Resolving Siemens FDBACK Block ERROR=1 in F-CPU Safety Programs

When the FDBACK function block from the Siemens F-Library returns ERROR=1 in an S7-300F, S7-400F, S7-1500F, or ET 200SP F-CPU program despite ON=0, FEEDBACK=0, and QBAD_FIO=0, the most common root cause is a misunderstanding of the inverse feedback relationship the block enforces. The FEEDBACK input is expected to be the logical inverse of output Q, not a mirror. This reference explains the underlying logic, the role of QBAD_FIO, the latching behavior of ERROR, the rising-edge requirement on ACK, the FDBACK_TIME sizing rules, and the verification steps required to commission the block correctly. It is written for engineers commissioning safety functions in SIMATIC Safety (TIA Portal) and S7 Distributed Safety / S7 F/FH Systems (STEP 7 V5.x).

1. Problem Statement

The FDBACK block is part of the F-Application Blocks delivered with SIMATIC Safety and the legacy S7 Distributed Safety option. It is a fail-safe function block (F-FB) that monitors a digital F-DO channel driving a contactor or actuator whose auxiliary contact is wired back to a digital F-DI. The block's job is to verify that the actuator has actually de-energized (or energized) within a defined window, providing diagnostic coverage for the contactor as required by IEC 61508 / IEC 62061 / ISO 13849-1.

A programmer calling the block in FBD or LAD and observing ERROR=1 at runtime with the apparent input combination (ON=0, FEEDBACK=0, QBAD_FIO=0) typically expects a steady-state (Q=0, ERROR=0). The block, however, evaluates the relationship between Q and FEEDBACK, not their absolute values. The pair (Q=0, FEEDBACK=0) violates the inverse relationship, so the block raises ERROR and latches it. The safety function is held passivated until a valid rising edge is applied to the ACK input.

This article is a structured troubleshooting reference for that exact failure mode. It covers:

• The expected (Q, FEEDBACK) truth table, including NC and NO contact wiring
• The QBAD_FIO passivation-suppression mechanism
• FDBACK_TIME sizing and the F-OB cycle-time relationship
• The ACK edge requirement and the latched error state
• Diagnostic steps using the F-DB (F-diagnostic buffer), VAT, and TIA Portal trace
• Verification, validation, and standards compliance

2. How the FDBACK Block Works

The FDBACK block is declared in the F-Library under the runtime group of the safety program. It is instantiated as an F-FB with fail-safe I/O and runs in the safety task (F-OB, F-OB123, or F-OB124 depending on the S7-CPU generation). The block monitors two main signals:

• Output Q — the commanded state of the safe output driving the actuator coil.
• Input FEEDBACK — the digital reading of the actuator's auxiliary contact wired to an F-DI channel.

When Q transitions, the block starts a timer set to the configured FDBACK_TIME (an F-parameter of type TIME). The block expects FEEDBACK to settle to its inverse value within that window. If FEEDBACK does not invert within FDBACK_TIME, the block sets ERROR=1 and saves (latches) the error. The block will not release ERROR until a rising edge is detected on the ACK input.

The block's I/O interface is summarized below.

The block is fail-safe: even if the F-runtime group is interrupted, the outputs are forced to safe values by the F-CPU's safety mechanism. The block must be called in an F-cycle OB; calling it in the standard OB is prohibited and is rejected by the F-CPU at compile time.

3. Root Cause: Inverse Feedback Logic

The key concept that is consistently missed in field reports is that FEEDBACK is the logical inverse of Q. The block's documentation states: "A feedback error ERROR = 1 is detected if the inverse signal state of the feedback input FEEDBACK (to input Q) does not follow the signal state of output Q within the maximum tolerable feedback time."

Reading the wording carefully: the feedback error is raised when FEEDBACK is not the inverse of Q. The block does not say "FEEDBACK must equal zero". It says "FEEDBACK must equal NOT Q".

The expected steady-state truth table is:

Rows three and four show exactly the case in the original report. With Q=0 and FEEDBACK=0, the block infers that the actuator's NC contact is open even though the drive is de-energized — i.e. the contactor is mechanically stuck or the wiring is wrong. ERROR=1 is the correct response.

For NO contacts, the inversion must be added externally or in the F-DI channel configuration. The F-Library provides the F_NAND, F_NOT, and channel-inversion options. Confirm with the wiring diagram: an NO contact driven by a contactor coil reads 0 when the contactor is de-energized (coil off, spring open) and 1 when energized. To match the inverse relationship, the F-DI must be inverted at the channel or in the F-program.

4. The Role of QBAD_FIO

The QBAD_FIO input exists so that the FDBACK block does not raise a feedback error while the F-I/O module driving Q is itself passivated. Passivation occurs when the F-CPU detects an internal channel fault (short circuit, wire break, discrepancy, communication failure to the F-I/O) and the F-DO output is forced to 0 regardless of the process.

Without QBAD_FIO, the FDBACK block would see FEEDBACK stuck at 0 (because the actuator is de-energized but the safe output driver is in a passivated state) and would raise a spurious ERROR. QBAD_FIO gates the error check:

• If QBAD_FIO=1, the block suppresses the feedback error check; ERROR remains 0 regardless of FEEDBACK.
• If QBAD_FIO=0, the block performs the inverse-feedback check normally.

