Siemens SIMATIC S7-1500 System Manual page 141

Failure scenario
①
②
③
④
⑤
⑥
⑦
⑧
Figure 5-44 Failure of the redundant system through safe state of the 1518HF-4 PN CPUs
Sequence of events
1. Data corruption in the safety program of the primary CPU occurs due to incorrect
programming (DIV instruction = 0 if enable output ENO is not connected).
2. The error response state switches all fail-safe inputs/outputs to the safe state. The HF-
system then switches to STOP system state.
3. System redundancy has failed. The process is no longer controlled by the redundant
system.
S7-1500R/H redundant system
System Manual, 11/2022, A5E41814787-AD
Primary CPU (CPU 1518HF-4 PN) → Data corruption in the safety program due to incorrect pro­
gramming
Backup CPU (CPU 1518HF-4 PN)
Two fiber-optic cables (redundancy connections)
IO device ET 200SP
IO device ET 200MP
ET 200MP IO device with fail-safe modules
ET 200SP IO device with fail-safe modules
PROFINET cables (PROFINET ring)
Application planning
5.5 Failure scenarios
141