Introduction

The BMXSDO0802 safety digital output module presents the following features:

  • 8 non-electrically isolated 0.5 A outputs.

  • 24 Vdc rated output voltage.

  • Achieves the following:

    • SIL3 IEC61508, SILCL3 IEC62061.

    • SIL4 EN5012x.

    • Category 4 (Cat4) / Performance Level e (PLe) ISO13849.

  • Monitors the external pre-actuator power supply.

  • LED diagnostic display provided for the module and for each output channel.

  • Automatically provided channel wiring diagnostics that can detect the following conditions when the output is energized:

    • Overload current

    • Short circuit to the 0 Vdc ground

  • Configurable (enable/disable) channel wiring diagnostics that can detect the following conditions:

    • Open (or cut) wire.

  • Configurable (enable/disable) channel wiring diagnostics that can detect the following conditions when the output is de-energized:

    • Short circuit to the 0 V ground.

  • Configurable (enable/disable) channel wiring diagnostics that can detect the following conditions when the output is energized or de-energized:

    • Short circuit to the 24 Vdc.

    • Crossed circuits between two channels (if sensor power is internally provided).

  • Configurable fallback settings for each channel that are applied if communication between the CPU and output module are lost.

  • Module hot swap during runtime.

  • Module CCOTF when operating in maintenance mode. (CCOTF is not supported in safety mode.)

NOTE: A self-test is performed on each output to check its capability to be de-energized and reach its safe state without any impact for the load (off-pulse < 1ms). This self-test is alternatively performed, one output at a time, on each energized output with a period less than 1 second. If the output is connected to a static input of a product, the connected static input may detect this pulse. A filter may be useful to avoid the potential impact of this pulse on the input.

High Availability

You can connect the CPU to two output modules via a black channel, then connect each output module to a single actuator. No function block is needed, because the signal from the CPU is connected to both output channels.

The following figure illustrates the redundant digital output configuration for high availability:

The health of each output module can be read from the elements of its T_U_DIS_SIS_OUT_8 DDDT structure. You can use this data to determine if a module needs to be replaced. If a module ceases to be operational and needs to be replaced, the system continues to run in a SIL3 compliant configuration while the module exchange takes place.

Refer to the high availability output wiring example for details on this design.