Siemens SIMATIC S7 Instructions for use

S7-1200 Functional Safety Manual
___________________
___________________
___________________
___________________
___________________
___________________
___________________
___________________
___________________
___________________
SIMATIC
S7
S7-1200 Functional Safety Manual
Manual
02/2015
A5E03470344
-AA
Preface
Product overview
1
Getting started
2
Fail-Safe signal module (SM)
applications
3
Fail-Safe CPU and signal
module (SM) installation
4
Fail-Safe signal module (SM)
I/O configuration
5
Fail-Safe signal module (SM)
diagnostics
6
Technical specifications
A
Ordering information
B
Fail-Safe response times
C

Siemens AG
Division Digital Factory
Postfach 48 48
90026 NÜRNBERG
GERMANY
A5E03470344-AA
Ⓟ
04/2015 Subject to change
Copyright © Siemens AG 2015.
All rights reserved
Legal information
Warning notice system
This manual contains notices you have to observe in order to ensure your personal safety, as well as to prevent
damage to property. The notices referring to your personal safety are highlighted in the manual by a safety alert
symbol, notices referring only to property damage have no safety alert symbol. These notices shown below are
graded according to the degree of danger.
DANGER
indicates that death or severe personal injury will result if proper precautions are not taken.
WARNING
indicates that death or severe personal injury may result if proper precautions are not taken.
CAUTION
indicates that minor personal injury can result if proper precautions are not taken.
NOTICE
indicates that property damage can result if proper precautions are not taken.
If more than one degree of danger is present, the warning notice representing the highest degree of danger will
be used. A notice warning of injury to persons with a safety alert symbol may also include a warning relating to
property damage.
Qualified Personnel
The product/system described in this documentation may be operated only by
personnel qualified
for the specific
task in accordance with the relevant documentation, in particular its warning notices and safety instructions.
Qualified personnel are those who, based on their training and experience, are capable of identifying risks and
avoiding potential hazards when working with these products/systems.
Proper use of Siemens products
Note the following:
WARNING
Siemens products may only be used for the applications described in the catalog and in the relevant technical
documentation. If products and components from other manufacturers are used, these must be recommended
or approved by Siemens. Proper transport, storage, installation, assembly, commissioning, operation and
maintenance are required to ensure that the products operate safely and without any problems. The permissible
ambient conditions must be complied with. The information in the relevant documentation must be observed.
Trademarks
All names identified by ® are registered trademarks of Siemens AG. The remaining trademarks in this publication
may be trademarks whose use by third parties for their own purposes could violate the rights of the owner.
Disclaimer of Liability
We have reviewed the contents of this publication to ensure consistency with the hardware and software
described. Since variance cannot be precluded entirely, we cannot guarantee full consistency. However, the
information in this publication is reviewed regularly and any necessary corrections are included in subsequent
editions.

S7-1200 Functional Safety Manual
Manual, 02/2015, A5E03470344-AA 3
Preface
Purpose of the manual
The S7-1200 series is a line of programmable logic controllers (PLCs) that can control a
variety of automation applications. Compact design, low cost, and a powerful instruction set
make the S7-1200 a perfect solution for controlling a wide variety of applications. The
S7-1200 models and Windows-based programming tools give you the flexibility you need to
solve your automation problems.
This manual provides information about using, installing, and programming the S7-1200
Fail-Safe PLCs and is designed for engineers, programmers, installers, and electricians who
have a general knowledge of programmable logic controllers.
Required basic knowledge
To understand this manual, it is necessary to have a general knowledge of automation and
programmable logic controllers.
Scope of the manual
This manual describes or references the following products:
●STEP 7 Basic V13 SP1 or later with:
–STEP 7 Safety Basic V13 SP1 or later
–STEP 7 Safety Advanced V13 SP1 or later
●STEP 7 Professional V13 SP1 or later with:
–STEP 7 Safety Advanced V13 SP1 or later
●S7-1200 fail-safe CPU firmware release V4.1 or later
●S7-1200 fail-safe signal modules (SM) firmware release V2.0 or later

Preface
S7-1200 Functional Safety Manual
4Manual, 02/2015, A5E03470344-AA
For a complete list of the S7-1200 products described in this manual, refer to the technical
specifications article numbers for fail-safe CPUs (Page 193) and fail-safe SMs (Page 193).
WARNING
The "SIMATIC, Industrial Software, SIMATIC Safety - Configuring and Programming,
Programming and Operating Manual" in the current version is the authoritative source for
Functional Safety-related information concerning configuring and programming.
Siemens identifies the "SIMATIC, Industrial Software, SIMATIC Safety - Configuring and
Programming, Programming and Operating Manual"
(http://support.automation.siemens.com/WW/view/en/54110126/0/en) as the authoritative
and/or original source in the case of discrepancies between the manuals.
All warnings in the "SIMATIC, Industrial Software, SIMATIC Safety - Configuring and
Programming, Programming and Operating Manual" have to be observed.
Certification, CE label, C-Tick, and other standards
Refer to the technical specifications (Page 144) for more information.
Glossary
The definitions in the glossary are provided to give the reader an easy first reference for
understanding the terms as used in this manual. Some terms have detailed formal definitions
in IEC 61508, ISO EN 13849, IEC 61784-3-3, and associated standards, and must be
understood in terms of broad safety concepts detailed in these standards.
Another reference for more exact definitions is the "SIMATIC, Industrial Software, SIMATIC
Safety - Configuring and Programming, Programming and Operating Manual"
(http://support.automation.siemens.com/WW/view/en/54110126/0/en).
Service and support
In addition to our documentation, we offer our technical expertise on the Internet on the
customer support web site (http://www.siemens.com/automation/).
Contact your Siemens distributor or sales office for assistance in answering any technical
questions, for training, or for ordering S7 products. Because your sales representatives are
technically trained and have specific knowledge about your operations, processes, and
industry, as well as the individual Siemens products that you are using, they can provide the
fastest and most efficient answers to any problems you might encounter.

