Siemens SIMATIC S7 F Manual page 222

Fail-Safe Blocks
TIMEOUT Parameter
The input TIMEOUT cannot be interconnected and must be assigned a constant
value. See "Monitoring Safety-Related Communication Between CPUs".
Error Handling
If a connection partner receives an invalid safety frame (e.g.: due to a check value
error (CRC) or watchdog error) or doesn't receive a valid safety frame within the
TIMEOUT monitoring time, the outputs ERROR and SUBS_ON are set and the
substitute values are output. An error code is displayed at the output RETVAL.
Note
Once communication has been set up without errors, compliance with the assigned
monitoring time (TIMEOUT parameter) is checked.
Communication between the connection partners is reestablished. The data
received with valid safety frames is not applied to the outputs (= reintegrated) until
the input ACK_REI had a rising edge (e.g. via F_QUITES).
The block sets the output ACK_REQ to indicate that acknowledgment is required.
In the event of an error that is critical to safety, the system function SFC F_CTRL
is called. This records the event in the Diagnostic Buffer and requests a switch to
the reserve CPU if the error occurred only on the master CPU. For non-redundant
systems or a common-cause error occurring in both CPUs, the shutdown logic can
be configured to either disable the erred F-run-time group or the entire Safety
Program.
Error Information in Diagnostic Buffer
Error Code (W#16#...)
75DAH
8-34
Description
Error in the safety data format (error due to online modification
of the Safety Program or internal CPU fault)
Fail-Safe Systems
A5E00085588-03