Siemens S7-317F Failsafe I/O Reintegration: Resolving CPU STOP

Problem Overview

A SIMATIC S7-317F-2 PN/DP safety controller (order number 6ES7 317-2FK14-0AB0, firmware V3.2.6) communicates with eight (8) ET 200S distributed I/O stations over PROFINET IO. Each ET 200S head module is equipped with one fail-safe (F-) input module and one fail-safe output module. The end user must be able to remove the 24 V supply to any individual ET 200S station for service work on the field switchboard without disturbing the rest of the process. A digital input wired to the disconnect switch is evaluated by the standard program so that no F-channel of the affected station is read or written while the station is unpowered.

When the station is powered up again, the engineer attempts to reintegrate the affected F-channels by toggling the channel-specific acknowledgment tag DBxxx.DBX0.2 (the ACK_REI bit exposed by the F-I/O DB). On the first attempt, the CPU 317F leaves RUN and enters STOP. The diagnostic buffer shows a safety-internal error. The symptom reappears on every station, which makes the application uncommissionable.

Affected Hardware and Firmware

The CPU 317F-2 PN/DP belongs to the S7-300F family. It supports distributed F-I/O over PROFINET IO and PROFIBUS DP. The fail-safe function is implemented through the F-library blocks F_IO_CGP, F_ACK_REI (FB 218 in older libraries), F_ACK_GL (FB 219 in older libraries), and the F-runtime group signature check performed by the F-shared DB.

Diagnostic Buffer Analysis

The following three events are saved in the CPU diagnostic buffer immediately before the STOP. They are the canonical signature of the failure mode described in this article.

Event 1 of 129 — 16# 457F — STOP caused by STOP command

Event 16#457F is the result event — the F-system has already decided to stop the CPU. The cause event is the next entry in the buffer.

Event 2 of 129 — 16# 75D1 — Safety program: internal CPU error

Event 16#75D1 with additional information 161:0000 is the diagnostic signature of an F-I/O driver block (F_IO_CGP / F_IO_MOD) that has detected a violation of the safety-runtime invariants. In the F-library, the additional information field encodes the cause. The value 161 (= 0xA1) in the high word combined with 0x0000 in the low word points to a sequencing fault during the reintegration handshake. The instance DB 1094 belongs to the F-I/O DB generated for one of the F-modules on the affected ET 200S.

Event 3 of 129 — 16# 38CB — PROFINET IO station return

This is the trigger event. Approximately five minutes before the STOP, station #2 of IO system 100 returned. OB 86 was called, which is the standard reaction to a station return. From this point on, all F-modules of the returned station are in the passivated state and require operator-side acknowledgment (reintegration) before their process values are used again by the F-program.

Root Cause

The root cause is not the PROFINET station return and it is not the toggle of the ACK_REI bit. The root cause is that the ACK_REI bit was being written from the standard user program — i.e. outside the F-runtime group — at a moment when the F-I/O DB was being processed by the F-CPU in the F-cycle.

Every fail-safe I/O channel exposes a one-byte status image in the F-I/O DB. The standard assignment is:

The ACK_REI bit at DBX0.2 is the channel-level reintegration handshake. According to the SIMATIC Safety documentation, the F-CPU checks the bit only when it is being evaluated inside the F-runtime group. Writing the bit from OB 1 (or any standard OB) is a documented anti-pattern: the standard cycle can collide with the F-cycle, and the F-CPU detects the inconsistent access window as a runtime violation, raises 16#75D1, and forces the CPU to STOP. The exact manual warning is reproduced in the ET 200SP fail-safe system description:

"By using the ET 200SP distributed I/O system with fail-safe I/O modules, you are replacing conventional safety engineering configurations."

— SIMATIC ET 200SP Manual Collection — What are fail-safe automation systems and fail-safe modules?

Once the engineer moves the toggle of DBX0.2 into the F-runtime group OB (typically the F-OB, e.g. OB 35 / OB 123 depending on configuration), the STOP disappears. This was confirmed on the affected machine: "What caused the problem was the programmer (that's me), I did the reintegration outside the failsafe program. The CPU doesn't stop now..."

Secondary Symptom — "Hiccup" of Other F-Stations

After moving the local ACK_REI into the F-program, the CPU no longer stops. A second symptom, however, remains: while one station is being reintegrated, the other F-stations on the network briefly passivate and re-acknowledge. The process logic interprets this as a momentary loss of F-IO. The engineer originally tried to reintegrate every channel locally as its ACK_REQ rose, then switched to the global block.

Local vs. global reintegration

The brief passivation of other stations during a global reintegration is the documented behavior. The F_ACK_GL block issues a single acknowledgment pulse to all F-modules of all F-runtime groups on the CPU. The internal handshake clears the passivation latch and re-reads the process image. Other F-stations that are healthy and unpassivated at that instant pass through the operation in a few microseconds, but if those stations have any pending ACK_REQ of their own (e.g. a noise-induced passivation in the previous second), the rising edge from F_ACK_GL will inadvertently clear those latches. This is the visible "hiccup".

