S7-1500 1oo2 F-I/O Accessing Individual Channel Values in TIA

Overview

On a SIMATIC S7-1500 fail-safe system, two physical inputs that belong to a 1oo2 (1-out-of-2) sensor evaluation are combined into a single channel pair by the F-I/O module firmware. The safety result is exposed to the F-CPU under the I/O address of the channel with the lower channel number. Accessing the second channel's process value or value status from the safety program is technically still possible, but the TIA Portal compiler rejects or warns about it because the safety evaluation has already consolidated both channels into the lower-numbered address.

This is a deliberate change from the classic S7-300 / S7-400 safety model (F-I/O on ET 200M with F-Configuration in STEP 7 V5.x), where the same restriction existed but produced different diagnostic messages. Engineers migrating F-I/O logic from S7-300F / S7-400F to S7-1500F / ET 200MP F / ET 200SP F must understand the addressing rules or they will lose diagnostic information, generate spurious passivations, or fail the safety program signature check.

Key Technical Question

When a fail-safe digital input module is configured for 1oo2 evaluation with discrepancy analysis (F-block instance EV1oo2DI in the safety program library), the engineer sees two bits in the process image of the F-I/O. The natural assumption is that bit 0 and bit 1 of the input word correspond to the two physical channels. The reality:

• Bit 0 (channel 0) of the input word carries the evaluated 1oo2 result.
• Bit 1 (channel 1) is the raw input of the second physical channel and is used internally by the F-module for discrepancy, cross-circuit, and short-circuit diagnostics.
• Only the lower channel's address (channel value + value status) may be referenced in the F-program. A second reference produces a compile warning in the safety program editor.

1oo2 Sensor Evaluation: How It Works

The 1oo2 evaluation requires two sensor signals that must agree (1oo2 = "1 out of 2") or, in the inverse interpretation, that both signals must be in the safe state (0oo2) for the safety function to release. In Siemens terminology, the F-block EV1oo2DI implements a 1oo2 evaluation with:

• Discrepancy time monitoring
• Discrepancy error handling (passivation, acknowledge)
• Value status (VS) integration
• Optional integration test pulse sources

The block is provided by the global safety library STEP 7 Safety and is automatically inserted into the safety program when you assign a 1oo2 channel pair in the F-I/O device configuration. The relevant documentation section is the SIMATIC Safety manual, chapter 13.3.6 EV1oo2DI: 1oo2 evaluation with discrepancy analysis (STEP 7 Safety V14 SP1), valid for TIA Portal V14 SP1 and later, including V15, V15.1, V16, V17, V18, V19, and V20. The current online reference is hosted on the Siemens TIA Portal documentation portal.

Affected Hardware: F-I/O for S7-1500

The following F-I/O modules support 1oo2 evaluation of digital inputs. All are usable only in safety mode on S7-1500 / ET 200MP / ET 200SP stations; they cannot be operated in standard mode.

F-CPU variants that can host the safety program include the CPU 1511F, 1511TF, 1513F, 1515F, 1515TF, 1516F, 1516TF, 1517F, 1517TF, 1518F, and 1518TF families (MLFB group 6ES751x-xxx00-0AB0 and 6ES751x-xxxxx-0AB0 R variants). The S7-1500 software controller (CPU 1505S / 1507S) and the ET 200SP F-CPU also support the same safety program structure.

Channel Pair Addressing Rules

Each F-DI module exposes its channels in the process image of the F-CPU in groups of 2 or 4 bytes, depending on the module width. The mapping of channel pair → process image is fixed by the F-module firmware and is described in the device manual of the respective F-I/O. For the standard ET 200SP F-DI 8x24VDC HF (6ES7136-6BA00-0CA0), channel pair 0 occupies input bit 0 (channel 0) and input bit 1 (channel 1) of the assigned input address; channel pair 1 occupies bits 2 and 3, and so on.

The rule is unambiguous:

1. The safety result of a 1oo2 channel pair appears at the address of the lower channel number of the pair.
2. The higher-numbered channel's process image still exists, but reading it from the safety program is a programming error.
3. The value status bit (VS) for the entire channel pair is also exposed at the address of the lower channel number; the VS of the higher channel is a duplicate and must not be evaluated.

If you symbolically address the higher channel in an F-FBD, F-LAD, or F-STL/F-CFC block, the safety program editor in TIA Portal produces a warning of the form "The addressed channel does not belong to the channel pair being evaluated" and the safety program signature may be flagged as inconsistent until the reference is removed. The compilation does not always abort, but the warning is treated as a safety-relevant violation in F-runtime checks for newer TIA Portal versions (V18 and later).

Step-by-Step: Configuring 1oo2 on an ET 200SP F-DI in TIA Portal

1. Insert the ET 200SP F-DI (for example 6ES7136-6BA00-0CA0) into the device configuration. The base unit must be a type F0 or F1 BU (BU15-P16+A0+2B, BU20-P12+A4+0B, etc.).
2. Open the module properties → Operating mode tab. Set the module to Safety mode. The module cannot be used in standard mode.
3. In the Channel configuration tab, select the channel pair (e.g. channels 0+1). Set Sensor evaluation = 1oo2 evaluation.
4. Configure the discrepancy time (typical: 50 ms to 500 ms depending on the application standard IEC 62061 / ISO 13849-1 PL e). The discrepancy time is the maximum permissible time both inputs may differ before the channel pair is passivated.
5. Set the value status (VS) source. The VS bit indicates the validity of the channel pair. Use it in the F-program via the EV1oo2DI instance DB.
6. Assign a PROFIsafe address (for ET 200SP, the F-destination address and F-source address are configured here or via the SIMATIC Automation Tool). The default PROFIsafe slot address 1 is used unless your station has multiple F-modules.
7. Compile the hardware configuration. Download to the F-CPU. The safety program will be regenerated automatically when you change 1oo2 parameters.
8. Open the safety program editor (the F-CPU has a separate Safety program view alongside the standard program). Insert EV1oo2DI from the "Safety > F-Blocks > I/O" library. Wire the input IN0 to the symbolic tag of the lower channel of the pair.
9. Do not wire the higher channel of the pair anywhere in the F-program. If you need the raw second channel for non-safety diagnostics (e.g. HMI display of the second sensor), do this from the standard program, not the F-program, and clearly mark the tag as non-safety.

