Resolving F-Shared DB Missing Error on CPU 412-3H S7 F Systems

Problem Overview

A redundant SIMATIC S7-400H station built around two CPU 412-3H modules (6ES7412-3HJ14-0AB0 or later) loses its safety program after a power recycle, and the subsequent download via SIMATIC Manager (STEP 7 V5.5 / V5.6) fails with the diagnostic message:

"Fail-safe blocks cannot be downloaded to the F-CPU because the F-shared DB does not exist in the safety program. Do you want to download the selected standard blocks to the F-CPU?"

Observed side effects once the message is acknowledged with Yes:

• F-DI modules report hardware OK (green SF/ON LEDs, no group fault) but every input bit reads 0 in the VAT.
• The HMI shows #### with unknown status on every safety tag.
• In HW Config, CPU Properties → Protection → "CPU contains safety program" is already checked.
• A re-compile of the S7 program does not regenerate the F-shared DB.
• Choosing Edit Safety Program in SIMATIC Manager returns:

  "'S7 F Systems' was not found. 'S7 F Systems' is required for editing the safety program. Please install it on your PC/PG."

Only the standard user program reaches the F-CPU; the safety portion of the program never lands. The classic workaround of copying the offline S7_PRG container to the Flash Memory Card (MC) on a Siemens Field PG (PG 740/760, Field PG M4) and inserting it into the CPU boots cleanly, but the online download path remains broken and the next power-cycle will again drop the safety portion.

Root Cause Analysis

Two independent defects combine to produce the symptom tree. Both must be fixed before the download can be made reproducible.

Defect 1 — Wrong F-toolset installed on the programming device

The engineering station carries S7 Distributed Safety (package F-FB / F-FC library for S7-300F / S7-400F in factory automation) but not S7 F Systems (package for S7-400F / S7-400FH in process automation). The CPU 412-3H is an F-CPU classified for process automation, so SIMATIC Manager routes every safety edit/download through the S7F_SYS library exposed only by S7 F Systems. With the library absent, Edit Safety Program and Generate Safety Program are unavailable, and STEP 7 falls back to the standard download path that has no authority to write the F-shared DB.

Defect 2 — F-shared DB was never (re)generated after the last change

After any modification inside the safety program — including the seemingly harmless act of saving, re-importing, or version-stamping the offline project — the F-shared DB must be regenerated with Options → Edit Safety Program → Generate Safety Program. If the safety program is compiled or downloaded without this step, the F-CPU accepts the standard portion but the F-DB in the online container is empty. On the next restart the F-runtime detects a missing/empty F-shared DB and forces the safety portion to STOP. The hardware-OK LED state on the F-DI module reflects the backplane handshake, not the application-level passivation state, which is why inputs read 0 while the module reports no fault.

S7 Distributed Safety vs S7 F Systems — When to Use Which

For the CPU 412-3H the engineering station must have S7 F Systems installed; S7 Distributed Safety alone is insufficient and is the principal cause of the "S7 F Systems was not found" popup.

Version Compatibility Matrix

Mismatched versions of the F-toolset and the F Configuration Pack are the second most common cause of "compiles cleanly, cannot download" faults. Use the matrix below to select a known-good set before touching the project. The versions are official Siemens release data; verify against the most recent Siemens Industry Online Support entry for your CPU's firmware.

Required Software Stack on the Programming Device

1. STEP 7 V5.5 / V5.6 (SIMATIC Manager) at the same service pack level originally used for the project's first commissioning.
2. S7 F Systems (option package, sold under MLFB 6ES7833-1CC02-0YX0 or its successor) at the version matching STEP 7.
3. F Configuration Pack for the CPU 412-3H firmware actually on the rack.
4. F-Library (F_LIB_Vxx) referenced by the F-blocks in the offline project.
5. CFC (Continuous Function Chart) editor at the version bundled with S7 F Systems; do not mix with a stand-alone PCS 7 CFC newer than the F-toolset.
6. Optional: S7-PLCSIM with the F-option for offline dry-runs.

