1606-XLS80E模块备件

1606-XLS80E

发生故障时的反应
如果检测到故障信号，则受影响的模块输出设置为安全、断电
使用安全开关的状态。如果发生模块故障，则切换所有模块输出
关闭。两种类型的故障也由错误指示灯指示。
注
系统可能出现故障！
在关闭感应负载期间感应的电压可能会导致系统故障
控制器或靠近演员输入引线的其他电子系统中。
因此，将感应负载与致动器处的适当续流电路连接以抵消这些干扰是一种良好的做法。
开关操作的数量根据相应的时间限制
标准，如EN 50156-1熔炉电气设备。请参阅模块手册
（HI 801023 E）了解更多详情。
切换操作计数器过期后，必须更换模块！
8.4.3根据通电跳闸原则进行操作
允许根据通电跳闸操作数字继电器输出
道德原则
8.4.4冗余
允许冗余连接数字继电器输出。冗余连接是
通常用于提高可用性。
如果应使用其他连接变体，例如增加SIL值，则故障状态：
必须在用户程序逻辑中处理。
8.5安全相关模拟输出
它们将用户程序中确定的值转发给执行器。
安全相关模拟输出读回其输出值，并将其与
要输出的值。如果值不同，则会触发故障反应。
8.5.1模拟输出的测试例程
模块在运行期间自动测试。主要测试功能有：
ƒ读回输出信号。
ƒ检查集成冗余安全停机。
如果发生故障，输出设置为安全值0 mA。
8.5.2发生故障时的反应
如果测试例程检测到一个或多个通道中存在故障，模块将切换
通道组关闭并使其进入安全状态。参数Channel OK设置为：
对于这些通道为FALSE。
如果测试例程检测到模块或子模块故障，则模块将模块设置为OK或OK
子模块OK状态为FALSE。此外，模块或子模块设置通道OK
对于其所有通道，设置为FALSE。
在所有情况下，模块还通过面板上的错误指示灯指示故障。
HIMax 8输出模块
HI 801 003 E版本4.00，第35页，共64页
8.5.3外部开路情况下的行为
如果出现断路，模块将关闭电流约8毫秒，然后关闭
检查开路是否仍然存在。如果是这种情况，它将关闭约10秒。
这个过程可以无限重复。
8.5.4使用模拟X-AO 16 01输出时，应注意以下几点：
单元
如果使用模拟输出模块，则必须对遵守以下特殊性：
请参阅模块特定手册（HI 801 111 E）：
ƒ只能使用模块手册（HI 801 111 E）中规定的连接变体
习惯于
ƒ如果两个以上的模块冗余串联，则SELV电压可能会降低
超过！
ƒ对于串行冗余，每组两个信道中只能使用一个信道！
ƒ如果连接的致动器和一个HART之间发生HART通信
端子，输出信号与终值的偏差可达2%！
ƒ如果发生故障，在坏的情况下，达到安全状态的时间可能长达16毫秒。
在定义反应时间和安全时间时要考虑到这一时间！
ƒ用户程序不能在短于6毫秒的周期内写入模拟输出。
ƒ如果发生故障，模块输出安全值0 mA，即使电流上限
超过设定范围。
8.5.5根据通电跳闸原则进行操作
允许根据通电跳闸原则操作模拟输出。在里面
在这种情况下，必须使用在线监测。
8.5.6冗余
允许冗余连接模拟输出。冗余连接是
通常用于提高可用性。
如果应使用其他连接变体，例如增加SIL值，则故障状态：
必须在用户程序逻辑中处理。
8.6输出检查表
HIMA建议使用可用的清单进行工程、编程和测试
启动安全相关数字输出。检查表可用于帮助：
规划，并在稍后证明规划阶段是认真的
完整的。
在设计或启动系统时，填写以下各项的检查表非常有用：
系统中使用的安全相关输入通道，用于验证是否满足要求。这
是确保所有要求都得到考虑和明确记录的一方法。这个
检查表还记录了外部接线和用户之间的关系
程序
检查表在HI上以Microsoft®Word®格式提供

