SM326 SF Reintegration After Power Shutdown in S7 Distributed Safety

When a CPU 317F is brought back online after a controlled or uncontrolled power shutdown, the SM326F safety I/O modules frequently display a blinking SF (red) LED. Process data exchange with the safety program is frozen, the F-I/O remain in the passivated state, and any operator pushbutton wired into the passivated module cannot acknowledge the fault. This article explains exactly why the SF LED blinks, how S7 Distributed Safety treats passivation and reintegration at startup, and how to wire and configure F_ACK_GL correctly so that an operator can clear the fault after the hardware is healthy again.

1. Problem Statement: SM326 SF LED After Power Restoration

A typical symptom observed in the field with an S7-300F station consisting of a CPU 317F and one or more SM326F modules (for example 6ES7326-1BK02-0AB0 or 6ES7326-2BF01-0AB0 for failsafe digital inputs, and 6ES7326-2BF10-0AB0 for failsafe digital output) is:

• The 24 V supply returns, the CPU goes to RUN, and the standard I/O modules exchange process data normally.
• Each SM326F reports a blinking SF LED, the F-channel LEDs show the last valid state, and the diagnostic buffer of the module records entries such as "F-I/O passivated" with incoming event ID W#16#75E2 / W#16#75E3 or PROFIsafe channel fault W#16#0390/

  W#16#0391

  .
• The operator press of the acknowledge pushbutton, even though it is wired to a "safety input" of the same SM326F, has no effect on the SF LED.
• Calling F_ACK_GL from the safety program with the input wired to a channel of the passivated module returns immediately because the input value is forced to 0 (passivated).

The root cause is a sequencing issue between the F-system startup, the PROFIsafe communication establishment, and the reintegration policy selected in HW Config / the safety program.

2. Passivation and Reintegration Fundamentals

S7 Distributed Safety implements the PROFIsafe profile on top of PROFIBUS DP or PROFINET IO. Each F-I/O channel can be in one of three states:

The SM326F enters passivation when the F-CPU sends a passivation token over PROFIsafe, when the module detects an internal discrepancy / overload / wire-break fault, or when the monitoring time for the PROFIsafe connection is exceeded. The module remembers the passivated state in non-volatile memory; the LED SF blinks at 2 Hz (with 0.5 s pattern) to indicate passivation, while a solid SF LED indicates a hardware fault that is not recoverable by reintegration.

3. Why the SF LED Blinks and I/O Is Not Updated

There are three common causes for the SF blink pattern after power restoration:

1. Power-on race. The 24 V supply on the SM326F came up after the backplane power of the F-CPU. The module initialises itself, but PROFIsafe communication between the F-CPU and the SM326F is not yet established when the F-run-time group executes its first cycle.
2. Monitoring time exceeded. The monitoring time configured in HW Config (default 1500 ms for PROFINET IO, default 100 ms for PROFIBUS DP in newer GSD revisions) is shorter than the time required by the F-CPU to bring up the safety stack after STOP-to-RUN.
3. Operator acknowledge blocked by passivation. The pushbutton used to drive ACK on F_ACK_GL is wired to an input channel of the SM326F that is itself passivated. Because the F-channel reports 0 when passivated, the rising edge required by F_ACK_GL never occurs and the operator cannot complete the acknowledge.

4. Automatic Reintegration at F-System Startup

The S7 Distributed Safety Programming and Operating Manual specifies the following behaviour (extract):

Reintegration of the F-I/O, that is, the provision of process data in the PII or the transfer of process data provided in the PIQ to the fail-safe outputs, takes place automatically, starting at the earliest with the second cycle of the F-run-time group after startup of the F-system; this happens regardless of the setting at variable ACK_NEC. Depending on the F-I/O you are using and the cycle time of the F-run-time group and PROFIBUS DP / PROFINET IO, several cycles of the F-run-time group can elapse before reintegration occurs. If communication between the F-CPU and F-I/O takes longer to establish than the monitoring time set in the object properties for the F-I/O in HW Config, automatic reintegration does not take place.

