Siemens S7-400 CPU 416F Fail-Safe Programming and Configuration Guide

1. CPU 416F Family Overview and Variant Identification

The SIMATIC S7-400F series are fail-safe (F-) CPUs certified to IEC 61508 SIL 3, EN 62061 SIL CL 3, and ISO 13849-1 PL e / Category 4. From a hardware standpoint an F-CPU is identical to its standard counterpart; the safety function is implemented in firmware and the S7 Distributed Safety option package detects and forces safe reactions on detected faults.

The reference manual SIMATIC S7-400 CPU 416F-3 PN/DP, Edition 01, as of firmware V6.0 is the canonical source for bit/word/instruction timing, memory layout, and interface pinout. For 416F-2 DP, the CPU 416F-2 DP manual with the same manual structure is published in the same product tree.

Functional differences between CPU 416 and CPU 416F:

• F-CPUs contain an additional safety firmware layer (Flexislave safety kernel) that executes the F-runtime group with a guaranteed cycle time.
• Two PROFIsafe addresses must be assigned per F-CPU for PROFIsafe over PROFINET or PROFIBUS.
• The F-CPU stores a CRC signature (collective F-signature) of every safety block; any change forces re-acceptance.
• The standard user program, MPI/PROFIBUS/PROFINET communication, and HMI behavior are otherwise identical to a non-F 416.

2. When You Do and Do Not Need the Safety Option

If the application has no emergency-stop, guard-door, two-hand, or SIL-rated I/O, the CPU can be programmed as a standard S7-400. In that mode:

• STEP 7 V5.x with no extra option package handles project creation, hardware config, LAD/FBD/STL, and HMI tags.
• No F-runtime group, no F-signature, no S7 Distributed Safety license required.
• The CPU behaves exactly like 6ES7 416-… non-F parts from the perspective of the MPI/DP/PN interfaces.

If the application requires a SIL 3 / PL e function, you must install the S7 Distributed Safety option package (V5.4 SP5 or later is recommended for current 416F firmware V6.0). The package adds:

• F-block types: F-FB, F-FC, F-DB, F-I/O DB, F-runtime group DB.
• F-library blocks for emergency stop, muting, two-hand, guard monitoring, and PROFIsafe driver blocks.
• Password-protected acceptance test with F-signature comparison.

3. Prerequisites

All HMI connection paths described below use standard S7 communication (Put/Get or S7 communication) and do not require a safety protocol — the panel reads non-safety tags only.

4. Project Setup Step-by-Step

4.1 Create the S7 Project

1. Open SIMATIC Manager → File → New Project; name it to match the plant area (e.g., Plant42_S7-400F).
2. Insert a SIMATIC 400 Station in the project.
3. Open HW Config and add a UR2 (or UR2-H) rack. Slot 1 = power supply (PS 405/407), slot 2 reserved, slot 3 = the F-CPU.
4. From the catalog SIMATIC 400 / CPU 400 / CPU 416F / 6ES7 416-…-0AB0 / V6.0, drag the CPU into slot 3.
5. Insert I/O modules in slots 4–18 as required. F-I/O can be standard ET 200M with F-modules, ET 200S with F-PM, ET 200pro, or ET 200SP F-modules.

4.2 Configure the F-CPU Properties

Double-click the CPU and switch to the Protection tab:

• Set Operating mode selector to RUN (key removable) and assign password level 1–3.
• Protection: "Password for F-CPU write protection" — enter a strong password; this is the one engineers most often forget to document.
• In the Startup tab, set Restart on warm restart OB 100 and the F-CPU will run the F-signature check on every restart.

Switch to the Safety Integrated tab (only present after installing S7 Distributed Safety):

• Enable safety mode = Yes.
• F-source address — the F-CPU itself (typical 1).
• F-monitoring time — usually 1500 ms for the central F-runtime group. The F-monitoring time is the maximum allowed cycle in which the F-runtime group must complete; if exceeded, the CPU goes to STOP.
• F-runtime group 1 parameters: OB 35 default cycle 100 ms, F-cycle time auto-calculated, F-monitoring time 3× cycle.
• Set the passivation behavior: Passivate F-I/O on CPU STOP — recommended for safety so downstream drives are forced safe on a CPU failure.

4.3 Configure PROFIsafe Addresses

For each F-I/O station (ET 200M with IM 153-2, ET 200SP with F-PM, ET 200pro, etc.), assign a unique PROFIsafe address in the range 1..1023 on the corresponding DP / PROFINET subnet. The same address must be set on the hardware (DIL switch on the F-module or rotary on the F-CPU's PROFIsafe slot).

5. Safety Program Structure

5.1 F-Runtime Group

The F-runtime group is a cyclic task executed by the safety kernel. It is bound to an OB (typically OB 35 — 100 ms cyclic interrupt). Inside the F-runtime group, you may call only F-blocks. Non-F blocks (regular FB/FC/DB) cannot be called from inside an F-runtime group, and F-blocks cannot be called from standard OBs.

5.2 Block Hierarchy

• FB 1 / F-FB "Main_Safety" — top-level safety logic (e.g., ESTOP1, guard door, mode select).
• FC 1 / F-FC "ESTOP_Eval" — emergency-stop evaluation (uses F-library F_ESTOP1).
• FC 2 / F-FC "GuardDoor" — guard-door monitoring (uses F_FDBACK, F_LOCK).
• DB 100 / F-DB "Safety_DB" — instance / shared safety data.
• DB 200 / F-I/O DB — generated per F-I/O station; never edit by hand.

