DESCRIPTION AND OPERATION
SECURITY FUNCTIONS
2 - 12
I-E96-207A
®
•
The controller is unable to drive analog or digital outputs to
correct values.
•
The controller's own status is bad (the controller is no
longer functioning).
•
An input status is bad.
All I/O points that have any of the preceding errors are tagged
by the controller as bad quality. Bad quality stays with the
point no matter where it goes (for example, in the controller, on
the module bus or the communication highway.
If you select to run the process using bad quality data, the con-
troller uses the last valid value it had for the process point
before the quality went bad. The controller then writes the bad
quality information to its module status bytes and activates an
OIS or MCS alarm.
Station and redundancy failures are also noted in the modules
status bytes. Since the status bytes are always available to the
communication module (in the same PCU as the controller), it
is also available to the OIS or MCS console. The console opera-
tor can be aware of the problem and correct it before a fatal
error can occur.
I/O Security
For safety reasons, the controller module outputs always go to
known states in the event of a failure. Default states (for exam-
ple, power up value, hold at current value) are given in the
product instructions for the related controller modules. Refer
to these documents for specifics.