Preface
S7-1200 Functional Safety Manual
Manual, 02/2015, A5E03470344-AA 5
Documentation and information
S7-1200 and STEP 7 provide a variety of documentation and other resources for finding the
technical information that you require.
●The
S7-1200 Functional Safety Manual presents an overview of the Siemens Safety
software and fail-safe CPUs and SMs and a Getting Started configuration and
programming example. However, the focus of the manual is the S7-1200 fail-safe SMs.
SM installation, configuration, diagnostics, applications, and technical specifications are
emphasized.
The English version of the
S7-1200 Functional Safety Manual is the authoritative
(original) language for Functional Safety-related information. All translated manuals refer
back to the English manual as the authoritative and/or original source. Siemens identifies
the English manual as the authoritative and/or original source in the case of
discrepancies between the translated manuals.
●The
Industrial Software, SIMATIC Safety - Configuring and Programming, Programming
and Operating Manual
provides information that enables you to configure and program
SIMATIC Safety fail-safe systems. In addition, you will obtain information on acceptance
testing of a SIMATIC Safety fail-safe system. Before configuring and programming an
actual live fail-safe operation, it is essential that you refer to this manual.
●The
S7-1200 Programmable Controller System Manual provides specific information
about the operation, programming, and the specifications for the complete S7-1200
product family. In addition to the system manual, the
S7-1200 Easy Book provides a
more general overview to the capabilities of the S7-1200 family.
●The
S7-1200 Functional Safety Manual; SIMATIC, Industrial Software, SIMATIC Safety -
Configuring and Programming, Programming and Operating Manual; S7-1200
Programmable Controller System Manual
; and the S7-1200 Easy Book are available as
electronic (PDF) manuals. The electronic manuals can be downloaded from the customer
support web site and can also be found on the companion disk that ships with every S7-
1200 CPU.
●The TIA portal STEP 7 online help information system provides immediate access to the
conceptual information, specific instructions, and error code event IDs that describe the
operation and functionality of the programming package and basic operation of SIMATIC
CPUs.
●My Documentation Manager accesses the electronic (PDF) versions of the SIMATIC
documentation set, including the system manual, the Easy Book, and the information
system of STEP 7. With My Documentation Manager, you can drag and drop topics from
various documents to create your own custom manual.
The customer support entry portal (http://support.automation.siemens.com) provides a
link to My Documentation Manager under mySupport.
●Siemens also provides online comprehensive support for your use of safety technology. A
Safety Evaluation Tool assists you in determining required safety levels, Functional
Examples guide you in your safety applications, and SITRAIN classes offer training in
safety standards and products. Visit the following web sites to access these support
activities:
–Safety Evaluation Tool (http://www.siemens.com/safety-evaluation-tool)
–Functional examples (http://www.siemens.com/safety-functional-examples)
–SITRAIN (http://www.siemens.com/sitrain-safetyintegrated)

Preface
S7-1200 Functional Safety Manual
6Manual, 02/2015, A5E03470344-AA
●The customer support web site also provides podcasts, FAQs, and other helpful
documents for S7-1200 and STEP 7. The podcasts utilize short educational video
presentations that focus on specific features or scenarios in order to demonstrate the
interactions, convenience and efficiency provided by STEP 7. Visit the following web sites
to access the collection of podcasts:
–STEP 7 Basic web page (http://www.automation.siemens.com/mcms/simatic-
controller-software/en/step7/step7-basic/Pages/Default.aspx)
–STEP 7 Professional web page (http://www.automation.siemens.com/mcms/simatic-
controller-software/en/step7/step7-professional/Pages/Default.aspx)
●You can also follow or join product discussions on the Service & Support technical forum
(https://www.automation.siemens.com/WW/forum/guests/Conferences.aspx?Language=e
n&siteid=csius&treeLang=en&groupid=4000002&extranet=standard&viewreg=WW&nodei
d0=34612486). These forums allow you to interact with various product experts.
–Forum for S7-1200
(https://www.automation.siemens.com/WW/forum/guests/Conference.aspx?SortField=
LastPostDate&SortOrder=Descending&ForumID=258&Language=en&onlyInternet=Fa
lse)
–Forum for STEP 7 Basic and Professional
(https://www.automation.siemens.com/WW/forum/guests/Conference.aspx?SortField=
LastPostDate&SortOrder=Descending&ForumID=265&Language=en&onlyInternet=Fa
lse)
Security information
Siemens provides products and solutions with industrial security functions that support the
secure operation of plants, solutions, machines, equipment and/or networks. They are
important components in a holistic industrial security concept. With this in mind, Siemens’
products and solutions undergo continuous development. Siemens recommends strongly
that you regularly check for product updates.
For the secure operation of Siemens products and solutions, it is necessary to take suitable
preventive action (e.g. cell protection concept) and integrate each component into a holistic,
state-of-the-art industrial security concept. Third-party products that may be in use should
also be considered. You can find more information about industrial security on the Internet
(http://www.siemens.com/industrialsecurity).
To stay informed about product updates as they occur, sign up for a product-specific
newsletter. You can find more information on the Internet
(http://support.automation.siemens.com).

