Output fault detection applies to hardware outputs that are allocated to tested output modules. The tests include detection of faults affecting: . a single output channel, . a group of output channels at the same output module, and. all channels of an output module. Output fault detection applies to the following fail-safe output modules: Module Group specification - 10201/1/1 and 10201/2/1: Group 1: channels 1 to 4 Group 2: channels 5 to 8 - 10203/1/2: Group 1: channels 1 to 4 - 10205/1/1 and 10205/2/1: Each channel is a separate group.

- 10212/1/1 Group 1: channels 1 to 4 Group 2: channels 5 to 8 - 10213/1/1 and 10213/2/1: Group 1: channels 1 to 4 - 10213/1/2 and 10213/2/2: Group 1: channels 1 to 4 - 10213/1/3 and 10213/2/3: Group 1: channels 1 to 4 - 10214/1/2: Group 1: channels 1 to 3 - 10215/1/1 and 10215/2/1: Group 1: channels 1 and 2 Group 2: channels 3 and 4 - 10216/1/1 and 10216/2/1: Group 1: channels 1 to 4 - 10216/2/3: Group 1: channels 1 to 4 Safety-related Outputs If a fault affects an output configured for a safety-related signal, the faulty output is forced to the safe state (i. e. '0'). The '0' value is applied to the process, regardless of the value calculated by the application program. Depending on the predefined effects of the fault, a single channel, a group of channels or all channels of an entire module are forced to '0'. If a fault is detected for one output channel, that channel is forced to '0'.

If a fault is detected for two or more channels within a single output group, all channels of the entire group are forced to '0'. If an entire group of safety-related output channels is regarded faulty, the second fault timer is started. If all groups at the same output module are faulty, the entire module is regarded faulty. If an entire safety-related output module is regarded faulty, the Central Part that controls the affected output module will trip.

If the module is located in a single I/O section, the entire FSC system will trip. Digital Outputs If a safety-related digital output channel is over-loaded or shorted, the output will switch off. If a second fault in that output group is detected, all channels of the entire group are forced to '0'. A fault on a safety-related output will generate an FSC system fault, and remain de-energized until a fault reset is given. Non-safety-related outputs switch on again after a delay of several hundreds of milliseconds. A system fault is only generated if the output is of a fail-safe type.

Analog Outputs An open-circuit across a safety-related analog output will cause that output to be forced to '0'. An FSC system fault will be generated, and the output will remain de-energized and defect until a fault reset is given. A short-circuit across a safety-related analog output will cause the output to be forced to '0'. This however, will not render the output defective. When the short-circuit is removed, the output value is applied to the process as calculated by the application program.

A fault reset is not necessary. Non-safety-related Outputs If a fault affects an output configured for a non safety-related signal, the fault is only reported. The output value is applied to the process as calculated by the application program as a result of the faulty module.