The safety light curtain was not moved. The safe boundary moved.
That is the uncomfortable truth behind this safety light curtain distance case. In a SIMATIC S7-1500F configured in TIA Portal V18, F_WD_TIME was increased from roughly 150 ms to roughly 500 ms. That does not automatically mean the designer made a mistake. PROFIsafe monitoring time, or watchdog time, is not a universal number. It must fit the real communication setup, F-CPU cycles, the F program, and the F devices used on the machine.
The problem starts when the change is treated as a communication tweak only, with no check of what it does to the whole safety function.
Do not hunt for a ready-made recipe in those two values. They are rounded for this case description. They are not universal Siemens settings and they are not a recommendation to set F_WD_TIME to either value.
In this case, the impact came out during revalidation. A stopping time measurement established the real time for the hazardous movement to cease. A maximum response time calculation reflected the current safety-related control system configuration. When both were combined correctly and the distance was recalculated under ISO 13855, the result was blunt: the light curtain was too close to the hazard zone. More than half a metre was missing.
The scale is easy to see in the formula S = (K × T) + C. If total time T increases by 350 ms, then at K = 1600 mm/s the required distance increases by 560 mm. The F_WD_TIME difference does not always pass into the total time one-to-one. That is exactly why the calculation and the measurement of the whole function decide the case, not a gut feeling about one parameter.
There was no extra half metre available. The light curtain could not be moved away, so the protective measure had to change. It was replaced by a transparent interlocking guard with guard locking, the safety-related control system was rebuilt, and PLr = d was defined for the new safety functions.
At that point the story stopped being about one parameter in TIA Portal. A change to F_WD_TIME can start a chain: response time recalculation, changed safeguarding, new validation, and then the uncomfortable question of whether the work has become a substantial modification and who now carries manufacturer obligations.
F_WD_TIME 500 ms: wrong value, or wrongly assessed safety light curtain distance?
The first reaction is predictable:
- Who increases a watchdog from 150 ms to 500 ms?
- Isn’t that a safety function parameter?
- Is someone trying to hide communication problems?
Those are reasonable questions. None of them proves whether the light curtain is still far enough from the hazard.
The correct question is this: what did the F_WD_TIME change do to the maximum response time and the required safety light curtain distance?
Why F_WD_TIME has no single correct value
F_WD_TIME has no one correct value for every installation. If the monitoring time is too short, F devices can passivate even though communication is not actually faulty. In a more complex installation, F-CPU cycles, network update time, the selected devices, the PROFIsafe architecture, and the F program structure all matter.
So yes, you can have a badly selected 150 ms and a correctly selected 500 ms. You can also have a perfectly justified 150 ms and a completely unjustified 500 ms. The number alone does not answer the question.
Siemens describes two requirements that must be met at the same time. The monitoring time must be long enough that it is not exceeded during fault-free operation. It must also be short enough that the safety time of the process is not exceeded.
Increasing the parameter can therefore improve machine availability. It does not prove that the machine still reacts fast enough. It does not prove that the existing protective measure still gives the required risk reduction.
Here, F_WD_TIME was increased from about 150 ms to about 500 ms. From a communication standpoint, that may have been justified for the actual configuration. From a safety standpoint, it demanded a fresh check of the complete function.
The watchdog value itself may not be the defect. The defect is carrying on with the old calculation, the old stopping time report, and the old distance after the parameter has changed.
Why not simply go back to 150 ms?
This is the first practical question after a failed validation: if the light curtain is too close at 500 ms, why not set F_WD_TIME back to 150 ms?
If the shorter value still fits the real PROFIsafe configuration, that can be the right answer. There is no engineering honour in rebuilding a machine just to preserve an unnecessarily long watchdog.
The situation is different if 150 ms no longer provides the required reserve for the current F-CPU cycles, devices, network behaviour, and communication architecture. Going back to the old number may improve the distance calculation, but it may simply recreate the original communication problem.
Safety light curtain distance follows response time. Response time is not selected to fit the free space left on the factory floor.
First check whether F_WD_TIME can be reduced. Then check whether other response time components can be reduced. Then check whether the mechanical stopping time can be shortened. Only after those options are exhausted do the hard choices remain: move the light curtain away, or change the protective concept.
In this case, there was no space for the extra half metre. The issue could not be closed by a settings correction alone. The safeguarding concept had to change.
Stopping time measurement and response time: when 350 ms becomes 560 mm
Up to this point, you can still argue about the PROFIsafe configuration. Was 150 ms valid? Was 500 ms necessary? Could the F cycle have been shortened? Could network timing have been improved?
The answer comes only from coherent validation. The maximum response time calculation shows the behaviour of the control part of the safety function, including the fault scenarios considered in the design. The stopping time measurement shows the real time for the hazardous motion to cease. The boundaries of both values must be clear, otherwise you either miss a component or count it twice.