S7-1200 Functional Safety Manual
Manual, 02/2015, A5E03470344-AA 7
Table of contents
Preface ...................................................................................................................................................... 3
1 Product overview ..................................................................................................................................... 11
1.1 Overview .................................................................................................................................11
1.2 Hardware and software components......................................................................................13
1.3 S7-1200 Fail-Safe CPUs ........................................................................................................14
1.3.1 Behavior differences between standard and fail-safe CPUs ..................................................15
1.3.1.1 Safety mode............................................................................................................................15
1.3.1.2 Fault reactions ........................................................................................................................16
1.3.1.3 Restart of fail-safe system ......................................................................................................18
1.3.1.4 Firmware update.....................................................................................................................18
1.4 S7-1200 Fail-Safe signal modules (SM).................................................................................19
1.4.1 Overview .................................................................................................................................19
1.4.2 SM 1226 F-DI 16 x 24 VDC ....................................................................................................20
1.4.3 SM 1226 F-DQ 4 x 24 VDC ....................................................................................................21
1.4.4 SM 1226 F-DQ 2 x Relay........................................................................................................23
2 Getting started ......................................................................................................................................... 25
2.1 Introduction to example ..........................................................................................................25
2.1.1 Instructive, interactive animation files.....................................................................................25
2.1.2 Requirements for configuring and programming ....................................................................26
2.1.3 Example structure and task definition.....................................................................................27
2.1.4 Procedure ...............................................................................................................................28
2.2 Configuring..............................................................................................................................30
2.2.1 Introduction .............................................................................................................................30
2.2.2 Step 1: Configuring the S7-1200 CPU 1214FC or CPU 1215FC...........................................31
2.2.3 Step 2: Configuring fail-safe CPU standard digital inputs for user acknowledgement,
feedback circuit, and start pushbutton....................................................................................34
2.2.4 Step 3: Configuring an SM1226 F-DI 16 x 24 VDC for connecting an emergency stop
switch, position switches, and the laser scanner....................................................................35
2.2.5 Step 4: Configuring an SM 1226 F-DQ 4 x 24 VDC for connecting a motor ..........................43
2.2.6 Summary: Configuring the Hardware .....................................................................................45
2.3 Programming ..........................................................................................................................46
2.3.1 Introduction .............................................................................................................................46
2.3.2 Step 5: Specifying the centralized settings for the safety program ........................................48
2.3.3 Step 6: Creating an F-FB........................................................................................................51
2.3.4 Step 7: Programming the safety door function .......................................................................52
2.3.5 Step 8: Programming the emergency stop function ...............................................................54
2.3.6 Step 9: Programming the feedback monitoring ......................................................................56
2.3.7 Step 10: Programming the user acknowledgment for reintegration of the fail-safe SM .........58
2.3.8 Step 11: Programming of the main safety block.....................................................................59
2.3.9 Step 12: Compiling the safety program ..................................................................................60
2.3.10 Step 13: Downloading the complete safety program to the fail-safe CPU and activating
safety mode ............................................................................................................................61

