Overview: Defining Fail-Safe and Standard Control Systems
A standard (non-safety) control system executes the user program deterministically and drives outputs based on inputs. Its single failure mode assumes a fault may produce an undefined output, leaving the process in an unsafe condition if not handled by external means. A fail-safe (F) system is engineered so that any single detected fault, or a defined combination of faults, drives the system to a predetermined safe state - typically a de-energize-to-trip action - while remaining diagnosable for the operator. This is not the same as inherent safety, which removes the hazard at source; fail-safe design is a protective layer on top of an existing hazard. (Reference: Fail-safe (Wikipedia overview).)
For industrial process and machine applications, the relevant functional safety standards are:
- IEC 61508 - Functional safety of E/E/PE systems (the umbrella standard).
- IEC 61511 - Functional safety - sector standard for the process industry (ESD, SIS).
- IEC 62061 - Functional safety of machinery-related E/E/PE systems.
- ISO 13849-1 - Safety of machinery, safety-related parts of control systems (PL a-e).
These standards define Safety Integrity Levels (SIL 1 to SIL 4 per IEC 61508) and Performance Levels (PL a to PL e per ISO 13849-1) and prescribe the probability of dangerous failure per hour (PFH) and safe failure fraction (SFF) targets the system must meet.
Standard System Behavior vs Fail-Safe Behavior
The differences are summarized in the table below. Each row reflects how a typical SIMATIC standard CPU behaves versus an F-CPU such as the S7-300F or S7-400F/HF.
| Attribute | Standard PLC | Fail-Safe PLC (F-System) |
|---|---|---|
| Single component fault effect | May propagate to process, undefined output possible | Detected and forced to safe state |
| Diagnostics | Basic, runtime errors only | End-to-end: CPU, backplane, IM, I/O module, channel, field wire, sensor/actuator |
| Programming language | LAD/FBD/ST/SCL/GRAPH (single compilation) | F-LAD/F-FBD/F-CFC compiled and signed separately; safety signature required |
| Program structure | OB/FB/FC/DB - one runtime | Two runtimes: standard user program + F-runtime (F-CPU) |
| Safety signature | Not required | Required for F-blocks; checksum and access protection enforced |
| Output on fault | Holds last value or undefined | De-energizes (passive safe) per F-I/O wiring |
| Redundancy | Optional, application-driven | Architectural choice: 1oo1, 1oo2, 2oo2, 2oo3, 3oo3 voting possible |
| Certification | None required for safety use | TÜV-certified subsystem, validatable against IEC 61508 SIL 2/3 |
| Typical use | Process control, HMI, motion, dosing | ESD, fire & gas, turbine control, burner management, machine safeguarding |
Siemens F-CPU Family and Software Packages
Siemens implements fail-safe control across the SIMATIC range. The two principal families for process and large-scale safety are the S7-300F and S7-400F/HF lines.
S7-300F with Distributed Safety
The S7-300F CPUs (e.g., CPU 315F-2 PN/DP, CPU 317F-2 PN/DP, CPU 319F-3 PN/DP) require the optional software package S7 Distributed Safety. This package adds the F-LAD and F-FBD editors, F-runtime group configuration, and the safety signature mechanism. The F-program runs in parallel with the standard program on the same F-CPU. F-I/O can be on PROFIBUS-DP or PROFINET via PROFIsafe profile.
- Configuration manual: SIMATIC S7 Distributed Safety - Configuring and Programming (Siemens Support entry ID 22099875, available on the Siemens Industry Online Support portal).
- Getting Started manual: S7 Distributed Safety Getting Started (entry ID 21669834).
S7-400F and S7-400FH with S7 F Systems
The S7-400F and S7-400FH CPUs require the S7 F Systems package. The F-program is written in CFC (Continuous Function Chart) and is compiled independently from the standard STEP 7 program. The FH variant adds fault tolerance through redundant CPUs (see Redundancy section).
