Siemens SIMATIC S7-1500 System Manual page 224

Maintenance
13.6 Fault reactions with fail-safe modules
Remedying faults in the F-system
To remedy faults in your F-system, follow the procedure described in IEC 61508-1:2010
section 7.15.2.4 and IEC 61508-2:2010 section 7.6.2.1 e.
The following steps must be performed:
1. Diagnostic and repair of the fault
2. Revalidation of the safety function
3. Recording in the service report
Fail-safe v alue output for F-modules
In t he c ase of F-modules with inputs, the F-system provides fail-safe values (0) for the safety
program instead of the process data pending at the fail-safe inputs in case of passivation.
In t he c ase of F-modules with outputs, the F-system transfers fail-safe values (0) to the fail-
safe outputs instead of the output values provided by the safety program in case of
passivation. The output channels are de-energized. This also applies when the F-CPU goes
into STOP mode. The parameter assignment of fail-safe values is not possible.
Depending on the F-system used and the type of fault that occurred, (F-I/O, channel or
communication error) and on the parameter assignment of the F-module, fail-safe values are
used either for the affected channel only or for all channels of the fail-safe module involved.
Reintegration of a fail-safe m odule
The system changes from fail-safe to process values (reintegration of an F-module) either
automatically or only after user acknowledgment in the safety program. If channel faults
occur, it may be necessary to remove and reinsert the F-module. A detailed listing of faults
requiring removal and insertion of the F-module can be found in the section Diagnostic
messages of the respective F-module.
After reintegration, the following occurs:
● In the case of an F-module with inputs, the process data pending at the fail-safe inputs
are provided to the safety program
● In the case of an F-module with outputs, the output values provided in the safety program
are again transferred to the fail-safe outputs
Additional information on passivation and reintegration
For additional information on passivation and reintegration of F-I/O, refer to the SIMATIC
Safety, Configuring and Programming
(http://support.automation.siemens.com/WW/view/en/54110126) manual.
Reaction of the F-module with inputs to communication errors
F-modules with inputs respond differently to communication errors compared to other errors.
If a communication error is detected, the current process values remain set at the inputs of
the F-module. There is no passivation of the channels. The current process values are
passivated in the F-CPU.
224
Automation system
System Manual, 09/2016, A5E03461182-AD