Table of contents
S7-1200 Functional Safety Manual
8Manual, 02/2015, A5E03470344-AA
3 Fail-Safe signal module (SM) applications............................................................................................... 65
3.1 Digital input applications ........................................................................................................ 67
3.1.1 Selecting the digital input application..................................................................................... 68
3.1.2 Applications 1 and 2: 1oo1 evaluation of a single sensor...................................................... 69
3.1.3 Applications 3 and 4: 1oo2 evaluation of a single sensor...................................................... 70
3.1.4 Applications 5 and 6: 1oo2 evaluation of independent equivalent sensors........................... 71
3.1.5 Applications 7 and 8: 1oo2 evaluation of 3-wire, non-equivalent sensor circuit .................... 72
3.1.6 Applications 9 and 10: 1oo2 evaluation of 4-wire non-equivalent sensor circuit ................... 73
3.2 Digital output applications...................................................................................................... 74
3.2.1 Selecting the digital output application .................................................................................. 75
3.2.2 Application 1: Wiring a directly-connected SIL-rated actuator............................................... 75
3.2.3 Application 2: Wiring external contactors: Separate P and M controlled contactors............. 76
3.2.4 Application 3: Wiring external contactors: Parallel connected between P and M.................. 76
3.2.5 Application 4: Wiring external contactors: Separate P and M output channels for each
contactor ................................................................................................................................ 77
3.2.6 Application 5: Separate circuits of a relay channel controlling external contactors............... 77
3.2.7 Application 6: Wiring a directly-connected SIL-rated actuator............................................... 78
3.2.8 Application 7: Wiring a directly-connected SIL-rated actuator, switching both load
conductors.............................................................................................................................. 78
4 Fail-Safe CPU and signal module (SM) installation ................................................................................. 79
4.1 S7-1200 Fail-Safe modules installation and removal ............................................................ 79
4.1.1 Mounting dimensions for S7-1200 Fail-Safe modules........................................................... 79
4.1.2 Guidelines for installing S7-1200 Fail-Safe devices .............................................................. 80
4.1.3 Installation and removal safety rules ..................................................................................... 83
4.1.4 Installing and removing an S7-1200 FC CPU........................................................................ 85
4.1.5 Installing and removing a signal module (SM)....................................................................... 87
4.1.6 Removing and reinstalling the S7-1200 terminal block connector......................................... 89
4.2 Fail-Safe system electrical design rules ................................................................................ 90
4.2.1 Safe functional extra low voltage requirement (power supplies and other system
components) .......................................................................................................................... 90
4.2.2 Power budget......................................................................................................................... 91
4.2.2.1 Connecting power to the S7-1200 system............................................................................. 91
4.2.2.2 Calculating a sample power requirement .............................................................................. 94
4.2.2.3 Calculating your power requirement ...................................................................................... 96
4.2.3 Fail-Safe module electrical characteristics and terminal assignments .................................. 97
4.3 Control system wiring guidelines ........................................................................................... 98
4.3.1 Guidelines for grounding and wiring ...................................................................................... 98
4.3.2 Grounding an S7-1200 system .............................................................................................. 99
4.3.3 Wiring an S7-1200 system................................................................................................... 100
4.3.4 Guidelines for lamp loads .................................................................................................... 101
4.3.5 Guidelines for inductive loads.............................................................................................. 101
4.4 Maintenance guidelines ....................................................................................................... 104
5 Fail-Safe signal module (SM) I/O configuration...................................................................................... 105
5.1 Configuring fail-safe SM I/O properties................................................................................ 105
5.2 Configuring common F-parameters ..................................................................................... 106
5.3 Configuring SM 1226 F-DI 16 x 24 VDC DI and channel parameters................................. 107

Table of contents
S7-1200 Functional Safety Manual
Manual, 02/2015, A5E03470344-AA 9
5.4 Configuring SM 1226 F-DQ 4 x 24 VDC DQ and channel parameters ................................111
5.5 Configuring SM 1226 F-DQ 2 x Relay DQ and channel parameters....................................114
6 Fail-Safe signal module (SM) diagnostics.............................................................................................. 115
6.1 Reactions to faults ................................................................................................................115
6.2 Fault diagnostics...................................................................................................................119
6.2.1 Diagnostics by LED display ..................................................................................................120
6.2.2 Fault types, causes, and corrective measures .....................................................................125
A Technical specifications......................................................................................................................... 131
A.1 General technical specifications ...........................................................................................131
A.1.1 Standards compliance ..........................................................................................................131
A.1.2 Fail-Safe standards and approvals.......................................................................................131
A.1.3 PROFIsafe compatibility .......................................................................................................131
A.1.4 General certifications ............................................................................................................132
A.1.5 Industrial environments.........................................................................................................135
A.1.6 Electromagnetic compatibility ...............................................................................................135
A.1.7 Surge immunity.....................................................................................................................136
A.1.8 Environmental conditions......................................................................................................137
A.1.9 Protection class.....................................................................................................................138
A.1.10 Degree of protection .............................................................................................................138
A.1.11 Rated voltages......................................................................................................................139
A.1.12 Reverse voltage protection ...................................................................................................140
A.1.13 DC outputs............................................................................................................................140
A.1.14 Relay electrical service life ...................................................................................................141
A.1.15 Internal CPU memory retention ............................................................................................142
A.1.16 Overvoltage Category III.......................................................................................................143
A.2 Fail-Safe CPU technical specifications.................................................................................144
A.2.1 Fail-Safe additions/exceptions..............................................................................................144
A.2.1.1 Areas of application ..............................................................................................................144
A.2.1.2 Restrictions with "READ_DBL" and "WRIT_DBL".................................................................144
A.2.1.3 Restrictions to configuring the retentive behavior of data blocks .........................................144
A.2.1.4 Probabilities of failure............................................................................................................144
A.2.1.5 Web server............................................................................................................................145
A.2.1.6 Using a memory card with the S7-1200 Fail-Safe CPU .......................................................147
A.2.2 CPU 1214FC.........................................................................................................................149
A.2.2.1 General specifications and features .....................................................................................149
A.2.2.2 Performance .........................................................................................................................151
A.2.2.3 Timers, counters and code blocks supported.......................................................................151
A.2.2.4 Digital inputs and outputs .....................................................................................................153
A.2.2.5 Analog inputs ........................................................................................................................155
A.2.2.6 CPU 1214FC wiring diagrams ..............................................................................................156
A.2.3 CPU 1215FC.........................................................................................................................160
A.2.3.1 General specifications and features .....................................................................................160
A.2.3.2 Timers, counters and code blocks supported.......................................................................161
A.2.3.3 Digital inputs and outputs .....................................................................................................163
A.2.3.4 Analog inputs and outputs ....................................................................................................165
A.2.3.5 CPU 1215FC wiring diagrams ..............................................................................................168
A.3 Fail-Safe signal module (SM) technical specifications .........................................................171
A.3.1 Fail-Safe signal modules (SM)..............................................................................................171

