DESCRIPTION AND OPERATION
SECURITY FUNCTIONS
I-E96-213A
2 - 5
Local and remote I/O errors cause the MFC to assign a bad
status to the slave signals. Local errors occur when:
•
An I/O signal or voltage reference is out of range.
•
The MFC is unable to drive analog or digital outputs to cor-
rect values.
•
A slave status is bad.
All I/O points that have any of the preceding errors are tagged
by the MFC as bad quality. Bad quality stays with the point no
matter where it goes (e.g., in the MFC, on the module bus, or
the communication highway).
You can run the process using bad quality data. The MFC will
use the last valid value it had for the process point before the
quality went bad. The MFC then writes the bad quality infor-
mation to its module status bytes and starts an OIS or MCS
alarm.
Station and redundancy failures are also noted in the module's
status bytes. Since the status bytes are always available at the
communication module (in the same PCU as the MFC), it is
also available to the OIS or MCS console. Therefore, the con-
sole operator can be aware of the problem and correct it before
a fatal error can occur.
I/O Security
For safety reasons, slave module outputs are programmed to
go to user defined states when they detect a failure. Failover
states (e.g., power up value, hold at current value) are given in
the product instructions for the related MFC slave modules.
Refer to these documents for specifics.
