Siemens F-I/O Passivation & Reintegration (ACK_REI)

Siemens · advanced · 35 min

When a Siemens fail-safe module passivates after a fault, it substitutes safe values until you reintegrate it. Clear the real fault, then acknowledge reintegration with a rising edge on ACK_REI.

⚠️ Passivation is the F-system protecting the process — it means a real fault was detected. Never force a reintegration to make an alarm go away; eliminate the fault first, then acknowledge.

What passivation is

In a Siemens fail-safe system (S7-1200F / 1500F, ET 200SP F-modules, STEP 7 Safety in TIA Portal), when an F-I/O fault or a channel fault is detected, the affected F-I/O passivates. Passivation means the F-CPU stops using the module's process values and substitutes fail-safe (zero) values instead, keeping the process safe. You can see it in the F-I/O DB: when a module is passivated, PASS_OUT and QBAD both equal 1.

So a passivated module isn't 'broken' — it detected a fault and went to a safe substitute state, and it stays there until you reintegrate it.

What reintegration is

Reintegration (also called depassivation) is the confirmation performed after the fault that caused passivation has disappeared. It returns the F-I/O to using real process values. Two tags in the F-I/O DB drive it:

• ACK_REQ — a status output you read. When the fault is gone and the module is waiting for a reintegration acknowledgment, ACK_REQ becomes TRUE.
• ACK_REI — a control input you set. A rising edge (0→1) on ACK_REI acknowledges the reintegration for that F-I/O.

Step-by-step recovery

1. Identify the passivated module. In the safety program / F-I/O DBs (or the diagnostics), find the F-I/O with PASS_OUT / QBAD = 1. The CPU diagnostic buffer also logs the F-I/O fault with its cause.
2. Eliminate the real fault. Fix what the diagnostics name: a channel fault (wire break, short, discrepancy on a dual-channel input), a module/communication fault, or a supply issue. Reintegration will not stick while the fault is present.
3. Wait for ACK_REQ = TRUE. Once the fault is gone, the F-system requests acknowledgment by setting ACK_REQ true for that module.
4. Pulse ACK_REI. Provide a rising edge on ACK_REI — typically from an operator acknowledge (HMI button, input) routed in the safety program. This reintegrates that single F-I/O and it resumes using real values.

Single vs. global acknowledge

• ACK_REI acknowledges one F-I/O — this is the recommended best practice, so you only reintegrate the module whose fault you actually resolved.
• ACK_GL reintegrates all F-I/O at once — use it only for commissioning, never as the routine production acknowledge, because it can mask which module was faulted.

Verify

After a successful reintegration, PASS_OUT / QBAD return to 0 and the module's real values are used again. If it re-passivates immediately, the fault is still present — re-read the diagnostics rather than repeatedly acknowledging.

Never do this

Do not wire ACK_REI to acknowledge automatically/continuously, and do not use ACK_GL in production to sweep faults away. Acknowledgment must be a deliberate action after the fault is genuinely fixed, per your safety concept.