Table of contents
S7-1200 Functional Safety Manual
10 Manual, 02/2015, A5E03470344-AA
A.3.2 SM 1226 F-DI 16 x 24 VDC ................................................................................................. 171
A.3.2.1 Properties............................................................................................................................. 171
A.3.2.2 User data space................................................................................................................... 172
A.3.2.3 Specifications....................................................................................................................... 172
A.3.2.4 Wiring diagrams ................................................................................................................... 175
A.3.3 SM 1226 F-DQ 4 x 24 VDC ................................................................................................. 177
A.3.3.1 Properties............................................................................................................................. 177
A.3.3.2 User data space................................................................................................................... 177
A.3.3.3 Specifications....................................................................................................................... 178
A.3.3.4 Fuse and electronic overload protection.............................................................................. 180
A.3.3.5 Switching of loads ................................................................................................................ 181
A.3.3.6 Wiring diagrams ................................................................................................................... 183
A.3.4 SM 1226 F-DQ 2 x Relay..................................................................................................... 184
A.3.4.1 Properties............................................................................................................................. 184
A.3.4.2 User data space................................................................................................................... 184
A.3.4.3 Specifications....................................................................................................................... 185
A.3.4.4 Relay output circuits............................................................................................................. 187
A.3.4.5 Switching performance and service life of contacts............................................................. 188
A.3.4.6 Wiring diagrams ................................................................................................................... 190
A.4 Companion products............................................................................................................ 192
A.4.1 PM1207 power module ........................................................................................................ 192
B Ordering information .............................................................................................................................. 193
B.1 Fail-Safe CPUs .................................................................................................................... 193
B.2 Fail-Safe signal modules (SM)............................................................................................. 193
B.3 Other modules...................................................................................................................... 193
B.4 Spare parts and other hardware .......................................................................................... 194
B.5 Programming software......................................................................................................... 195
C Fail-Safe response times ....................................................................................................................... 197
C.1 Manual update note ............................................................................................................. 197
Glossary ................................................................................................................................................ 199
Index...................................................................................................................................................... 207

S7-1200 Functional Safety Manual
Manual, 02/2015, A5E03470344-AA 11
Product overview
1
1.1
Overview
SIMATIC Safety fail-safe system
The objective of safety engineering is to minimize danger to humans and the environment as
much as possible through use of safety-oriented technical installations without restricting
industrial production and the use of machines and chemical products any more than
necessary. The SIMATIC Safety fail-safe system is available to implement safety concepts in
the area of machine and personnel protection (for example, for emergency STOP devices for
machining and processing equipment).
What are fail-safe automation systems?
Fail-safe automation systems control processes that can achieve a safe state immediately as
a result of an unexpected operation or failure. These are fail-safe control processes where
an immediate shutdown to safe state does not endanger humans or the environment.
Fail-safe systems go beyond conventional safety engineering to enable far-reaching
intelligent systems that extend all the way to the electrical drives and measuring systems.
You use fail-safe systems in applications with advanced safety requirements. You can
resume production quickly following a safety-related interruption, using the improved fault
detection and localization provided in fail-safe systems through detailed diagnostic
information.
Achievable safety requirements
SIMATIC Safety fail-safe systems can satisfy the following safety requirements:
●Safety class (Safety Integrity Level) SIL 1 to SIL 3 in accordance with IEC 61508:2010
●Category 2 to 4, Performance Level (PL) a to e in accordance with EN ISO 13849-
1:2008/AC:2009 (ISO 13849-1:2006)

Product overview
1.1 Overview
S7-1200 Functional Safety Manual
12 Manual, 02/2015, A5E03470344-AA
Principles of safety functions in SIMATIC Safety
You implement functional safety using the hardware and firmware of the fail-safe CPUs and
signal modules (SM) in conjunction with the safety program downloaded by the software
(ES). The SIMATIC Safety system executes the safety function to bring the system to a safe
state or maintain a safe state in case of a dangerous event.
The fail-safe SMs ensure the safe processing of field information (for example, sensors for
emergency OFF pushbuttons and light barriers and actuators for motor control). The fail-safe
SMs have the required hardware and software components for safe processing, in
accordance with the required Safety Integrity Level (SIL).
You provide the safety function for the process through the application program that you
create or by the reaction of the fail-safe system to a fault. In the event of an error, if the fail-
safe system can no longer execute its actual user safety function, it executes the fault
reaction function (for example, the fail-safe system shuts down the associated outputs).
Example of user safety function
If an object interrupts the beam of a light curtain, the fail-safe system stops the motion in the
area protected by the light curtain (user safety function):
●The light curtain provides a "1" signal, perhaps redundantly, to say the light beam is not
broken or "0" to say the light beam is broken.
●The fail-safe digital input signal module (SM) acquires the signal from the light curtain and
provides the state to the fail-safe CPU through a safe communication protocol.
Redundant processors with mutual diagnostics in the fail-safe digital input SM provide a
high assurance that a "1" is provided only when correct and faults result in a "0" being
provided.
●The fail-safe CPU executes your user program for normal control of the motion and
includes your programmed safety logic that says a "1" from the light curtain is required to
enable the motion. Your programmed safety logic is encoded by the Engineering System
in redundant logic steps that gives a high assurance that any fault in CPU execution
results in an identified discrepancy and an output of "0". If the CPU fails to receive
verifiable communication from the fail-safe digital input SM in a required time, the fail-safe
CPU replaces the signal from the fail-safe digital input SM with "0".
●The fail-safe CPU delivers the results of the safety logic to the fail-safe digital output SM
through the safe communication protocol. A "1" signal from your safety logic enables
motion by turning an output channel ON, or a "0" turns the output channel OFF.
Redundant processors with mutual diagnostics in the fail-safe digital output SM provide a
high assurance that redundant output switches (series relay contacts or P/M 24VDC solid
state switches) are turned ON only when this is correct and at least one output switch
turns OFF if a fault occurs. If the fail-safe digital output SM fails to receive verifiable
communication from the fail-safe CPU in a required time, the fail-safe digital output SM
replaces the signal from the fail-safe CPU with "0" and turns outputs OFF.

