Verifying F-Runtime Licenses and Engineering Station Security Checklists in PCS 7 Compendium Part B

In SIMATIC PCS 7 Compendium Part B (Process Safety), checklist item 3.2.2 ('F runtime Licence available') refers to the physical Certificate of License (CoL) and paper authorization label that must be physically affixed to the S7-400 F-CPU hardware, as the runtime license is a legal entitlement rather than a software-enforced electronic license key in ALM. Checklist item 3.2.4 ('Screen saver activated') mandates configuring an automatic, password-protected screen saver on the Engineering Station (ES) to prevent unauthorized tampering with active safety programs in RUN mode, satisfying mandatory IEC 61511 and IEC 62443 industrial cybersecurity standards.

Purpose of the PCS 7 Compendium Part B Safety Checklist

In the engineering and commissioning of Safety Instrumented Systems (SIS) governed by international standards IEC 61508 and IEC 61511, process safety documentation must adhere to rigorous validation workflows.

Siemens publishes the SIMATIC Process Control System PCS 7 Compendium Part B - Process Safety as the authoritative guideline for designing and validating fail-safe architectures running S7 F Systems and Safety Matrix. A foundational component of Compendium Part B is the Pre-Commissioning and Safety Acceptance Checklist. This checklist serves as formal documentation presented to regulatory authorities (e.g., TÜV, OSHA, insurance inspectors) to certify that the automation system is legally licensed, functionally safe, and protected against unauthorized modification.

Anatomy of the S7-400 F-Runtime License: Physical Label vs Electronic Key

Engineers reviewing checklist item 3.2.2 ("HW version of the CPU: F runtime Licence available") frequently search the Automation License Manager (ALM) on the Engineering Station for an electronic license key and find nothing:

The S7-400 F-Runtime License Architecture (6ES7833-1CC00-6YX0):
Unlike engineering software packages (such as S7 F Systems 6ES7833-1FC02-0YA5 which installs an electronic .sik key on the ES), the F-Runtime License is an equipment-level entitlement granting legal permission to execute fail-safe code on a specific S7-400 CPU (e.g., CPU 414F, CPU 417F, or CPU 410-5H).
The Physical Authorization Label:
The F-Runtime license package is delivered physically as a Certificate of License (CoL) containing an official, serialized, adhesive authorization label.
Affixing the Label:
The commissioning engineer is legally required to peel this serialized paper label from the Certificate of License and stick it directly onto the front housing of the F-CPU (or behind the protective front door of the module). The controller firmware does not perform an electronic handshake; compliance is strictly audited by physical inspection.

Regulatory and TÜV Certification Compliance for F-Runtime Labels

Why does Siemens utilize a physical adhesive label rather than electronic license locking?

Continuous Operation Guarantee:
In a safety-critical chemical plant or nuclear facility, an emergency trip system must never halt or enter STOP mode because of a corrupted hard drive, an expired network license server, or a missing software key. Physical labeling eliminates any possibility that an electronic licensing error could trip or incapacitate an active safety function.
TÜV Acceptance Audits:
During official safety sign-off, a certified TÜV inspector verifies that every CPU running fail-safe runtime blocks displays this serialized label. Operating a fail-safe program without the physical label affixed constitutes an unlicensed safety installation and invalidates the plant's functional safety certification.

Engineering Station Password-Protected Screen Savers (Item 3.2.4)

Checklist item 3.2.4 ("Safety program properties: Screen saver activated") addresses a critical operational security vulnerability:

Safety Program RUN-Mode Modification:
SIMATIC S7 F Systems provides the capability to modify safety logic and download delta changes while the controller is in RUN mode (RUN-P). To prevent unauthorized changes, opening the Safety Program dialog requires entering the Safety Password.
The Security Threat Vector:
Once an engineer enters the safety password, the engineering session remains authenticated. If the engineer leaves the workstation unattended (e.g., to inspect a field transmitter or take a break), an unauthorized individual sitting at the ES could bypass safety interlocks, force fail-safe channels, or alter critical trip setpoints.
The Cybersecurity Countermeasure:
Checklist item 3.2.4 mandates configuring an automatic Windows screen saver with a short timeout interval (e.g., 5 to 10 minutes) and strictly enabling On resume, display logon screen. If the workstation remains idle, Windows locks the session automatically, neutralizing unauthorized access risks according to IEC 62443 industrial cybersecurity standards.

