Siemens Simatic S7-1500/ET 200MP System Manual page 302

Fail-safe value output for F-modules
In the case of F-modules with inputs, the F-system provides fail-safe values (0) for the safety
program instead of the process data pending at the fail-safe inputs in case of passivation.
In the case of F-modules with outputs, the F-system transfers fail-safe values (0) to the fail-
safe outputs instead of the output values provided by the safety program in case of
passivation. The output channels are de-energized. This also applies when the F-CPU goes
into STOP mode. The parameter assignment of fail-safe values is not possible.
Depending on the F-system used and the type of fault that occurred, (F-I/O, channel or
communication error) and on the parameter assignment of the F-module, fail-safe values are
used either for the affected channel only or for all channels of the fail-safe module involved.
Reintegration of a fail-safe module
The system changes from fail-safe to process values (reintegration of an F-module) either
automatically or only after user acknowledgment in the safety program. If channel faults
occur, it may be necessary to remove and reinsert the F-module. A detailed listing of faults
requiring removal and insertion of the F-module can be found in the section Diagnostic
messages of the respective F-module.
After reintegration, the following occurs:
● In the case of an F-module with inputs, the process data pending at the fail-safe inputs
are provided to the safety program
● In the case of an F-module with outputs, the output values provided in the safety program
are again transferred to the fail-safe outputs
Additional information on passivation and reintegration
For additional information on passivation and reintegration of F-I/O, refer to the SIMATIC
Safety, Configuring and Programming
(http://support.automation.siemens.com/WW/view/en/54110126) manual.
Reaction of the F-module with inputs to communication errors
F-modules with inputs respond differently to communication errors compared to other errors.
If a communication error is detected, the current process values remain set at the inputs of
the F-module. There is no passivation of the channels. The current process values are
passivated in the F-CPU.
Automation system
System Manual, 12/2017, A5E03461182-AE
14.7 Fault reactions with fail-safe modules
Maintenance
301