Siemens SIMATIC S7 Functional Safety Manual page 17

Detection and response to faults
SIMATIC Safety systems detect and respond to faults in several different conditions:
● Faults in the fail-safe CPU hardware and firmware
● Faults in the fail-safe user program
● PROFIsafe communication errors caused by conditions in either the fail-safe CPU or SMs
● Fail-safe SM-wide errors such as microprocessor errors or memory errors
● Fail-safe SM channel errors such as discrepancy errors, wiring shorts, or internal channel
faults
Fail-safe CPU faults and fail-safe user program faults often result in the CPU operating mode
being set to STOP. You can reintegrate PROFIsafe communication faults once
communication is successfully restored. In most cases, you cannot reintegrate SM-wide
faults because these faults require the fail-safe SM to be power-cycled. You can often
reintegrate and return channel faults to proper operation by removing the fault and
reintegrating the channel.
Virtual monitoring number, cyclic interrupt time, and F-monitoring time
The following parameters are integral to fault reactions:
● Virtual monitoring number: The PROFIsafe protocol provides time monitoring and
detection of message sequence errors by means of a periodically-updated monitoring
number.
● Cyclic interrrupt time: The cyclic interrupt time is the interval by which the F-runtime group
executes and determines how often the fail-safe CPU sends the PROFIsafe frame to the
fail-safe SMs. When you add a fail-safe CPU to your project, STEP 7 creates Functional
Safety Organization Block 1 (FOB_1) (OB123 by default). FOB_1 contains the cyclic time
interrupt time, and you can configure the cyclic interrupt time (100ms by default).
● F-monitoring time: The F-monitoring time is the amount of time an SM or CPU waits for
an error-free communication including a new Virtual Monitoring Number before
passivating channels. You can configure the F-monitoring time. The fail-safe CPU and
SMs must receive a valid, current safety message frame with a valid monitoring number
within the configured F-monitoring time.
If the fail-safe system fails to detect a valid monitoring number within the F-monitoring time,
the fail-safe system passivates the fail-safe SM. Expiration of an SM's F-monitoring time
causes a transition to safe state for all F-inputs or F-outputs of the SM.
CRC (Cyclic Redundancy Check) signature
A CRC signature contained in the safety message frame protects the validity of the process
data in the safety message frame, the accuracy of the assigned address references, and the
safety-relevant parameters.
If a CRC signature error occurs during communication between the fail-safe CPU and fail-
safe SMs, the fail-safe system passivates the fail-safe SMs.
S7-1200 Functional Safety Manual
Manual, 02/2015, A5E03470344-AA
Product overview
1.3 S7-1200 Fail-Safe CPUs
17