Overview
The SIMATIC S7-1500 F-CPU family integrates safety functions directly into the standard controller, but the failsafe I/O channels do not live in the central rack. Unlike the S7-300F, which accepts SM 326F / SM 336F modules directly in the base unit, the S7-1500 central I/O bus has no F-capable modules. To close the loop between an F-CPU and safety devices, you must deploy a distributed I/O station (ET200SP, ET200MP, or ET200M) with F-modules and bind it to the F-CPU through PROFIsafe over PROFINET IO.
According to the SIMATIC S7-1500 / ET 200MP Manual Collection, "Fail-safe digital input modules detect the signal states of safety-related sensors and send the relevant safety frames to the F-CPU," which confirms the distributed-I/O model is the only supported topology for S7-1500 F-CPUs at the time of writing. The same reference also describes passivation behavior: "If the F-CPU detects an error relevant to safety, it passivates the relevant fail-safe channel or the entire fail-safe module."
Prerequisites
Before commissioning failsafe I/O on an S7-1500, confirm that the following hardware, firmware, and software items are present and compatible:
- F-CPU: One of the F-capable S7-1500 CPUs (CPU 1510F, 1511F, 1512F, 1513F, 1515F, 1516F, 1517F, or 1518F). Cross-check the firmware version against the TIA Portal release you are using; mismatched firmware is a common reason for the F-CPU to refuse to start the safety program.
- SIMATIC Safety STEP 7 option: Required in TIA Portal to compile the F-runtime group and the F-blocks. Without this option the F-CPU will not accept the safety program download.
- Distributed I/O: At least one ET200SP head module (IM 155-6 PN HF, recommended firmware level for fail-safe applications) with F-modules, or an ET200M station with an IM 153-2 PN HF and SM 326F / SM 336F.
- PROFINET topology: Switched PROFINET network with a deterministic update time. F-modules default to PROFINET send clock relationships; verify with the GSD file that the watchdog time exceeds your worst-case send clock.
- Sensor / actuator wiring: Dual-channel sensors for SIL 2 / PL d, dual-channel wiring for SIL 3 / PL e (cross-circuit monitoring by the F-DI when using 24 V DC discrepant evaluation).
- Documentation references: The SIMATIC S7-1500 / ET 200MP Manual Collection and the Safety Programming Guideline for SIMATIC S7-1200/1500.
Architecture: Why S7-1500 Has No Central F-I/O
The S7-1500 backplane was designed around high-speed deterministic standard I/O. The F-CPU itself contains two independent processing sections - the standard user program and the safety program - but the I/O bus is shared with the standard modules. Adding F-modules to the central rack would have forced every slot to honor the PROFIsafe safety frame format and extended the central diagnostics model. Siemens solved the problem differently: the F-CPU exchanges PROFIsafe safety frames over PROFINET with F-modules that live in a remote station.
The PROFIsafe layer (V2 mode on PROFINET IO) provides the black-channel principle: the standard PROFINET transport is treated as an unreliable medium, and the F-module / F-CPU pair adds authentication, sequence numbering, and CRC. The Safety Programming Guideline confirms: passivation and reintegration are managed by the F-runtime group, not by the central PLC rack.
Available F-I/O Platforms
Three ET200 families are typically considered for an S7-1500 F project. The trade-offs are summarized below.
| Platform | F-Module Family | Channel Density | Replacement | Typical Use |
|---|---|---|---|---|
| ET200SP | F-DI 8x24VDC HF, F-DQ 4x24VDC/2A HF, F-AI 4xI, F-AO 4xI, F-RQ 1x24VDC | High (per BaseUnit) | Module-level, no station stop | New projects, compact machines |
| ET200MP | F-modules that share the S7-1500 form factor (e.g., SM 15xF) | Medium | Module-level | Large distributed racks aligned with S7-1500 standard I/O |
| ET200M | SM 326F (DI/DO), SM 336F (AI) | Low (legacy) | Station-level (entire IM stops) | Migrating S7-300F projects |
For new builds, the ET200SP HF head module is the recommended platform because individual F-modules can be hot-swapped with a new slot, and the F-PM-E power module enables the safety-related load voltage to be shut down without removing a sensor wire.
PROFIsafe Addressing on the S7-1500
Each F-module needs a PROFIsafe address. With ET200SP / ET200MP, TIA Portal assigns the F-address automatically when you set the module's F-source address to the F-CPU and select the slot. With ET200M SM 326F / SM 336F you must set the F-address using the DIL switch on the module; values 1 to 1022 are valid, 0 and 1023 are reserved by PROFIsafe.
