Siemens 3RK3 Modular Safety System: Transitioning from STOP to Safety Mode

The Siemens SIRIUS 3RK3 Modular Safety System (MSS) is a freely configurable safety controller that integrates safety logic without the footprint of a full PLC. A common first-encounter failure is the DEVICE LED showing steady yellow, which means the central unit is parked in configuration mode (logical STOP) and refuses to execute the safety program. This reference covers the full transition from a freshly installed, never-run device to a stable safety RUN state, including the engineering-software release path that is mandatory before the MSS will leave configuration mode.

1. System Overview and Why the Device is "Stopped"

The 3RK3 MSS is not a classic PLC that toggles between RUN and STOP via a key switch. The MSS has three distinct operating modes, only one of which produces the typical PLC "executing logic" behavior:

If your central unit is sitting at the yellow LED, it is in configuration mode. The most common reasons are:

• Power applied but the device has never been commissioned, so there is no released configuration in non-volatile memory.
• A parameter change was downloaded via MSS ES but the project was not yet released (a "release" is a separate step from a "download").
• The configuration CRC does not match the CRC of the released project (e.g. someone edited online without releasing).
• Firmware update interrupted.

2. Hardware Architecture and Catalog Numbers

Before attempting to release the device, verify the physical module set against the engineering project. Mismatched hardware will block the release step. The standard SIRIUS 3RK3 family members include:

Always record the complete MLFB string (including the /S suffix codes, e.g. 3RK3 11-1AA10 /CC for Conformal Coating) and the firmware version printed on the side label before requesting support. Siemens support requires both for any 3RK3 query.

3. LED Diagnostics Reference

The front of the central unit carries the diagnostic LEDs you need to interpret to know which transition path applies:

A yellow DEVICE LED without an SF LED almost always means "no released configuration present." A yellow DEVICE LED plus SF red typically points to a CRC mismatch or an unacknowledged parameter change.

4. Prerequisites for Transitioning to Safety Mode

1. PC with MSS ES installed (ordering code 3RK3 90-1AA00 or current 3ZS1310-CC10-0YA0 equivalent). The version must support the firmware on the device — check release notes at the Siemens Product Support page for MSS System Manual entry 26493228.
2. PC-to-MSS cable: original Siemens 3RK1 901-0FA00 USB-to-RS232 adapter, or the modern USB-direct cable listed in the manual.
3. Matching MSS ES project file (with valid hardware layout and parameter set).
4. 24 V DC supply present and within tolerance (20.4 V–28.8 V). Measure at the device terminals, not just at the PSU.
5. Password for "Release configuration" if one has been configured in the project. The default is empty (no password).
6. Access to the test actuators, so the test-mode pass/fail can be observed.

5. Step-by-Step: Transitioning from Configuration Mode to Safety Mode

The procedure follows chapter 4 of the MSS System Manual ("Getting Started"), with section 4.8 covering the test-and-release portion.

5.1 Establish PC Connection

1. Open MSS ES.
2. Select Online → Set PG/PC Interface, choose SERIAL CABLE MSS 3RK1 901-0FA00 (or the COM port assigned to your USB cable).
3. Click Online → Establish Connection to Target System. The DEVICE LED on the central unit will switch to yellow and stay yellow until the connection is opened.
4. If the device does not respond, verify cable polarity (pin 2/3 crossover in older cables), baud rate auto-detect, and that no other MSS ES session is already connected.

5.2 Read the Existing Project

1. Select Target System → Read from Device. MSS ES pulls the parameter set currently held on the device.
2. Compare the hardware layout in the offline project against what is mounted in the rack. If they differ, resolve the discrepancy before continuing — a layout mismatch is the most common cause of an SF red LED after download.
3. If no released configuration exists on the device, the read returns an empty slot; you must then load the offline project file (.mss).

5.3 Adjust Parameters (if required)

1. Make the necessary parameter changes in the offline project tree (input filter times, cross-circuit detection, output test pulse width, etc.).
2. Run Project → Compile. The compiler must return zero errors. Warnings about unused inputs can be ignored, but errors must be cleared.

5.4 Download to the Device

1. Select Target System → Download to Device.
2. When prompted, confirm that the device will be put into STOP (configuration mode). This is normal — the device must be in configuration mode to accept new parameters.
3. The DEVICE LED stays yellow throughout the download. A green progress bar in MSS ES tracks the transfer.

