Product overview
1.3 S7-1200 Fail-Safe CPUs
S7-1200 Functional Safety Manual
16 Manual, 02/2015, A5E03470344-AA
Fault reactions
Safe state
The fail-safe concept depends on the identification of a safe state for all process variables.
The value "0" (de-energized) represents this safe state for digital fail-safe signal modules
(SM). This applies to both sensors and actuators.
Passivation applies safe state values to the fail-safe SM or channel(s) instead of process
values when the fail-safe system detects faults. The safety function requires passivation of
the fail-safe SM or channel(s) in the following situations:
● When the fail-safe system starts up
● If the fail-safe system detects overall module faults, such as RAM or Processor failures
● If the fail-safe system detects errors during safety-related communication between the
fail-safe CPU and the fail-safe SM through the PROFIsafe safety protocol
(communication error)
● If fail-safe channel faults occur (for example, short-circuit and discrepancy errors or
internal faults of fail-safe input or output channels)
When passivation occurs in a digital input fail-safe SM, SIMATIC Safety provides the safety
program with safe state values (0) instead of the process data pending at the fail-safe inputs
in the input process image.
When passivation occurs in a digital output fail-safe SM, the SM sets the passivated
channel(s) to a value of (0).
Reintegration returns the process from passivation to a normal state after successful
diagnostics determine that the fault has cleared. After reintegration of a fail-safe digital input,
SIMATIC Safety again provides the process data pending at the inputs to the safety
program. For a fail-safe digital output , SIMATIC Safety again transfers the output values
provided by the safety program to the fail-safe outputs. Reintegration from safe state values
to process data can be automatic or require acknowledgement by your safety program. See
"Reactions to faults" (Page 115) for steps to reintegrate.