Resolving F-Analog I/O Access Error in S7-400H PLCSIM V5.4

1. Problem Summary

On a Siemens SIMATIC S7-400H fail-safe (F) station built around a 6ES7 414-5H CPU and the SM 336 F-Analog Input module (6ES7 336-4GE00-0AB0), engineers routinely see "I/O access error" diagnostic events on every F-analog channel when the project is run inside S7-PLCSIM V5.4 + SP6. Digital F-signals (F-DI/F-DO) usually simulate correctly, but the F-AI block raises a peripheral-access fault on the configured addresses, e.g. IW 400 and IW 402. The fault appears even though:

• The hardware configuration in STEP 7 V5.4 shows the F-AI module at the expected slot.
• The CFC chart uses the same logical addresses (IW 400, IW 402) for the F-Analog input blocks (F-CH_AI / F-AI from the S7 F-Systems library).
• Download completes without warnings.

The same project loads cleanly into a real S7-400H CPU and reads the F-AI channels without peripheral faults, which confirms the fault is simulation-related, not application-related.

2. Affected Hardware and Software Components

The 6ES7 336-4GE00-0AB0 is the only S7-400 F-analog input module; it provides 6 channels of 16-bit resolution, supports 0..10 V, ±10 V, 0/4..20 mA, and RTD/PTC (channel-group dependent) and is intended exclusively for safety-related operation in S7-400F / S7-400FH systems. Its data exchange with the F-CPU is wrapped in the PROFIsafe protocol (PROFIsafe V1 profile on PROFIBUS-DP), which is the root cause of the PLCSIM error.

3. Root Cause 1 — PLCSIM V5.4 Does Not Emulate PROFIsafe

S7-PLCSIM V5.4 emulates the S7-400 CPU, the standard process image, OB1/OB35, bit memories, timers, counters, FBs/FCs/DBs, and the basic DI/DO/DM read/write paths. It does not implement the PROFIsafe state machine on its PROFIBUS-DP master side. When the F-CPU polls an F-slave such as the 6ES7 336-4GE00-0AB0 through the F-host interface, the F-runtime group inside the F-CPU evaluates the F-peripheral data via the F-Periphery-DB. The simulation returns either:

• A "passivated" channel status (PASSIVE = 0) for every F-AI channel, or
• A peripheral-access fault (SF / BF / "I/O access error" in the diagnostic buffer, OB122 priority-class error) when the F-CFC block reads the F-peripheral word directly.

The official Siemens FAQ "What is the difference between S7-PLCSIM and a 'real' automation system?" documents that S7-PLCSIM has functional restrictions for fail-safe I/O. Digital F-modules frequently appear to work because the CFC chart may not be exercising the F-I/O access path strictly (e.g. passivation is tolerated, or the test routine is reading from a mirror), but the analog F-modules fail because the F-CPU evaluates every channel value against the F-monitoring time and the iParameter signature stored in the F-Periphery-DB.

4. Root Cause 2 — Direct I/O Access vs. F-Periphery DB

The second contributor is the access mechanism used in the CFC chart. In an F-program the only legal way to read an F-input is through the F-Periphery-DB created by STEP 7 F-Systems, not through a standard L IW 400 / IW 402 load. If the CFC chart has been wired to a standard analog-input driver block (e.g. CH_AI from the CFC library, or a user-written FB) and that block is inside the F-runtime group, the F-OB will report a "non-F-capable I/O access" and passivate the channel.

Correct wiring for an F-AI channel in CFC:

1. Compile the HW Config so that the F-AI module generates an F-Periphery-DB (e.g. DB 1024 – "F-Periphery-DB SM336").
2. Insert the F-CH_AI block (or F-AI channel driver) from the S7 F-Systems library into the F-runtime group.
3. Connect the channel input to the symbolic name of the value in the F-Periphery-DB (e.g. "F-Periphery-DB".AI0_VALUE or the corresponding structure element), not to the process image address IW 400.
4. On the F-CH_AI block, set CH_TAG = the symbolic channel reference, and ensure SAFETY_MODE = 1 (or 2 for 1oo2 voting).

5. Diagnostic Procedure

Run the following checks in order before changing any code. They cost less than five minutes and isolate whether the fault is PLCSIM-related or configuration-related.

5.1 Inspect the S7-PLCSIM diagnostic buffer

1. In PLCSIM, open PLC > Diagnostic Buffer after the F-runtime group has started.
2. Look for event IDs 0x39xx (I/O access error), 0x35xx (PROFIsafe fault), and OB122 entries.
3. Note the slot and channel number — it must match the physical slot of the 6ES7 336-4GE00-0AB0.

5.2 Verify the F-Periphery-DB exists and is updated

1. In STEP 7, open the F-Periphery-DB created for the SM 336 (HW Config > F-AI module > Properties > "F-Periphery-DB").
2. Confirm the DB number (typical range 1024…2047), the symbolic name, and that it is mapped in the CFC chart.
3. Online in PLCSIM, open Monitor/Modify > Data Block, enter the DB number, and confirm that the value in VALUE for the relevant channel is reading 0x0000 or 0x7FFF (substituted value) rather than a real measurement.

5.3 Check F-monitoring time and PROFIsafe address

1. Open HW Config, double-click the F-AI module, switch to the Safety tab.
2. Record:
   • F-monitoring time (default 3000 ms, valid range 1…65535 ms)
   • F-source address (F-CPU PROFIsafe address, default 0x0001 + slot offset)
   • F-destination address (F-module PROFIsafe address, e.g. 0x0003)
3. Confirm the F-monitoring time in the F-Periphery-DB matches the module. A mismatch is logged as a CRC/sign-check error and passivates the channel.

