Reducing SM 326F Safety DI Delay: S7-400H F-Cycle Time Tuning

1. Problem Definition: 2-3 Second Safety DI Response on S7-400H

A field report describes an S7-400H fault-tolerant station (CPU 412-5H) using SIMATIC SM 326F safety digital input module 6ES7326-1BK02-0AB0 in which every Safety DI signal exhibits a 2-3 second response delay even though the standard program is running in OB35. Two critical clarifications frame the troubleshooting path:

1. The F-program does not execute in the standard OB35. It runs in an F-runtime group that the Distributed Safety (or S7 F/FH Systems) editor assigns to a cyclic interrupt OB. The cyclic time of that OB - not the user's standard OB35 - is what determines the safety scan rate.
2. SM 326F is an ET 200M safety module, not a centralized S7-400 module. The 412-5H communicates with it through PROFIsafe on top of PROFIBUS DP or PROFINET IO. The PROFIsafe watchdog adds deterministic transport latency on top of the F-cycle time.

A 2-3 second end-to-end response on a properly configured F-system is an order of magnitude larger than the typical 10-100 ms total. The delay almost always traces to one of the following configuration errors:

• F-runtime group assigned to a cyclic interrupt OB with a 2000-3000 ms period.
• MaxCycleTime of the F-runtime group set in seconds instead of the typical 100 ms default.
• PROFIsafe F_WD_Time (watchdog) set to 2000-3000 ms.
• SM 326F input filter Input delay set to 50 ms on every channel combined with debounce in the safety program.
• PROFIBUS DP / PROFINET update time scaled to 1-2 s on the ET 200M station.

This article walks through the architecture, the timing model, the parameter paths inside the F-Configuration editor, and the verification procedure using STEP 7 / TIA Portal online diagnostics.

2. Hardware Architecture: CPU 412-5H, ET 200M, SM 326F

The configuration described in the source does not place the SM 326F in the central rack of the S7-400H. Central S7-400 I/O is the SM 4xx family. The SM 326F belongs to the S7-300 family and is mechanically and electrically designed for either the S7-300 central rack (where it cannot be used with an F-CPU without an F-link) or, more commonly, the ET 200M distributed I/O station. With CPU 412-5H, the realistic topology is an ET 200M with IM 153-2 / IM 153-4 PROFINET or PROFIBUS interface module, hosting the SM 326F, connected to the H-CPU via PROFINET IO or PROFIBUS DP, and using the PROFIsafe profile (V2.4 on PROFIBUS, V2.6.1 on PROFINET).

2.1 Module Reference

2.2 SM 326F (6ES7326-1BK02-0AB0) Key Parameters

2.3 Topology Diagram

3. How the F-Runtime Group and PROFIsafe Affect Cycle Time

An F-runtime group is the smallest unit of execution that contains one or more safety-related function blocks (F-FB / F-FC / F-DB). The group is mapped to a cyclic interrupt OB whose period becomes the F-scan time. The F-Configuration tool defines three principal timing parameters per group:

The 412-5H typically runs Distributed Safety (STEP 7 V5.x) or S7 F/FH Systems (STEP 7 V5.x, fault-tolerant extension) as the engineering tool, or the safety editor in TIA Portal with the F-CPU enabled. The F-runtime group editor exposes both the MaxCycleTime and the OB assignment.

4. Root Cause Analysis: Why Safety DI Signals Lag 2-3 Seconds

A 2-3 second total response in a properly installed F-system is almost never a wiring or hardware fault - the SM 326F itself cycles in roughly 5 ms. The delay sits in one or more of the following configuration parameters:

4.1 OB Cycle Time Set in Seconds

If the cyclic interrupt OB assigned to the F-runtime group (commonly OB35, but the editor allows OB30-OB38) is configured with a period of 2000 ms or 3000 ms, every safety DI will appear to lag 2-3 s because the F-CPU only polls the F-input process image once per cycle. This is the single most common cause of the symptom in the field report.

4.2 PROFIsafe Watchdog Oversized

PROFIsafe uses an F_WD_Time value that is doubled from the configured value to form the actual transport timeout. If F_WD_Time is set to 2000-3000 ms, the system will wait that long before declaring a telegram lost. While it is waiting, the F-input value is buffered; the F-program does not see the new state until the next valid telegram is processed. The default in STEP 7 is conservative; users often increase it to "make passivation stop happening," which silently slows the response.

4.3 ET 200M PROFINET / PROFIBUS Update Time

On PROFINET, the IM 153-4 PN has an "Update time" parameter that determines how often the device is polled. If the user selected 1 s or 2 s (for example, by setting the send clock to 1 ms and the reduction ratio to 1000), the F-input process image will lag accordingly. The Siemens recommendation is to keep the update time of an F-device at or below the F-cycle time, otherwise the F_WD_Time will trip passivation.

4.4 Input Filter on SM 326F

Each channel of the SM 326F offers a selectable input delay: 0.5 ms, 3 ms, 15 ms, or 50 ms. A misconfiguration to 50 ms on all 24 channels only adds 50 ms, but combined with a 2 s OB cycle and a 2 s PROFIsafe watchdog, the chain easily exceeds 4 s, which the operator often rounds to "2-3 seconds."

4.5 Debounce / Discrepancy Logic in the Safety Program

F-input blocks such as F-I-DI from the F-library contain a discrepancy window for 1oo2 / 2oo2 evaluation. If the discrepancy time is set in seconds instead of milliseconds, the block will not propagate the new state until the discrepancy window elapses without disagreement.

