Siemens SIMATIC ET 200AL, System Manual

Page: 99 / 2255

Maintenance
9.4 Reactions to errors of the F module
Distributed I/O system
System Manual, 08/2021, A5E31861578-AJ
97
9.4 Reactions to errors of the F module
Safe state (safety concept)
The basic principle behind the safety concept is the presence of a safe state for all process
tags.
Note
For digital F-modules, the safe state is "0". The safe state applies to sensors and actuators.
Error reactions and startup of the F-system
In the following situations, the values of the safe state must be connected to the fail-safe
channel/channels instead of the process values (passivation of the fail-safe module) due to
the safety function:
•
When the F-system is started
• When errors are detected in the safety-related communication between the F-CPU and the
F-module via the PROFIsafe safety protocol (communication error)
• When errors of the F-I/O or channel errors (e.g. wire break or discrepancy error) are
detected
Detected errors are written to the diagnostic buffer of the F-CPU and reported to the safety
program in the F-CPU.
F-modules cannot save errors as retentive data. If the system is switched off and then
restarted, any pending errors are detected again at startup. However, you can save errors in
your safety program.
WARNING
If channels are set to "disabled", there are no diagnostic or error handling reactions.
For channels that are set to "disabled" in STEP 7, no diagnostic message or error handling is
triggered when a channel error occurs. Not even if this channel is indirectly affected by a
channel group error ("Channel activated/deactivated" parameter).
Troubleshooting in the F-system
To correct errors in your F-system, proceed as described in IEC 61508-1:2010 section
7.15.2.4 and IEC 61508-2:2010 section 7.6.2.1 e.
Perform the following steps:
1.
Rung diagnostics and correct the error
2. Revalidate the safety function
3. Record in the service report