5.4 Confirm F-runtime group signature

1. Open the safety program properties and recompile the F-runtime group.
2. Compare the printed collective signature with the value stored in the F-CPU. A signature mismatch causes a global F-stop and appears as I/O access error in the diagnostic buffer.

6. Solution A — Move the Test to a Real S7-400H Rack

The only method that fully validates PROFIsafe behavior end-to-end is to download the project to the real S7-400H station. The procedure is:

1. Connect the programming PC to the S7-400H CPU (MPI/DP or Ethernet via CP443-1).
2. Set the CPU to STOP.
3. Download the HW Config, the standard program, and the F-program separately (the F-program is a separate download object in STEP 7 V5.4 — right-click the F-station > Download F-Program).
4. Re-enter the F-CPU password; STEP 7 will display the collective signature for the F-program — note it in the safety logbook.
5. Switch the CPU to RUN; the F-runtime group de-energises within the F-monitoring time (≤ 3 s) and the F-AI channels become valid.

7. Solution B — Use SIMIT Virtual Controller

For a fully offline test that still exercises the F-I/O path, SIMIT with a "Virtual Controller" is the recommended replacement for PLCSIM. SIMIT emulates the F-CPU and a virtual PROFIsafe slave:

1. Install SIMIT V8.2 or later with the option Virtual Controller.
2. Import the STEP 7 V5.4 project (SIMIT reads the HW Config and the symbol table directly).
3. Add a virtual PROFIsafe slave model for the 6ES7 336-4GE00-0AB0 from the SIMIT component library.
4. Couple the simulation: SIMIT Virtual Controller <-> CFC charts through the same S7-PLCSIM interface (MPI/TCP) used by STEP 7.
5. Drive the analog input values from a SIMIT chart (e.g. a 4..20 mA ramp) and observe the F-CH_AI block response.

SIMIT also supports the H-feature and the entire S7 F-Systems library, so F-runtime group passivation, de-passivation, and PROFIsafe V2 monitoring are validated before going to the real rack.

8. Solution C — Keep PLCSIM and De-Scope the F-AI Test

If neither real hardware nor SIMIT is available, you can keep PLCSIM and split the test into two layers:

1. Standard logic layer — runs inside PLCSIM without modification. Verify the standard part of the CFC chart (scaling, limit-checking, mode selection).
2. F-safety layer — test on the real S7-400H rack. Compile the F-runtime group, download it, and check that:
   • All 6 channels of the 6ES7 336-4GE00-0AB0 de-passivate within 3 s of CPU-RUN.
   • Disabling one channel (cut the wire) causes the F-CPU to passivate that channel only.
   • The F-monitoring time fault is raised if PROFIsafe telegrams are stopped.

This is the practical path most commissioning engineers take: PLCSIM for the standard logic, real hardware for the F-layer.

9. Solution D — Verify the F-Periphery-DB Wiring (CFC)

If the problem persists on the real rack, the cause is almost always a wiring mistake in CFC. Apply this checklist:

1. Open the F-CFC chart; switch to Compile > Check Consistency. STEP 7 reports any standard blocks sitting inside the F-runtime group.
2. For every F-CH_AI block, expand the input VALUE / CH_TAG and confirm the connection points to the F-Periphery-DB symbol, e.g. "F_Peri_DB_SM336".AI[1].VALUE.
3. Open the F-Periphery-DB; confirm the value-array length matches the channel count (6 entries for 6ES7 336-4GE00-0AB0).
4. Re-compile the F-program; the F-collective signature must be regenerated and downloaded.

A typical mistake to look for is a residual wiring from a previous standard project: IW 400 and IW 402 may have been used with a standard CH_AI block before the station was converted to F. After the conversion, those wires must be re-pointed to the F-Periphery-DB symbols; otherwise the F-OB raises an "F-I/O access fault".

10. Verification Procedure

Whichever path you take, the following four verifications must all pass before the F-station is released for production:

For V4, drive the test by physically disconnecting the PROFIBUS-DP connector to the SM 336, or by entering the F-monitoring time to a temporary 100 ms value, observing the F-stop, and reverting to 3000 ms. The temporary value must be restored and the F-program re-compiled and downloaded — the F-collective signature changes whenever the F-monitoring time is touched, so the safety logbook must be updated.

11. Preventive Configuration Tips

• Always run the S7-400H F-CPU on a dedicated PROFIBUS-DP subnet for F-I/O. Mixing standard DP slaves and F-slaves on the same segment works, but doubles the diagnostic effort because every standard slave restart can look like a PROFIsafe fault during the first 3 s of CPU RUN.
• Set the F-monitoring time to 3 s (default) for the 6ES7 336-4GE00-0AB0. Lower values reduce fault-detection time but increase the probability of nuisance passivation on a noisy bus.
• Keep the F-Periphery-DB number above 1024; lower DB numbers are sometimes used for standard projects and can collide with re-imported archives.
• Stamp every download of the F-program with a new collective signature, and write the signature into the safety acceptance report. This is required by IEC 61508 / IEC 61511 SIL verification.
• Do not use PLCSIM for the final F-acceptance test. The official Siemens fail-safe modules manual explicitly states that the simulator does not cover all F-runtime conditions.

12. Frequently Asked Questions