QBAD_FIO must be wired to one of:

1. The QBAD output of the F-DO module instance (e.g., the F-channel driver's iQBAD tag).
2. The per-channel QBAD_O_xx tag for the specific output driving Q.
3. The inverted value-status of the channel (used when the channel is configured with channel-level inversion).

If QBAD_FIO is left unwired (constant FALSE), the block assumes the F-DO is always healthy, and a feedback error will be raised the moment (Q, FEEDBACK) fails the inversion test — even if the root cause is a downstream F-DO passivation rather than a real contactor fault. Many field reports of FDBACK ERROR=1 after a wire break on the F-DO trace back to a missing QBAD_FIO wiring.

5. Maximum Tolerable Feedback Time (FDBACK_TIME)

FDBACK_TIME is the upper bound within which FEEDBACK must follow Q. It is configured as a TIME constant or an F-parameter in the safety program:

FDBACK_TIME := T#500ms;   // 500 milliseconds
FDBACK_TIME := T#1s;       // 1 second
FDBACK_TIME := T#2s;       // 2 seconds (large hydraulic actuators)

Typical industrial values:

FDBACK_TIME must be larger than the actuator's worst-case dropout (turn-off) time. If the contactor takes 600 ms to drop out and FDBACK_TIME is 500 ms, ERROR=1 will be raised on every stop. The temptation is to set FDBACK_TIME to a very large value (e.g., 5 s) to mask the issue, but this degrades diagnostic coverage and may push the safety function below the required SIL/PL. The correct approach is to measure the actual dropout time, set FDBACK_TIME to dropout time + safety margin (typically +20%), and document the value in the safety validation report.

6. Error Latching and the ACK Requirement

The FDBACK block saves (latches) the feedback error. Once ERROR transitions from 0 to 1, it remains 1 indefinitely until a valid acknowledgment is received. The error is not auto-cleared when the underlying condition resolves. This is intentional: the safety function must not silently mask a fault, and the diagnostic coverage (DC) calculation requires that the operator be informed of every feedback event.

The ACK input is used to clear the latched error. The block is edge-sensitive: it requires a 0 → 1 transition on ACK. A static logic-1 level will not re-acknowledge, and a static logic-0 will never acknowledge. Only the rising edge is detected as a valid ACK event.

A typical F-program pattern in TIA Portal (FBD):

// Operator reset request from HMI, level-based
HMI_Reset_Request : BOOL;  // tagged to an HMI button
F_Start_Interlock  : BOOL;  // tagged to permissives

// Edge detection in the F-program using a custom R_TRIG
R_Trig_Inst(
    CLK := HMI_Reset_Request AND NOT F_Start_Interlock,
    Q   := ACK_Pulse
);

// FDBACK instance
FDBACK_Inst(
    ON        := Safety_Enable,
    FEEDBACK  := Aux_Contact_Inverted,
    QBAD_FIO  := F_DQ.iQBAD_O0,
    ACK       := ACK_Pulse,
    Q         => Drive_Out,
    ERROR     => Feedback_Error
);

Acknowledgment is typically gated by an F-Start interlock: the operator must satisfy all safety permissives (guard doors closed, e-stop released, reset button pressed) before the F-program will issue ACK. The pulse width should be at least one F-OB cycle, but the F-Library detects the edge regardless of width.

7. Step-by-Step Diagnostic Procedure

Use this procedure to systematically diagnose a stuck FDBACK ERROR=1.

1. Read the F-DB. In TIA Portal, go to Online & Diagnostics → Safety Diagnostics → F-CPU Diagnostic Buffer. Look for the F-event code on the FDBACK instance. Common codes:

2. Monitor the four inputs live. Open a VAT (Variable Table) or Watch Table and monitor ON, FEEDBACK, QBAD_FIO, Q, ERROR, and ACK. Force the safety program to a known state and observe transitions.
3. Force Q=0 and read FEEDBACK. If FEEDBACK reads 0 while Q=0, the wiring is inverted from what the block expects. Two fixes are possible: (a) re-wire the auxiliary contact as NC, or (b) add an inverter (F_NOT) in the F-program between the F-DI channel tag and the FEEDBACK input.
4. Verify QBAD_FIO source. Cross-check the F-DO module's QBAD bit. In S7-1500F with F-DQ 4×24VDC/2A (6ES7526-2BF00-0AB0), the QBAD is available in the driver's tag database as %DBxxx.iQBAD_O0. If QBAD_FIO is wired to constant FALSE, change the connection.
5. Check FDBACK_TIME. Use TIA Portal's Trace function or an external logic analyzer to measure the time between the Q transition and the FEEDBACK transition. If the measurement exceeds FDBACK_TIME, the block is correctly raising ERROR — increase FDBACK_TIME, but document the change and re-verify SIL.
6. Generate a clean rising edge on ACK. From an HMI or a temporary test rung, apply a single 0 → 1 transition to the ACK input. ERROR should clear on the next F-OB cycle. If it does not, the issue is upstream (the F-DO is still passivated, or a wiring fault persists).
7. Recompile the safety program. In TIA Portal, after every change to F-blocks, the safety program must be recompiled and reloaded with the "Compile and download safety program" workflow. The F-signature changes, the safety administration password is required, and the F-CPU briefly leaves safety mode during the download.
8. Document the F-signature. Record the new safety program signature in the plant's safety file. The signature must be archived for the lifetime of the system per ISO 13849-1 and IEC 62061 documentation requirements.