The test scope must match the scenario being analysed. A typical measurement triggered by interrupting the light curtain during healthy communication confirms the normal response path. It does not necessarily include waiting for F_WD_TIME. If the watchdog affects the maximum response path, that influence must be shown in the safety system timing calculation and then combined correctly with the measured time for the hazard to cease.
The sentence the machine stopped is not worth much here. The real question is sharper: did it stop before a person could reach the danger?
How to calculate minimum safety light curtain distance
ISO 13855 answers by converting time into distance:
S = (K × T) + C
If the other components stay unchanged, the effect of a change in total time can be shown as:
ΔS = K × ΔT
| Increase in calculated maximum time ΔT | Increase in distance at K = 1600 mm/s | Illustrative increase at K = 2000 mm/s |
|---|---|---|
| 100 ms | 160 mm | 200 mm |
| 350 ms | 560 mm | 700 mm |
Here, ΔT means the difference between two maximum response time calculations. It does not automatically mean the difference between two F_WD_TIME settings. The K = 2000 mm/s column only shows the mathematical scale. The correct variant for the project must be selected according to ISO 13855, not according to the result that looks more convenient.
You cannot choose a favourable K just because it produces a smaller number. The correct calculation method, value C, approach direction, detection capability, and other conditions come from ISO 13855 and the specific application.
This is not a margin you can round away. It is the distance that must exist between the light curtain detection field and the hazard zone.
Which stopping time result should be used?
One measurement is not enough. The informative annex of the ISO 13855 edition used in this case referred to at least 10 measurements. They must be taken under identified conditions that lead to the longest realistic time for the hazard to cease.
Depending on the machine, those conditions can include speed, load, cycle phase, temperature, and the state of the stopping elements.
Which result do you take?
Not the cleanest one. Not the average. Not the one that saves the existing light curtain.
Under the method described in that annex, the value used for the distance calculation is the greater of two values: the longest measured stopping time, or the average plus three standard deviations.
What exactly is included in the stopping time measurement?
The measurement boundaries matter. If the instrument measures the full time from protective device actuation to the cessation of hazardous motion, you must not add the same upstream response time components again from a calculator. If the measurement covers only the mechanical stopping part, then the calculated time for the earlier part of the chain must be added.
When the calculation and the stopping time measurement were combined in this case, the conclusion was clean and unpleasant: the required light curtain distance had grown by more than half a metre.
And the factory floor did not have that half metre.
The safety light curtain worked correctly. It still had to go
That sounds contradictory, but it is not. The light curtain detected a person and triggered a stop. The device itself was not the problem. The problem was its distance from the hazard.
A light curtain does not physically stop a person. It detects entry and gives the machine a signal to stop. The concept works only if hazardous motion ceases before the person can reach the hazard.
Why lack of space forced a new protective concept
What do you do when testing and calculation show that you need another 560 mm, but the line cannot give it to you?
ISO 12100 sends you back to the iterative risk reduction process. First, reconsider inherently safe design measures, including whether response time and stopping time can be reduced. If that is not enough, select a technical protective measure that fits the real conditions.
The floor layout does not amend ISO 13855. If the required distance is not available, the protective concept must change.
In this case, the principle changed. The light curtain, which detected a person entering the zone, was replaced by a transparent guard designed to prevent entry in the first place.
The transparent panels kept process visibility, but they could not be treated as decoration. The guard structure, strength, and fixing had to be assessed under ISO 14120. It could not create new crushing points or sharp edges. Reaching through, over, under, or around the construction had to be assessed with ISO 13857 in mind.
Why an interlocking guard with guard locking was used
Access was still needed for operation and service. So why not use a simple interlocking guard?
An interlocking guard triggers a stop when opened, but it does not necessarily prevent immediate access. If hazardous motion continues for a while, the operator can reach the zone before the machine has actually stopped.
The need for guard locking is not decided by stopping time alone. It is decided by comparing the time for the hazard to cease with the time needed to gain access, and by the risk assessment. In this case, the guard had to remain closed from the access request until the risk had ceased. Only then could the system release the lock and allow the door to open.
ISO 14119 covers the selection of interlocking devices, guard locking, and measures to reduce defeat.
Changing from a light curtain to an interlocking guard with guard locking was not a simple component swap. It created new safety functions, including:
- stopping hazardous motion after an access request,
- preventing start with the guard open,
- maintaining guard locking until the risk has ceased,
- releasing guard locking only after the required conditions are confirmed,
- preventing unexpected restart.
PLr = d belongs to the safety function, not the guard
For each identified safety function, the required Performance Level was defined from the risk assessment. In this case, PLr = d was selected for the functions providing the required risk reduction. The safety-related parts of the control system were then designed so that the achieved PL was at least equal to PLr, and the functions were verified and validated under ISO 13849-1.