Product overview
1.2 Hardware and software components
S7-1200 Functional Safety Manual
Manual, 02/2015, A5E03470344-AA 13
1.2
Hardware and software components
S7-1200 Fail-Safe CPUs and SMs
There are four fail-safe CPUs and three fail-safe signal modules (SM) in conjunction with the
S7-1200 V4.1 or later release:
●CPU 1214FC DC/DC/DC
●CPU 1214FC DC/DC/RLY
●CPU 1215FC DC/DC/DC
●CPU 1215FC DC/DC/RLY
●SM 1226 F-DI 16 x 24 VDC
●SM 1226 F-DQ 4 x 24 VDC
●SM 1226 F-DQ 2 x Relay
An S7-1200 fail-safe system requires a fail-safe CPU and fail-safe SMs. The integrated I/O
on the CPU is not fail-safe, but can be used to complete other control functions.
The S7-1200 standard signal modules (SM), communication modules (CM), and signal
boards (SB) can be used in the same system with fail-safe SMs to complete your application
control functions that do not require a rated Safety Integrity Level (SIL). Standard SMs that
are supported for use with fail-safe SMs have the article numbers (6ES7 --- ---32 0XB0) or
later.
The S7-1200 fail-safe CPUs do not support PROFIBUS or PROFINET distributed fail-safe
I/O.
Required software components
You require one of the following software combinations:
●STEP 7 Basic V13 SP1 or later with STEP 7 Safety Basic V13 SP1 or later
●STEP 7 Professional V13 SP1 or later with STEP 7 Safety Advanced V13 SP1 or later
STEP 7 Safety Advanced V13 SP1 or later and STEP 7 Safety Basic V13 SP1 or later are
the configuration and programming software packages for the SIMATIC Safety fail-safe
system. In both software packages, you receive the following:
●Support for configuring the fail-safe CPUs and SMs in the hardware and network editor of
the TIA portal
●Support for creating the safety program using LAD and FBD and integrating error
detection functions into the safety program
●Instructions for programming your safety program in LAD and FBD, which you are familiar
with from the standard user programs
●Instructions for programming your safety program in LAD and FBD with special safety
functions

Product overview
1.3 S7-1200 Fail-Safe CPUs
S7-1200 Functional Safety Manual
14 Manual, 02/2015, A5E03470344-AA
1.3
S7-1200 Fail-Safe CPUs
The fail-safe CPU executes your safety program along with standard applications programs.
Communication between the fail-safe CPU and the fail-safe signal modules is verified using
the PROFIsafe protocol.
Safety program
You can create a safety program using the program editor. You can program fail-safe
function blocks (FB) and functions (FC) in the Function Block Diagram (FBD) or Ladder
Logic (LAD) programming languages and create fail-safe data blocks (DB).
The fail-safe system performs a dual execution using coded processing. The fail-safe system
automatically performs safety checks and inserts additional fail-safe logic for error detection
and error response when the safety program compilation occurs. This ensures the detection
of failures and faults and appropriate execution of reactions to maintain the fail-safe system
in the safe state or bring it to a safe state.
In addition to the safety program, you can run a standard user program on the fail-safe CPU.
A standard program can coexist with a safety program in a fail-safe CPU. The fail-safe CPU
protects the safety-related data of the safety program from the unintentional effects of the
data of the standard user program.
WARNING
You cannot put an S7-1200 Fail-Safe system that provides safety-related functions into
operation after installation or modification until after you successfully commission the
safety-related functionality.
Death or serious personal injury and damage to machines and equipment may result if
proper precautions are not taken.
An S7-1200 Fail-Safe system that provides both safety-related functions and standard (non
safety-related) functions must not be put into operation in order to use the standard
functions before you successfully commission the safety-related functions, even if all fail-
safe signal modules go to the error state and thus remain safe.

