Troubleshooting Failsafe F_CH_DI Output Zero When Input Value Is True in S7-400FH Systems

In SIMATIC S7-400FH safety systems, a failsafe digital input driver (F_CH_DI) holding its output pin Q at 0 while the physical or forced input VALUE is 1 indicates channel passivation or pending safety reintegration. Fail-safe channel drivers comply with IEC 61508 / IEC 61511 and substitute safe values (0) whenever a hardware fault, wire break, discrepancy error, or communication glitch occurs (QBAD = 1). If the fault has cleared physically, Q remains 0 until the driver receives a rising edge on the reintegration acknowledgment pin (ACK_REI) while ACK_REQ = 1. Inspect QBAD, ACK_REQ, and the module diagnostic buffer to restore operation.

Fail-Safe Architecture and Passivation Mechanism in S7 F Systems

SIMATIC S7-400FH controllers execute safety-instrumented functions (SIF) using the S7 F Systems library. Unlike standard APL channel drivers that pass raw signals directly, fail-safe channel drivers (F_CH_DI, F_CH_DO, F_CH_AI) enforce fail-safe behavior. Under safety standards (IEC 61508 SIL3 / EN ISO 13849-1 PLe), any detected fault must force the process into a predefined safe state—typically zero (0 / de-energized to trip).

When a hardware discrepancy, wire break, short circuit, sensor power loss, or PROFIsafe communication frame CRC error is detected, the F-System immediately passivates the affected channel or the entire I/O module. During passivation, the driver substitutes the configured safe value (SUBS_V, default FALSE) at output Q, completely ignoring the incoming field signal on VALUE.

Diagnostic Output Pins on F_CH_DI Driver Blocks

To determine why Q remains 0 despite VALUE = 1, engineers must inspect the diagnostic outputs of F_CH_DI in online test mode:

QBAD (Quality Bad): When QBAD = 1, the channel is passivated. The output Q is clamped to the fail-safe value.
ACK_REQ (Acknowledgment Request): Asserts 1 when the underlying hardware fault has physically cleared, but the safety logic requires a deliberate operator acknowledgment before returning to process data.
ACK_REI (Reintegration Acknowledgment): An input pin that accepts a rising edge (0 -> 1) from an OS faceplate button or CFC logic to reintegrate passivated channels.
QUALITY: Evaluates PROFIsafe channel data quality (16#80 = Valid, 16#40 = Degraded/Passivated).

Fail-Safe Diagnostic Matrix and Status Pin Interpretations

The table below details diagnostic pin combinations, controller states, and required maintenance actions for F_CH_DI:

QBADACK_REQQUALITYSafety Operating StateRequired Engineering Action1016#40 / 00Active Fault / Passivated: Physical wire break, sensor power fault, or discrepancy timer active.Repair field wiring; inspect ET 200M/SP module diagnostic buffer.1116#40Fault Cleared / Pending Reintegration: Hardware is healthy, but safety runtime awaits operator reset.Issue a positive pulse (0 -> 1) to parameter ACK_REI.0016#80Healthy Process Mode: Channel operating normally; Q tracks VALUE.Normal operation; no action required.0016#60Simulation Mode Active: QSIM = 1; output driven by manual simulation value.Disable simulation mode (SIM_ON = FALSE) for live production.

Step-by-Step Troubleshooting and Channel Reintegration Procedure

Inspect Driver Outputs in CFC Test Mode: Open the CFC chart containing the F_CH_DI block and activate test mode. Check the status of QBAD and ACK_REQ.
Check Diagnostic Buffer: If QBAD = 1 and ACK_REQ = 0, open SIMATIC Manager -> HW Config -> select the target ET 200M or ET 200SP F-module -> select PLC -> Module Information -> Diagnostic Buffer. Identify the exact fault (e.g., Short circuit to L+, Wire break, or Discrepancy error on channel pair).
Clear Field Hardware Fault: Inspect field termination, sensor power supplies, and safety barrier fuses. Once the physical condition is rectified, the red SF / F-LED on the I/O module turns off.
Verify ACK_REQ Assertion: Check F_CH_DI in CFC: once the fault clears, ACK_REQ will assert 1, indicating readiness for reintegration.
Execute Reintegration Acknowledgment: Send a rising edge pulse (0 -> 1) to the ACK_REI pin (either via the standard PCS 7 F-faceplate operator acknowledgment button or a dedicated reset tag). QBAD immediately drops to 0, ACK_REQ drops to 0, and output Q transitions to 1 matching input VALUE.

Verification

Verify fail-safe channel restoration through the following milestones:
1. In CFC test mode, confirm that F_CH_DI.QBAD = FALSE and F_CH_DI.ACK_REQ = FALSE.
2. Confirm that output Q reflects input VALUE precisely (VALUE = 1 results in Q = 1).
3. Verify that the safety siren or downstream safety actuator responds to the process logic output.
4. In the WinCC Alarm Logging list, verify that safety alarm messages (Channel Passivated, Module Passivated) transition to cleared and acknowledged status.

Limitations and Operational Precautions

Never permanently tie ACK_REI high (TRUE) or configure automatic cyclic pulsing in an attempt to bypass manual acknowledgment. Automatic unconditional reintegration violates safety standard regulations (IEC 61511 / NFPA 85/86) because it can cause safety actuators to restart unexpectedly upon field fault clearance. Always ensure reintegration acknowledgment is initiated by qualified operating personnel following verification of field safety conditions.