TIA Portal Β· Track 08 Β· Safety Integrated

Separate control from the safety program

A fail-safe CPU runs two programs side by side: your ordinary machine logic, and a separate, protected safety program that can override the ordinary logic. If an E-stop is pressed, the safety program removes the dangerous output independently of the standard program's command. Use the simulation below to compare what the two programs request.

🟨 F-runtime groupπŸ“¨ PROFIsafeSIL 3 / PL e
01 Β· Two worlds, one CPU

The F-program controls the safe output

Left: your standard program wants the saw running whenever the operator presses Run. Right: the safety program is shown in yellow, following the Siemens convention for F-blocks. It controls the motor's safe enable from the E-stop. Press Run, then press the E-stop. The standard logic still requests movement, but the safety program cuts the safe output.

βš™οΈ Standard program OB1
everyday machine logic with no safety authority
"RunRequest" β†’ SawMotorCmd := FALSE
"SawMotorCmd" wants the saw OFF
πŸ›‘οΈ Safety program F-runtime
protected F-blocks; runs at its own interval, signature-checked
ESTOP1(E-stop OK) β†’ "SafeEnable" := TRUE
SafeSawOut := MotorCmd AND SafeEnable = FALSE
E-STOPtap to hit / reset
πŸͺš
Saw: SAFE-OFF
Standard cmd: FALSE
Safe enable: TRUE
● safe output controlled by F-program
F-state: RUNNING

Releasing the E-stop does not restart this simulation. Its safety channel passivates and waits for a deliberate acknowledge (reintegration). The example requires that deliberate confirmation before restart; releasing the E-stop alone does not allow the machine to resume.

02 Β· How it stays trustworthy

Safety over an ordinary wire

The safe E-stop signal travels the same PROFINET cable as the other signals. How does the safety communication support an application that requires SIL 3? PROFIsafe wraps each safe value with a sequence number, watchdog timer and CRC. Those checks let the receiver detect a stale number, a late telegram or an invalid checksum. When a check fails, the channel goes to the safe state instead of accepting the affected value as valid safety data.

🟨 F-blocks are protected. The safety program has its own runtime group and collective signature. Access protection restricts edits, and a change is logged and re-verified. The yellow display identifies that separate safety program and distinguishes it from the ordinary machine logic shown beside it.

🀝 Safe & standard coexist. Both run on the one F-CPU and can exchange data in both directions (safe β†’ standard is unrestricted; standard β†’ safe is restricted). Your machine logic reads safety status but can never weaken it.

03 Β· Check yourself

Who drops the output?

A PROFIsafe telegram arrives after its F-monitoring time has expired. What does the F-CPU do with that channel?