8. Common Pitfalls and Workarounds

Field experience with the FDBACK block surfaces a recurring set of pitfalls. The table below lists them with practical workarounds.

For legacy STEP 7 V5.x with S7 Distributed Safety (S7-300F / S7-400F), the F-Library version is typically V1.3 or V2.x. The FDBACK block's behavior is consistent across versions, but the path to the F-DB and the diagnostic buffer layout differ slightly. In STEP 7 V5.x, the buffer is accessible via PLC → Module Information → Safety Diagnostics.

9. Verification Procedure

After correcting the FDBACK block, perform the following verification steps before re-arming the machine.

1. Functional test (stop path). Issue a stop command. Confirm Q drops to 0, FEEDBACK transitions to its inverse (1) within FDBACK_TIME, and ERROR remains 0.
2. Functional test (start path). With all permissives satisfied, raise ON to 1. Confirm Q=1 and FEEDBACK transitions to 0 within FDBACK_TIME. ERROR remains 0.
3. Acknowledgment test. Disconnect the auxiliary contact wire at the F-DI terminal to force FEEDBACK=0 while Q=0. Confirm ERROR transitions to 1 and is latched. Reconnect the wire, apply a rising edge on ACK, and confirm ERROR=0 and Q is allowed to be re-driven on the next ON=1.
4. Passivation test. Passivate the F-DO module via the TIA Portal test function (Online → Safety → Passivate F-I/O) or by physically breaking the PROFIsafe connection. Confirm QBAD_FIO=1 and that FDBACK does not raise an error (Q remains 0, ERROR=0). De-passivate and confirm normal operation resumes after ACK.
5. Edge-case test: short FDBACK_TIME. Temporarily reduce FDBACK_TIME to a value just below the measured dropout. Confirm ERROR=1 is raised. This validates that the timer is wired correctly.
6. Long-running test. Run the machine for a representative production cycle (e.g., 24 hours). Capture every FDBACK event in the diagnostic buffer. Any spurious ERROR=1 indicates a wiring or timing issue.
7. Proof-test interval. Per IEC 61508, the diagnostic test interval for the feedback loop must be ≤ the safety function's required proof-test interval. The FDBACK block inherently tests the feedback contact on every cycle of Q; verify that the cycle count is sufficient for the assumed demand rate.
8. Recalculate PFH / PFDavg. Recalculate the probability of dangerous failure per hour (PFH, for high-demand mode) or probability of failure on demand (PFDavg, for low-demand mode) with the new FDBACK_TIME and wiring. Ensure the safety integrity target (SIL 2 / SIL 3, PL d / PL e) is still met. Common tools: Siemens Safety Evaluation Tool, SISTEMA (IFA, BG), PAScal (Pilz).
9. Document. Update the safety validation report with the new wiring diagram, FDBACK_TIME value, diagnostic buffer screenshots, and the new F-signature. The report must be signed by the safety engineer and archived.

10. Standards and Compliance Context

The FDBACK block is part of a safety function that must be designed and documented against the relevant functional safety standards. The block itself is a building block; the safety function is the overall risk-reduction measure, comprising sensor, logic, and actuator.

Reference resources for the broader discipline:

• Functional safety — overview of the discipline, lifecycle phases, and SIL/PL concepts.
• Safety Functions Documents | Rockwell Automation — reference for safety function documentation structure. Although vendor-specific, the document hierarchy (concept, design, validation, operation) is applicable to Siemens installations as well.
• Safety Function - an overview | ScienceDirect Topics — engineering background on safety functions, including examples in process and machinery domains.

Standards to verify the design against (these are the documents, not guarantees — the safety engineer must confirm applicability to the specific installation):

• IEC 61508 (parts 1–7) — functional safety of E/E/PE safety-related systems. Source of SIL definitions, PFH/PFDavg formulas, and diagnostic coverage requirements.
• IEC 62061 — functional safety of safety-related control systems for machinery. Maps SIL to PFHd.
• ISO 13849-1 — safety of machinery, safety-related parts of control systems. Defines Performance Level (PL a–e), categories (B, 1, 2, 3, 4), and DC.
• IEC 61784-3 — functional safety fieldbuses; defines PROFIsafe.
• IEC 60204-1 — electrical equipment of machines.

For Siemens-specific manuals, refer to the SIMATIC Safety — Configuring and Programming manual (TIA Portal) and the S7 Distributed Safety / S7 F/FH Systems — Configuring and Programming manual (STEP 7 V5.x). These are delivered with the F-Option packages and are also available on the Siemens Industry Online Support portal.

FAQ