Calculating Fail-Safe Execution and Response Times in SIMATIC S7 F Systems Using the s7ftime.xlsm Tool

In SIMATIC S7 F Systems, the official calculation tool s7ftime.xlsm is an Excel macro-enabled spreadsheet provided by Siemens to calculate execution times of fail-safe blocks, runtimes of F-shutdown groups, and maximum safety monitoring and response times (such as F_WD_Time) in compliance with IEC 61508. While Siemens support pages may display German descriptions depending on browser language settings, the downloaded s7ftime.xlsm file contains full English language support with switchable language tabs. The tool is available directly from Siemens Industry Online Support (SIOS) under Entry ID 22557362, with detailed application guidance provided in PCS 7 Compendium Part B.

Executive Summary

Functional safety standards (IEC 61508, IEC 61511, and EN ISO 13849) require safety engineers to prove that safety instrumented functions (SIF) de-energize within the process safety time (PST). In SIMATIC PCS 7 and S7 F Systems, calculating these worst-case reaction times manually across distributed fail-safe I/O, PROFIsafe communication cycles, and controller execution groups is highly complex. Siemens provides the standardized engineering calculation tool s7ftime.xlsm for this purpose. Engineers occasionally struggle to locate an English edition because download pages can default to German. This guide clarifies the tool's multilingual availability, download location, and core calculation methodology.

Architecture and Fundamental Mechanics

The safety response time in an S7 F Systems architecture comprises three distinct, additive temporal domains:
1. Input Reaction and PROFIsafe Transmission Time:
- Fail-Safe Input Module (F-DI): Sensor input filter time, internal diagnostic test cycle, and F-module processing time.
- PROFIsafe Cycle: Bus cycle time ($T_{bus}$), F-monitoring time (F_WD_Time), and communication jitter across PROFIBUS DP or PROFINET IO.
2. AS F-Execution and Shutdown Group Runtime:
- F-Shutdown Group: Safety logic executes inside cyclic interrupt OBs (OB35, OB36, or OB38). The total runtime of the safety program depends on the number and type of F-blocks instantiated (logic gates, safety timers, Safety Matrix instances).
- Controller Cycle Time: The maximum cycle time of the F-execution group must be strictly bounded to prevent watchdog trips.
3. Output Reaction Time:
- PROFIsafe Transmission to F-DO module.
- Fail-Safe Output Module (F-DO): Internal processing time, dark/light test cycle, and actuator switch-off delay.
4. Role of s7ftime.xlsm:
The spreadsheet incorporates empirical execution constants for every certified S7 F-block and fail-safe signal module across S7-400H / CPU 410-5H controllers. Entering the module count, bus architecture, and F-block quantities calculates the precise worst-case system response time and verifies that it does not exceed the designated Process Safety Time.

Step-by-Step Implementation Procedure

Download the s7ftime.xlsm Calculation Tool:
a. Access the Siemens Industry Online Support (SIOS) portal (support.industry.siemens.com).
b. Navigate to Entry ID: 22557362 ('SIMATIC S7 F Systems: Execution times of fail-safe blocks, runtime of the F shutdown group, monitoring and response times').
c. Download the archive containing s7ftime.xlsm.
d. Right-click the downloaded zip file, select 'Properties', check 'Unblock' if present, and extract the file.
Open and Configure Language in Excel:
a. Open s7ftime.xlsm in Microsoft Excel with macros enabled.
b. Look at the introductory worksheet: click the language selector button or select the English worksheet tab ('EN' / 'English').
c. Confirm that all column headers, parameter definitions, and formula instructions display in English.
Enter System Architecture Parameters:
a. Select your AS CPU type (e.g., CPU 410-5H or CPU 416-5H).
b. Enter the configured cyclic interrupt OB cycle time (e.g., 100 ms for OB35).
c. Select the communication architecture: PROFIBUS DP baud rate (e.g., 1.5 Mbps or 12 Mbps) or PROFINET IO (100 Mbps).
Populate F-Block and Module Quantities:
a. In the 'F-Blocks' tab, enter the exact quantity of each instantiated F-block (F_DI_4x, F_DO_4x, F_CH_AI, F_SHUTDN, Safety Matrix blocks) extracted from the Step 7 block list.
b. In the 'F-Modules' tab, enter the inventory of fail-safe ET 200M / ET 200SP / ET 200iSP modules.
Calculate and Evaluate Results:
a. Click 'Calculate' to execute the embedded macros.
b. Review the calculated 'F-Shutdown Group Runtime' ($T_{run}$): ensure $T_{run}$ is less than 50% of the OB cycle time to prevent cycle overrun.
c. Review the recommended 'PROFIsafe Monitoring Time' (F_WD_Time): update this value in HW Config on each F-module.
d. Confirm that the calculated 'Maximum Response Time' ($T_{resp}$) is safely below the plant's Process Safety Time (PST).

Verification

In Step 7 HW Config, verify that the configured F_WD_Time parameters on all F-modules match or exceed the minimum values calculated by s7ftime.xlsm.
In the AS Diagnostic Buffer online, confirm that the F-shutdown group executes without reporting OB cycle overruns.
Archive the completed s7ftime.xlsm calculation sheet in the plant safety lifecycle dossier for third-party TÜV audit compliance.

Limitations and Operational Precautions

The calculated response times are valid only when using certified hardware and firmware configurations documented in the spreadsheet. Overclocking execution groups or exceeding calculated watchdog bounds risks spurious safety shutdowns.

Engineer FAQ

Where can I download the English s7ftime.xlsm spreadsheet?

From Siemens Industry Online Support (SIOS) under Entry ID 22557362. The spreadsheet contains built-in English and German language options.

Why is s7ftime.xlsm required for S7 F Systems?

Functional safety standards (IEC 61508 / IEC 61511) mandate documented proof of worst-case system response times to guarantee that safety trips occur before hazardous states develop.

What is F_WD_Time?

F_WD_Time is the fail-safe watchdog monitoring time configured in HW Config that defines how long a PROFIsafe communication dropout is tolerated before fail-safe passivation occurs.