Safety Considerations Guide, Tricon v9.0 - Tuv-fs.com

Module Diagnostics 45Relay Output ModulesRelay Output Module points are not intended for safety-critical applications. Thediagnostics used by the relay output points cannot detect faults in the relaycontacts.Relay Output Module AlarmsDetectable Relay Output Module faults are reported to the control program.Input/Output ProcessingEach processor on an I/O module is protected by an independent watchdog thatverifies the timely execution of the I/O module firmware and diagnostics. If an I/Oprocessor fails to execute correctly, the I/O processor enters the fail-safe state. TheI/O bus transceiver and all outputs for the faulting channel are disabled, leaving alloutputs under control of the remaining healthy channels.The integrity of the I/O bus is continuously monitored and verified independentlyby each channel of the system. A catastrophic bus fault results in affected I/Omodule channels reverting to the fail-safe state in less than 50 milliseconds, worstcase.• Each digital input point is reported to the control program as de-energized.• Each analog input point is reported to the control program as zero.• Each digital output point goes to the de-energized state.• Each analog output point goes to 0.0 mA.• Each relay output point goes to the normally open (NO) position.I/O Module AlarmsLoss of communication with an I/O module is reported to the control program andcan be used to increase availability during specific multiple-fault conditions.Chapter 3Fault Management