Siemens SIMATIC S7-1500 System Manual page 218

Failure scenario
①
②
③
④
⑤
⑥
⑦
⑧
Figure 6-56
Sequence of events
1. Data corruption in the safety program of the primary CPU occurs due to incorrect
programming (DIV instruction = 0 if enable output ENO is not connected).
2. The error response state switches all fail-safe inputs/outputs to the safe state. The HF-system
then switches to STOP system state.
3. System redundancy has failed. The process is no longer controlled by the redundant system.
S7-1500R/H redundant system
System Manual, 01/2024, A5E41814787-AF
Primary CPU (CPU 1518HF-4 PN) → Data corruption in the safety program due to incorrect pro-
gramming
Backup CPU (CPU 1518HF-4 PN)
Two fiber-optic cables (redundancy connections)
IO device ET 200SP
IO device ET 200MP
ET 200MP IO device with fail-safe modules
ET 200SP IO device with fail-safe modules
PROFINET cables (PROFINET ring)
Failure of the redundant system through safe state of the 1518HF-4 PN CPUs
Application planning
6.5 Failure scenarios
217