4.6 Diagnostic Re-evaluation Loop

If the F-CPU has a redundant partner CPU and the two are in different run states, the H-sync link can briefly hold the F-input value at the last synchronized value until both CPUs agree. This normally resolves in tens of milliseconds; persistent 2-3 s lags indicate a sync-link problem rather than tuning.

5. Adjusting MaxCycleTime in the F-Configuration Interface

The field report asks how to edit the MaxCycleTime of the F-runtime group. The path depends on the engineering tool.

5.1 STEP 7 V5.x with Distributed Safety / S7 F/FH Systems

1. Open the SIMATIC Manager and the S7 project.
2. Select the F-CPU in the project tree.
3. Open Safety -> F-Configuration (Distributed Safety) or Safety -> F-Runtime Groups (S7 F/FH Systems).
4. Highlight the F-runtime group that owns the safety DI tags.
5. Open the properties dialog. The field "Maximum cycle time of the F-runtime group (ms)" exposes the F-MAX_CYC_TIME value.
6. Set it to a value greater than the worst-case OB execution but less than any PROFIsafe watchdog. A typical safe choice is 200 ms for a 412-5H running OB35 at 100 ms.
7. Save and download (with F-password if protected).

5.2 TIA Portal with S7 F-CPU

1. Open the TIA Portal project.
2. Expand the F-CPU in the project tree.
3. Open Safety Administration -> F-runtime groups.
4. Select the relevant F-runtime group; the right-hand pane shows Cycle time (the OB period) and Maximum cycle time.
5. Reduce Cycle time to 100 ms if it is currently in the second range.
6. Set Maximum cycle time to a value of 2x the cycle time (e.g. 200 ms).
7. Compile and download hardware configuration and software to the F-CPU.

5.3 Changing the OB Period

In HW Config (STEP 7 V5.x) or Device Configuration (TIA Portal), open the properties of the cyclic interrupt OB that hosts the F-runtime group (commonly OB35) and change the Cycle time field. For example:

The change requires a STOP / RUN transition of the F-CPU, or an H-sync resynchronization on the 412-5H pair.

6. Parameter Reference: F-Runtime Group Settings

7. Verification: Reading Online Cycle Diagnostics and PROFIsafe Status

After each parameter change, verify the actual measured cycle against the configuration:

7.1 STEP 7 V5.x Online

1. Go online to the F-CPU.
2. Open PLC -> Module Information -> Performance Data on the CPU.
3. Read the OB35 execution time and compare to the configured cycle.
4. Open Safety -> F-Diagnostics for any passivation events and PROFIsafe communication errors.

7.2 TIA Portal Online

1. Go online to the F-CPU.
2. Open Online & Diagnostics -> Cycle time for the CPU.
3. Open Safety Administration -> Diagnostics for F-runtime group status and PROFIsafe status per slot.

7.3 Reading PROFIsafe Watchdog State

In HW Config, right-click the SM 326F slot, choose PROFIsafe, and read the live F_WD_Time currently in use. If the field shows a value in the second range, the parameter is misconfigured.

7.4 Functional Test

Force a Safety DI transition and timestamp the response in the F-application via SFB 37 / SFB 38 or via a non-safety timestamp. The expected end-to-end response after tuning should be:

8. Common Pitfalls and Edge Cases

9. Calculating the Safety Response Time

The safety response time from sensor transition to safe actuator de-energization is the sum of the deterministic stages plus the worst-case wait for the next cycle of the slowest stage. A conservative field formula:

Where:

• T_filter = SM 326F input delay (0.5 - 50 ms)
• T_module = SM 326F module conversion (~5 ms)
• T_PROFIsafe = PROFIsafe transport = PROFINET update time + telegram jitter (1 - 10 ms typical)
• T_F_cycle = F-runtime OB period (100 ms default; up to 2x the average wait)
• T_logic = F-program execution (1 - 20 ms for a typical 412-5H F-application)
• T_output_filter = F-DO output filter (0.5 - 50 ms)
• T_output = actuator drop-out time

With the recommended 100 ms F-cycle, 3 ms input filter, 4 ms PROFINET update, and 5 ms output filter:

T_response = 3 + 5 + 8 + 100 + 10 + 5 = 131 ms (typical)
Worst case = 3 + 5 + 8 + 200 + 20 + 50 + actuator = ~300 ms

With a 2000 ms OB period (the misconfiguration in the field report):

That matches the 2-3 second symptom precisely and confirms the OB period as the dominant contributor.

10. Related Standards and Documentation

• IEC 61508 - Functional safety of E/E/PE systems, defines SIL 1-3 and the architecture constraints that drive the use of an F-CPU and F-I/O.
• IEC 62061 - Safety of machinery: functional safety of E/E/PE safety-related systems. Specifies SILCL 3 and the PFHd calculation that the F-runtime group must meet.
• ISO 13849-1 - Safety of machinery: safety-related parts of control systems. Defines PL e / Cat 4 to which the SM 326F is rated.
• PROFIsafe profile V2.6.1 - The transport protocol encapsulating safety telegrams over PROFINET IO. Defines the F_WD_Time semantics.

When evaluating PFHd for the safety function, the F-cycle time directly affects the diagnostic test interval and must remain within the values assumed during the SISTEMA / PAS calculation. Reducing the cycle time below the assumed value is safe but increases CPU load; raising it can invalidate the safety case.

11. Frequently Asked Questions