That does not mean the guard itself had PL d. Performance Level applies to the complete safety function: position and lock status sensing, safety logic, output devices, and the final element that stops the hazardous motion. The marking on one switch does not prove the achieved PL of the complete system.
So a single parameter change led to a new guard, new safety functions, a rebuilt F program, and fresh validation.
That raises the next question: is the organisation that performed the rebuild still only the user of the machine, or has it taken over manufacturer obligations?
From a digital change to substantial modification
At first glance the answer feels obvious. A light curtain was replaced by an interlocking guard with guard locking, the F program was rebuilt, and new safety functions were added. The scope was large, so surely it must be a substantial modification.
Regulation (EU) 2023/1230 does not judge the number of changed parts. It does not ask how many metres of guarding were added or how many software blocks were rewritten. It asks about the effect of the change on safety.
How to assess the combined trigger conditions
For the path relevant to this case, you need to establish the chain:
- whether a physical or digital change was made after the machinery had been placed on the market or put into service,
- whether that change was not foreseen or planned by the manufacturer,
- whether it created a new hazard or increased an existing risk,
- whether it required the addition of a guard or protective device,
- whether the operation of that measure required modification of the existing safety-related control system.
A change to F_WD_TIME alone does not prove substantial modification. But it can trigger the conditions if the full chain is confirmed by risk assessment.
In this case, the starting point was a digital change on a machine already in use. Revalidation showed that the existing light curtain position no longer provided the intended risk reduction. Safety could not be restored by moving the light curtain, and the new interlocking guard with guard locking required safety function changes in the existing control system.
That is the chain described in Regulation (EU) 2023/1230:
digital change → increased risk → new protective measure → rebuild of the existing safety-related control system
This is not legalese fog. It is cause and effect.
One condition must not be assumed from the size of the work alone: was this change foreseen or planned by the original machine manufacturer?
If the manufacturer covered that variant in the original risk assessment, documentation, and instructions, the change may be part of a foreseen configuration. If it was not foreseen, and the other conditions are met, the case may qualify as a substantial modification.
When does the modifier take on manufacturer obligations?
If all conditions are met, Article 18 of Regulation (EU) 2023/1230 treats the natural or legal person carrying out the substantial modification as the manufacturer for the purposes of that Regulation. The obligations apply to the machinery or related product affected by the modification. For an assembly of machinery, they apply to the affected product within the scope shown by the risk assessment.
This does not end with another risk assessment and validation report. Manufacturer obligations include preparing technical documentation, carrying out the appropriate conformity assessment procedure, drawing up the EU declaration of conformity, affixing the CE marking, providing instructions and identification, and keeping the technical documentation and EU declaration of conformity for at least 10 years.
Regulation (EU) 2023/1230 entered into force on 19 July 2023, but its main provisions on substantial modification apply from 20 January 2027. If the rebuild was carried out earlier, those articles do not apply retroactively. You apply the rules in force at the time of the change.
Directive 2006/42/EC did not contain a legal definition of substantial modification. The European Commission guide to the Machinery Directive pointed instead to the need to assess whether the extent of transformation meant, in substance, that a new machine had been constructed.
How far does substantial modification reach?
After the words manufacturer obligations, it is easy to run into one of two ditches.
The first says: we must redo conformity assessment and documentation for the entire line from scratch.
The second says: we only changed the light curtain to a guard, so we document only the new door and the lock.
Both answers can be wrong.
Recital 26 of Regulation (EU) 2023/1230 explains that a person carrying out a substantial modification should not be required to repeat tests or produce new documentation for machinery or related products that are part of an assembly of machinery and are not affected by the modification.
That does not reduce the obligations for the machinery or related product that is actually affected.
The scope of influence cannot be defined by the project name, the edge of the electrical cabinet, or the physical location of the new guard. It must come from the risk assessment.
You therefore need to check much more than the door structure:
- which part of the line stops when the guard is opened,
- whether stop zone boundaries changed,
- whether adjacent machines can still perform hazardous motion,
- where the reset is located and what the operator can see from there,
- whether unexpected restart is possible after closing the guard,
- whether a person can remain between the guard and the hazard zone,
- whether the change affects interfaces between machines.
If the risk assessment shows that the substantial modification affects safety only on one machine or one related product within an assembly, Article 18 allows manufacturer obligations to be limited to that product.
If, however, the work changes shared access, stopping, reset, restart, or communication between zones, you cannot honestly claim that the modification concerns only one door.
Machinery or integrated manufacturing system?
If the analysed installation is an integrated manufacturing system with at least two interconnected machines working together for a specific application, ISO 11161 becomes relevant to the analysis of interfaces and interaction between safety functions.
Individual machines can be compliant and correctly guarded on their own. Once connected, or once a shared protective measure is changed, new risk can appear at system level.
