Fault Reactions With Failsafe Components - Siemens SIMATIC S7-1500 System Manual

13.6

Fault reactions with failsafe components

Safe state (safety concept)
The basic principle behind the safety concept is the existence of a safe state for all process
variables.
Note
For fail-safe input and output modules, this safe state is the value "0".
Fault reactions and startup of the F-system
The safety function requires the output of substitute values (safe state) instead of process
values for a failsafe module (passivation of the failsafe module) in the following cases:
● When the F-system is started up
● If errors are detected during safety-related communication between the F-CPU and the F-
module via the PROFIsafe safety protocol (communication error)
● If F-I/O faults or channel faults are detected (for example wire break, discrepancy error)
Detected faults are written to the diagnostic buffer of the F-CPU and communicated to the
safety program in the F-CPU.
F-modules cannot save errors as retentive data. When the system is powered down and
then restarted, any faults persisting are detected again during startup. However, you have
the option of saving faults in your safety program.
Channel faults do not trigger any diagnostic reactions or error handling for channels that
have been set to "deactivated" in STEP 7. This applies even if such a channel is affected
indirectly by a channel group fault (channel parameter "activated/deactivated").
Remedying faults in the F-system
To remedy faults in your F-system, follow the procedure described in IEC 61508-1:2010
section 7.15.2.4 and IEC 61508-2:2010 section 7.6.2.1 e.
The following steps must be performed:
1. Diagnostic and repair of the fault
2. Revalidation of the safety function
3. Recording in the service report
SIMATIC Drive Controller
System Manual, 11/2019, A5E46600094-AA
WARNING
13.6 Fault reactions with failsafe components
Maintenance
255