Reference: see the Siemens Safety Programming Guideline for SIMATIC S7-1200/1500 (PDF) for the general safety architecture and F-shared DB purpose, which carries over to S7-400F; and the SIMATIC Safety — Fail-Safe Blocks reference for the F-FB / F-FC calling convention. Although the live target here is S7-400H, the block model described in both documents applies unchanged.

Step-by-Step Recovery Procedure

The procedure below restores a deterministic download path on a redundant CPU 412-3H pair while the plant is shut down. Adjust the lockout / tag-out steps to your site EHS rules.

1. Capture the current state. From SIMATIC Manager: PLC → Save to Memory Card on both CPUs. This writes the present (possibly incomplete) program to the Flash MCs and lets you boot the system with the temporary fix while you correct the engineering station.
2. Install the missing F-toolset.
   • Uninstall S7 Distributed Safety if the CPU 412-3H was originally configured with S7 F Systems. Mixed toolchains on the same PG produce nondeterministic signature faults.
   • Insert the S7 F Systems installation medium and run Setup.exe. The installer adds the F-chart editor and registers the S7F_SYS library in SIMATIC Manager.
   • Apply the matching F Configuration Pack and overwrite the F-Library to the version referenced in the offline project.
3. Open the offline project in SIMATIC Manager and confirm that the safety program is editable. Options → Edit Safety Program must no longer raise the "S7 F Systems was not found" popup.
4. Recompile the standard program first. Program → Compile All (or Ctrl+F9). Resolve every warning before touching the safety program — unresolved standard errors suppress F-block generation.
5. Generate the safety program. Options → Edit Safety Program → Generate Safety Program. The compiler writes the F-shared DB, the F-Instance DBs, and the updated F-run-time DBs. Confirm the log reports "Generation completed without errors"; copy the log to the project documentation.
6. Run an offline consistency check. Options → Check Safety Program Consistency. The expected output is "No inconsistencies found". If the check reports a signature mismatch with the F-Library, re-select the F-Library version in Options → F-Library and re-generate.
7. Download in the correct order.
   1. Connect online to the reserve CPU (CPU1 in slot 3, slot 4 with the sync module).
   2. PLC → Download. The dialog now asks: "Do you want to include standard blocks in this download?". Answer No for the first pass — this writes only the safety blocks and avoids overwriting a confirmed-good standard program.
   3. Wait for the F-CPU to perform the safety restart, then PLC → Download a second time and answer Yes to include standard blocks. The CPU will restart again.
8. Fail over and repeat on the standby CPU. Switch the master via PLC → Operating Mode → Switch Master (S7-400H redundancy control), then repeat steps 7a–7c on what is now the reserve.

Inline Topology of the F-Shared DB and Runtime Path

Verification and Commissioning Checks

After the second restart, run the following verification matrix before handing the line back to operations. A red row means the download is not yet safe.

Common Pitfalls and Field Notes

• Skipping the safety generation step. Compiling the standard program only does not touch the F-shared DB. The download proceeds, the CPU restarts, and the safety portion is silently absent.
• Mixing toolset versions across PGs. If one PG signs the project with F-Library V1.3 SP2 and a second PG with V1.3, the second download raises a signature mismatch that looks like a network fault.
• Editing safety blocks in the standard editor. SIMATIC Manager allows you to open F-blocks in the standard LAD/FBD editor when the F-option is not installed. Any change made there is overwritten the next time the safety program is generated.
• Online delta download on the master only. On an H-station, you must download to both rack slots or use Download to Both; otherwise the redundant pair can drift into different F-signature states and refuse a subsequent LINK-UP.
• Card swap on a running system. Removing a Flash MC from a CPU that is in RUN on the other master can drop the safety portion. Always perform a controlled switchover before card work.
• Password drift. S7 F Systems uses a separate safety password distinct from the CPU password. Forgetting it blocks every subsequent Edit Safety Program even when the toolset is correctly installed.

Frequently Asked Questions