Fault avoidance
Dieses Thema enthält die folgenden Abschnitte:
- Validation
- Asymmetrical switching signals at the inputs
- Different states at the inputs
- Plausibility and connection errors
- Sporadically switching or toggling signal levels or impermissible signals
- Machine/system start-up without a function test for safety-related equipment
Validation
Only you, the user, machine builder or system integrator can be aware of all the conditions and factors realized in the design of your application for the machine. Therefore, only you can determine the automation equipment and the related safeties and interlocks which can be properly used, and validate such usage.
|
WARNUNG
|
| Unintended machine operation Validate the overall safety-related function and thoroughly test the application. |
Asymmetrical switching signals at the inputs
If the signals at the inputs switch asymmetrically (e.g., due to inoperable safety-related equipment, an inoperable switch, damaged or disconnected lines, etc.), the defined safe state S_EquivalentOut = SAFEFALSE will be retained once the safety-related equipment or the switch has been closed.
Different states at the inputs
If the states at the inputs are not the same (e.g., due to inoperable safety equipment, an inoperable switch, damaged or disconnected lines, etc.) once the time set at DiscrepancyTime has elapsed, the function block will output an error message (Error output = TRUE) and the S_EquivalentOut output will be SAFEFALSE.
Plausibility and connection errors
Plausibility errors are errors which occur, for example, when a range of values is exceeded or an impermissible connection is made. Such errors are detected and reported either by the function block itself or while the project is being compiled. However, this is not always possible in the case of connection errors.
This means that it is not possible, for example, to automatically verify whether:
- Values or constants within the range of validity at inputs are, in fact, incorrect for the safety-related function executed.
- Inputs and/or outputs are incorrectly connected or are not connected when they should be.
|
WARNUNG
|
| Unintended machine operation Validate the signals, formulas, variables or constants connected to the input and output formal parameters of the safety-related function block and thoroughly test the application. |
Sporadically switching or toggling signal levels or impermissible signals
If no additional fault avoidance measures are taken, signal levels which switch or toggle sporadically at the state-controlled inputs may cause the signal to trigger a potentially undesirable corresponding action.
Impermissible signals at inputs can lead to an unintended start, prevent a requested action from being executed or cause an error.
These signals may be caused by:
- Programming errors in the application program (user errors).
- Cross circuit, short circuit, and cable break (user errors, wiring errors).
To prevent this, the following measures can be taken, depending on the safety-related function:
- Using options for cross-circuit detection.
- Suitable cabling.
- Verifying the safety-related code in the Code Editor followed by validation of all safety-related networks.
The measures listed above can also be taken in combination in order to help prevent cascading or otherwise difficult to detect errors.
Machine/system start-up without a function test for safety-related equipment
Inoperable or error producing safety-related equipment can only be detected by testing whether it is functioning correctly. The function block does not support function testing.
Possible causes of inoperable or error producing safety-related equipment are:
- Inoperable devices (hardware errors)
- Cross circuit, short circuit, and cable break (user errors, wiring errors)
|
WARNUNG
|
Unintended machine operation
|