The address assignment creates the F-I/O DB automatically. The standard tags exposed include:
-
QBAD– 1 = module passivated, 0 = valid process data -
ACK_REQ– 1 = operator must acknowledge for reintegration -
IPAR_EN– 1 = substitute values are output (digital outputs) -
DIAG– 1 = diagnostic event pending -
VALUE / INPUT / OUTPUT– process image of the fail-safe channels
All F-I/O DBs are compiled into the F-runtime group, which is generated by the SIMATIC Safety add-in in TIA Portal. The F-CPU executes the safety program within a fixed time slice (the F-monitoring time). If the safety program runs longer than the F-monitoring time, the entire F-runtime group is passivated and the F-CPU enters STOP / STOP-with-reintegration depending on configuration.
Step-by-Step: Configuring ET200SP F-Modules with an S7-1500 F-CPU
- Insert the F-CPU and add PROFINET. In Devices & Networks, drag the F-CPU to the project. Open Properties > PROFINET interface > Ethernet addresses and set an IP and a PROFINET device name.
- Add an ET200SP head module. Place an IM 155-6 PN HF on the same PROFINET subnet, assign the head module a unique device name, and assign it to the F-CPU as IO controller.
- Insert the F-PM-E first in the ET200SP rack. This power module separates the load group supply from the head module and is mandatory if any F-DQ or F-AO module needs to be safely de-energized.
- Add F-DI / F-DQ modules. Drag the F-DI 8x24VDC HF and F-DQ 4x24VDC/2A HF modules into the slot list. In the inspector, set the Operating mode to Safety mode, choose the channel-specific evaluation (1oo1, 1oo2, 2oo2), and assign the F-source address to the F-CPU.
- Configure the F-monitoring time and the F-runtime group. Open Safety Administration > F-runtime group 1. Set the F-monitoring time to at least twice the worst-case execution time of the safety program. Increase the figure for every 10 ms of PROFINET send clock you add to the topology.
- Compile and download. The compile pass generates the F-I/O DBs, the F-runtime group OB (typically OB 35), and the F-CPU signature. Download the hardware configuration to both the F-CPU and the ET200SP head module, then download the safety program in a separate step that requires the Safety password.
- Assign the PROFIsafe addresses. For ET200SP the address is set automatically by the F-CPU during startup; verify that F-Parameters > F_source_address on each module matches the F-CPU index in the project.
Passivation and Reintegration
Passivation is the mechanism that protects a process from a single point of failure. When the F-CPU detects a discrepancy, a PROFIsafe CRC error, a channel-level diagnostic, or a watchdog timeout, it passivates the affected F-module:
- Digital F-DI: Process values are reported as 0; the user's safety program sees a passivated input.
-
Digital F-DQ: Outputs are forced to the safe state (typically 0 V on the load).
IPAR_ENis set so the standard program can drive a substitute value if the application requires it. -
Analog F-AI / F-AO: Substitute values are signaled via
IPAR_EN; the F-DB supplies the configured safe value.
Reintegration happens automatically once the F-CPU confirms that the module is error-free. If the module has ACK_REQ = 1, the user must issue a positive edge on the ACK tag of the F-I/O DB. The Safety Programming Guideline warns that for F-modules with manual acknowledgment, the F-program must use an edge-triggered bit (not a level) - a level would re-passivate the module immediately if a new error is detected.
Discrepancy, Short-Circuit, and Cross-Circuit Detection
For SIL 3 / PL e, two redundant sensor channels are wired to one F-DI. The module supports the following evaluations:
| Evaluation | Sensor Wiring | Discrepancy Time | Typical Application |
|---|---|---|---|
| 1oo1 (single channel) | 1 sensor on 1 input | n/a | SIL 1 / PL c; not for E-stop with high demand rate |
| 1oo2 (one of two) | 2 sensors on 2 inputs, parallel | Configurable, e.g. 500 ms | SIL 2 / PL d; cross-circuit monitored by the module |
| 2oo2 (two of two) | 2 sensors on 2 inputs, both must agree | Configurable, e.g. 500 ms | SIL 3 / PL e; channel-equalized safety |
Set the Discrepancy time for the F-DI channel so that the slowest mechanical switch can toggle without a false passivation. For industrial e-stop buttons with bounce, 300 ms to 500 ms is typical. For light curtains with electronic outputs, 100 ms is enough.
Commissioning Checklist
- Read the diagnostic buffer of the F-CPU and the F-module in TIA Portal Online & Diagnostics. There must be no entry of type F-Channel error after a clean power cycle.
- Force a passivation by unplugging one sensor channel. Verify that the F-CPU transitions the affected F-DB to
QBAD = 1and that downstream F-DQ outputs drop to the safe state. - Reconnect the channel. If the F-module was set to manual acknowledgment, confirm that the
ACKtag produces a positive edge in the F-runtime group. If set to automatic, verify thatQBADclears without operator action. - Run the Safety Mode in TIA Portal and trigger each F-I/O. Confirm that the standard program only sees process values that match the safety program's view of the world.