1606-XLS80E

1606-XLS80E

Reaction in the Event of a Fault If a faulty signal is detected, the affected module output is set to the safe, de-energized state using the safety switches. If a module fault occurs, all module outputs are switched off. Both types of faults are also indicated by the Error LED. NOTE System malfunction possible! The voltage induced during switching off inductive loads could cause faults in the controller or in other electronical systems close to the actor's input leads. Therefore, it is a good practice to connect inductive loads with a suitable freewheeling circuit at the actuator to counteract these disturbances. The number of switching operations is limited in accordance with the corresponding standards, e. g., EN 50156-1 Electrical equipment for furnaces. Refer to the module manual (HI 801 023 E) for more details. After the switching operations counter has expired, the module must be replaced! 8.4.3 Operation in Accordance with the Energize to Trip Principle It is allowed to operate digital relay outputs in accordance with the energized to trip principle. 8.4.4 Redundancy It is allowed to connect the digital relay outputs redundantly. The redundant connection is usually used to increase availability. If other connection variants, e.g., to increase the SIL value, should be used, fault states must be handled in the user program logic. 8.5 Safety-Related Analog Outputs They forward the values determined in the user program to the actuators. The safety-related analog outputs read back their output values and compare them to the values to be output. If the values differ, a fault reaction is triggered. 8.5.1 Test Routines for Analog Outputs The modules are tested automatically during operation. The main test functions are: ƒ Read back of the output signal. ƒ Checking the integrated redundant safety shutdown. If faults occur, the outputs are set to the safe value 0 mA. 8.5.2 Reaction in the Event of a Fault If the test routines detect a fault in one or several channels, the module switches the channel groups off and brings them into the safe state. The parameter Channel OK is set to FALSE for these channels. If the test routines detect a module or submodule fault, the module sets the Module OK or Submodule OK status to FALSE. Additionally, the module or submodule sets Channel OK to FALSE for all its channels. In all cases, the module also indicates the fault by the Error LED on the faceplate. HIMax 8 Output Modules HI 801 003 E Rev. 4.00 Page 35 of 64 8.5.3 Behavior in the Event of External Open-Circuit If an open-circuit occurs, the module switches the current off for approx. 8 ms and then checks if the open-circuit is still present. If this is the case, it switches off for approx. 10 s. This process can repeat infinitely. 8.5.4 Observe the following points when using the analog X-AO 16 01 output module! If the analog output module is used, the following particularities must absolutely be observed, also refer to the module-specific manual (HI 801 111 E): ƒ Only the connection variants specified in the module manual (HI 801 111 E) may be used! ƒ If more than two modules are redundantly connected in series, the SELV voltage can be exceeded! ƒ With serial redundancy, only one channel of each group of two channels may be used! ƒ If HART communication occurs between the connected actuator and one HART terminal, the output signal can deviate from the final value by up to 2 % ! ƒ If a fault occurs, the time to reach the safe state can take up to 16 ms in the worst case. Take this time into account when defining the reaction and safety times! ƒ The user program may not write to analog outputs in cycles shorter than 6 ms. ƒ If faults occur, the module outputs the safe value 0 mA, even if the upper limit of the setting range is exceeded. 8.5.5 Operation in Accordance with the Energize to Trip Principle It is allowed to operate analog outputs in accordance with the energized to trip principle. In this case, line monitoring must be used. 8.5.6 Redundancy It is allowed to connected the analog outputs redundantly. The redundant connection is usually used to increase availability. If other connection variants, e.g., to increase the SIL value, should be used, fault states must be handled in the user program logic. 8.6 Checklists for Outputs HIMA recommends using the available checklists for engineering, programming and starting up safety-related digital outputs. The checklists can be used for helping with planning as well as to demonstrate later on that the planning phase was carefully completed. When engineering or starting up the system, it is useful to fill out a checklist for each of the safety-related input channels used in the system to verify the requirements to be met. This is the only way to ensure that all requirements were considered and clearly recorded. The checklist also documents the relationship between the external wiring and the user program. The checklists are available in Microsoft® Word® format on the HIMA website. 9 Software HIMax Page 36 of 64 HI 801 003 E Rev. 4.00 9 Software The software for the safety-related automation devices of the HIMax systems consist of the following components: ƒ Operating system ƒ User program ƒ SILworX programming system in accordance with IEC 61131-3. The operating system is loaded into each controller's module. HIMA recommends using the latest version valid for the safety-related applications. This chapter particularly describes the operating system of the processor module. The user program is created using the SILworX programming system and contains the application-specific functions to be performed by the automation device. SILworX is also used to configure it. The user program is compiled with the code generator and transferred to the non-volatile memory automation device through an Ethernet interface. 9.1 Safety-Related Aspects of the Operating System Each approved operating system is clearly identified by the revision number and the CRC signature. The valid versions of the operating system and corresponding signatures (CRCs) - approved by the TÜV for use in safety-related automation devices - are subject to a revision control and are documented in the version list of modules and firmware for HIMax systems from HIMA Paul Hildebrandt GmbH + Co KG maintained together with TÜV, The current version of the operating system can be read using SILworX. The users must verify whether a valid version of the operating system has been loaded into the modules (see 10.3 Checklist for Creating a User Program). 9.2 Safety-Related Aspects of Programming When creating a user program, the requirements detailed in this section must be observed. 9.2.1 Safety Concept of SILworX The safety concept of SILworX: ƒ When SILworX is installed, a CRC checksum helps ensure the program package's integrity on the way from the manufacturer to the user. ƒ SILworX performs validity checks to reduce the likelihood of faults while entering data. ƒ Compiling the program twice and comparing the two CRC checksums ensures that data corruption in the application is detected that can result from random faults in the PC in use. To compile the program two times and compare the results 1. Start compiling. ; Upon completion of compiling, SILworX shows a CRC checksum. 2. Restart compiling. ; Upon completion of compiling, SILworX shows a CRC checksum. If the two checksums are identical, the results have not been corrupted during compiling. When starting up a safety-related controller for the first time, a comprehensive function test to verify the safety of the entire system must be performed. Function Test of the Controller 1. Verify that the tasks to be performed by the controller were properly implemented using the data and signal flows