- Product Information: Product Information S7 F Systems V5.2 SP4 (entry ID 11617902).
- Programming and configuring manual: SIMATIC Industrial Software S7 F/FH Systems - Configuring and Programming (entry ID 22099875).
Three Topologies: Standalone, Fault-Tolerant, and Fail-Safe
Engineers often conflate redundancy with safety. The two are independent attributes:
- Standalone system - a single PLC (or a single channel of a non-redundant controller). No provision for continued operation on component failure. The probability of dangerous failure is the sum of all dangerous failure rates of the path. Used where the process tolerates downtime and the risk is acceptable.
- Fault-tolerant system - redundant CPUs (e.g., S7-400H, S7-1500R/H) that continue producing outputs when one channel fails. Availability is the design goal. Fault-tolerant systems are not automatically fail-safe - they must also be engineered with the F-CPU profile and the F-program.
- Fail-safe system - the architecture, diagnostics, and voting are designed to bring the process to a safe state on detected faults. Certified to a SIL by an accredited body (TÜV Süd, TÜV Rheinland, TÜV Nord, exida).
The S7-400FH combines (2) and (3): a fault-tolerant, fail-safe controller for high-availability safety applications such as turbine control, fired-heater control, and offshore ESD.
Voting Architectures (1oo1, 1oo2, 2oo2, 2oo3, 3oo3)
When redundant sensors or redundant I/O channels are used, the safety logic must decide whether the process is safe. The notation MooN means N channels are used and M must agree to trip.
| Notation | Meaning | Effect on PFHd vs SFF | Typical use |
|---|---|---|---|
| 1oo1 | Single channel, single trip | Highest dangerous failure rate, no fault tolerance | Low-demand, SIL 1 only |
| 1oo2 | Any one of two trips | Higher spurious trip rate, lower dangerous failure rate than 1oo1 | High-integrity trip, low spurious cost |
| 2oo2 | Both of two must trip | Lowest dangerous failure rate, high spurious trip resistance | Fire & gas, reactor trip |
| 2oo3 | Two of three must trip | Best balance: tolerance to one bad channel, low dangerous failure rate, acceptable spurious | Turbine overspeed, ESD pushbuttons + level switch |
| 3oo3 | All three must trip | Lowest dangerous failure rate, but loss of any one disables trip | Rare; used where spurious trips are very costly |
For IEC 61508 SIL 2 the target PFHd is >= 10-7 to < 10-6 per hour. For SIL 3 it is >= 10-8 to < 10-7 per hour. A properly designed 2oo3 sensor vote with self-diagnostics and high SFF can achieve SIL 3.
End-to-End Diagnostics: Why Fail-Safe Is More Than a CPU Label
A common misconception is that adding an F-CPU is enough. In reality, the F-CPU is the brain of a fail-safe subsystem that must remain diagnosable from the sensor to the final element. The F-system continuously checks:
- CPU self-test - signature, watchdog, program flow, dual-channel disagreement of the two internal processors (1oo2D inside the F-CPU).
- Backplane and interface modules (IM) - PROFIBUS-DP / PROFINET line monitoring, IM155-6 PN HF/HS diagnostics.
- F-I/O modules - SM 326F (DI/DO) and SM 336F (AI) channel-level short-circuit, wire-break, and discrepancy diagnostics.
- Sensor and actuator wiring - line monitoring with a defined quiescent current (typically 4-20 mA plus a parallel 1 kohm test pulse for short/open detection) or NAMUR-style sensors.
- Valve partial stroke test - if a pneumatic shut-off valve is fitted with a positioner that supports PST, the F-program can periodically move the valve a small percentage of stroke to confirm it has not seized.
Emergency Shutdown (ESD) and Safety Instrumented System (SIS)
An ESD is a specific application of an SIS. The hierarchy in a typical process plant is:
- BPCS - Basic Process Control System (e.g., PCS 7 AS 410, DeltaV). Handles normal regulation. Not safety-rated.
