Siemens SIMATIC S7 F Manual page 211

Fail-Safe Blocks
•
If a fault occurs on both of the redundant channels:
- In the case of digital input modules, the substitute value 0 is output on the
F channel driver.
- In the case of digital output modules, the substitute value 0 is sent to both
channels.
- In the case of analog input modules, the substitute value or the last valid
value is output on the F channel driver, depending what is configured.
As long as both redundant channels don't fail, an acknowledgment is not
necessary for reintegration after the problem has been dealt with.
Note
In the case of analog input modules, after a problem is corrected there is no switch
back to the channel of the original module. This can lead to the presence of active
channels on both modules.
When an analog input modules is replaced, a switchover to the second module
takes place automatically.
Discrepancy Analysis In the Case of Module Redundancy
In the case of redundant, fail-safe digital input modules with single-channel or two-
channel non-equivalent sensor interconnection, the F module driver carries out a
discrepancy analysis to increase availability. For this purpose, the input DISC_ON
is assigned automatically and the assigned discrepancy time is stored at the input
DISCTIME when CFC charts are compiled.
In the discrepancy analysis, the F module driver compares two corresponding input
signals in each case. If a discrepancy between the signals lasts longer than the
configured discrepancy time, it detects a discrepancy error for the channel that
supplies the 0 signal and sets the corresponding bit in the diagnostic information at
the DIAG_1/2 output.
As long as it is only discrepancy errors that occur for a channel, the output QBAD
is not set on the F channel driver and the process value remains valid.
Reintegration after an error has been eliminated occurs automatically without
acknowledgment at the F channel driver.
In the case of redundant analog input modules, a discrepancy analysis is not
carried out.
A distinction should be drawn between this and discrepancy analysis in the case
of 1oo2 sensor evaluation, which is carried out by the module rather than the
driver block. A discrepancy error in the case of 1oo2 evaluation is handled in the
same way as a channel fault. You can find additional information on discrepancy
analysis and sensor interconnection in the Fail-Safe Signal Modules manual,
sections 3.2, 9.1 and 9.2.
Fail-Safe Systems
A5E00085588-03
8-23