Safety Function

The module ensures its safety function using three safety switches connected in series for

each channel. This ensures that each output is two-fault-tolerant with respect to the safety

switch. Each safety switch of a channel can be individually switched off either via the

system bus (I/O bus) or via the second independent shutdown function (watchdog).

The safe output state is the de-energized state. Redundant processor systems monitor the

values expected for the outputs. Outputs that do not correspond to the expected values are

reset. The back-read branch is testable.

The safety function is performed in accordance with SIL 3.

Reaction in the Event of a Fault

If a channel fault occurs, the affected channel is set to the safe state. If a safety-relevant

fault occurs (e.g., multiple faults in one channel), the module adopts the safe state.

If the system bus fails, the outputs are de-energized.

The module activates the Error LED on the front plate.

Scope of Delivery

The module must be installed on a suitable connector board to be able to operate. If a FTA

is used, a system cable is required to connect the connector board to the FTA. Connector

boards, system cables and FTAs are not included within the scope of delivery.

The connector boards are described in Chapter 3.6. the system cables are described in

Chapter 3.7. The FTAs are described in own manuals.