F-Timer in PCS 7: Configuring Failsafe Timers and Logic Blocks

Engineers designing a failsafe program in Siemens PCS 7 frequently ask whether the internal logic (timers, AND/OR) must be implemented with F-blocks from the F-Library, or whether standard IEC 61131-3 blocks can be inserted into an F-program. The short answer is that any signal that contributes to a safety decision, including time-qualified conditions and combinatorial logic, must be processed with certified failsafe blocks. Standard blocks can coexist on the F-CPU, but if a standard block's output feeds a safety function the F-program will fail the compilation check. This reference covers the F-Timer family (F_TON, F_TOF, F_TP), the F-AND and F-OR logic blocks, the rules that govern an F-program's compilation, and a worked burner-management example.

1. F-Block Architecture in S7 F/FH Systems

An F-program in S7 F/FH is a protected subset of the STEP 7 / PCS 7 user program that is executed redundantly and diversely inside the F-CPU (e.g., S7-300F, S7-400F/FH, ET 200SP F-CPU, or the AS 410 / AS 410E in PCS 7). The F-runtime is invoked by the safety program block FB 215 "F_RTG" (in older libraries: FB 150) and runs in a separate, priority-elevated cyclic task. Two independent channels (channel A and channel B) execute the F-code on the same CPU using different instruction sets; the result is compared every cycle, and any divergence places the F-CPU in STOP.

The F-Library is the only sanctioned source of F-blocks. It contains input/output channels (F-DI, F-DO, F-AI), voting and routing blocks, and the logic/timer family covered here. Each F-block is delivered with a Siemens digital signature; modifying the block instance, removing its signature, or wiring its ACK_NEC, ACK, or QBAD signals incorrectly is a common reason for an F-program to be rejected at compile time.

2. F-Timer Family: F_TON, F_TOF, F_TP

The F-Library exposes three timer primitives, each wrapped in the same dual-channel execution and signature logic as the I/O blocks. They are functionally analogous to the IEC 61131-3 TON, TOF, and TP, but they must not be interchanged with standard SFB 4 / SFB 5 instances inside an F-program.

2.1 F_TON — F-Timer On-Delay

Used to delay the rising edge of a safety-critical signal. A typical burner-management use case is the pre-purge timer: the air-flow proven signal must be present continuously for a defined period before the pilot valve is enabled. If the proof is lost, the timer must reset immediately and the output must drop to 0 without delay.

2.2 F_TOF — F-Timer Off-Delay

Used to delay the falling edge. Common in flame-failure-after-ignition (FFAI) logic, where a confirmed flame loss does not open the main fuel valve instantly; the controller allows a short grace period (e.g., 1–2 s) to absorb flame-sensor flicker, then trips.

2.3 F_TP — F-Timer Pulse

Generates a fixed-width pulse on a rising edge. Used for valve-purge sequences, where a single proof input triggers a defined actuation window.

3. F-AND and F-OR Logic Blocks

F-AND and F-OR are the safety equivalents of the standard CFC boxes AND and OR. They evaluate up to 8 (or 16, library-version-dependent) BOOL inputs and produce a single safety output. Crucially, they also enforce the input-source check: every input pin must be wired to a safety-tag (F-DI, F-DO, F-AI, or another F-block's Q output). Wiring an input to a standard DB tag causes the safety program generator to flag a "non-F-tag at safety input" error.

For negated logic, the F-Library provides F_NOT (or the inverted-input option on F-DI). Do not use a standard NOT box in CFC with an F-tag input; the compiler will reject the net.

4. F-Program Compilation Rules

PCS 7's safety program generator (the F-Compiler) walks every net in the F-chart and checks three things: signature integrity, tag provenance, and reachability of the safety output.

1. Signature integrity: Every F-block instance must carry an unmodified Siemens signature. Re-compiling the F-Library in source form voids the signature and fails the F-compile step.
2. Tag provenance: Every input to an F-block must resolve to an F-tag, an F-shared-DB, or a constant. Mixing in a standard DB BOOL fails the check.
3. Reachability / dead-code analysis: The F-Compiler enforces that every F-tag in scope is consumed by at least one F-block whose output is wired to a safety output (F-DO, F-AO, or passivation driver). A floating F_AND whose Q is unused will produce a warning, and in many PCS 7 versions, an error.

5. Application: Burner Management F-Program

The motivating use case from the field report is a burner management system (BMS). A typical EN 267 / NFPA 85 burner sequence is:

1. Start permissive: Master enable, no flame, no lockout, fuel valves proven closed.
2. Pre-purge: Combustion-air fan ON, air-flow proven for ≥ T_purge (typically 30–60 s).
3. Pre-ignition: Ignition transformer energised for T_pi.
4. Pilot trial: Pilot valve opens; pilot flame must be proven within T_pilot (e.g., 3 s).
5. Main trial: Main fuel valve opens; main flame must be proven within T_main (e.g., 5 s).
6. Run: Both flame signals must be continuously present. Loss of either flame with re-ignition failure = lockout.

Every timer in the above sequence is a safety decision. The F_TON for pre-purge, the F_TOF for flame-failure grace, and the F_AND gating the main fuel valve must therefore be F-blocks. A standard SFB 4 TON on a standard DB tag will compile in the standard chart but the F-Compiler will refuse to fold it into the safety program.

