The safety CPU and non-safety CPU have their own firmware, boot project and application program, which are executed separately. The only control element on non-safety CPU hardware, which allows changing the status of both non-safety and safety CPU is [Run] button on non-safety CPU. [Run] button on non-safety CPU can simultaneously stop and start both non-safety and safety CPU. This behavior of [Run] button depends on non-safety CPU settings⮫ [3]. Stopped safety CPU means that application program execution has stopped only. PROFIsafe F-Host and F-Device stacks⮫ [2] continue to run in fail-safe mode. All safety I/O modules are passivated and substitute values "0" are used for safety I/Os and F-Devices. PROFIsafe F-Host and F-Device stack execution can be stopped by entering SAFE STOP state only. In this case, PROFIsafe telegrams are not generated and I-ERR LED is on.

DANGER

It is not possible to safely start safety CPU using [Run] button on non-safety CPU. The safety CPU always goes to non-safe DEBUG mode (DEBUG RUN or DEBUG STOP) as soon as [Run] button is pressed on non-safety CPU⮫ “Description of safety CPU module states”. To bring the safety CPU back into the safe RUN mode, perform a power cyle of the safety CPU or use “reboot” PLC browser/shell command on non-safety CPU.

The commands “Run” and “Stop” in engineering suite have the same effect on the safety CPU and non-safety CPU as [Run] button on non-safety CPU.

There are some parameters of non-safety CPU configuration which influence the overall system behavior of safety and non-safety CPU.

1

Safety CPU

2

Non-safety CPU

3

Safety I/O module

4

Valid safety telegram

5

Telegram with "0" values or valid safety telegram

6

Non-safety CPU settings

7

Safety CPU safety telegrams with output values