- SIS / ESD - independent layer of protection. Detects hazardous conditions and brings the plant to a safe state. Typically built on F-CPUs (S7-400FH, AS 410S F, Triconex, HIMA, ABB 800xA High Integrity).
- Fire & Gas (F&G) - dedicated subsystem, often separate from ESD, certified to IEC 61511.
Per IEC 61511, the SIS must be physically, electrically, and communicatively separated from the BPCS. Shared I/O is not permitted; the F-CPU and the standard CPU communicate through a defined, validated interface (e.g., PROFIsafe over PROFINET, or OPC UA with safety guard).
Selecting the Right System: Decision Path
Use the following decision flow when specifying a controller for a given application. Replace "S7-300F" with the equivalent from your platform of choice (Allen-Bradley GuardLogix, Schneider M580 Safety, ABB AC500-S, Omron NX/NJ-S, Mitsubishi MELSEC iQ-R Safety).
- Perform HAZOP / LOPA. The Hazard and Operability study and Layer of Protection Analysis determine the required SIL for each independent protection layer.
- Calculate the loop PFHd. Sum the PFH of sensor + logic solver + final element. Compare to the SIL target.
- Decide on redundancy. If continuous operation matters as much as safety, choose fault-tolerant (S7-400H, S7-1500R/H) plus F-CPU (S7-400FH).
- Select the I/O. Choose F-DI/DO with line monitoring. For high-risk SIFs, use 2oo3 or 1oo2D sensors.
- Define the diagnostics depth. Specify wire-break, short-circuit, valve PST, and proof-test intervals.
- Plan the proof test. IEC 61511 requires periodic proof testing; the interval drives the SIL achievable. Typical offshore ESD proof-test interval: 1 year (8760 h).
- Document the safety lifecycle. Maintain the Safety Requirement Specification (SRS), the verification report, and the FAT/SAT records. TÜV auditors will request these for re-certification.
Commissioning and Verification Steps
Standard PLC commissioning focuses on functional acceptance. F-CPU commissioning requires additional steps that must be witnessed and signed off.
- Hardware acceptance - check every F-module's serial number against the BOM, verify the PROFIsafe address matches the configuration, and confirm the F-CPU firmware version matches the library compatibility list.
- F-program signature - generate the safety signature in the F-editor and store it in the change log. Any unauthorized change invalidates the signature and the CPU will refuse to run.
- Channel-by-channel test - force each F-DI to its safe state (e.g., open a NAMUR sensor) and confirm the F-DO de-energizes within the configured max fault time (typically 10-50 ms for SM 326F).
- Discrepancy test - for 1oo2 / 2oo3 sensors, simulate one channel stuck and confirm the voted output behaves per the voting table.
- Communication fault test - unplug the PROFINET cable, power down the remote IM, and confirm the F-CPU goes to safe state within the watchdog time (PROFIsafe watchdog, default 100 ms; set to 50 ms for SIL 3 SIFs).
- Power-loss test - remove primary power; on restoration, the F-CPU must come up in safe state, not in the last operating state.
- Acceptance test report - record every test result with timestamp, instrument, and signature.
