The safety function of safety modules (DI581-S, DX581-S and AI581-S) with digital and analog input channels is to correctly read external analog and/or digital signals. If this function cannot be correctly executed, the safety module or only its input channel, depending on the fault scope, has to go to a safe state. In case of a channel fault, the safe value (de-energized = ‘0’) is transferred to the safety logic module (e.g., SM560-S) with additional information about the fault for the given channel.

In case of module fault, no valid telegrams are generated by the safety module to the safety logic module. The values of those safety input channels will be assigned to safe values (de-energized = ‘0’) on the safety CPU.

Faults in the cyclic communication between the safety CPU and the safety modules are detected by the safety modules with input channels. If a communication fault occurs, all inputs of the affected safety module go to a so-called passivation state in which ‘0’ values are sent as process values when the communication to the safety CPU is re-established. The switch-over (reintegration) from safety values ‘0’ to process data takes place only after user acknowledgment.