Product overview
1.3 S7-1200 Fail-Safe CPUs
S7-1200 Functional Safety Manual
Manual, 02/2015, A5E03470344-AA 15
You can exchange data between the safety program and the standard user program in the
fail-safe CPU by means of bit memory or data of a standard DB.
1.3.1
Behavior differences between standard and fail-safe CPUs
1.3.1.1
Safety mode
Safety mode
In safety mode, the safety functions for fault detection and fault reaction are activated in the
following:
●Safety program of the fail-safe CPU
●Fail-safe signal modules (SM)
Safety mode of safety program
The safety program runs in the fail-safe CPU in safety mode. The safety program activates
all safety mechanisms for fault detection and fault reaction. You cannot modify the safety
program during operation in safety mode.
You can deactivate and reactivate the safety mode of the safety program. "Deactivated
safety mode" enables the safety program for online tests and changes as needed while the
fail-safe CPU is in RUN mode.
For SIMATIC Safety, you can switch back to safety mode only after an operating mode
change of the fail-safe CPU from RUN to STOP to RUN.
Safety message frame
In safety mode, the fail-safe CPU and fail-safe SMs consistently transmit data between them
in a safety message frame. The safety message frame in accordance with PROFIsafe
standards consists of the following:
●Process data (user data)
●Status byte/control byte (coordination data for safety mode)
●Virtual Monitoring Number (encoded in CRC signature, provides keep-alive mechanism
and detection of out-of-sequence messages)
●CRC signature

Product overview
1.3 S7-1200 Fail-Safe CPUs
S7-1200 Functional Safety Manual
16 Manual, 02/2015, A5E03470344-AA
1.3.1.2
Fault reactions
Safe state
The fail-safe concept depends on the identification of a safe state for all process variables.
The value "0" (de-energized) represents this safe state for digital fail-safe signal modules
(SM). This applies to both sensors and actuators.
Passivation
Passivation applies safe state values to the fail-safe SM or channel(s) instead of process
values when the fail-safe system detects faults. The safety function requires passivation of
the fail-safe SM or channel(s) in the following situations:
●When the fail-safe system starts up
●If the fail-safe system detects overall module faults, such as RAM or Processor failures
●If the fail-safe system detects errors during safety-related communication between the
fail-safe CPU and the fail-safe SM through the PROFIsafe safety protocol
(communication error)
●If fail-safe channel faults occur (for example, short-circuit and discrepancy errors or
internal faults of fail-safe input or output channels)
When passivation occurs in a digital input fail-safe SM, SIMATIC Safety provides the safety
program with safe state values (0) instead of the process data pending at the fail-safe inputs
in the input process image.
When passivation occurs in a digital output fail-safe SM, the SM sets the passivated
channel(s) to a value of (0).
Reintegration
Reintegration returns the process from passivation to a normal state after successful
diagnostics determine that the fault has cleared. After reintegration of a fail-safe digital input,
SIMATIC Safety again provides the process data pending at the inputs to the safety
program. For a fail-safe digital output , SIMATIC Safety again transfers the output values
provided by the safety program to the fail-safe outputs. Reintegration from safe state values
to process data can be automatic or require acknowledgement by your safety program. See
"Reactions to faults" (Page 115) for steps to reintegrate.

Product overview
1.3 S7-1200 Fail-Safe CPUs
S7-1200 Functional Safety Manual
Manual, 02/2015, A5E03470344-AA 17
Detection and response to faults
SIMATIC Safety systems detect and respond to faults in several different conditions:
●Faults in the fail-safe CPU hardware and firmware
●Faults in the fail-safe user program
●PROFIsafe communication errors caused by conditions in either the fail-safe CPU or SMs
●Fail-safe SM-wide errors such as microprocessor errors or memory errors
●Fail-safe SM channel errors such as discrepancy errors, wiring shorts, or internal channel
faults
Fail-safe CPU faults and fail-safe user program faults often result in the CPU operating mode
being set to STOP. You can reintegrate PROFIsafe communication faults once
communication is successfully restored. In most cases, you cannot reintegrate SM-wide
faults because these faults require the fail-safe SM to be power-cycled. You can often
reintegrate and return channel faults to proper operation by removing the fault and
reintegrating the channel.
Virtual monitoring number, cyclic interrupt time, and F-monitoring time
The following parameters are integral to fault reactions:
●Virtual monitoring number: The PROFIsafe protocol provides time monitoring and
detection of message sequence errors by means of a periodically-updated monitoring
number.
●Cyclic interrrupt time: The cyclic interrupt time is the interval by which the F-runtime group
executes and determines how often the fail-safe CPU sends the PROFIsafe frame to the
fail-safe SMs. When you add a fail-safe CPU to your project, STEP 7 creates Functional
Safety Organization Block 1 (FOB_1) (OB123 by default). FOB_1 contains the cyclic time
interrupt time, and you can configure the cyclic interrupt time (100ms by default).
●F-monitoring time: The F-monitoring time is the amount of time an SM or CPU waits for
an error-free communication including a new Virtual Monitoring Number before
passivating channels. You can configure the F-monitoring time. The fail-safe CPU and
SMs must receive a valid, current safety message frame with a valid monitoring number
within the configured F-monitoring time.
If the fail-safe system fails to detect a valid monitoring number within the F-monitoring time,
the fail-safe system passivates the fail-safe SM. Expiration of an SM's F-monitoring time
causes a transition to safe state for all F-inputs or F-outputs of the SM.
CRC (Cyclic Redundancy Check) signature
A CRC signature contained in the safety message frame protects the validity of the process
data in the safety message frame, the accuracy of the assigned address references, and the
safety-relevant parameters.
If a CRC signature error occurs during communication between the fail-safe CPU and fail-
safe SMs, the fail-safe system passivates the fail-safe SMs.