Step-by-Step Resolution

1. Open the F-station in SIMATIC Manager / STEP 7 Safety.
2. Open the F-runtime group that owns the affected F-I/O DB. Identify the F-OB (typically OB 35 for the safety cycle, e.g. 100 ms).
3. Move the logic that drives DBxxx.DBX0.2 from the standard OB 1 into the F-OB. Use a one-shot rising-edge detection (FP) so that a stuck operator button does not re-trigger the handshake on every cycle.
4. Compile the F-program. STEP 7 Safety will perform the F-signature check. Note the new F-signature.
5. Download to the CPU 317F. Accept the new F-signature in the safety password dialog.
6. Power down ET 200S station #2. Verify that OB 86 reports the failure and that all F-channels of the station show PASS_ON = 1 and ACK_REQ = 1.
7. Power the station back up. Wait for PROFINET station return (event 16#38CB) and for the F-CPU to detect the modules. The F-shared DB will reflect the new ACK_REQ on the affected channels.
8. Operate the operator push button. The F-OB detects the 0→1 edge on ACK_REI. The F-modules come out of passivation, PASS_ON and ACK_REQ fall, and the process values are again valid for the F-program.
9. Verify that the diagnostic buffer no longer contains 16#75D1 and that the CPU remains in RUN.

Optional: Using F_ACK_GL (FB 219) Instead of Local ACK_REI

For a centralized maintenance procedure, the global acknowledge is acceptable and is the block Siemens explicitly recommends when multiple stations may need to be brought back simultaneously. Wire it as follows in the F-OB:

// F-OB (e.g. OB 35)
// Inputs
//   i_ackReqAny  : BOOL   ; OR of all ACK_REQ bits of the F-I/O DBs
//   i_opAckGl    : BOOL   ; operator push button on HMI
// Outputs
//   q_ackGlDone  : BOOL   ; one-cycle pulse to drive a green HMI indicator

// F_ACK_GL instance (FB 219)
//   ACK_GLOBAL : BOOL   ; bind to i_opAckGl (rising edge triggers global reintegration)
//   ACK_FIN    : BOOL   ; bind to q_ackGlDone
//   DIAG_INFO  : BYTE   ; diagnostics byte, evaluate in standard program

IF i_opAckGl AND NOT i_ackGlLast THEN
   // rising edge — issue global acknowledge
   F_ACK_GL.ACK_GLOBAL := TRUE;
ELSE
   F_ACK_GL.ACK_GLOBAL := FALSE;
END_IF;

q_ackGlDone := F_ACK_GL.ACK_FIN;
i_ackGlLast := i_opAckGl;

Important details:

• The operator button must drive the ACK_GLOBAL input from inside the F-OB, not from the standard program. A standard-cycle pulse will collide with the F-CPU's internal reintegration state machine and reproduce the original 16#75D1 STOP.
• Evaluate the ACK_FIN output in the F-OB; reflect it to a standard tag for HMI feedback. Do not latch the HMI tag in the F-program — latches of HMI-facing tags must be in the standard program.
• Apply the safety password before downloading. STEP 7 Safety will refuse the download otherwise.

Diagnostic Event Cross-Reference

Verification Checklist

• Diagnostic buffer contains the expected 16#38CB station-return event, but no 16#75D1 / 16#457F pair.
• CPU 317F stays in RUN during and after the operator acknowledgment.
• All eight ET 200S stations report QBAD = 0 on every F-channel within two F-cycles after the global acknowledge pulse.
• The F-signature displayed on the HMI matches the signature stored in STEP 7 Safety.
• The F-monitoring time (max F-cycle) of the F-runtime group is at least 1.5× the configured F-OB cycle time. For a 100 ms OB 35, the F-monitoring time should be at least 150 ms; the default 200 ms is acceptable.
• The PROFINET update time on the IO system is not shorter than 1 ms; for F-modules Siemens recommends 1 ms or 2 ms. A 250 µs update time is not certified for F-IO.
• OB 82, OB 83, OB 86, OB 121 and OB 122 are present in the CPU (the F-CPU will refuse to start without OB 82 and OB 86 in some firmware versions).

Parameter Reference — Typical ET 200S F-Module Configuration

Common Mistakes that Re-trigger 16#75D1

• Toggling ACK_REI from OB 1 or from an alarm OB instead of the F-OB.
• Writing ACK_REI with the same Boolean variable that the HMI polls, creating a standard/F-program data race.
• Calling F_ACK_GL from OB 1 (the input pulse is then generated outside the F-cycle).
• Forgetting to re-accept the F-signature after a download; the F-CPU enters STOP with 16#75D1 (162:xxxx) on the next cold restart.
• Reconfiguring the F-I/O DB (e.g. adding a channel) without regenerating the F-I/O DB and the F-signature.
• Using FB 219 from the wrong F-library version (S7 Distributed Safety vs. S7 F/FH Systems) — the two libraries are not binary-compatible.

Alternative Approach — One ACK_REI per Station

If the "hiccup" on the other stations is unacceptable, replace the single F_ACK_GL with a per-station F_ACK_REI call. The HMI sends the station number; the F-program selects the correct ACK_REI bit and pulses it. The remaining seven stations are untouched:

// F-OB
CASE i_selectedStation OF
   1: DB_et200s_1.AckReiPulse := i_opAck;
   2: DB_et200s_2.AckReiPulse := i_opAck;
   3: DB_et200s_3.AckReiPulse := i_opAck;
   // ... etc.
   8: DB_et200s_8.AckReiPulse := i_opAck;
ELSE
   ; // no station selected
END_CASE;

This eliminates the cross-station passivation effect at the cost of a slightly more complex HMI mask. It is the preferred approach in machine-safety applications where the process must remain running while one station is being serviced.

FAQ