HIMax Safety Manual - Tuv-fs.com

HIMax8 Output ModulesNOTICESystem malfunction possible!The slots reserved for processor and system bus modules must not be used forinput modules!!8.5 Safety-Related Digital OutputsThe safety-related output channels are equipped with three testable switches connected inseries. By this, the requirement for a safe, independent, second way of de-energizing isfulfilled. If a fault occurs, this integrated safety shutdown function safely de-energizes allchannels of the defective output module (de-energized state).Furthermore, the watchdog signal of the module provides a second way of safetyshutdown: If the watchdog signal is lost, the module immediately adopts the safe state.8.5.1 Use of Digital InputPerform the following steps to write a value in the user program to a digital output:1. Define a global variable of type BOOL.2. When defining the global variable, enter the initial value as safe value.3 Assign the global variable to the channel value of the output.The global variable provides the safe value to the digital output.To get additional options for diagnosing the external wiring and programming fault reactionsin the user program, assign global variable to Channel OK and to further diagnosticstatuses. For more information on the individual diagnostic statuses such as line shortcircuitsand line breaks, refer to the manual of the corresponding module.8.5.2 Test Routines for Digital OutputsThe modules are tested automatically during operation.The main test functions are:• Reading the output signals back from the switching amplifier. The switching threshold ofa 0 signal that has been read back is below the valid voltage value for the type of output.The diodes used prevent a feed back of signals.• Checking the integrated redundant safety shutdown.• A shutdown test of the outputs is performed cyclically for max. 200 µs. The minimuminterval between two tests can be set from within the SILworX Hardware Editor.If faults occur, the outputs are set to the safe value.8.5.3 Reaction in the Event of a FaultIf the test routines detect a fault in one or several channels, the module switches thosechannels off and by this brings them into the safe state. The parameter Channel OK is setto FALSE for these channels.If the test routines detect a module or submodule fault, the module sets the Module OK orSubmodule OK status to FALSE.In all cases, the module also indicates the fault by the Error LED on the faceplate.8.5.4 Behavior in the Event of External Short-Circuit or OverloadIf the output is short-circuited to L- or overloaded, the module is still testable. It is notnecessary to transfer the module to the safe state.HI 801 003 D Rev.2.0 Page 41 of 70