LION I/O Modules
▪
Product Description
43
RUN
Master transfers a message to all slaves
modules to change into run mode. The L-Bus
2
runs without errors. Cyclic communication with
the process data. No time exceed.
error
Occurirng of a minor error (e.g. local I/O
peripherie is disturbed), the module changes
into the limited run mode.
limited run
Limited operation of the module. The L-Bus
2
runs without errors. No process data
communication.
fatal error
Occurring of a fatal error. The I/O module
changes into the fail safe mode.
A fatal error could be:
▪ Time exceeding/ No communication
▪ Bus is disturbed
▪ Defect slave hardware, error during core test
▪ Temperature exceeding
fail safe
No communication. The I/O module can be
reactivated by switching off and on the supply
voltage or by resetting the module.
7.6.1
Fail Safe
SIL
relevant
LION-015 Two different types of fail safe can be occure regarding the detected error:
▪ Recognized distinct error of an I/O channel of a group.
The channel or the goup will be in the fail safe mode.
▪ Recognized error of the central processing unit (e.g. µC).
The whole module will be in the fail safe mode.
Criteria
Reaction
SIL
relevant
LION-026
Communication is interrupted to the
master (time exceedence > t
tolerance
)
The tolerance times are described in
the system description.
▪ Fail safe mode
▪ No communication
The module can be reactivated by an
L-Bus² reset or the disconnecting of
the power supply.
Fatal hardware error of the slaves - a
safe operation is not possible anymore
(core test error)
▪ Memory error (RAM/Flash)
▪ (Over-) voltage monitoring is
triggered
▪ CPU-Test error (register, command
execution)
▪ Temperature monitoring is triggered
▪ Fail safe mode
▪ No communication
The module can be reactivated by an
L-Bus² reset or the disconnecting of
the power supply.
