Rockwell Automation AADvance Controller Safety Manual - Manual (Page 85)

 
Document: 553630
ICSTT-RM446K-EN-P Issue: 10
_C
4-29
When the safety accuracy between channels exceeds the following limits then
a discrepancy alarm is set for the input channel
 Digital Input Module = 8%
 Analogue Input Module = 2%
In both situations the following safe values are reported by the variables:
Digital input modules
 Input state FALSE
 Line fault TRUE
 Discrepancy TRUE
 Channel fault TRUE
and the voltage value is 0mV
Analogue input module
 process value = a calculated value based on a count value of 0 (51 counts =
0.2mA)
 line fault TRUE
 Discrepancy TRUE
 Channel Fault TRUE
 Count value 0
In safety critical applications, the discrepancy alarms shall be
monitored by the application program and be used to provide an alarm to the
plant operations personnel.
Output Module Safety Functions
Digital Output Module Safety Functions
The digital output module is rated at SIL3 as a fail-safe module. In dual
redundant configurations it can be used for energize to action and de-energize
to trip SIL3 applications. Each module provides the following safety functions:
 output channel signals based on commands from the processor.
 redundant voltage and current measurements to the processor modules
for monitoring and diagnostics.
 over current and over voltage channel protection.
 executing diagnostic tests (on command from the processor module) and
reporting results back to the processor module.
 On power up or module insertion all output channels are set to the de-
energized (fail-safe) state until command states are received from the
processor. Each channel is driven individually according to the command
state values.
 When the module is unlocked, all of its output channels (including any
channels set to hold last state) always go to the de-energized state.
 the module enters a Shutdown Mode when the time between processor
commands exceeds the PST.