5.5 Activate Test Mode (per Manual §4.8)

1. Select Target System → Test Mode. The device enters test mode; the DEVICE LED changes from steady yellow to flickering green.
2. Manually actuate every safety input (E-stops, guards, light curtains) one at a time and verify in the MSS ES I/O monitor that the corresponding bit flips and the related logic function de-energizes the correct output.
3. Force each safety output ON from MSS ES (right-click the output tag → Force) and confirm the downstream contactor or drive does NOT energize (the test pulse must be visible on the MSS ES trend).
4. Document the results. Many integrators print the trend screen and attach it to the validation report.
5. Exit test mode via Target System → Exit Test Mode. The DEVICE LED returns to yellow.

5.6 Release the Configuration (the critical step)

This is the step beginners miss. Downloading a project only writes it as a draft in the device's working memory. The MSS will not enter safety mode on a draft.

1. Select Target System → Release Configuration.
2. MSS ES prompts for the release password (if one was set during project engineering). Enter it.
3. MSS ES computes a CRC of the offline project and the on-device project. They must match. If they do not match, the menu item is greyed out — recompile and re-download.
4. On successful release, MSS ES writes the configuration as permanent (non-volatile) and updates the device's safety CRC. The DEVICE LED briefly turns red for the save cycle, then returns to yellow.
5. Save the offline project and the release receipt (PDF) into the safety file folder per EN ISO 13849-1.

5.7 Switch to Safety Mode

1. Select Target System → Run (Safety Mode).
2. Alternatively, cycle the 24 V supply. After a power-on reset, a device that holds a released configuration will boot directly into safety mode (steady green DEVICE LED).
3. Confirm the green DEVICE LED is steady (not flickering). Flickering indicates you are still in test mode.

6. Verification After Entering Safety Mode

Once the DEVICE LED is steady green, perform the following independent functional checks before releasing the machine to production:

• Open each guard while the machine is in automatic mode — the safety output must drop within the configured filter time (typically 20–50 ms).
• Press every E-stop — same response time check.
• Cross-circuit test: bridge one input terminal to 24 V — the MSS must detect the cross-circuit (if cross-circuit monitoring is enabled for that input type) and latch the SF LED.
• Confirm the SF and BF LEDs are OFF.
• Verify the PROFIsafe/PROFIBUS status word from the higher-level PLC reports "Safety active" (bit pattern depending on the host PLC family).

7. Online Edit Without Falling Back to STOP

If you need to change a parameter after the machine is in service, MSS ES supports an Online Change workflow that can keep the device in safety mode during the change:

1. Edit the parameter in the offline project.
2. Select Target System → Online → Download Changes (without STOP).
3. MSS ES suspends logic execution briefly, writes the delta, and resumes. The DEVICE LED may flicker once but should return to steady green.
4. After any online edit, repeat the release procedure (step 5.6). The MSS does not auto-update the released CRC on online edits; running without re-release reverts to the previous released CRC after the next power cycle.

8. PROFIsafe / PLC Integration Check

If the 3RK3 is acting as a PROFIsafe slave to an S7-300, S7-400, S7-1200, or S7-1500 safety PLC, the MSS will not enter safety mode on the bus side until:

• The PROFIsafe address set in MSS ES matches the slot assignment in the F-CPU's hardware configuration.
• The F-CPU sends the correct PROFIsafe watchdog parameter block.
• The F-CPU's safety program calls the DB containing the MSS process image.

A successful safety-mode transition on the MSS local DEVICE LED can coexist with a BF (bus fault) if the host PLC is not yet configured. Resolve the BF separately via the F-CPU hardware diagnostic.

9. Troubleshooting Matrix

10. Safety Documentation Obligations

Every release of a 3RK3 configuration is a safety-relevant event. Per EN ISO 13849-1 §6, retain:

• The released MSS ES project file (archive with version stamp).
• The MSS ES release receipt PDF (CRC value, date, engineer signature).
• The validation report showing every safety function was functionally tested.
• The risk assessment reference.

A replacement central unit loaded from a 3RK3 90-0AA00 memory module restores the released configuration automatically, but you must still verify against the archived project before authorizing production.

11. Useful References

• MSS System Manual (entry 26493228) — chapter 4 covers Getting Started; 4.8 covers test mode and release.
• Siemens Product Support — firmware, FAQs, and application examples for 3RK3.
• MSS ES Online Help — context-sensitive reference inside the engineering software (F1).