The right question is: how far does the rebuild affect safety functions, zones, and interfaces?
Which documents and evidence must be updated?
For unaffected machinery or related products that form part of an assembly, tests do not have to be repeated and new documentation does not have to be created. Existing evidence can be used in the documentation of the affected product if it is still current and suitable.
That does not always mean writing every document from a blank page. It does mean preparing complete and coherent technical documentation for the product covered by the obligations. The file must show which previous evidence remains valid, what has been updated, and why the modification does not affect the remaining machinery or related products in the assembly.
The boundary of manufacturer obligations is not where the new guard ends. It is where the impact of the modification ends, as demonstrated by the risk assessment.
Change a safety parameter? Check the whole chain again
Changing F_WD_TIME does not automatically mean rewriting the full technical file from zero. But if the change leads to a substantial modification, the technical documentation must cover the machinery or related product whose safety has been affected.
An old stopping time report may still be a correct historical record. It does not automatically prove the light curtain position after the F program has changed.
| What changed? | What can be affected? | What must be demonstrated again? |
|---|---|---|
| F_WD_TIME or PROFIsafe configuration | Different maximum response time | Response time calculation for the current design |
| Response time or stopping time | Different safety light curtain distance | Stopping time measurement and ISO 13855 calculation |
| Light curtain replaced by interlocking guard with guard locking | New hazardous situations and safety functions | Risk assessment, function specification, and PLr |
| F program, interlocking, or guard locking logic | Changed SRP/CS | Verification of achieved PL and validation |
| Shared access, reset, or stop zone | Impact on neighbouring machinery | Interface analysis and scope assessment under ISO 11161 |
| Substantial modification conditions are met | Manufacturer obligations | Conformity assessment and complete documentation for the affected product |
No single proof replaces the others. The timing calculation, stopping time measurement, ISO 13855 distance calculation, risk assessment, and validation each answer a different question.
A response time calculator shows the behaviour of the control system. A stopping time measurement shows the real cessation of hazardous motion. ISO 13855 turns time into distance. The risk assessment decides whether the protective measures still deliver the required risk reduction.
Each change to a parameter that affects response time should therefore leave a clear trail: the reason for the change, configuration before and after, calculations, measurement results, risk assessment decision, design decision, and validation report.
Leave an audit trail from parameter change to validation
Siemens RT Calculator helps calculate response time. It does not show why the change was accepted or what consequences it had for the whole machine.
That decision chain needs structure. In a machine risk assessment system, the audit trail should retain the change history and the engineering justification. A machine audit should connect findings, corrective actions, evidence, and validation results. Without that trail, the next engineer sees only a new watchdog value and an old report. That is where bad assumptions breed.
Summary
This case does not prove that F_WD_TIME = 500 ms is wrong. It proves something more important: a parameter change that affects response time can invalidate earlier assumptions about machine safety.
The chain was simple:
F_WD_TIME change → different maximum response time → larger safety light curtain distance → no available space → new interlocking guard with guard locking → rebuilt safety-related control system
At K = 1600 mm/s, an extra 350 ms in total time means 560 mm of additional required distance. You cannot shrink that result because the floor is full. If you cannot reduce the time and you cannot move the light curtain, you must change the protective concept.
The watchdog change alone does not prove substantial modification. It can, however, start a sequence that meets all the conditions: a digital change after the machine was placed on the market or put into service, not foreseen by the manufacturer, increased risk, a new protective measure, and modification of the existing safety-related control system.
The key question is not: was it allowed to increase F_WD_TIME?
The better question is: after the change, was the machine safety recalculated, measured, assessed, and validated?
If the answer is backed by current calculations, stopping time measurement, risk assessment, and validation, the change is under control.
If the answer still rests on an old report and the belief that the curtain was not moved, that is exactly where the problem starts.
Official sources and standards
Siemens sources
- SIMATIC Safety — Configuring the monitoring times
- SIMATIC STEP 7 Safety Advanced — RT Calculator
- SIMATIC Safety — Response Times of Safety Functions
- Safety Function via IWLAN — example for TIA Portal V18
- SIMATIC Safety — system acceptance and verification of times
European Union law
- Regulation (EU) 2023/1230 — current text
- Regulation (EU) 2023/1230 — Recital 26
- Guide to Directive 2006/42/EC
Standards used in the analysis
- ISO 12100 — risk assessment and risk reduction
- ISO 13855 — positioning of safeguards with respect to the approach of the human body
- ISO 14119 — interlocking devices associated with guards
- ISO 14120 — design and construction of guards
- ISO 13857 — safety distances to prevent hazard zones being reached
- ISO 13849-1 — design of safety-related parts of control systems
- ISO 11161 — integrated manufacturing systems
Before applying a standard, confirm the edition relevant to the project, the national publication where required, and the current basis for presumption of conformity.