite CHADDR or CH_INF, the F-Compiler detects a safety program integrity violation during compilation, generating error messages and refusing to generate safety runtime groups. Direct manipulation of internal driver interconnections violates safety certification standards under IEC 61508 / IEC 61511.

Fail-Safe Channel Driver Parameters and Simulation Interface

The S7 F-Systems library provides dedicated, TÜV-certified simulation parameters on all standard fail-safe channel driver blocks. Modifying these supported parameters allows full functional testing in S7-PLCSIM without compromising safety checksums or creating compilation faults.

Parameter NameData TypeI/O CategoryDescription and Simulation UsageVALUEBOOL / REALOutputSafe process output value transferred to user safety logic.QUALITYWORDOutputFail-safe signal quality code (16#80 = Good, 16#48 = Simulated, 16#00 = Bad/Passivated).SIM_ONBOOLInputEnables software simulation mode when set to TRUE. Disconnects physical hardware reading.SIM_IBOOL / REALInputInjected simulation value applied to VALUE when SIM_ON = TRUE.CHADDRDINT / WORDInput (Hidden)Hardware channel diagnostic address generated by driver generator. Never edit manually.CH_INFDWORDInput (Hidden)Private channel diagnostic structure. Managed exclusively by Generate Module Drivers.PASS_ONBOOLInputManual passivation command. When TRUE, forces safe default value (SUBS_V).SUBS_VBOOL / REALInputFail-safe substitute value output during channel fault or passivation.ACK_REIBOOLInputAcknowledgement input required to reintegrate channel after passivation clearance.

Table 1: Key functional and simulation parameters of S7 F-Systems channel driver blocks.

Procedure for Simulating F-Channel Drivers in S7 F-Systems and S7-PLCSIM

To simulate safety inputs without connected physical ET 200M/ET 200SP F-modules:

Open the Safety CFC Chart:
* Navigate to the CFC chart containing the F_CH_DI or F_CH_AI instance in SIMATIC Manager.
* Open the block properties and ensure SIM_ON and SIM_I are configured as visible parameters in CFC.
Configure Simulation Mode:
* Connect a test control signal or set the default value of SIM_ON to TRUE.
* Set SIM_I to the desired test input state (TRUE or FALSE for digital, engineering value for analog).
Compile Safety Program:
* Execute Chart > Compile > Changes Only in CFC. Ensure the F-Compiler generates the safety collective signature successfully.
Download to S7-PLCSIM:
* Open S7-PLCSIM and load the controller hardware configuration and S7 safety program.
* Verify that the F-CPU transitions to RUN mode.
Manipulate Test Signals:
* Toggle SIM_I directly in CFC test mode or via S7-PLCSIM variable table.
* Observe that VALUE updates according to SIM_I, while QUALITY outputs status 16#48 (Simulated Good) instead of passivating the channel.

Handling Quality Codes and Passivation During Offline Verification

In standard operating conditions without connected physical I/O racks, S7 F-Systems detects a Profisafe communication timeout (F-Monitoring time elapsed) and automatically passivates all unreached I/O channels. When passivated, the driver sets QUALITY = 16#00 and outputs SUBS_V (typically 0 or FALSE).

When SIM_ON is activated:
* The channel driver bypasses the physical hardware watchdog and module diagnostics.
* Output QUALITY reports 16#48 (Simulation active, valid quality).
* If downstream safety blocks (such as safety voter blocks or emergency stop logic) evaluate the QUALITY word, verify that the downstream logic accepts simulated status (16#48) without triggering unwanted safe state shutdown trips.
* When returning the project to production, ensure all SIM_ON parameters are reset to FALSE before conducting commissioning on the live controller hardware.

Verification

To confirm proper simulation behavior:

Open CFC in test mode (Test > Test Mode) and switch on CPU monitoring.
Inspect the F_CH_DI block: verify that parameter SIM_ON is TRUE.
Set SIM_I = TRUE and confirm that output VALUE immediately switches to TRUE.
Inspect output QUALITY: verify the hex value is 16#48 indicating active simulation.
Set SIM_I = FALSE: confirm VALUE transitions to FALSE.
Set PASS_ON = TRUE: confirm that the channel immediately passivates and VALUE returns to SUBS_V (FALSE), confirming priority of passivation logic over simulation.

Limitations and Operational Precautions

Never attempt to edit hidden system parameters (CHADDR, CH_INF, SUB_1, SUB_2); manual editing breaks the F-Signature and will abort safety compilation.
S7-PLCSIM simulates S7-400 F-CPUs (such as CPU 410-5H 6ES7410-5HX08-0AB0 or CPU 417-4F 6ES7417-4HT14-0AB0) for logic verification, but cannot validate physical Profisafe cycle timing or network latency.
Ensure all simulation inputs (SIM_ON) are decommissioned and reset to FALSE prior to downloading safety code to a running production controller.

Engineer FAQ

Why does F1 on the block show no description for CHADDR or CH_INF?

Siemens S7 F-Systems documentation and context help (F1) deliberately conceal or mark internal driver interconnection inputs as system-managed. These inputs are reserved exclusively for the PCS 7 Driver Generator (Generate Module Drivers) to link module diagnosis and safety telemetry. Siemens does not allow end users to configure or alter these inputs.

Can I simulate fail-safe blocks without modifying CFC charts?

In S7 F-Systems, channel drivers require SIM_ON = TRUE to accept simulated values. Alternatively, you can use dedicated simulation software suites such as SIMIT Simulation Platform, which interfaces with S7-PLCSIM or Virtual Controller (VC) to simulate Profisafe telegrams at the I/O bus level without altering CFC chart parameters.

What happens if I try to write to CHADDR via a variable table (VAT)?

Writing to CHADDR or internal fail-safe DB addresses via VAT or user scripts causes safety checksum mismatch faults in the F-CPU or is rejected by the CPU operating system, triggering an F-STOP or F-Shutdown event due to data corruption detection.