Troubleshooting Matrix for F-System Alarms
| Symptom in TIA Portal / STEP 7 | Likely cause | Action |
|---|---|---|
| SF (System Fault) LED on F-CPU | F-I/O channel fault, PROFIsafe address mismatch, signature mismatch | Open the F-diagnostics buffer; compare configured vs actual PROFIsafe address; re-sign the F-program if a deliberate change was made. |
| BF (Bus Fault) on IM 155-6 PN | PROFINET line break, duplicate IP, MRP ring open | Check switch port LEDs; verify the device name is unique; if MRP is used, confirm one and only one manager is active. |
| Discrepancy fault on F-DI (channel) | Two sensors wired for 1oo2 disagree beyond discrepancy time | Increase the discrepancy time only after a HAZOP review; check field wiring for noise, ground loops, or a failed sensor. |
| Short-circuit / wire-break on F-DO | Load wiring fault, overload, or actuator coil failure | Measure the loop resistance with the output de-energized; replace the actuator if the solenoid is open-circuit. |
| F-CPU in STOP with "Safety program: signature missing" | F-block compiled but not signed, or wrong F-library version | Open the F-block properties, generate the safety signature, and download. Verify the F-library version matches the hardware catalog. |
| PROFIsafe channel passivated | Crc error, watchdog timeout, or address conflict | Acknowledge the passivation only after the root cause is fixed; the channel must re-integrate cleanly. |
Platform Comparison Notes
While the S7-300F / S7-400FH example is the focus, the principles apply across vendors. Allen-Bradley GuardLogix (1756-L7xS / L8xS) uses Studio 5000 Logix Designer with a safety task and safety signature. Schneider Electric Modicon M580 Safety uses EcoStruxure Control Expert with safety libraries. ABB AC500-S uses Safety Builder. All implement a two-channel architecture inside the CPU and a separate signed safety program; all require periodic proof testing to maintain SIL.
Key Formulas and Limits
- Average Probability of Failure on Demand (PFDavg) for a low-demand SIF: PFDavg = (lambdaDU × Tproof) / 2, where lambdaDU is the dangerous undetected failure rate (per hour) and Tproof is the proof-test interval in hours.
- PFH (high-demand or continuous mode): PFH = sum of lambdaDU across the SIF.
- SIL budget: PFDavg for SIL 1 = 10-2 to 10-1; SIL 2 = 10-3 to 10-2; SIL 3 = 10-4 to 10-3.
- Safe Failure Fraction (SFF) = (lambdaS + lambdaDD) / (lambdaS + lambdaD). Hardware fault tolerance and SFF determine the maximum SIL achievable for a given architecture per IEC 61508-2 Tables 2 and 3.
FAQ
What is the practical difference between a fail-safe system and a fault-tolerant system?
A fail-safe system forces the process to a defined safe state on detected fault; a fault-tolerant system keeps running on a redundant channel. They are independent attributes. The Siemens S7-400FH is both: fault-tolerant (redundant CPUs) and fail-safe (F-runtime). A plain S7-400H is fault-tolerant only - it is not certified for safety use without the F-program.
Do I need a TUV-certified CPU for every safety application?
Yes, for IEC 61508/61511 SIL 1-3 applications the logic solver must be a certified subsystem. Siemens F-CPUs (S7-300F, S7-400F, S7-400FH, S7-1500F) and the F-I/O (e.g., SM 326F, ET 200SP HF) are TUV-certified to IEC 61508 SIL 2/3. The certification covers the hardware and the F-runtime together; the user-written F-program is the integrator's responsibility and is validated through a documented acceptance test.
What voting should I choose for a SIL 3 ESD?
For SIL 3 high-demand applications, 2oo3 voting of sensors and 2oo2 of final elements is the most common pattern. It tolerates one bad sensor, keeps the dangerous failure rate low, and gives an acceptable spurious trip rate. Always confirm by calculating the loop PFH or PFD with the documented failure rates of the actual hardware.
How often must I proof-test a Safety Instrumented Function?
IEC 61511 requires proof testing at a defined interval to maintain the SIL. Typical offshore ESD intervals are 6-12 months. The required interval is a function of the dangerous undetected failure rate and the target PFD. Increasing the interval pushes the SIF toward a lower SIL unless the components have very low lambdaDU.
Can I share I/O between a standard PCS 7 AS and the safety AS?
No. IEC 61511 requires physical, electrical, and communicative separation between the BPCS and the SIS. Use dedicated F-I/O on the safety AS and a defined, validated interface (PROFIsafe or OPC UA with safety guard) to exchange non-safety data.