Siemens SIMATIC ET 200AL, System Manual

Page: 967 / 2255

Digital I/O module F-DI 4+F-DQ 2x24VDC/2A, 4xM12 (6ES7146-5FF00-0BA0)
Equipment Manual, V1.0, 05/2021, A5E51082342-AA
61
Interrupts/diagnostic messages/diagnostics
6
6.1 Reactions to faults
Reactions to startup of the fail-safe system and to faults
The fail-safe concept depends on the identification of a safe state for all process variables.
The value "0" (de-energized) represents this safe state for digital fail-safe modules. This
applies to both sensors and actuators.
The safety function requires that safe state values be applied to the fail-safe channel(s)
instead of process values (passivation of the fail-safe module or channel(s)) in the following
situations:
•
When the fail-safe system is started up
• If module faults are detected, such as RAM or processor failures
• If errors are detected during safety-related communication between the fail-safe CPU and
the fail-safe module through the PROFIsafe safety protocol (communication error)
• If module channel faults occur (for example, short-circuit and discrepancy errors)
The fail-safe CPU enters information about detected system faults into the diagnostic buffer.
Automatic safety measures and the PROFIsafe protocol ensure that the safe state is set if the
system detects a fault.
Fail-safe modules do not remember errors upon power cycle. When the system is powered
down and then restarted, the modules detect any faults still existing again. The exception to
this is a permanent deactivation fault such as "sustained overvoltage".
Fail-Safe value for fail-safe modules
If digital input channels are passivated, the fail-safe system always provides safe state values
("0") for the safety program instead of the process values applied to the fail-safe inputs.
If digital output channels are passivated in the fail-safe module digital outputs, the fail-safe
system always transfers safe state values "0" to the fail-safe outputs instead of the output
values provided by the safety program. The output channels are de-energized.
The passivation safe state value and the output state value in CPU STOP mode are always "0",
de-energized. You cannot select or program a default "ON" state for passivation or STOP
mode.