Siemens SIMATIC S7-1500/ET 200MP System Manual page 327

Maintenance
14.7 Fault reactions with fail-safe modules
F-modules cannot save errors as retentive data. When the system is powered down and then
restarted, any faults still existing are detected again during startup. However, you have the
option of saving faults in your safety program.
Channel faults do not trigger any diagnostic reactions or error handling for channels that
have been set to "deactivated" in STEP 7, even if this channel is affected indirectly by a
channel group fault (channel parameter "activated/deactivated").
Remedying faults in the F-system
To remedy faults in your F-system, follow the procedure described in IEC 61508-1:2010
section 7.15.2.4 and IEC 61508-2:2010 section 7.6.2.1 e.
The following steps must be performed:
1. Diagnostic and repair of the fault
2. Revalidation of the safety function
3. Recording in the service report
Fail-safe value output for F-modules
In the case of F-modules with inputs, if there is passivation, the F-system provides
substitute values (0) for the safety program instead of the process data pending at the fail-
safe inputs.
In the case of F-modules with outputs, if there is passivation, the F-system transfers
substitute values (0) to the fail-safe outputs instead of the output values provided by the
safety program. The output channels are de-energized. This also applies when the F-CPU goes
into STOP mode. The parameter assignment of fail-safe values is not possible.
Substitute values are used either for the relevant channel only or for all channels of the
relevant fail-safe module, depending on:
• The F-system used
• The type of fault that occurred (fail-safe I/O fault, channel fault or communication error)
• The parameter assignment of the F-module
326
WARNING
Automation system
System Manual, 01/2023, A5E03461182-AK