5.3 Acknowledge and Reintegration

F-I/O that passivates after a fault must be reintegrated by operator action. The standard pattern is:

1. Passivated F-I/O flag set in F-I/O DB.
2. Operator presses "Acknowledge" on the HMI (or a wired acknowledge pushbutton).
3. Call ACK_OP or ACK_REI from the F-library with a rising edge of the acknowledge variable.
4. Passivation flag clears; F-I/O returns to process data exchange after the next PROFIsafe cycle.

5.4 Standard Logic Outside the F-Runtime Group

Standard OBs (OB 1, OB 35 if not used for F) run independently. They may read non-safety inputs and write non-safety outputs. Never write safety outputs from standard logic — the F-kernel re-asserts them on every cycle. Reading safety inputs from standard logic is allowed only for visualization, with the understanding that they are not safety-grade.

6. Standard Communication — MPI / PROFIBUS / PROFINET

6.1 PROFIBUS DP with PROFIsafe

To use PROFIsafe on PROFIBUS DP, the F-modules must support PROFIsafe V2 mode (most ET 200M F-modules do). The steps in HW Config:

1. Open DP master system 1 in HW Config.
2. Add an ET 200M station (IM 153-2 with F-capable FW).
3. Insert F-DI and F-DO modules.
4. Right-click the F-module → PROFIsafe → assign F-source address (= F-CPU DP master index) and unique F-destination address matching the DIL switch on the module.
5. Set F-monitoring time (typical 1500–3000 ms) and F-sil = SIL 3 / Category 4.

6.2 PROFINET IO with PROFIsafe

PROFINET IO with PROFIsafe is supported on the 416F-3 PN/DP and later. The steps mirror PROFIBUS:

1. Drag an ET 200SP / ET 200pro with F-modules onto PN-IO system 1.
2. Assign the device a PROFINET device name (must match the name stored in the device via the Assign PROFINET device name tool).
3. Open the F-module's PROFIsafe tab and assign the same F-address pair as for PROFIBUS.
4. Set F-WD-Time (PROFIsafe watchdog, default 150 ms); the safety frame cycle derives from the PROFINET send clock (typically 1 ms).

6.3 Open TCP/IP S7 Communication (for HMI)

HMI panels and SCADA connect to the CPU using S7 communication over Industrial Ethernet. In NetPro:

1. Right-click the CPU's PN/IE interface → Insert New Connection.
2. Choose partner HMI station; for partner not in project, use Unspecified.
3. Connection type: S7 connection; ID auto-assigned.
4. Activate Establish active connection on the CPU side; tick Put/Get on both sides if the HMI will write tags.

7. HMI Integration (Mobile Panels, TP / Comfort Panels, WinCC)

There is no difference between a 416 and a 416F for HMI connection purposes. Standard HMI panels communicate over MPI, PROFIBUS, or Industrial Ethernet using the S7 protocol — none of those transports carry safety data. Safety outputs/inputs visible on the HMI are information only; they cannot be acted on as safety-relevant commands.

For OPC UA on classic S7-400F, an external S7-OPC-UA gateway is required because the CPU firmware does not natively publish OPC UA. The 416F-3 PN/DP does support S7 connections for OPC DA via the S7 OPC server from SIMATIC NET.

8. Standard Example Wiring for a Guarded Cell

A typical F-CPU 416F application uses ET 200M with digital F-I/O:

• F-DI 24 VDC (e.g., 6ES7 326-1BK02-0AB0) reads ESTOP pushbutton (dual-channel) and guard-door interlock.
• F-DO 24 VDC / 2 A (e.g., 6ES7 326-2BF41-0AB0) drives the contactors for the safety gate.
• F-library block F_ESTOP1 with AcknowledgeMode = manual, DiscrepancyTime = 500 ms.
• F_FDBACK reads back contactor auxiliary contacts and verifies drop-out within MaxFBTime.

9. Commissioning and Verification

1. Download the HW Config and the program blocks to the F-CPU. Use the password assigned in §4.2.
2. In S7 Distributed Safety → Commissioning, select Generate F-signature. The F-signature is a CRC32 over all F-blocks; record it in the safety log.
3. Run the acceptance test: the tool forces you through each F-I/O and each F-block with checklist items; print and sign the report.
4. Verify the F-monitoring time in Module Information → F-Parameters: actual F-cycle must be < F-monitoring time. A 416F-3 PN/DP with 32 F-I/O typically shows 20–40 ms cycle time at OB 35 / 100 ms.
5. Force a fault by disconnecting one PROFIsafe channel → verify that the affected F-DO passivates and the safety reaction occurs (contactors drop, drives stop).
6. Reintegrate from the HMI and verify the F-I/O recovers without CPU restart.

10. Troubleshooting Matrix

11. Safety vs Standard Operation — Decision Guide

• Use the F-CPU as standard when no SIL/PL requirement exists; you avoid the Distributed Safety license and acceptance overhead.
• Activate safety as soon as any single function in the machine requires SIL ≥ 1 or PL ≥ a. Even one ESTOP will pull the entire CPU into safety mode.
• Standard and safety code coexist: safety blocks live in the F-runtime group, standard blocks in OB 1 / OB 35 / OB 82 etc., with no cross-call allowed.

12. Useful Catalogs and Documentation

• Manual: SIMATIC S7-400 CPU 416F-3 PN/DP, Edition 01, firmware V6.0.
• Functional Safety manual: S7 Distributed Safety — Configuring and Programming, Programming and Operating Manual (Siemens, 6ZB5310-0GM01-0BA0).
• System description: Safety Engineering in SIMATIC S7.
• Examples: Siemens Industry Online Support filter "SIMATIC S7-300/400 / Distributed Safety / Programming examples" (entry ID 20208582 and successors).
• Print catalog: ST 80 (formerly ST 70) for the current S7-400 module range.