Hi

I am trying to learn about how the failsafe concept of the S7-1500 and how the failsafe input/output modules works on e.g. ET200SP modules. I have found a topic (TOPIC) about a S7-300F where fritz gives a very good explanation about the failsafe concept. Is this still relevant for the S7-1500 or does that have a new concept?

Best regards

Azkaban

Hi Towome

Yes I know them, I am actually in the progress of reading them (still in the start). But I stumbled upon the other topic where fritz has giving a very good and precise explanation, and I was just wondering if that still was the case for the S7-1500 series :)

But I guess that when I am done with the documents, I will have my answer :)

Towome

Hi,

do you still know the following documents?

Programming Guideline Safety for SIMATIC S7-1200/1500

 

SIMATIC Industrial Software SIMATIC Safety - Configuring and Programming

Regards,

Towome

Hi

I have read the documents quickly through, but I can't seem to find anything like the post from the other topic. There is nothing about how it works in general and about diversity and redundancy.

This is what fritz wrote:

"The TUV certificate is in general the "ultimate" certificate to have for it, but good on you for questioning what is really going on behind the scenes and how does Siemens "get away" with doing CAT4/SIL3 certified safetyin a single F-CPU.

The answer is in general quite simple: Through time based redundancy and diversity.

What this means is this:
You program your safety logic in F-LAD and/or F-FBD.
When youhit the compile button, the compiler takes your safety logic andinverts it as well as converts it toa WORD based logic (this gives you diversity).

When the Safety program is executed, it willbe executed twice every time its called (without you as a programmer having to "worry" about it).
First execution is done on what youprogrammed followed by an execution of the "diversified" (inverted and WORD based) logic that the compiler created for you (this is the "time based redundancy" part).

Whenboth executions are done the safety call compares the resultsand "expects" that they will be exactly opposite (and if not shut down the CPU).

This is how Siemens is able to achieve TUV certified CAT4/SIL3 rating for a single CPUand it is not only pretty "safe" but also pretty clever in my humble opinion."

Best regards

Azkaban

Hi

I have read a little bit more, and would like to know if this is understood correctly:

Value status bit: Not a failsafe signal, but can be used on all I/O modules. Bit = TRUE, when the channel/module is okay. Bit = FALSE, when the channel/module detects an error.

QBAD signal: Failsafe signal. Has the opposite value of the input/output. So when the output is set to FALSE, the QBAD signal will be TRUE, and vice versa.

Is this correct understood?

Best regards

Azkaban

Azkaban

QBAD signal: Failsafe signal. Has the opposite value of the input/output. So when the output is set to FALSE, the QBAD signal will be TRUE, and vice versa.

Is this correct understood?

 If you read the manuals again, and really think what is written about QBAD, it's not what you are thinking now.

QBAD will be TRUE, when there is a F-I/O fault in the safety module. After Reintegrations has been made, the QBAD will return to FALSE.

Hi

Okay, then I have understood it wrong. Sorry for that. Is this then right?

The value status bit is used to show the validity of each input/output channel signal.

• TRUE: The input/output value is valid for the channel; no errors are detected.

• FALSE: The input/output value is not valid for the channel; an error is detected.

The QBAD signal is used to show the validity of each input/output module signal.

• FALSE: The input/output value is valid for the module; no errors are detected.

• TRUE: The input/output value is not valid for the module; an error is detected.

Hati

 

Azkaban

QBAD signal: Failsafe signal. Has the opposite value of the input/output. So when the output is set to FALSE, the QBAD signal will be TRUE, and vice versa.

Is this correct understood?

 If you read the manuals again, and really think what is written about QBAD, it's not what you are thinking now.

QBAD will be TRUE, when there is a F-I/O fault in the safety module. After Reintegrations has been made, the QBAD will return to FALSE.

Hi Hati

Okay, that is also more or less what I wrote. Sorry for all the dumb questions, but I am still very new to the programming world. I am very glad that you all are trying to help me in my quest for more knowledge :)

What about the thing i copied from the other topic about an S7-300F CPU and how it works with diversity and time based redundancy. Is that still the same for a S7-1500F?

Best regards

Azkaban

Hati

Read my last post, and the answer is there...

Azkaban

What about the thing i copied from the other topic about an S7-300F CPU and how it works with diversity and time based redundancy. Is that still the same for a S7-1500F?

 I don't think that the way the safety program is executed inside the PLC has changed.