Worked Example: F-Program in F-FBD

A typical 1oo2 evaluation of an emergency stop in F-FBD:

// Tag declarations in the standard / safety tag table
i_SafetyEStopCh0   : Bool  // Symbolic I-address, channel 0 of pair 0
i_SafetyEStopCh1   : Bool  // Symbolic I-address, channel 1 of pair 0 (DO NOT USE in F-program)
i_ValueStatusPair0 : Bool  // Value status, channel 0 address

// F-program block: "fb_EStop_1oo2"
// EV1oo2DI instance: "inst_EV1oo2DI_EStop"
//
//  IN0  := i_SafetyEStopCh0      // Allowed: lower channel of the pair
//  VS_IN0 := i_ValueStatusPair0   // Allowed: VS of the lower channel
//  DISCTIME := T#100ms            // Discrepancy time
//  ACK_NEC := TRUE                // Operator acknowledge required
//  ACK     := i_AckEStop          // Standard tag from HMI
//  Q       := inst_EV1oo2DI_EStop.Q       // Safe output to F-ESTOP block
//  Q_VS    := inst_EV1oo2DI_EStop.Q_VS    // Valid status
//  DIAG    := inst_EV1oo2DI_EStop.DIAG    // Diagnostic word

The compiled F-program will accept the reference to i_SafetyEStopCh0 and will issue a warning if i_SafetyEStopCh1 appears anywhere downstream of the EV1oo2DI block. The warning ID is documented in the SIMATIC Safety manual under "Compiler messages of the F-program".

Why the Higher Channel Cannot Be Used

The 1oo2 evaluation is implemented partly in the F-module firmware and partly in the F-library block EV1oo2DI. The firmware performs:

• Read of physical input 0 and physical input 1.
• Short-circuit, cross-circuit, and stuck-at tests on the wire between the sensor and the module terminal.
• Discrepancy timer start when input 0 and input 1 differ.
• Passivation decision when the discrepancy timer expires or a wire fault is detected.

The F-library block performs the safe-state evaluation, debouncing, integration test supervision, and passivation acknowledgement. Both halves together constitute the certified safety function. Exposing the raw second channel to user logic would let the engineer build a safety decision that bypasses the certified EV1oo2DI evaluation, which is forbidden by the F-program compilation rules and by the standards IEC 61508 (SIL) and ISO 13849-1 (PL).

Comparison: S7-300F / S7-400F vs S7-1500F

The addressing rule did not change between the two generations. What changed is the toolchain's strictness in reporting the violation, and the integration with the S7-1500 Safety Unit, which is a software container in TIA Portal that physically separates the safety program from the standard program at compile time.

Diagnostics and Verification

After download and restart, verify the configuration in the following order:

1. Open the F-I/O in the online TIA Portal. Confirm the channel pair reports "Valid" for the value status bit.
2. Force the second physical input to a different state than the first (within the discrepancy time). The channel pair must not passivate. After both return to the same state, the channel pair must remain valid.
3. Hold the two inputs in different states for longer than the configured discrepancy time. The channel pair must passivate, the VS bit must go to 0, and the DIAG output of EV1oo2DI must report a discrepancy error (code 0x0002 typical).
4. Trigger a wire fault (short-circuit of channel 0 to 24 V while channel 1 is at 0 V, or short between the two sensor cables if the module supports cross-circuit detection with the configured test pulse sources). The channel pair must passivate and the DIAG output must report a wire fault (code 0x0004 typical).
5. After acknowledgement via the operator ACK input, the channel pair must re-evaluate and the VS bit must return to 1.

Typical DIAG bit assignments for EV1oo2DI (from the SIMATIC Safety manual, appendix A):

Accessing the Raw Channels for Non-Safety Use

If you need the raw second channel for visualization, sequence-of-events, or for a non-safety interlock, the standard user program can read both channels. Symbolic access to i_SafetyEStopCh1 from the standard program does not violate any F-rule because the standard program is excluded from the F-signature and from the SIL-rated path. Recommended practice:

• Use the standard program to mirror the raw channels onto HMI tags.
• Mark the HMI tags clearly as "non-safety" with a prefix such as NS_ or a flag in the tag comment.
• Do not use these tags in the safety program, even as default values for F-blocks.
• Use the value status bit (lower channel) to qualify any non-safety read. If VS = 0, the standard display should show "channel pair invalid / passivated" instead of the raw value.

Standards Compliance

The 1oo2 evaluation implemented in EV1oo2DI and the underlying F-modules is certified for use in safety functions up to:

• SIL 3 per IEC 61508 (parts 1-7) and IEC 62061
• PL e / Category 4 per ISO 13849-1

Compliance is achieved by the dual-channel redundant acquisition plus cross-circuit monitoring in the F-module, plus the certified software evaluation in EV1oo2DI. The proof test interval and the demand rate must be observed per the safety manual of the respective F-CPU and F-I/O module; the values are stated in the manufacturer's certificate and reproduced in the TIA Portal safety summary view. The user is responsible for confirming that the achieved PFHd (probability of dangerous failure per hour) of the entire safety function lies within the target PFHd of the safety function calculated per IEC 62061 / ISO 13849-1.

Common Pitfalls and Troubleshooting

FAQ