5.1 Worked netlist (CFC, conceptual)

[F-DI "Perm_Master_OK"]      --+
                                |
[F-DI "Air_Flow_Proven"]       --+--> [F_AND "Prepurge_Permit"] --> [F_TON PT=T#30s] --> [F_AND "Ignition_OK"]
                                |       IN1:Perm_Master_OK          PT: T#30s                IN1:Prepurge_Permit.Q
                                |       IN2:Air_Flow_Proven                                   IN2:[F-DI "Pilot_Valve_Closed"]
                                |       Q:Prepurge_Permit.Q
                                |
[F-DI "Flame_Pilot"]          --+--> [F_AND "Pilot_Stable"] --> [F_AND "Main_Enable"] --> [F-DO "Main_Fuel_Valve"]
[F-DI "Flame_Main"]           --+       IN1:Flame_Pilot.Q                IN1:Pilot_Stable.Q
                                        IN2:Flame_Main.Q                  IN2:[F-DI "Master_OK"]
                                                                             IN3:[F_TOF PT=T#1s]      (FFAI grace)

In a real PCS 7 chart each [F_X] element is an instance of the corresponding F-block from the F-Library, and the interconnections are CFC lines carrying F-tags, not standard DB tags.

6. Implementation Procedure

6.1 Prerequisites

• PCS 7 V9.0 SPx (or your installed version) with the matching F-Library installed in SIMATIC Manager / TIA Portal.
• Safety program matrix approved by the TÜV / certifying body (E.g., SIL-Capability Calculation spreadsheet showing PFHd < target).
• F-CPU type selected (e.g., AS 410E Single Station or AS 410F-H redundant pair).
• PROFIsafe addresses set on each F-I/O module.
• Operator HMI / WinCC faceplate design for ACK and QBAD display.

6.2 Step-by-step

1. Insert F-chart. In the PCS 7 master data library, open the S7 program, right-click the Charts folder, and select Insert New Chart > F-chart. Name it (e.g., F_BURNER1).
2. Drop F-I/O blocks. Drag an F-DI for each hardwired input (master enable, air-flow switch, pilot-flame UV, main-flame UV) and an F-DO for each safety output (pilot valve, main fuel valve, ignition transformer).
3. Insert F_TON / F_TOF / F_TP. From the F-Library, place the timer primitive in the chart. Set PT to the engineered value. The F-Compiler validates the time constant against the F-OB period.
4. Insert F_AND / F_OR. Use F_AND for the pre-purge-and-pilot-stable coincidence, and F_OR where a permissive can be asserted by more than one path (e.g., manual reset from HMI or automatic reset after ACK_NEC clears).
5. Wire outputs to F-DO. The Q of the final F_AND feeds the L+ input of the F-DO. The Q of the F-DO is the safe-state driver for the field contactor.
6. Wire QBAD and ACK to the HMI. The QBAD flag drives the operator "passivated" alarm. The ACK input is pulsed by the operator's "Reset" button (rising-edge, with debounce).
7. Compile F-program. Charts > Compile (F-program). Resolve every error before continuing; warnings must be justified in the safety lifecycle file.
8. Download to F-CPU. Use the "Download F-program" function, which writes both the standard program and the signed F-chart.

7. Verification and Acceptance Test

The S7 F/FH Systems — Acceptance Test checklist (chapter 7 of the manual) requires that every F-Timer value, every F-AND / F-OR input, and every F-DI / F-DO be physically exercised. For the burner example:

Document each row in the safety acceptance test report; a signed copy is part of the IEC 61511 / IEC 61508 SIL verification dossier.

8. Common Pitfalls and Troubleshooting

9. Interoperability with Third-Party F-Relays

When a field device has its own safety relay (for example, a Rockwell Automation CU1 Failsafe Timer for a guard interlock, documented in CU1 Failsafe Timer Installation Instructions, publication CU1-IN001), the device's safe output becomes a standard dry contact feeding an F-DI. The PCS 7 F-program then processes the contact through an F-DI, optionally through an F_TON to debounce, and into the F_AND voting. Mixing vendors is acceptable as long as every safety decision that affects the F-CPU is made inside an F-block, and the field device's SIL capability is documented in the safety lifecycle file.

10. Field-Proven Caveats

• PFHd budget: Every F-block contributes a probability of dangerous failure per hour to the subsystem PFHd sum. The F-Library datasheets (e.g., SIL-Capability Calculation for the F_TON family) quote single-block PFHd in the order of 1×10⁻⁹ / h. A pre-purge + ignition + main-fuel sequence with three F_TON, two F_AND, one F_OR, four F-DI, two F-DO will land in the low single-digit ×10⁻⁸ / h — well within SIL 2 (10⁻⁷) and below SIL 3 (10⁻⁸) for non-redundant topology.
• Re-integration storm: After a global passivation (e.g., F-CPU warm restart), all F_AND / F_OR blocks raise ACK_NEC simultaneously. If the HMI is configured to latch ACK, the operator may need to acknowledge dozens of blocks. Engineer the HMI to issue a single Reset All that pulses the ACK line of every F-block in a controlled sequence.
• Time synchronisation: For redundant F-CPU pairs (S7-400FH), the F-OB period must be identical on both CPUs. Drift larger than 1× the F-OB period can produce spurious channel-mismatch STOPs.
• Library version drift: A PCS 7 upgrade can change the F-Library version. The F-Compiler will refuse to load a chart compiled against an older signature. The migration path is to download the new F-Library, re-compile the F-charts, re-execute the acceptance test, and re-issue the safety lifecycle dossier.

11. Quick-Reference Block Summary

12. Frequently Asked Questions