In practice this means:

• If the F-system was already in RUN before the power dip (warm restart of the backplane only), automatic reintegration will be attempted once PROFIsafe communication is re-established, provided the monitoring time is large enough.
• If the F-CPU itself transitioned STOP -> RUN during the power shutdown (cold restart), the F-I/O is treated as freshly commissioned. Automatic reintegration still occurs if and only if the connection is established before the monitoring timer expires.
• If the monitoring time expires before PROFIsafe is up, the module remains passivated and must be reintegrated manually by an operator using F_ACK_GL (with the appropriate ACK_NEC setting) or via the ACK input on the channel-level F-block (for example F_DI, F_ESTOP1).

5. Operator-Controlled Reintegration with F_ACK_GL

F_ACK_GL is the F-block in S7 Distributed Safety that globally acknowledges all F-I/O passivations of an F-run-time group. Its interface in STEP 7 V5.5 / S7 F Configuration Pack SP9 or later is:

The relevant decision flag is ACK_NEC:

The S7 Distributed Safety runtime does not reset the machine; it only enables the F-I/O to provide valid process data again. The actual machine restart still has to be commanded by a separate, non-safety or safety-rated start sequence that depends on the application.

6. Selecting the Acknowledge Input: F-DI vs. Standard DI

A common source of confusion is whether the acknowledge pushbutton must be wired to a failsafe input. The short answer, consistent with both the S7 Distributed Safety manual and industry practice on safety relay systems, is:

• Use a standard (non-safety) digital input for acknowledge, reset, operator-controlled reintegration, contactor feedback, and similar non-protective signals. Examples include the standard DI of an SM321 (6ES7321-1BL00-0AA0) or the non-F channel of an SM326F-DI when the module exposes any.
• Use a failsafe input (F-DI) only for signals that participate in the safety function itself: E-stop pushbuttons, safety gates, light curtains, two-hand controls, muting sensors.

Wiring the acknowledge to a channel of the very SM326F that you are trying to reintegrate is the most common wiring mistake in this scenario, and it makes the acknowledge physically impossible because the F-channel reports the fail-safe value 0 while passivated.

7. Configuring ACK_NEC and the ACK Variable in STEP 7

7.1 Open the F-block in the safety program

1. In SIMATIC Manager, open the S7 Distributed Safety project and the F-library F_ACK_GL instance DB in the F-program of the safety runtime group.
2. Place the F_ACK_GL block (or use the instance already generated by the F-Configuration Pack).

7.2 Set ACK_NEC to TRUE

1. Drive ACK_NEC with the constant TRUE or with a tag that is settable from the standard program (recommended for commissioning access).
2. Save and recompile the safety program.

7.3 Wire ACK to a standard digital input

1. Insert a standard DI tag (for example I 0.0 of an SM321) into the F-symbol table via Options > Edit Safety Program > Symbol Table.
2. Connect the tag to the ACK input of the F_ACK_GL instance.
3. Provide a rising-edge helper (for example using a manual edge flag) if you want to acknowledge from a maintained selector switch.

7.4 Adjust the PROFIsafe monitoring time

1. In HW Config, open the SM326F properties and select F-parameters.
2. Increase F-monitoring time to a value at least three times the worst-case F-run-time group cycle time. A typical setting for a CPU 317F is 1500 ms on PROFINET IO and 250 ms on PROFIBUS DP.
3. Recompile HW Config and download to the F-CPU.

8. Step-by-Step Commissioning Procedure

1. Verify that all F-channel wiring is correct (sensor supply, test pulse sources, ground reference) before energising the F-system.
2. Power up the F-CPU and download the safety program with ACK_NEC = TRUE and the acknowledge wired to a standard DI.
3. Confirm that all SM326F modules show a steady green SF off and the channel LEDs reflect the wired sensor state.
4. Simulate a power shutdown by switching off the 24 V system supply (UPS upstream recommended).
5. Restore the supply and observe the CPU diagnostic buffer. Wait at least 5 F-cycles for automatic reintegration to complete.
6. If any SM326F still blinks SF, press the operator acknowledge pushbutton wired to the standard DI. The SF LED should extinguish within 2 F-cycles and process data should reappear in PII.
7. Repeat steps 4-6 with the F-monitoring time set to its minimum allowed value to confirm robustness of the wiring choice.

9. Verification and Acceptance Test

10. Troubleshooting Matrix

11. Frequently Asked Questions