S7 F-System Response Time: Calculation Guide for S7-400H

Safety instrumented functions in SIMATIC S7-400H redundant controllers require deterministic worst-case response time calculations to satisfy IEC 61508 / IEC 61511 SIL targets and to validate the Safety Instrumented System (SIS) loop before commissioning. This reference covers the formal Siemens methodology, the difference between S7 F Systems and Distributed Safety, the S7ftimeb.xls and S7fcotib.xls calculation workbooks, and the parameter set required to size the F-monitoring and reaction time for an S7-400H F-CPU pair.

1. Overview: What "Response Time" Means in an F-System

The response time of a safety function is the worst-case interval between a defined process event (for example, an F-input going to the safe state) and the corresponding safe reaction at the F-output. In Siemens terminology this is the maximum system reaction time of the F-application, sometimes written as t_R,max or T_max.

For an F-CPU the response time is the sum of:

1. The F-input module acquisition time (including sensor test pulses).
2. The F-CPU F-cycle time (F-runtime of the safety program).
3. The PROFIsafe / PROFIBUS-DP or PROFINET transmission time.
4. The F-CPU F-monitoring time (F_WD_Time / F_Host_WD).
5. The F-output module reaction time (including output test pulses).

For an S7-400H redundant pair (two F-CPUs in hot-standby, synchronized by fiber-optic redundancy links), the response time calculation must additionally account for:

• Master/reserve switchover time when a fault is detected on the active CPU.
• Updated redundancy synchronization update window.
• Dual-channel acquisition on SM 326F / SM 336F input modules.

2. Distributed Safety vs. S7 F Systems

Siemens ships two distinct F-libraries. They are not interchangeable, and the wrong tool produces a non-valid response time calculation. Use the table below as a hard rule when selecting the calculation workbook.

3. Response-Time Building Blocks

The maximum F-response time is the sum of the partial times of every F-relevant signal path. Each partial time is bounded by a parameter the user enters in the calculation sheet or in the HW Config.

3.1 F-Input Module Time (F_In)

Includes the input filter, the channel-discrepancy time on 1oo2 / 2oo2 evaluation, and the internal sensor-supply test pulse. For SM 326F DI 24×DC24V (6ES7326-1BK02-0AB0) the basic input time is documented in the module manual at 1 ms, plus a 0.5 ms debounce plus a test-pulse window that scales with the configured discrepancy tolerance.

3.2 PROFIsafe Bus Time (F_Bus)

For PROFIBUS-DP with PROFIsafe V2, the typical slot time on a 1.5 Mbps segment is 5.5 ms per PROFIsafe frame. On PROFINET the corresponding value is derived from the configured SendClock and ReductionRatio of the PROFINET IO. The S7ftimeb.xls sheet contains a PROFIsafe / bus time column that defaults to 5.5 ms × 2 (one frame each direction).

3.3 F-CPU F-Runtime (F_Cpu)

This is the worst-case F-program execution time per F-cycle. The S7 F Systems library inserts a measurement call (F_CYC_CO) that records the F-runtime in the diagnostic block. Insert the measured value in the S7ftimeb.xls column F-Runtime of the safety program.

3.4 F-Monitoring Times (F_WD_Time, F_Host_WD)

These are the watchdogs that force the F-CPU into the safe state if a fresh PROFIsafe telegram is not received within the configured time. They are the dominant adjustable parameters in the safety loop:

3.5 F-Output Module Time (F_Out)

Includes the read-back time of the F-DO (verifying the output actually de-energized) and the test-pulse window used to detect a stuck-at fault on the wiring. For SM 326F DO 10×DC24V/2A (6ES7326-2BF41-0AB0) the value is 1.0 ms read-back plus 0.5 ms test pulse plus the configured dark / light test period.

4. Maximum Response-Time Formula

The general Siemens formula (per the Safety Engineering in SIMATIC S7 manual, entry ID 12490443) is:

T_R,max = F_In + F_Bus + F_Cpu + F_WD_Time + F_Out + F_Host_WD

All times are summed in milliseconds and represent the worst-case single occurrence of each term. The workbook internally multiplies terms that are time-multiplexed (for example, two PROFIsafe frames per cycle) by an explicit count factor.

4.1 Worked Example (Numeric)

The numeric values below match the published safety-function response-time example for a single-channel F-input and a standard F-CPU cycle:

This matches the order-of-magnitude target for a single PROFIsafe loop without sensor test pulses on an S7-400F. With sensor test pulses enabled, add the configured test-pulse window (typically 0.5 ms to 4 ms per channel) to F_In.

