Safety Function

The module ensures its safety function using three safety switches connected in series for each

channel. This ensures that each output is two-fault-tolerant with respect to the safety switch.

Each safety switch of a channel can be individually switched off either via the system bus

(I/O bus) or via the second independent shutdown function (watchdog).

The safe output state is the de-energized state. Redundant processor systems monitor the

values expected for the outputs. Outputs that do not correspond to the expected values are

reset. One of the two read-back branches that were monitored for their expected values can be

tested.

The safety function is performed in accordance with SIL 3.

Reaction in the Event of a Fault

If a fault is detected, the module adopts the safe state and all the outputs are de-energized in

accordance with the ‘de-energize to trip principle’. If a channel fault occurs, only the

corresponding output is switched off; if a module fault occurs, all module outputs are switched

off.

If the system bus fails, the outputs are de-energized.

The module activates the Error LED on the front plate.