Product overview
1.3 S7-1200 Fail-Safe CPUs
S7-1200 Functional Safety Manual
18 Manual, 02/2015, A5E03470344-AA
1.3.1.3
Restart of fail-safe system
The operating modes of the SIMATIC Safety system differ from those of the standard system
only in terms of the restart characteristics.
Restart characteristics
When you switch a fail-safe CPU from STOP to RUN mode, the standard user program
restarts in the usual way. When you restart the safety program, the fail-safe system initializes
all data blocks with the F-Attribute with values from load memory. This is comparable to a
cold restart.
The fail-safe system attempts to reintegrate each fail-safe SM at restart. In contrast to the
standard user program, you cannot use startup OBs in the safety program.
1.3.1.4
Firmware update
Note
Fail-safe SM firmware (FW) updates
If 24 VDC power to the fail
-
safe SM is interrupted during the FW update, then the FW update
must be started again with a memory card.
You cannot complete re
-started FW updates from a web server or the TIA Portal.
Refer to the S7-1200 Programmable Controller System Manual
(http://support.automation.siemens.com/WW/view/en/91696622) for firmware update
procedures.

Product overview
1.4 S7-1200 Fail-Safe signal modules (SM)
S7-1200 Functional Safety Manual
Manual, 02/2015, A5E03470344-AA 19
1.4
S7-1200 Fail-Safe signal modules (SM)
1.4.1
Overview
Siemens intends for the S7-1200 fail-safe products to be used to help solve functional safety
in machine applications.
There are three fail-safe SMs in conjunction with the S7-1200 V4.1 or later release:
●SM 1226 F-DI 16 x 24 VDC
●SM 1226 F-DQ 4 x 24 VDC
●SM 1226 F-DQ 2 x Relay
Redundant two-processor functional safety design
The major difference between S7-1200 fail-safe and standard SMs is that failsafe SMs use
redundancy to achieve functional safety, including two processors that control fail-safe
operation. Both processors monitor each other and verify that they are executing the same
code at the same time, automatically test the I/O circuits, and set the fail-safe SMs to safe
state in the event of a fault. Each processor monitors internal and external power supplies
and module internal temperature and can passivate the module if an abnormal condition is
detected.
Safety-related input and output signals form the interface to the process. This enables direct
connection of single-channel and two-channel input signals from devices such as emergency
STOP buttons or light barriers. The fail-safe SM redundantly combines the safety-related
signals internally and passes the unified result on to the CPU in a fail-safe manner for further
processing.
The fail-safe CPU sends the safety-related outputs from the CPU to the fail-safe SM for each
individual output channel. Each output then sets two independent switches for each channel,
a P and M solid-state switch, or two independent relays.

Product overview
1.4 S7-1200 Fail-Safe signal modules (SM)
S7-1200 Functional Safety Manual
20 Manual, 02/2015, A5E03470344-AA
1.4.2
SM 1226 F-DI 16 x 24 VDC
The SM 1226 F
-DI 16 x 24 VDC is an S7-
1200 signal module (SM) for use in fail
-safe
applications. The inputs are rated for
connec-
tion to 24V
DC sensors/switches and 3/4-wire
proximity switches (for example, BEROs:
Siemens line of no
-touch sensors) and have
an EN61131
-2 type 1 input rating.
The module has two sensor supply outputs
that can each power eight external sensors
(inp
uts).
Inputs and test circuit
The F-DI consists of 16 input channels (F-DI a.0..a.7, F-DI b.0...b.7). You can configure
these inputs as sixteen one-out-of-one (1oo1) inputs (SIL 2/Category 3/PL d), eight one-out-
of-two (1oo2) inputs (SIL 3/Category 3 or Category 4/PL e), or combinations of 1oo1 and
1oo2 channels. One microcomputer monitors inputs a.0 to a.7, and the other microcomputer
monitors inputs b.0 to b.7. The corresponding channels from a and b (a.0, b.0), (a.1,
b.1)...(a.7,b.7) form a 1oo2 channel group . The "a" input, the first of the two inputs, conveys
the signal in a 1oo2 configuration. For example, if you wire I8.0 and I9.0 in a 1oo2
configuration and configure STEP 7 to use 1oo2 sensor evaluation, the signal appears at
only the I8.0 input when you close or open the circuit for both.
When you configure a channel group as 1oo2, the two controllers must sense the same input
change within a configured time. Otherwise, the two controllers detect a discrepancy error.
The F-DI reports the 1oo2 input back to the fail-safe CPU as a single input.
If you use a sensor supply output to provide power to a sensor, you can enable short-circuit
testing. The short-circuit test checks for shorts to plus voltage by periodically pulsing the
sensor output off and verifying that the associated input is off. This short-circuit test also
checks for shorts to the other circuit in a 1oo2 paired input because the test pulses the two
sensor outputs off at different times. The short-circuit test does not detect shorts between
inputs in the same sensor group.
The processors cooperate in providing internal test pulses to each others process input
circuits, after the initial field interface, to verify that sensing electronics are responsive to "1"
and "0" inputs.