|
This is the web edition of the original ⮫ AC500-S safety user manual, version 1.3.2. This web edition is provided for quick reference only. The original safety user manual must be used to meet functional safety application requirements. |
The safety CPU and non-safety CPU have their own firmware, boot project and application program, which are executed separately. The only control element on non-safety CPU hardware, which allows changing the status of both non-safety and safety CPU is [Run] button on non-safety CPU. [Run] button on non-safety CPU can simultaneously stop and start both non-safety and safety CPU. This behavior of [Run] button depends on non-safety CPU settings⮫ [3]. Stopped safety CPU means that application program execution has stopped only. PROFIsafe F-Host and F-Device stacks⮫ [2] continue to run in fail-safe mode. All safety I/O modules are passivated and substitute values "0" are used for safety I/Os and F-Devices. PROFIsafe F-Host and F-Device stack execution can be stopped by entering SAFE STOP state only. In this case, PROFIsafe telegrams are not generated and I-ERR LED is on.
DANGER
It is not possible to safely start safety CPU using [Run] button on non-safety CPU. The safety CPU always goes to non-safe DEBUG mode (DEBUG RUN or DEBUG STOP) as soon as [Run] button is pressed on non-safety CPU⮫ “Description of safety CPU module states”. To bring the safety CPU back into the safe RUN mode, perform a power cyle of the safety CPU or use “reboot” PLC browser/shell command on non-safety CPU.
The commands “Run” and “Stop” in engineering suite have the same effect on the safety CPU and non-safety CPU as [Run] button on non-safety CPU.
There are some parameters of non-safety CPU configuration which influence the overall system behavior of safety and non-safety CPU.
- 1
-
Safety CPU
- 2
-
Non-safety CPU
- 3
-
Safety I/O module
- 4
-
Valid safety telegram
- 5
-
Telegram with "0" values or valid safety telegram
- 6
-
Non-safety CPU settings
- 7
-
Safety CPU safety telegrams with output values