Safety Audit Verification Matrix: Physical, Electronic, and Cybersecurity Checks

The following table details the key pre-commissioning checklist items from PCS 7 Compendium Part B Section 3.2:

Checklist ItemScope / DomainVerification MethodPass / Audit Criteria3.2.1 CPU Firmware VersionHardware / FirmwareSIMATIC Manager Module Info (Ctrl+D)Matches firmware listed in safety TÜV certificate3.2.2 F-Runtime LicenseCommercial / LegalPhysical inspection of CPU moduleSerialized Siemens authorization label affixed to CPU3.2.3 Safety Collective SignatureSoftware IntegrityCFC > Options > Safety ProgramOffline and Online signatures match; documented in logbook3.2.4 Screen Saver ActivatedCybersecurity / AccessWindows Control Panel > Screen SaverAuto-lock active <= 10 min; "Display logon screen" enabled3.2.5 Safety Passwords DefinedAccess ControlSafety Program PropertiesIndependent passwords set for Safety Program and CPU Access3.2.6 Safety Cycle Time LimitsTiming DeterminismModule Info > Diagnostic Buffer / F-CTRLMaximum cycle execution time safely below configured MAX_CYC

Step-by-Step Procedure to Complete Section 3.2 of the Safety Checklist

Follow this verified engineering procedure to validate and document checklist compliance:

Verify and Document F-Runtime Licensing:
* Inspect the physical S7-400 rack.
* Open the front door of the F-CPU (or CPU 410-5H).
* Confirm that the yellow/white serialized label from the 6ES7833-1CC00-6YX0 package is affixed cleanly.
* Record the serial number and delivery note number in the plant safety audit logbook.
Configure Engineering Station Screen Saver:
* On the Windows desktop of the Engineering Station, right-click and select Personalize > Lock Screen > Screen saver settings.
* Select a screen saver (e.g., "Blank").
* Set Wait to 10 minutes (or client policy standard).
* Check the box On resume, display logon screen.
* Click Apply and OK.
Configure Safety Program Passwords:
* In CFC, open Options > Safety Program.
* Click Password and set a robust password protecting the fail-safe program.
* In HW Config, double-click the CPU, open the Protection tab, and configure CPU access passwords.
Record Safety Collective Signatures:
* In the Safety Program dialog, record the Offline Collective Signature and Compilation Date.
* Verify against the online signature in the controller and attach the report to the official Compendium Part B dossier.

Verification

Verify compliance prior to regulatory handover:
1. Walk down the control equipment room and visually inspect every S7-400 F-CPU; verify the presence and readability of the physical F-Runtime authorization label.
2. Leave the Engineering Station keyboard and mouse untouched for 10 minutes; verify that the screen saver activates and Windows locks the session, requiring user credentials to unlock.
3. In SIMATIC Manager, select the CPU and press Ctrl+D; verify that the firmware revision displayed matches the approved TÜV Annex list exactly.
4. Open Options > Safety Program in CFC; verify that the collective signature matches the documented engineering validation record.

Limitations and Operational Precautions

Redundant S7-400H / FH Controllers: Redundant fail-safe controller systems (S7-400FH) consist of two physical CPUs. Two separate F-Runtime licenses (6ES7833-1CC00-6YX0) are legally required—one label must be affixed to each CPU in the redundant rack.
Never Run Without Physical Labels: Operating a safety controller without purchasing and affixing the official F-runtime license label breaches regulatory safety certifications and invalidates insurance coverage in the event of an industrial incident.
Screen Saver Overhead: Ensure standard enterprise screen savers (such as 3D graphics or unverified third-party utilities) are never deployed on engineering stations, as excessive CPU consumption by 3D rendering can disrupt cyclic automation processes. Use simple "Blank" screen savers.
Commercial Accuracy: The F-Runtime license (6ES7833-1CC00-6YX0) and S7 F Systems engineering license (6ES7833-1FC02-0YA5) must be verified against current Siemens pricing and regulatory catalogs. Obtain official quotation verification through an authorized Siemens distributor.

Engineer FAQ

Can I see the F-Runtime License in Automation License Manager (ALM)?

No. The S7-400 F-Runtime License is delivered solely as a physical Certificate of License with an adhesive label. It does not exist as an electronic software key in ALM.

Does a missing F-Runtime label prevent the CPU from going into RUN mode?

No. The CPU hardware and S7 F Systems software will allow the program to compile and run. However, running without the physical label constitutes an unlicensed safety installation and will fail any formal TÜV or insurance audit.

Why does the safety checklist specify the screen saver on the ES rather than the OS?

The Operator Station (OS) runs WinCC Runtime with restricted operator controls. The Engineering Station (ES) has full programming access to download changes, modify logic, and bypass safety interlocks, making unattended ES sessions a severe process safety hazard.

Do CPU 410-5H controllers require the same F-Runtime License label?

The SIMATIC S7-400 CPU 410-5H uses modern System Expansion Cards (SEC) for process object capacity, but fail-safe execution still requires the official S7 F Systems F-Runtime License and physical documentation.