- Check the F-monitoring time. Use the F-CPU's Cycle time online view. If the F-runtime group reads within 80 percent of the configured F-monitoring time, increase the safety cycle time or shorten the F-program.
Troubleshooting Matrix
| Symptom | Likely Cause | Corrective Action |
|---|---|---|
| F-CPU stays in STOP with diagnostic "F-monitoring time exceeded" | F-runtime group OB is overloaded, or PROFINET send clock is too short | Increase F-monitoring time; raise PROFINET update time to 1 ms or 2 ms; review F-program for heavy array copies |
| F-DI channel stays passivated after wiring check | Discrepancy time too short; sensor contact bounce | Raise discrepancy time to 500 ms; replace mechanical switch; verify wiring polarity |
Output F-DQ does not energize despite QBAD = 0
|
F-PM-E not installed, or load voltage missing on the F-PM-E BaseUnit | Insert F-PM-E and apply 24 V to the F-PM-E segment; verify in TIA Portal that the module is mapped to a powered slot |
| TIA Portal reports "PROFIsafe address 0 invalid" | ET200M F-module DIL switch left at factory default (0) | Set DIL switch to a unique address in 1-1022, then run Assign F-address from the F-CPU |
| Standard program reads 0 from F-DI DB even though hardware input is 1 | F-DI is still passivated; QBAD not checked in the standard program |
Evaluate QBAD in the standard logic; if necessary, use ACK to reintegrate |
| Online download of safety program fails with "password required" | Safety Administration password lost or mismatched | Reset per Siemens support procedure; re-enter password in TIA Portal Safety Administration |
Migrating from S7-300F / S7-400F to S7-1500 F
When a legacy project uses SM 326F / SM 336F modules in an ET200M station, the same F-DBs and F-blocks can be ported with TIA Portal's migration tool. Watch for the following field-proven caveats:
- PROFIsafe V2 is the default on S7-1500; legacy S7-300F installations may still use V1. Mix-mode is supported by the F-CPU, but each F-module has to be configured for its own V-mode.
- SM 326F replacement is station-level: when one module is hot-swapped, the whole ET200M IM 153-2 stops PROFINET communication briefly. On an S7-1500F + ET200SP topology, replacement is module-level only.
- F-runtime groups are compiled with the SIMATIC Safety option, which is a separate add-in. If migrating to a project that was built with STEP 7 V5, import the F-blocks into the TIA Portal library and recompile them in the F-runtime group editor.
Safety Certifications and Standards
ET200SP F-modules and the S7-1500 F-CPU family are designed to support applications up to SIL 3 (IEC 61508 / IEC 62061) and PL e (ISO 13849-1). Specific module certifications, the proof-test interval, and the maximum achievable SIL/PL for a given configuration are listed in the manufacturer declarations of conformity, which must be re-verified for the exact module and firmware combination used in the project.
For a curated list of common safety-related questions, the SIMATIC S7-1200/S7-1500 Safety FAQ (entry ID 90939626) in Siemens Industry Online Support is the canonical starting point.
FAQ
Does the S7-1500 support failsafe I/O in the central rack?
No. The S7-1500 F-CPU family runs the safety program internally, but F-modules are not available in the central rack. You must connect an ET200SP, ET200MP, or ET200M station to the F-CPU over PROFINET and bind the F-modules through PROFIsafe (see the SIMATIC S7-1500 / ET 200MP Manual Collection).
Which ET200 is recommended for new S7-1500 F projects?
ET200SP with an IM 155-6 PN HF head module and F-DI 8x24VDC HF / F-DQ 4x24VDC/2A HF modules is the current recommended platform because individual F-modules can be replaced without stopping the station, and the F-PM-E power module provides a safety-related load voltage group.
What is a passivated F-module and how is it reintegrated?
Passivation is the F-CPU's response to a detected safety error: the affected F-channel is reported as invalid (QBAD = 1) and outputs are forced to the safe state. Reintegration can be automatic once the error clears, or manual via a positive edge on the ACK tag of the F-I/O DB. The exact procedure is in the Safety Programming Guideline for SIMATIC S7-1200/1500.
What is a typical F-monitoring time on an S7-1500 F-CPU?
A common starting point is 100 ms to 200 ms. The F-monitoring time must always be at least twice the worst-case execution time of the F-runtime group, and should be increased by 10-20 ms for every additional 1 ms PROFINET send clock you add to the topology. Verify the configured value against the F-CPU's online cycle-time statistics after the first commissioning pass.
Can an S7-1200F be used for PROFIsafe I/O on an S7-1500 F-CPU?
No. PROFIsafe I/O is bound to a single F-CPU per slot. An S7-1200F has its own safety program and cannot host F-I/O on behalf of an S7-1500F. If a small F-CPU is required in the same cell, the S7-1200F can be a stand-alone safety controller; for shared F-I/O, deploy the F-I/O under the S7-1500F only.