5. Using S7ftimeb.xls (S7 F Systems)

S7ftimeb.xls is the official calculation workbook delivered with the S7 F Systems option. Open it in Microsoft Excel 2003+; macros must be enabled because the workbook evaluates the F-cycle structure.

5.1 Inputs Required by the Sheet

1. F-CPU type and F-runtime of the safety program — read from CFC online (Online > F-block > Runtime) or from the diagnostic block F_CYC_RT.
2. F-module catalog numbers for every F-input and F-output (for example, 6ES7326-1BK02-0AB0, 6ES7326-2BF41-0AB0).
3. PROFIsafe / PROFINET configuration: baud rate, send-clock, reduction ratio, watchdog time.
4. Channel-level parameters: 1oo1 / 1oo2 / 2oo2 evaluation, discrepancy time, test-pulse width.
5. For S7-400H: redundancy mode (single-channel switchover, dual-channel) and the master/reserve switchover time (typical: 100 ms for a planned link update, 800 ms for an unplanned CPU failure).

5.2 Reading the Output

The bottom row of the Response Time tab shows T_R,max in milliseconds. Each individual path is shown in a separate column, so a non-conforming loop can be traced back to the specific module or PROFIsafe slot that contributes the most time. S7ftimeb.xls also flags any input that is outside the range supported by the S7 F Systems library; for example, an F_WD_Time below the minimum F-cycle time triggers a warning.

6. S7-400H-Specific Considerations

An S7-400H redundant system uses two F-CPUs (for example, CPU 417-4H, order number 6ES7417-4HT14-0AB0) running in hot-standby with synchronized F-databases. Three additional terms enter the response-time calculation for H systems:

7. Calculation Procedure (Step-by-Step)

1. Identify the safety function and the SIL target. The Process Safety Time (PST) must be greater than T_R,max.
2. Open S7ftimeb.xls from the S7 F Systems installation directory (default: C:\Program Files\Siemens\Automation\S7F\Tools\).
3. Enter the F-CPU catalog number and the measured F-runtime from CFC online diagnostics.
4. List every F-input and F-output module; enter its catalog number and channel configuration.
5. Enter the PROFIsafe parameters: baud rate, watchdog time, send-clock (for PROFINET).
6. For S7-400H, set the redundancy flag and add the master/reserve switchover term.
7. Read the computed T_R,max from the bottom of the sheet.
8. Compare T_R,max against the Process Safety Time. If T_R,max > 0.7 × PST, re-design (raise the PST, lower F-cycle load, or use a faster bus).
9. Document the result in the Safety Lifecycle file with a screenshot of the sheet and the input parameter set.

8. Verification and Validation

After the calculation is documented, validate it against the real plant. The standard procedure is:

1. Force the F-input into the safe state (for example, open the E-stop circuit) and timestamp the event with a high-resolution recorder (≥ 1 kHz sampling).
2. Record the F-output de-energization time with the same recorder.
3. Compare the measured time against T_R,max from the sheet. The measured value must be less than T_R,max; the ratio (measured ÷ T_R,max) typically lands in the 0.3 – 0.7 range for a well-tuned loop.
4. Repeat the test for every F-loop in the system, including dual-channel / 1oo2 inputs.
5. For S7-400H, also perform a forced master/reserve switchover during a steady-state safety demand and record the additional latency.

9. Common Pitfalls and Field Notes

10. Reference Documents and Tools

• Siemens support entry ID 12490443 — SIMATIC Industrial Software Safety Engineering in S7 F Systems (procedure for response-time calculation, lists the calculation workbooks for each F-System).
• TIA Portal documentation: Response Times of Safety Functions — S7 F-System response time definition and the in-tool calculation workflow.
• ET 200AL F-DI 4 / F-DQ 2 — Maximum Response Time — example of an F-module-level response time using the "SIMATIC STEP 7 Safety Advanced: F-Execution Times, F-Runtimes, F-Monitoring and Reaction Times" tool.
• Workbook S7ftimeb.xls — delivered with the S7 F Systems option package; chapter 16 (page 273) of the Safety Engineering in SIMATIC S7 manual describes the cycle- and response-time model in detail.
• Workbook S7fcotib.xls — delivered with the Distributed Safety option; use only with F-blocks from the S7 Distributed Safety library.